From cd946ac173c5e647c2649dcbebd7ee14874b0a96 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 17 Jul 2026 08:24:36 +0000 Subject: [PATCH 1/6] Add missing storage-bucket creation to the migration chain (drift fix) The clinical-documents and clinical-images buckets were declared only in supabase/schema.sql. The migration chain created the storage.objects RLS policies that reference them (20260527000000_bulk_ingestion.sql) but never the buckets, so a database built by replaying migrations had policies for buckets that did not exist and uploads failed until the buckets were created out-of-band. Add a migration mirroring schema.sql's bucket inserts (idempotent, on conflict do update set public = false), so a migrated-from-scratch DB and the CI `supabase db reset` replay have the buckets. schema.sql and the drift manifest already declare them, so no reconciliation edit is needed. Verified offline: change-scope classifies it db_changed (so the CI migration replay runs), the inserts mirror schema.sql exactly, prettier skips .sql, and 79 drift/schema/storage unit tests pass. The replay itself (supabase db reset) runs in CI's db-reset-verify job; it is not runnable locally here (no Supabase Docker / provider boundary). Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_019UQUcNriJUVSGRhWz794RQ --- .../20260717130000_create_storage_buckets.sql | 36 +++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 supabase/migrations/20260717130000_create_storage_buckets.sql diff --git a/supabase/migrations/20260717130000_create_storage_buckets.sql b/supabase/migrations/20260717130000_create_storage_buckets.sql new file mode 100644 index 000000000..80eb8dd00 --- /dev/null +++ b/supabase/migrations/20260717130000_create_storage_buckets.sql @@ -0,0 +1,36 @@ +-- Create the storage buckets in the migration chain (schema-drift fix). +-- +-- The clinical-documents and clinical-images buckets were declared only in +-- supabase/schema.sql. The migration chain created the storage.objects RLS +-- policies that reference them (20260527000000_bulk_ingestion.sql) but never the +-- buckets themselves, so a database built purely by replaying migrations had RLS +-- policies for buckets that did not exist and uploads failed until the buckets +-- were created out-of-band. This migration mirrors schema.sql so a +-- migrated-from-scratch database (and the CI `supabase db reset` replay) has the +-- buckets. Idempotent: an existing database that already has them only +-- re-affirms public = false, matching schema.sql's on-conflict behaviour. + +insert into storage.buckets (id, name, public, file_size_limit, allowed_mime_types) +values ( + 'clinical-documents', + 'clinical-documents', + false, + 157286400, + array[ + 'application/pdf', + 'application/vnd.openxmlformats-officedocument.wordprocessingml.document', + 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet', + 'text/plain' + ] +) +on conflict (id) do update set public = false; + +insert into storage.buckets (id, name, public, file_size_limit, allowed_mime_types) +values ( + 'clinical-images', + 'clinical-images', + false, + 52428800, + array['image/png', 'image/jpeg', 'image/webp'] +) +on conflict (id) do update set public = false; From acf6b63a8c91adb5b790e16c828c1443facf480c Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 17 Jul 2026 16:26:42 +0000 Subject: [PATCH 2/6] fix(ci): use base branch ref instead of stale base SHA in PR policy checkout When a PR is opened before scripts/pr-policy.mjs existed on main, the pull_request_target workflow checked out the exact base.sha (fd79bc8a) which predated the script, causing ERR_MODULE_NOT_FOUND. Fix: use github.base_ref (the branch name, e.g. "main") instead of github.event.pull_request.base.sha. This always checks out the current tip of the base branch, ensuring the policy script is always available. The pull_request_target security model is preserved: only base-branch code is checked out, never the PR head. --- .github/workflows/pr-policy.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/pr-policy.yml b/.github/workflows/pr-policy.yml index 1c2532d4f..5a0d59652 100644 --- a/.github/workflows/pr-policy.yml +++ b/.github/workflows/pr-policy.yml @@ -24,13 +24,15 @@ jobs: if: github.event_name == 'merge_group' run: echo "PR metadata was validated before merge-queue entry." - # pull_request_target runs trusted base-branch code. Pin the checkout to - # the PR's exact base SHA and never execute the PR head or persist credentials. + # pull_request_target runs trusted base-branch code. Checkout the current + # tip of the base branch (not a potentially stale base.sha) so the policy + # script is always available even when the PR was opened before the script + # was added to main. Never execute the PR head or persist credentials. - name: Checkout trusted policy if: github.event_name == 'pull_request_target' uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: - ref: ${{ github.event.pull_request.base.sha }} + ref: ${{ github.base_ref }} persist-credentials: false - name: Validate pull request evidence From c5625404f560b64a89f80bdc0ae0f80b61701d98 Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Sat, 18 Jul 2026 00:35:46 +0800 Subject: [PATCH 3/6] fix: use unique migration version for bucket migration --- ...rage_buckets.sql => 20260717139000_create_storage_buckets.sql} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename supabase/migrations/{20260717130000_create_storage_buckets.sql => 20260717139000_create_storage_buckets.sql} (100%) diff --git a/supabase/migrations/20260717130000_create_storage_buckets.sql b/supabase/migrations/20260717139000_create_storage_buckets.sql similarity index 100% rename from supabase/migrations/20260717130000_create_storage_buckets.sql rename to supabase/migrations/20260717139000_create_storage_buckets.sql From 38eb01ed135ca98ec4edf7f16839c188f8b964da Mon Sep 17 00:00:00 2001 From: "coderabbitai[bot]" <136622811+coderabbitai[bot]@users.noreply.github.com> Date: Fri, 17 Jul 2026 17:38:53 +0000 Subject: [PATCH 4/6] fix: apply CodeRabbit auto-fixes Fixed 1 file(s) based on 1 unresolved review comment. Co-authored-by: CodeRabbit --- .../20260717139000_create_storage_buckets.sql | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/supabase/migrations/20260717139000_create_storage_buckets.sql b/supabase/migrations/20260717139000_create_storage_buckets.sql index 80eb8dd00..bf52ee12e 100644 --- a/supabase/migrations/20260717139000_create_storage_buckets.sql +++ b/supabase/migrations/20260717139000_create_storage_buckets.sql @@ -23,7 +23,11 @@ values ( 'text/plain' ] ) -on conflict (id) do update set public = false; +on conflict (id) do update set + public = false, + name = excluded.name, + file_size_limit = excluded.file_size_limit, + allowed_mime_types = excluded.allowed_mime_types; insert into storage.buckets (id, name, public, file_size_limit, allowed_mime_types) values ( @@ -33,4 +37,8 @@ values ( 52428800, array['image/png', 'image/jpeg', 'image/webp'] ) -on conflict (id) do update set public = false; +on conflict (id) do update set + public = false, + name = excluded.name, + file_size_limit = excluded.file_size_limit, + allowed_mime_types = excluded.allowed_mime_types; From 97ead7807e1e2dbaecd72be156dcade07e92ed47 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Fri, 17 Jul 2026 18:26:18 +0000 Subject: [PATCH 5/6] chore: open merge-ready PR for storage-bucket migration Re-export the storage-bucket migration branch for a PR with complete policy evidence (verification, risk/rollout, clinical governance). Co-Authored-By: Cursor Agent From b2755c814b47cdec6868bd009f3ca1cdbc3a7dea Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Fri, 17 Jul 2026 18:47:04 +0000 Subject: [PATCH 6/6] docs(migration): clarify storage-bucket on-conflict reconciliation Match the comment to the ON CONFLICT updates for name, size limit, and MIME types. Co-authored-by: BigSimmo --- .../migrations/20260717139000_create_storage_buckets.sql | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/supabase/migrations/20260717139000_create_storage_buckets.sql b/supabase/migrations/20260717139000_create_storage_buckets.sql index bf52ee12e..bed9931c0 100644 --- a/supabase/migrations/20260717139000_create_storage_buckets.sql +++ b/supabase/migrations/20260717139000_create_storage_buckets.sql @@ -7,8 +7,9 @@ -- policies for buckets that did not exist and uploads failed until the buckets -- were created out-of-band. This migration mirrors schema.sql so a -- migrated-from-scratch database (and the CI `supabase db reset` replay) has the --- buckets. Idempotent: an existing database that already has them only --- re-affirms public = false, matching schema.sql's on-conflict behaviour. +-- buckets. Idempotent: an existing database that already has them re-affirms +-- public = false plus name, file_size_limit, and allowed_mime_types from this +-- migration (schema.sql only forces public = false on conflict). insert into storage.buckets (id, name, public, file_size_limit, allowed_mime_types) values (