[Coly010]

Every release has a window where installing supabase from npm on macOS or Windows gives you the umbrella package with no binary. npm makes a version installable a while after the publish returns, and the large platform tarballs take longer than the small umbrella. On 3.0.0-beta.16 the umbrella was installable about a minute after publishing, but @supabase/cli-darwin-arm64 and @supabase/cli-windows-x64 took four to five minutes. npm skips a missing optional dependency without failing, so supabase.js then throws No matching Supabase CLI binary package found. The setup-cli@v3 smoke test in the Release workflow hit exactly this.

publish.ts now polls the install packument for every platform package and only publishes the umbrella once all of them are installable. It checks every 10 seconds for up to 15 minutes, and gives up on a hung probe after 30 seconds. If a package never shows up, the publish fails before the umbrella goes out, and re-running it is safe because already-published packages are skipped.

This touches release infrastructure and v2.x publishes the same way, so it'll need a backport/* cherry-pick to v2.x too.

🤖 Generated with Claude Code

[github-actions]

CLI benchmark: no changes found

Commit c383b07 against develop at 8c8f5a7 · 10 runs each · report only, never blocks merging

Command	Before	After	Change
supabase --version	483 ms	459 ms	no real change
supabase --help	324 ms	308 ms	no real change
supabase init	259 ms	253 ms	no real change
supabase migration new bench	252 ms	265 ms	no real change (+5%, within normal variation)
supabase gen types --lang typescript --project-id replayfixtureprojref	273 ms	272 ms	no real change
supabase projects list	278 ms	265 ms	no real change
supabase functions list --project-ref replayfixtureprojref	285 ms	281 ms	no real change

API calls: unchanged for all 7 commands.

Binary size: 134.0 MB, unchanged.

Details: timing ranges, API calls per command, slowest phases

Timing ranges

Command	Before range	After range	Change	Verdict
supabase --version	259-934 ms	222-1020 ms	-24 ms (-5%)	within noise
supabase --help	257-770 ms	242-699 ms	-15 ms (-5%)	within noise
supabase init	237-271 ms	227-302 ms	-6 ms (-2%)	within noise
supabase migration new bench	233-281 ms	247-279 ms	+13 ms (+5%)	within noise
supabase gen types --lang typescript --project-id replayfixtureprojref	245-289 ms	243-328 ms	-1 ms (0%)	within noise
supabase projects list	240-299 ms	248-290 ms	-13 ms (-5%)	within noise
supabase functions list --project-ref replayfixtureprojref	246-361 ms	268-317 ms	-4 ms (-1%)	within noise

API calls per command

Command	Before	After	Endpoint changes
supabase --version	0	0
supabase --help	0	0
supabase init	0	0
supabase migration new bench	0	0
supabase gen types --lang typescript --project-id replayfixtureprojref	2	2
supabase projects list	1	1
supabase functions list --project-ref replayfixtureprojref	2	2

Slowest phases

No command moved beyond noise, so there are no phase deltas.

Comment /bench to run it again on the latest commit.

Workflow run

[github-actions]

🤖 AI Review

Verified all three findings against the checked-out code and trusted conventions. All are confirmed minor issues: discarded probe diagnostics, immediate failure on transient HTTP responses, and missing wait-span instrumentation. The findings are distinct and require no deduplication.

Findings

Severity	Location	Category	Sources	Claim
🟡 MINOR	apps/cli/scripts/npm-registry.ts:40	error-handling	claude	Retryable probe failures discard their causes, so persistent registry or network failures eventually produce only a generic installability timeout.
🟡 MINOR	apps/cli/scripts/npm-registry.ts:35	error-handling	codex	A single HTTP 408 or 429 aborts publishing immediately instead of allowing the polling budget to absorb a transient timeout or throttling response.
🟡 MINOR	apps/cli/scripts/npm-registry.ts:50	observability	codex	The registry wait lacks the named enclosing span and attempt annotations required by the repository's tracing convention.

Stats

Claude findings: 1 · Codex findings: 2 · Confirmed: 3 · Refuted: 0 · Uncertain: 0

---

Models: claude-opus-5-5 + gpt-6.1-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.