Repository navigation
feat(cli)!: default secrets unset to no and require --all to unset every secret - #7172
Merged
Coly010 merged 3 commits intoOct 15, 2026
Conversation
`secrets unset` with no names now fails unless `--all` is passed, and names with `--all` is rejected; both fail before any API call. The prompt names the project and defaults to No. Without `--yes` or `SUPABASE_YES`, a run that can't prompt (non-TTY stdin, non-interactive stdout, or JSON output) fails before any request, and piped answers are no longer read. `--dry-run` prints the secrets that would be unset without prompting or deleting. JSON results gain `names` and `dry_run`.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
🤖 AI Review
Verified both review sets against the checked-out code. Confirmed Claude's single non-blocking output-consistency nit: an empty secret list produces no machine-readable result, including in the new dry-run workflow. This behavior predates the PR. Codex reported no findings. Tests were not run.
Findings
| Severity | Location | Category | Sources | Claim |
|---|---|---|---|---|
| ⚪ NIT | apps/cli/src/commands/secrets/unset/unset.handler.ts:88 |
output-contract |
claude | When --all finds no non-SUPABASE_ secrets, --all --dry-run and --all --yes return successfully with empty stdout even in json or stream-json mode, omitting the structured result and its count, names, and dry_run fields. |
Findings outside the diff
- ⚪ NIT
apps/cli/src/commands/secrets/unset/unset.handler.ts:88— When --all finds no non-SUPABASE_ secrets, --all --dry-run and --all --yes return successfully with empty stdout even in json or stream-json mode, omitting the structured result and its count, names, and dry_run fields.
Stats
Claude findings: 1 · Codex findings: 0 · Confirmed: 1 · Refuted: 0 · Uncertain: 0
Models: claude-opus-5-5 + gpt-6.1-sol · Trigger: auto · Workflow run
This review runs once per PR. A maintainer can request another with a /ai-review comment.
Machine output formats now get {project_ref, count: 0, names: [], dry_run}
instead of only the stderr no-op, so --all and --all --dry-run always return
a structured result.
Coly010
changed the title
jgoux
approved these changes
Oct 15, 2026
The confirmation-required refusal makes no secrets request, but the
linked-project cache in Effect.ensuring can still GET /v1/projects/{ref}.
Also correct the cache path to <workdir>/supabase/.temp/linked-project.json.
Coly010
deleted the
columferry/cli-2346-require-safeguards-before-bulk-deleting-edge-function
branch
October 15, 2026 10:56
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
supabase secrets unsetdefaulted to yes. On a non-TTY it confirmed itself, and with no names it lists every secret and deletes all the non-SUPABASE_ones. A stray run in a script or CI could wipe every Edge Function secret, and there's no undo. This flips those defaults:--yes(orSUPABASE_YES), a run that can't prompt (non-TTY stdin, piped stdout, or--output-format json/stream-json) fails before any request. Piped answers aren't read any more, soecho y | supabase secrets unset FOOno longer counts as consent.--alldoes that explicitly. Names and--alltogether are rejected. Both usage errors fail before any API call.--dry-runprints the secrets that would be unset and exits 0 without prompting or deleting, so--allcan be previewed in CI without--yes.namesanddry_run, and--allwith nothing to unset now returns an empty result instead of only a stderr line.This applies the consent rule proposed in CLI-2695 (hosted destructive operations default to No and need
--yeswhen non-interactive) tosecrets unsetonly.Linked issue
Closes CLI-2346
Checklist
pnpm check:allpasses.BREAKING CHANGE:
supabase secrets unsetno longer defaults to yes. The prompt defaults to No, and a run that can't prompt (non-TTY stdin, non-interactive stdout, or JSON output) now fails unless--yesorSUPABASE_YES=1is set, for named secrets and--allalike. Piped stdin answers are no longer read. Running it with no secret names now fails instead of unsetting every secret; pass--allto do that. Add--yesto unattendedsecrets unsetinvocations.