ci: add reusable workflow to sync new capability IDs into SDK compliance files

[spydon]

What

Adds a reusable workflow that keeps each SDK's sdk-compliance.yaml in sync with new capability IDs added to this repo, mirroring the existing validate-sdk-compliance-<language>.yml pattern.

• .github/workflows/sync-sdk-compliance.yml — workflow_call reusable workflow. Checks out the calling SDK repo plus this repo's spec, runs the sync script, and opens/updates a PR (branch chore/sync-compliance-matrix) against the caller. Inputs: compliance-file, base-branch, sdk-ref. Secrets: app-id or client-id, plus private-key (the caller's GitHub App credentials, used to open the PR).
• scripts/capability-matrix/src/sync-compliance-cli.ts — language-agnostic diff/insert, run via npm run sync-compliance (tsx), reusing the matrix tooling's own loadAreas/collectFeatureIds/findMissingFeatureIds and buildSourceMap helpers. It edits the raw YAML text (rather than re-serializing the parsed document) so the file's comments and formatting stay intact.

Placement, not guessing

Canonical IDs and compliance keys share the area.group.feature shape, so each new ID is inserted next to its existing siblings (same area.group. prefix) and lands in the right section. An ID whose group has no local sibling yet is appended under a comment for manual placement.

How an SDK repo adopts it

A thin caller workflow on a weekly cron, e.g.:

name: Sync SDK Compliance Matrix
on:
  schedule:
    - cron: '0 6 * * 1'
  workflow_dispatch:
jobs:
  sync:
    permissions:
      contents: write
      pull-requests: write
    uses: supabase/sdk/.github/workflows/sync-sdk-compliance.yml@main
    secrets:
      app-id: ${{ secrets.APP_ID }}
      private-key: ${{ secrets.PRIVATE_KEY }}

(Repos that authenticate with a client ID pass client-id instead of app-id.) Each repo runs on its own token, so no cross-repo permissions are needed here. Callers: supabase-flutter#1606, supabase-js#2534, supabase-py#1541, supabase-swift#1128.

Notes

• Only adds new IDs as not_implemented; it never guesses real status or symbols. That triage stays a human step in each SDK repo.
• Opens a PR rather than committing directly.
• Verified against the current live compliance files: flutter +2, py +3, swift +3, js +51 (23 appended for groups it doesn't track yet). All placed correctly.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f06dc054-43db-4747-919b-dac64b5c5f56

📥 Commits

Reviewing files that changed from the base of the PR and between 1321786 and 18b6648.

📒 Files selected for processing (3)

• .github/workflows/sync-sdk-compliance.yml
• scripts/capability-matrix/package.json
• scripts/capability-matrix/src/sync-compliance-cli.ts

---

📝 Walkthrough

Summary by CodeRabbit

• New Features
  • Added automated synchronization of the SDK compliance matrix with the canonical capability specification.
  • Newly discovered capabilities are added as not_implemented entries, with orphaned capabilities flagged for manual placement.
  • Added a command-line option to run compliance synchronization and record newly identified capability IDs.
  • Automated pull request creation or updates when compliance changes are detected.

Walkthrough

Adds a TypeScript CLI and npm command that compare canonical SDK capabilities with a compliance YAML file, insert missing entries, and record new IDs. Adds a reusable GitHub Actions workflow that runs the sync against a selected SDK revision, then conditionally pushes a fixed branch and creates or updates a pull request containing the generated capability IDs.

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant TargetRepository
  participant SDKRepository
  participant SyncComplianceCLI
  participant PullRequest
  GitHubActions->>TargetRepository: Check out repository
  GitHubActions->>SDKRepository: Check out SDK specification
  GitHubActions->>SyncComplianceCLI: Run compliance synchronization
  SyncComplianceCLI->>TargetRepository: Update compliance YAML and write new IDs
  GitHubActions->>PullRequest: Create or update PR when changes exist

Loading

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/sync-sdk-compliance.yml:
- Around line 42-45: Update the Checkout SDK repo step’s actions/checkout
configuration to explicitly check out the configured inputs.base-branch rather
than the triggering ref, ensuring manual runs and workflow callers synchronize
from the intended base branch.
- Around line 35-60: The workflow currently exposes the generated App token to
the SDK sync script. Remove the early “Generate token” step, add
persist-credentials: false to both checkout steps, and generate the token
immediately before the PR step that needs it; keep the Insert new capability IDs
step running without repository credentials.
- Around line 73-79: Update the sync branch flow around git checkout and push to
fetch origin/chore/sync-compliance-matrix before invoking git push
--force-with-lease, ensuring the remote-tracking reference is current when the
branch already exists while preserving the existing branch creation and commit
behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 3ff54899-ad5d-4665-b3d0-afa9da2b67d4

📥 Commits

Reviewing files that changed from the base of the PR and between 5daeaf5 and 1321786.

📒 Files selected for processing (2)

• .github/workflows/sync-sdk-compliance.yml
• scripts/sync-compliance/sync_compliance_matrix.py