Borrowing it
Nothing to install: this file belongs to alnutile/supabase-as-a-service. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/alnutile/supabase-as-a-service/main/.agents/skills/release-to-tenants/SKILL.mdgit clone --depth 1 https://github.com/alnutile/supabase-as-a-serviceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/alnutile/supabase-as-a-service/release-to-tenants)<a href="https://agentmods.dev/skills/alnutile/supabase-as-a-service/release-to-tenants"><img src="https://agentmods.dev/badge/skills/alnutile/supabase-as-a-service/release-to-tenants/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/alnutile/supabase-as-a-service/release-to-tenants"><img src="https://agentmods.dev/badge/skills/alnutile/supabase-as-a-service/release-to-tenants.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00130 | $0.02537 |
| Opus 5.5 | $0.00052 | $0.01015 |
| Sonnet 5.5 | $0.00026 | $0.00507 |
| Haiku 4.5 | $0.00013 | $0.00254 |
Grade A, and why
release-to-tenants scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 216 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Release to tenants
SupaNet runs as one origin project plus many tenant apps. Each tenant is its own
Supabase project + Railway frontend, all under the maintainer's Supabase org. A release moves
everything on main out to the whole fleet, and it is one merge: main → release.
That merge triggers two things:
| What | How | Where it's defined |
|---|---|---|
| Frontend | Each tenant's Railway service rebuilds from the release branch |
Railway (per-tenant service, created by control-plane/) |
| DB migrations + edge functions | .github/workflows/release-tenants.yml fans out to every live tenant |
this repo |
The fan-out reads the tenant list from the control plane's tenants table
(status in ('active','past_due'), via scripts/list-tenants.ts). For each tenant it runs
scripts/apply-migrations.ts <ref> (pending migrations over the Management API SQL endpoint,
each one in a transaction with its schema_migrations row, then setup_automation_cron) and
supabase functions deploy --project-ref <ref>. One org-owner PAT (SUPABASE_ACCESS_TOKEN)
reaches every tenant, so no per-tenant secret exists and tenants don't have to do anything.
The matrix is fail-fast: false, max-parallel: 4, and a newer run never cancels one already
in flight.
You don't need any Supabase credentials locally. Everything below runs through gh.
Hard rules
- Never commit to
releasedirectly. It only ever receivesmainvia the release PR. A commit authored onreleasemakes the next release PR conflict. (That happened once, in PR #258.) - Merge with a merge commit (
--merge). Don't squash or rebase: both rewrite history so it no longer matchesmain. - Never force-push
release, and never cancel a runningRelease to tenantsjob. A half-applied fleet is worse than waiting for the run to finish. - Origin goes first. Don't cut a release until
main's own deploy workflows have passed for the commit you're shipping. Origin is the canary for every migration. - Don't edit a migration that has already shipped to tenants. Fix it with a new migration. The one exception: a migration that failed never recorded as applied, so you can fix that file in place and re-run it.
- Anything addressed to someone other than the maintainer (PR body, Slack note) is written as the AI, as a technical report. Don't write in the maintainer's first person.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 216 lines · 130 tokens per session scan A 5413b3178b0a
release-to-tenants is a skill published in the GitHub repository alnutile/supabase-as-a-service (5 stars, last pushed 2d ago), licensed MIT. It adds 130 tokens to every session and 2,537 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-15.
release-to-tenants compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| release-to-tenantsalnutile/supabase-as-a-service | Skill | 5 | 2d ago | MIT | A | 130 | Claude Code, Codex |
| land-and-deploygarrytan/gstack | Skill | 140k | yesterday | MIT | A | 14 | Claude Code |
| publish-siteNousResearch/hermes-agent | Skill | 261k | yesterday | MIT | A | 19 | Claude Code, Codex |
| release-publishrohitg00/ai-engineering-from-scratch | Skill | 77k | yesterday | MIT | A | 9 | Claude Code, Codex |
| release-reviewrohitg00/ai-engineering-from-scratch | Skill | 77k | yesterday | MIT | A | 7 | Claude Code, Codex |
| orchard-releaserohitg00/ai-engineering-from-scratch | Skill | 77k | yesterday | MIT | A | 11 | Claude Code, Codex |
| orchard-reviewrohitg00/ai-engineering-from-scratch | Skill | 77k | yesterday | MIT | A | 8 | Claude Code, Codex |