feat(onboarding): route 2nd+ app create to getting-started CLI steps

.github/workflows/build_and_deploy.yml

@@ -1,8 +1,8 @@
 name: Build source code and deploy
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ contains(github.ref_name, '-alpha.') && 'alpha' || 'production' }}
+  cancel-in-progress: false
 
 on:
   push:
@@ -24,6 +24,10 @@ jobs:
       plugins: ${{ steps.scope.outputs.plugins }}
       supabase: ${{ steps.scope.outputs.supabase }}
       translation: ${{ steps.scope.outputs.translation }}
+      deploy_tag: ${{ steps.target.outputs.deploy_tag }}
+      deploy_sha: ${{ steps.target.outputs.deploy_sha }}
+      is_alpha: ${{ steps.target.outputs.is_alpha }}
+      requires_schema_types_sync: ${{ steps.scope.outputs.requires_schema_types_sync }}
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -34,11 +38,20 @@ jobs:
         uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest
+      - name: Resolve triggering deployment target
+        id: target
+        run: bun scripts/resolve-deploy-tag.ts --resolve "${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+      - name: Reject stale queued deployment
+        run: bun scripts/resolve-deploy-tag.ts --assert-current "${{ github.ref_name }}"
+      - name: Checkout deployment target
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ steps.target.outputs.deploy_sha }}
+          fetch-depth: 0
+          filter: blob:none
       - name: Resolve deploy scope
         id: scope
-        env:
-          REF_NAME: ${{ github.ref_name }}
-        run: bun scripts/deploy-scope.ts "$REF_NAME" >> "$GITHUB_OUTPUT"
+        run: bun scripts/deploy-scope.ts "${{ steps.target.outputs.deploy_tag }}" >> "$GITHUB_OUTPUT"
 
   # Tests already passed before tag was created, so just build and deploy
   supabase_deploy:
@@ -56,13 +69,19 @@ jobs:
           node-version: 24.x
       - name: Checkout
         uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.changes.outputs.deploy_sha }}
+          fetch-depth: 0
       - name: Setup bun
         uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest
+      - name: Reject stale deployment retry
+        if: ${{ github.run_attempt > 1 }}
+        run: bun scripts/resolve-deploy-tag.ts --assert-current "${{ needs.changes.outputs.deploy_tag }}"
       - name: Set environment variable
         run: |
-          if [[ ${{ github.ref }} == *-alpha* ]]; then
+          if [ "${{ needs.changes.outputs.is_alpha }}" = "true" ]; then
             echo "SUPA_ENV=ALPHA" >> $GITHUB_ENV
           else
             echo "SUPA_ENV=PROD" >> $GITHUB_ENV
@@ -116,7 +135,7 @@ jobs:
 
   read_replica_schema:
     needs: changes
-    if: ${{ needs.changes.result == 'success' && needs.changes.outputs.supabase == 'true' && !contains(github.ref_name, '-alpha') }}
+    if: ${{ needs.changes.result == 'success' && needs.changes.outputs.supabase == 'true' && needs.changes.outputs.is_alpha != 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 40
     name: Reconcile production read-replica schema
@@ -125,10 +144,16 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.changes.outputs.deploy_sha }}
+          fetch-depth: 0
       - name: Setup bun
         uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest
+      - name: Reject stale deployment retry
+        if: ${{ github.run_attempt > 1 }}
+        run: bun scripts/resolve-deploy-tag.ts --assert-current "${{ needs.changes.outputs.deploy_tag }}"
       - name: Setup Google Cloud CLI
         uses: google-github-actions/setup-gcloud@v2
       - name: Install dependencies
@@ -156,6 +181,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
         with:
+          ref: ${{ needs.changes.outputs.deploy_sha }}
           fetch-depth: 0
           filter: blob:none
       - uses: actions/setup-node@v6
@@ -165,11 +191,14 @@ jobs:
         uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest
+      - name: Reject stale deployment retry
+        if: ${{ github.run_attempt > 1 }}
+        run: bun scripts/resolve-deploy-tag.ts --assert-current "${{ needs.changes.outputs.deploy_tag }}"
       - name: Install dependencies
         run: bun install
       - name: Set environment variable
         run: |
-          if [[ ${{ github.ref }} == *-alpha* ]]; then
+          if [ "${{ needs.changes.outputs.is_alpha }}" = "true" ]; then
             echo "ENV=dev" >> $GITHUB_ENV
             echo "CHANNEL=dev" >> $GITHUB_ENV
           else
@@ -227,10 +256,11 @@ jobs:
 
             ---
 
-            🔗 **Full Changelog**: https://github.com/${{ github.repository }}/compare/${{ steps.changelog.outputs.from_tag || github.ref_name }}...${{ steps.changelog.outputs.to_tag || github.ref_name }}
+            🔗 **Full Changelog**: https://github.com/${{ github.repository }}/compare/${{ steps.changelog.outputs.from_tag || needs.changes.outputs.deploy_tag }}...${{ steps.changelog.outputs.to_tag || needs.changes.outputs.deploy_tag }}
           make_latest: true
           token: "${{ secrets.PERSONAL_ACCESS_TOKEN }}"
-          prerelease: ${{ contains(github.ref, '-alpha.') }}
+          tag_name: ${{ needs.changes.outputs.deploy_tag }}
+          prerelease: ${{ needs.changes.outputs.is_alpha == 'true' }}
 
   deploy_api:
     needs: [changes, supabase_deploy, read_replica_schema]
@@ -240,18 +270,24 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.changes.outputs.deploy_sha }}
+          fetch-depth: 0
       - uses: actions/setup-node@v6
         with:
           node-version: 24
       - name: Setup bun
         uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest
+      - name: Reject stale deployment retry
+        if: ${{ github.run_attempt > 1 }}
+        run: bun scripts/resolve-deploy-tag.ts --assert-current "${{ needs.changes.outputs.deploy_tag }}"
       - name: Install dependencies
         run: bun install
       - name: Set environment variable
         run: |
-          if [[ ${{ github.ref }} == *-alpha* ]]; then
+          if [ "${{ needs.changes.outputs.is_alpha }}" = "true" ]; then
             echo "ENV=dev" >> $GITHUB_ENV
           else
             echo "ENV=prod" >> $GITHUB_ENV
@@ -270,18 +306,24 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.changes.outputs.deploy_sha }}
+          fetch-depth: 0
       - uses: actions/setup-node@v6
         with:
           node-version: 24
       - name: Setup bun
         uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest
+      - name: Reject stale deployment retry
+        if: ${{ github.run_attempt > 1 }}
+        run: bun scripts/resolve-deploy-tag.ts --assert-current "${{ needs.changes.outputs.deploy_tag }}"
       - name: Install dependencies
         run: bun install
       - name: Set environment variable
         run: |
-          if [[ ${{ github.ref }} == *-alpha* ]]; then
+          if [ "${{ needs.changes.outputs.is_alpha }}" = "true" ]; then
             echo "ENV=dev" >> $GITHUB_ENV
           else
             echo "ENV=prod" >> $GITHUB_ENV
@@ -300,18 +342,24 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.changes.outputs.deploy_sha }}
+          fetch-depth: 0
       - uses: actions/setup-node@v6
         with:
           node-version: 24
       - name: Setup bun
         uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest
+      - name: Reject stale deployment retry
+        if: ${{ github.run_attempt > 1 }}
+        run: bun scripts/resolve-deploy-tag.ts --assert-current "${{ needs.changes.outputs.deploy_tag }}"
       - name: Install dependencies
         run: bun install
       - name: Set environment variable
         run: |
-          if [[ ${{ github.ref }} == *-alpha* ]]; then
+          if [ "${{ needs.changes.outputs.is_alpha }}" = "true" ]; then
             echo "ENV=dev" >> $GITHUB_ENV
           else
             echo "ENV=prod" >> $GITHUB_ENV
@@ -363,18 +411,24 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.changes.outputs.deploy_sha }}
+          fetch-depth: 0
       - uses: actions/setup-node@v6
         with:
           node-version: 24
       - name: Setup bun
         uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest
+      - name: Reject stale deployment retry
+        if: ${{ github.run_attempt > 1 }}
+        run: bun scripts/resolve-deploy-tag.ts --assert-current "${{ needs.changes.outputs.deploy_tag }}"
       - name: Install dependencies
         run: bun install
       - name: Set environment variable
         run: |
-          if [[ ${{ github.ref }} == *-alpha* ]]; then
+          if [ "${{ needs.changes.outputs.is_alpha }}" = "true" ]; then
             echo "ENV=dev" >> $GITHUB_ENV
           else
             echo "ENV=prod" >> $GITHUB_ENV
@@ -400,13 +454,19 @@ jobs:
           node-version: 24.x
       - name: Checkout
         uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.changes.outputs.deploy_sha }}
+          fetch-depth: 0
       - name: Setup bun
         uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest
+      - name: Reject stale deployment retry
+        if: ${{ github.run_attempt > 1 }}
+        run: bun scripts/resolve-deploy-tag.ts --assert-current "${{ needs.changes.outputs.deploy_tag }}"
       - name: Set environment variable
         run: |
-          if [[ ${{ github.ref }} == *-alpha* ]]; then
+          if [ "${{ needs.changes.outputs.is_alpha }}" = "true" ]; then
             echo "BUILD_SCRIPT=build:dev" >> $GITHUB_ENV
           else
             echo "BUILD_SCRIPT=build" >> $GITHUB_ENV
@@ -446,13 +506,19 @@ jobs:
           node-version: 24.x
       - name: Checkout
         uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.changes.outputs.deploy_sha }}
+          fetch-depth: 0
       - name: Setup bun
         uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest
+      - name: Reject stale deployment retry
+        if: ${{ github.run_attempt > 1 }}
+        run: bun scripts/resolve-deploy-tag.ts --assert-current "${{ needs.changes.outputs.deploy_tag }}"
       - name: Set environment variable
         run: |
-          if [[ ${{ github.ref }} == *-alpha* ]]; then
+          if [ "${{ needs.changes.outputs.is_alpha }}" = "true" ]; then
             echo "BUILD_SCRIPT=build:dev" >> $GITHUB_ENV
           else
             echo "BUILD_SCRIPT=build" >> $GITHUB_ENV
@@ -474,3 +540,109 @@ jobs:
           BUILD_OUTPUT_UPLOAD_ENABLED: "true"
           BUILD_OUTPUT_RETENTION_SECONDS: "604800"
         run: bunx @capgo/cli@latest build request --platform android --path . --sync-android-version --ai-analytics
+
+  sync_schema_types:
+    needs: [changes, read_replica_schema, supabase_deploy]
+    if: ${{ needs.changes.result == 'success' && needs.changes.outputs.is_alpha != 'true' && needs.changes.outputs.requires_schema_types_sync == 'true' && needs.read_replica_schema.result == 'success' && needs.supabase_deploy.result == 'success' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    name: Sync production schema and generated types
+    permissions:
+      contents: write
+    steps:
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24.x
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.changes.outputs.deploy_sha }}
+          token: "${{ secrets.PERSONAL_ACCESS_TOKEN }}"
+          fetch-depth: 0
+          filter: blob:none
+      - name: Setup bun
+        run: bash scripts/setup-bun.sh
+      - name: Prepare production schema access
+        env:
+          SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_TOKEN }}
+          SUPABASE_PROJECT_ID_PROD: ${{ secrets.SUPABASE_PROJECT_ID_PROD }}
+        run: |
+          if [ -z "$SUPABASE_PROJECT_ID_PROD" ]; then
+            echo "SUPABASE_PROJECT_ID_PROD is required for schema/types sync" >&2
+            exit 1
+          fi
+
+          bunx supabase --version
+          bunx supabase link --project-ref "$SUPABASE_PROJECT_ID_PROD"
+      - name: Sync generated schema and types
+        env:
+          DEPLOY_TAG: ${{ needs.changes.outputs.deploy_tag }}
+          SCHEMA_TYPES_REMOTE_URL: https://x-access-token:${{ secrets.PERSONAL_ACCESS_TOKEN }}@github.com/${{ github.repository }}.git
+          SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_TOKEN }}
+        run: |
+          set -euo pipefail
+
+          generated_files=(
+            supabase/schemas/prod.sql
+            src/types/supabase.types.ts
+            supabase/functions/_backend/utils/supabase.types.ts
+          )
+          remote_repo="$SCHEMA_TYPES_REMOTE_URL"
+
+          git config --local user.name "github-actions[bot]"
+          git config --local user.email "github-actions[bot]@users.noreply.github.com"
+
+          for attempt in 1 2 3; do
+            echo "Schema/types publication attempt $attempt of 3"
+            git fetch --tags "$remote_repo" "+refs/heads/main:refs/remotes/schema-sync/main"
+            main_sha="$(git rev-parse refs/remotes/schema-sync/main)"
+
+            if ! bun scripts/resolve-deploy-tag.ts --assert-current "$DEPLOY_TAG"; then
+              echo "Schema/types sync deferred: $DEPLOY_TAG is no longer the current production tag."
+              exit 0
+            fi
+
+            pending_migrations="$(git diff --name-only "$DEPLOY_TAG" "$main_sha" -- supabase/migrations)"
+            if [ -n "$pending_migrations" ]; then
+              echo "Schema/types sync deferred: main contains migrations that are not present in $DEPLOY_TAG."
+              printf '%s\n' "$pending_migrations"
+              exit 0
+            fi
+
+            git checkout --detach "$main_sha"
+            bun install --frozen-lockfile
+            bun schemas
+            BRANCH=main bun types
+
+            if git diff --quiet -- "${generated_files[@]}"; then
+              echo "No schema/types drift detected."
+              exit 0
+            fi
+
+            echo "Schema/types drift detected; verifying regenerated types compile against current main."
+            if ! bun typecheck; then
+              echo "Schema/types sync deferred: production-generated types do not compile against current main." >&2
+              exit 0
+            fi
+
+            git add -- "${generated_files[@]}"
+            git commit -m "chore(auto-sync): update supabase schema and generated types"
+
+            git fetch --tags "$remote_repo"
+            if ! bun scripts/resolve-deploy-tag.ts --assert-current "$DEPLOY_TAG"; then
+              echo "Schema/types sync deferred: a newer production tag was published during generation."
+              exit 0
+            fi
+
+            status="$(bun scripts/publish-schema-types.ts main "$main_sha")"
+            if [ "$status" = "published" ]; then
+              echo "Schema/types commit published from main at $main_sha."
+              exit 0
+            fi
+
+            echo "Main moved during schema/types generation; regenerating from the new head."
+          done
+
+          echo "Schema/types publication could not obtain a stable main snapshot after 3 attempts." >&2
+          exit 1