On this page
This page is for the person who holds the GitHub and Supabase accounts, or for your AI agent.
Caution. Restoring a backup overwrites data. Applying migrations changes the live database. Both are easy to get wrong. The nightly backup and the merge-time backup are automatic. Do not dispatch the migration workflow by hand unless the owner asked. Keep the backup private key offline. If you lose it, old backups cannot be read.
Nightly backups
Each live site repo has a GitHub Action (backup.yml) that writes an encrypted dump of the database every night at 07:15 UTC, kept 7 days.
It needs repository secrets SUPABASE_ACCESS_TOKEN, SUPABASE_DB_PASSWORD, and SUPABASE_PROJECT_REF, plus a variable BACKUP_AGE_RECIPIENT (age1…). Generate that key pair with age-keygen. Keep the private identity offline. Never add the identity to GitHub.
Check now and then that Actions → Nightly database backup is green.
Migrations apply when you merge
On a site repo (not xylo-cms itself), merging files under supabase/migrations/ to main starts migrate.yml:
- Backup production (kept 30 days)
- Rehearse on a throwaway database on the runner
- Backup again, then
supabase db pushto production
That merge is the approval. New code may go live on Vercel while the migrate run is still rehearsing. Migrations are written so the old schema still works for that window.
Until the three Supabase secrets are set, the workflow logs a warning and applies nothing. Once they are set, it also needs BACKUP_AGE_RECIPIENT and fails without it: no backup, no migrations.
AI agents do not dispatch this workflow, or approve a waiting production-environment deployment, unless the owner says to.
The very first push to an empty project, from a trusted machine:
supabase link --project-ref PROJECTREF
supabase db pushUse the real project ref. Do not write it with angle brackets.
Restore
Download the artifact from Actions, decrypt it with the saved identity, unpack it, then load the SQL files into a new empty Supabase project, in order: roles.sql, then schema.sql + data.sql + history files in one transaction. Errors from roles.sql about Supabase’s own roles can be ignored. Expired artifacts cannot be recovered. The private key is required.