[supertj]

Pull Request Checklist

• I have read and followed the CONTRIBUTING.md guidelines.
• I have read and followed the Guidance for submissions involving paid services.
• My contribution adds a new instruction, prompt, agent, skill, workflow, or canvas extension file in the correct directory.
• The file follows the required naming convention.
• The content is clearly structured and follows the example format.
• I have tested my instructions, prompt, agent, skill, workflow, or canvas extension with GitHub Copilot.
• I have run npm start and verified that README.md is up to date.
• I am targeting the main branch for this pull request.

---

Description

Adds skills/supabase-restore-drill, a markdown-only skill for checking that a Supabase database dump actually restores. It restores the dump into a throwaway local Postgres container, compares it with the live project, and sorts every restore error into "expected in a sandbox" or "real problem". It never writes to the Supabase project.

The obvious way to test a backup is to run pg_restore into a stock Postgres container and see whether it finishes. On a Supabase dump that goes wrong in ways that are easy to miss:

• pg_restore carries on after errors. In my test, a Supabase-shaped dump restored into a bare postgres:17 container ended with 18 ignored errors, and two of the five tables were never created, so their rows were skipped. The schema "public" already exists error that shows up in every such log makes it easy to ignore the rest.
• Tables with column defaults like auth.uid() or types like extensions.vector, and policies TO authenticated, need Supabase's roles, auth helper functions and extensions schema. A --schema=public dump contains none of them and no CREATE EXTENSION. The skill gives the stub SQL that makes those objects restore.
• Some failures are expected in any sandbox and must not be "fixed" by guessing: foreign keys to auth.users, views and BEGIN ATOMIC functions that read it, and Database Webhook triggers on supabase_functions.http_request. The skill lists the exact error strings for each case and what each one means for a real restore.
• pg_restore --list succeeds on a truncated archive. pg_restore --file=/dev/null reads it to the end and catches truncation.
• Function bodies aren't checked during a restore, so a function that reads auth.users restores cleanly and fails when it's called. The skill includes a query to find them.
• Routing for the other backup formats people have: supabase db dump SQL files, the dashboard's db_cluster.backup (supabase db start --from-backup), and projects on physical backups, which can't be downloaded.

It ends with a fixed report format and a list of what a drill doesn't cover (Auth users, triggers on auth.users, Storage files, grants, RLS behavior, Edge Functions, secrets), plus the pg_restore --clean warning for restores into a Supabase project.

How it differs from existing resources

I searched skills/, instructions/, agents/ and plugins/ for Supabase, pg_dump, pg_restore and restore testing. Nothing covers it. The PostgreSQL skills (postgresql-optimization, postgresql-code-review) are about queries and schema design, not backups.

Paid services and affiliation

The skill uses only Postgres client tools, Docker and, for two of the routes, the Supabase CLI. The last section mentions the MIT-licensed backupdrill CLI as an optional way to run drills on a schedule, linking to its GitHub repo only. I maintain that CLI and the hosted BackupDrill service built on it, and the skill says so. Nothing in the skill depends on either. If you'd rather not have that section, I'm happy to remove it.

---

Type of Contribution

• New instruction file.
• New prompt file.
• New agent file.
• New plugin.
• New skill file.
• New agentic workflow.
• New canvas extension.
• Update to existing instruction, prompt, agent, plugin, skill, workflow, or canvas extension.
• Other (please specify):

---

Additional Notes

• Markdown only: one SKILL.md, no bundled scripts.
• Validation: npm run skill:validate passed (443 skills valid, including supabase-restore-drill). npm start regenerated docs/README.skills.md, and that change is in this PR. bash eng/fix-line-endings.sh and codespell on the new files are clean. npx @microsoft/vally-cli lint skills/supabase-restore-drill passed 2/2 checks.
• Testing: I ran the custom-format path end to end, copying the commands and SQL straight from SKILL.md, against a Supabase-shaped Postgres 17 source in Docker (anon/authenticated/service_role roles, an auth schema with auth.users and auth.uid(), pgcrypto, pg_trgm and pgvector in extensions, RLS policies, a foreign key to auth.users, a view and a BEGIN ATOMIC function over auth.users, and a Database Webhook trigger). Row counts matched, and the four remaining errors and four missing objects were exactly the expected ones from the table. Every error string in the table comes from those runs, with a sandbox missing each stub in turn.
• Not tested: the supabase db dump and db_cluster.backup routes. Those rows follow Supabase's documentation. I haven't run the skill against a hosted Supabase project in this PR, and I haven't tested it in GitHub Copilot yet, so that box is unchecked.

---

By submitting this pull request, I confirm that my contribution abides by the Code of Conduct and will be licensed under the MIT License.

[github-actions]

🔒 PR Risk Scan Results

Scanned 1 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	1
ℹ️ Info	0

Severity	Rule	File	Line	Match
🟠	unpinned-version-indicator	skills/supabase-restore-drill/SKILL.md	252	A single drill proves a single dump. For a recurring check, the MIT-licensed [backupdrill](https://github.com/backupdrill/cli) CLI (`npm install -g backupdrill`; needs Node.js 20 o

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

[github-actions]

🚦 Submission status: 👀 Ready for review

Risk tier: merge-risk:high — Privileged execution, automation, or review-policy change
Required to merge: passing submission-gate checks plus 1 approval from reviewers with write access, including a maintainer with admin or maintain permission.

Why this tier

• Label needs-review:HIGH flags a high contributor-risk signal

Automated checks

Check	Status	Details
Line endings	✅ Passed	Passed · logs
Spelling	✅ Passed	Passed · logs
Generated README consistency	✅ Passed	Passed · logs
Skill validation	✅ Passed	Passed · logs
Skill lint (vally)	✅ Passed	Passed · logs
Risk scan	✅ Passed	Passed · logs
Contributor reputation	✅ Passed	Passed · logs
Duplicate resource scan	✅ Passed	Passed · logs
PR quality signal	⏭️ Skipped	Skipped by its workflow · logs

Review

• Approvals: 0/1
• Assigned reviewer: not assigned yet — comment /request-review to ask for one
• Review target date: not set
• Still needed: 1 more approval(s); an approval from a maintainer with admin or maintain permission
• The core-maintainers pool is not staffed yet; an approver with admin or maintain permission is required instead.

Commands

Command	Who	What it does
/rerun-checks	PR author, maintainers	Re-runs failed or incomplete checks and re-evaluates this gate
/request-review	PR author, maintainers	Asks the review rotation to assign a reviewer (adds needs-reviewer)

_{Updated for 323e299 · gate run · This comment is maintained automatically — see submission gate docs.}

[github-actions]

🔴 Contributor Reputation Check: HIGH risk

Check	Risk
Profile	HIGH
Credential audit	NONE

Maintainers: please review this contributor before merging.
See the workflow run for full details.
Automated check powered by AGT.

[github-actions]

🔍 Vally Lint Results

✅ All checks passed

Scope	Checked
Skills	1
Agents	0
Total	1

Severity	Count
❌ Errors	0
⚠️ Warnings	0
ℹ️ Advisories	0

Summary

Level	Finding
ℹ️	✅ supabase-restore-drill (2/2 checks passed)
ℹ️	✓ [spec-compliance] All 1 skill(s) are spec-compliant.
ℹ️	✓ spec-compliance: All spec checks passed.
ℹ️	✓ [valid-refs] All file references across 1 skill(s) are valid.
ℹ️	✓ valid-refs: All file references resolve to existing files within the skill directory.
ℹ️	1 skill(s) linted, 1 passed

Full linter output

### Linting skills/supabase-restore-drill
✅ supabase-restore-drill (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

[aaronpowell]

Thanks for the detailed, Supabase-specific restore guidance and for disclosing your connection to the CLI. The issue is the recurring-check section: it directs readers to your backupdrill CLI, whose README describes the CLI as the DIY layer for the hosted service and routes readers to BackupDrill.com for scheduling, automated drills, alerts, and reports. That makes this a free-resource-to-hosted-service funnel, which is not a fit for this collection.