test(cli): cover db query, lint and advisors (CLI-1949)

[7ttp]

TL;DR

adds live e2e coverage for db query, db lint, and db advisors
completing the db family (push, pull, reset, and dump already have it)

whats introduced?

• db query: runs a marker select over the real connection and proves the row comes back as the -o json payload
• db lint: seeds a plpgsql function referencing a missing table and proves the reported finding names both the function and the missing relation
• db advisors: seeds a public table without row level security and proves the rls_disabled_in_public finding names it

ref:

• closes: CLI-1949

[github-actions]

Supabase CLI preview

npx --yes https://pkg.pr.new/supabase/cli/supabase@3963f6f3fba1b8024e286354cee3e4056462a685

Preview package for commit 3963f6f.

[7ttp]

/ai-review

[github-actions]

🤖 AI Review

Both independent reviews completed. After verification, no defect is confirmed: Codex reported none, and Claude's three low-severity observations are refuted by the trusted live-test contract and stable fresh-project defaults.

Findings

No issues found.

Refuted findings (kept for transparency, not posted as review comments)

• apps/cli/src/legacy/commands/db/advisors/advisors.live.test.ts:13 (test-reliability): The advisors test is unreliable because it does not explicitly grant SELECT to anon or authenticated before expecting rls_disabled_in_public.
  Refuted: The fresh-project default is deliberate and stable: trusted StackConfig.ts:66-71 documents automatic Data API exposure as the cloud default, and the trusted initial schema grants anon and authenticated all privileges on new public tables owned by postgres. The fixture provisions a new default project, so this table deterministically inherits the required privilege.
• apps/cli/src/legacy/commands/db/lint/lint.live.test.ts:18 (test-reliability): Omitting --schema makes the lint test depend on public schema discovery and unnecessarily lint every user schema.
  Refuted: The fixture creates a fresh project and the serial live suite has no other tests creating functions or schemas. The trusted initial schema explicitly assigns public to postgres, so discovery includes it. Moreover, lint.integration.test.ts:248 identifies linting every user schema when --schema is omitted as established command behavior, which this invocation validly exercises.
• apps/cli/src/legacy/commands/db/query/query.live.test.ts:21 (test-coverage): Using a literal marker does not prove db query reached the provisioned project's data plane because the same result could come from any PostgreSQL database.
  Refuted: query.handler.ts:144-149 connects through project.dbUrl and obtains the asserted row by executing the SQL on that database. Trusted ADR 0013:20-21 defines a live test as one whose command reaches the provisioned project or its data plane; it does not require project-specific persisted state. The literal query directly and sufficiently tests db query connectivity and JSON rendering while keeping the assertion focused on one command as ADR 0013:59-60 requires.

Stats

Claude findings: 3 · Codex findings: 0 · Confirmed: 0 · Refuted: 3 · Uncertain: 0

---

Models: claude-opus-5 + gpt-5.6-sol · Trigger: manual · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.