chore(ci): integrate Verdaccio for integration tests

[mandarini]

Description

Integrates Verdaccio local npm registry into CI integration tests to fix dependency resolution issues and improve test reliability.

Problem

Integration tests (Expo, Next, Bun, Deno) were using tarballs with the file: protocol, which caused * dependencies in package.json to resolve from the public npm registry instead of the workspace. This led to:

1. Tests installing @supabase/[email protected] from npm (missing tslib)
2. Tests not using the actual workspace versions being tested
3. CI failures due to missing transitive dependencies
4. Complex tarball management with manual packing and copying
5. Tests not catching issues with existing code, because they were installing previously latest published version

Example of the issue:

  // supabase-js package.json
  "dependencies": {
    "@supabase/functions-js": "*"  // Resolved from npm, not workspace!
  }

Solution

Replaced tarball-based approach with Verdaccio (local npm registry):

1. Start Verdaccio in each integration test job

  npx verdaccio --config .verdaccio/config.yml &
  npm set registry http://localhost:4873/

2. Publish all workspace packages to Verdaccio

  for pkg in auth-js functions-js postgrest-js realtime-js storage-js supabase-js; do
    npm publish --registry http://localhost:4873
  done

3. Tests install from Verdaccio

  npm install --registry http://localhost:4873
  # Now `*` resolves to workspace versions!

4. Updated test package.json files
   • Changed "@supabase/supabase-js": "file:supabase-supabase-js-0.0.0-automated.tgz"
   • To "@supabase/supabase-js": "*"

Benefits

• Correct dependency resolution - * dependencies now resolve to workspace versions
• Realistic testing
• Tests use npm install like real users
• Would have caught tslib issue - All transitive dependencies properly resolved
• No tarball management - Simpler CI workflow
• Consistent approach - All integration tests use same pattern
• Zero impact on releases - Verdaccio only used for testing

Security Note

Verdaccio config uses publish: $all (no authentication). This is safe because:

• Runs on localhost only (not exposed to internet)
• Ephemeral (starts/stops with each CI job)
• Temporary storage (deleted after job completes)
• Never touches real npm registry

[coveralls]

coverage: 95.455% (-0.5%) from 95.986%
when pulling 2afd73f on chore/use-verdaccio-for-integration-tests
into c408c47 on master.