ci: add schema validation workflow

.github/workflows/schema.yml

@@ -0,0 +1,71 @@
+name: Schema
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  schema:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+
+      - name: Cache bun install cache
+        uses: actions/cache@v4
+        with:
+          path: ~/.bun/install/cache
+          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: bun-${{ runner.os }}-
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Install Supabase CLI
+        uses: supabase/setup-cli@v1
+        with:
+          version: latest
+
+      - name: Start Supabase database
+        run: supabase db start
+
+      # `supabase db diff` always prints progress lines and exits 0, so we can't gate on output being
+      # empty. When the declarative schemas (supabase/schemas) and migrations match it prints
+      # "No schema changes found"; otherwise it prints the reconciling migration.
+      - name: Check declarative schema matches migrations
+        run: |
+          diff_output=$(supabase db diff 2>&1)
+          echo "$diff_output"
+          if ! grep -q "No schema changes found" <<< "$diff_output"; then
+            echo "::error::Declarative schemas and migrations are out of sync. Run 'supabase db diff -f <name>' to generate the missing migration and commit it."
+            exit 1
+          fi
+
+      - name: Reset database
+        run: supabase db reset
+
+      # `bun schema` (tools/update_schema.sh) sources .env.docker for the Zapatos connection vars.
+      # That file is gitignored, so recreate it here pointing at the local Supabase database.
+      - name: Configure schema generation env
+        run: |
+          cat > .env.docker <<'EOF'
+          PGHOST=127.0.0.1
+          PGPORT=54322
+          PGUSER=postgres
+          PGPASSWORD=postgres
+          PGDATABASE=postgres
+          EOF
+
+      - name: Regenerate Zapatos types
+        run: bun run schema
+
+      - name: Check generated types are up to date
+        run: |
+          if ! git diff --exit-code -- src/services/zapatos/schema.d.ts src/services/db/db.types.ts; then
+            echo "::error::Generated DB types are out of date. Run 'bun schema' locally and commit the result."
+            exit 1
+          fi