ci(eql): port the EQL release pipeline to the repository root, inert

packages/eql/.github/workflows/_build-docs.yml → .github/workflows/_build-eql-docs.yml

@@ -1,14 +1,19 @@
-name: "Build docs (reusable)"
-
-# Reusable docs build+attach. Called inline by release.yml (production and
-# prerelease paths). The target release already exists: _build-sql.yml creates
-# it in the same run before this docs job attaches to it.
+name: "Build EQL docs (reusable)"
 
+# Builds the EQL docs bundle and attaches it to the release _build-eql-sql.yml
+# created earlier in the same run. Called by release.yml on both paths.
+#
+# Ported from packages/eql/.github/workflows/_build-docs.yml — see
+# _build-eql-sql.yml for the rename and the path rewrites.
+#
+# This pipeline has never executed here: `docs:generate:json` had no caller at
+# all until this file landed. The apt install below is load-bearing — mise does
+# not provide doxygen.
 on:
   workflow_call:
     inputs:
       ref:
-        description: "Git ref/SHA to build docs from. Empty -> default checkout (github.sha)."
+        description: "Git ref/SHA to build docs from. Empty -> default checkout."
         required: false
         type: string
         default: ""
@@ -24,28 +29,29 @@ env:
 
 defaults:
   run:
-    shell: bash {0}
+    working-directory: packages/eql
 
 permissions:
   contents: write
 
 jobs:
   publish-docs:
+    name: Build and publish documentation
     runs-on: blacksmith-16vcpu-ubuntu-2204
-    name: Build and Publish Documentation
-    timeout-minutes: 10
+    timeout-minutes: 20
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
           ref: ${{ inputs.ref }}
 
-      - uses: jdx/mise-action@v3
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
         with:
           version: 2026.4.0
           install: true
-          cache: true
+          cache: false # publish path; see _build-eql-sql.yml
+          working_directory: packages/eql
 
       - name: Install Doxygen
         run: |
@@ -56,30 +62,28 @@ jobs:
         env:
           TAG: ${{ inputs.tag }}
         run: |
-          set -euo pipefail
           mise run docs:generate
           mise run docs:generate:markdown -- "${TAG}"
           mise run docs:generate:json -- "${TAG}"
 
       - name: Package documentation
         env:
           TAG: ${{ inputs.tag }}
-        run: |
-          mise run docs:package "${TAG}"
+        run: mise run docs:package "${TAG}"
 
       - name: Upload documentation artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: eql-docs
           path: |
-            release/eql-docs-*.zip
-            release/eql-docs-*.tar.gz
+            packages/eql/release/eql-docs-*.zip
+            packages/eql/release/eql-docs-*.tar.gz
 
       - name: Publish documentation to release
         if: ${{ inputs.tag != '' }}
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
         with:
           tag_name: ${{ inputs.tag }}
           files: |
-            release/eql-docs-*.zip
-            release/eql-docs-*.tar.gz
+            packages/eql/release/eql-docs-*.zip
+            packages/eql/release/eql-docs-*.tar.gz

.github/workflows/_build-eql-sql.yml

@@ -0,0 +1,116 @@
+name: "Build EQL SQL (reusable)"
+
+# Builds the EQL SQL bundle and attaches it to a GitHub release. Called by
+# release.yml on both the production and the prerelease path, so an EQL SQL
+# release has one build path.
+#
+# Ported from packages/eql/.github/workflows/_build-sql.yml, which GitHub never
+# read. Renamed on the way in (nothing binds to the filename; "SQL" names
+# nothing on its own in a monorepo), and every path moved down one level.
+#
+# The Multitudes deploy ping upstream ended this job with was dropped:
+# MULTITUDES_ACCESS_TOKEN does not exist in this repository, so the step would
+# have failed on every release under its own `continue-on-error`.
+
+on:
+  workflow_call:
+    inputs:
+      ref:
+        description: "Git ref/SHA to build from. Empty -> default checkout."
+        required: false
+        type: string
+        default: ""
+      tag:
+        description: "Full release tag (e.g. eql-3.0.6). Empty -> DEV build, no attach."
+        required: false
+        type: string
+        default: ""
+      attach:
+        description: "Attach the built .sql artefacts to a GitHub Release."
+        required: false
+        type: boolean
+        default: false
+      target_commitish:
+        description: "Non-empty -> create a release at this commit; empty -> attach to the existing release named by tag."
+        required: false
+        type: string
+        default: ""
+      prerelease:
+        description: "Mark the created release as a prerelease (create path only)."
+        required: false
+        type: boolean
+        default: false
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+  MISE_VERBOSE: "1"
+
+defaults:
+  run:
+    # Every `run:` here is written against the EQL root, one level down.
+    working-directory: packages/eql
+    # No `shell: bash {0}` override (upstream had one): that disables errexit.
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    name: Build EQL
+    runs-on: blacksmith-16vcpu-ubuntu-2204
+    timeout-minutes: 20
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+          ref: ${{ inputs.ref }}
+
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
+        with:
+          version: 2026.4.0
+          install: true
+          # Defaults to true; forbidden on a publish path by
+          # scripts/lint-no-workflow-caching.mjs. Upstream had `cache: true`.
+          cache: false
+          # `defaults.run` does not reach a `uses:` step, and mise reads config
+          # from cwd and its parents only.
+          working_directory: packages/eql
+
+      - name: Build EQL release
+        # Strip `eql-` so eql_v3.version() reports bare semver. An empty TAG
+        # falls through to tasks/build.sh's `${usage_version:-DEV}` default.
+        env:
+          TAG: ${{ inputs.tag }}
+        run: mise run build --version "${TAG#eql-}"
+
+      # Artifact and release paths are workspace-root relative.
+      - name: Upload EQL artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: eql-release
+          path: |
+            packages/eql/release/cipherstash-encrypt.sql
+            packages/eql/release/cipherstash-encrypt-uninstall.sql
+
+      - name: Attach artefacts to existing release
+        if: ${{ inputs.attach && inputs.target_commitish == '' }}
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
+        with:
+          tag_name: ${{ inputs.tag }}
+          files: |
+            packages/eql/release/cipherstash-encrypt.sql
+            packages/eql/release/cipherstash-encrypt-uninstall.sql
+
+      - name: Create release at commit
+        if: ${{ inputs.attach && inputs.target_commitish != '' }}
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
+        with:
+          tag_name: ${{ inputs.tag }}
+          target_commitish: ${{ inputs.target_commitish }}
+          prerelease: ${{ inputs.prerelease }}
+          name: ${{ inputs.tag }}
+          body: "The standalone eql_v3 SQL surface. See packages/eql/CHANGELOG.md."
+          files: |
+            packages/eql/release/cipherstash-encrypt.sql
+            packages/eql/release/cipherstash-encrypt-uninstall.sql

.github/workflows/lint-release.yml

@@ -10,27 +10,37 @@ name: Lint release tooling
 # shellcheck over every `run:` block — which is why the workflows it gates
 # avoid `sed`-into-`export` (SC2001, SC2155), `ls | wc -l` (SC2012), and
 # dollar-braces or backticks inside single-quoted `node -e` arguments (SC2016).
+#
+# The EQL release workflows are in scope. They came from `packages/eql/.github/`,
+# where an EQL-local copy of this file linted them and ran on nothing — along
+# with its two unique checks, the `prepare-bindings-assets` shellcheck and that
+# wrapper's bash unit test, neither of which ran anywhere here until now.
 
 on:
   pull_request:
-    # Exactly what the job reads: the four workflows actionlint is pointed at,
-    # plus the config it resolves the Blacksmith label from. The filter also
-    # named scripts/release-gate.mjs, scripts/ffi-release-matrix.mjs,
-    # scripts/lint-no-workflow-caching.mjs and package.json — none of which this
-    # job looks at, since it deliberately does not run `test:scripts` (see the
-    # job comment). Editing one booted a runner and downloaded a Go binary to
-    # lint four unchanged files, which is how a job trains reviewers to ignore
-    # it. `tests.yml`'s `lint` job runs `test:scripts` unfiltered on every PR,
-    # so those four are already covered.
+    # Exactly what the job reads: the workflows actionlint is pointed at, the
+    # config it resolves the Blacksmith label from, and the two shell scripts
+    # the last two steps run. The filter also named scripts/release-gate.mjs,
+    # scripts/ffi-release-matrix.mjs, scripts/lint-no-workflow-caching.mjs and
+    # package.json — none of which this job looks at, since it deliberately does
+    # not run `test:scripts` (see the job comment). Editing one booted a runner
+    # and downloaded a Go binary to lint four unchanged files, which is how a
+    # job trains reviewers to ignore it. `tests.yml`'s `lint` job runs
+    # `test:scripts` unfiltered on every PR, so those four are already covered.
     #
-    # `lint-release-scope.test.mjs` asserts this list and the actionlint
-    # argument list below stay the same set.
+    # `lint-release-scope.test.mjs` asserts the `.github/workflows/` half of
+    # this list and the actionlint argument list below stay the same set.
     paths:
       - .github/workflows/release.yml
       - .github/workflows/_build-ffi-artifacts.yml
       - .github/workflows/ffi-preflight.yml
+      - .github/workflows/_build-eql-sql.yml
+      - .github/workflows/_build-eql-docs.yml
+      - .github/workflows/release-plz.yml
+      - .github/workflows/release-postgres-eql-image.yml
       - .github/workflows/lint-release.yml
       - .github/actionlint.yaml
+      - packages/eql/tasks/release/*.sh
   workflow_dispatch: {}
 
 permissions:
@@ -46,15 +56,15 @@ concurrency:
 
 jobs:
   # No pnpm, no Node, no install: actionlint is a downloaded Go binary and
-  # shellcheck ships in the runner image, so this job is a checkout and one
-  # command.
+  # shellcheck ships in the runner image, so this job is a checkout and a few
+  # commands.
   #
   # It deliberately does NOT also run `test:scripts` or `lint:workflow-cache`.
   # `tests.yml`'s `lint` job runs `test:scripts` on every pull request with no
   # path filter, and `tests-supply-chain.yml` runs both — so a copy here would
   # be the second and third run of the same checks on any PR touching the
   # release machinery, each behind its own uncached full-workspace install. What
-  # this workflow uniquely has is actionlint.
+  # this workflow uniquely has is actionlint, and the two shell checks below.
   lint:
     name: actionlint (release workflows)
     runs-on: ubuntu-latest
@@ -81,5 +91,21 @@ jobs:
             .github/workflows/release.yml \
             .github/workflows/_build-ffi-artifacts.yml \
             .github/workflows/ffi-preflight.yml \
+            .github/workflows/_build-eql-sql.yml \
+            .github/workflows/_build-eql-docs.yml \
+            .github/workflows/release-plz.yml \
+            .github/workflows/release-postgres-eql-image.yml \
             .github/workflows/lint-release.yml
 
+      # `prepare-bindings-assets.sh` stamps the SQL bundle and rewrites the four
+      # release manifests during `pnpm run version`, so a shell mistake in it
+      # lands mid-release with every manifest already rewritten.
+      - name: shellcheck (EQL release wrappers)
+        run: |
+          set -euo pipefail
+          shellcheck \
+            packages/eql/tasks/release/prepare-bindings-assets.sh \
+            packages/eql/tasks/release/prepare-bindings-assets.test.sh
+
+      - name: prepare-bindings-assets validation unit test
+        run: bash packages/eql/tasks/release/prepare-bindings-assets.test.sh

.github/workflows/rebuild-docs.yml

@@ -1,14 +1,30 @@
 name: Rebuild Docs
 
+# ⚠️ THIS WORKFLOW HAS NEVER RUN. `gh run list --workflow rebuild-docs.yml` is
+# empty, across @cipherstash/stack@1.0.0, 1.1.0 and 1.1.1. A ref created with
+# the repository's GITHUB_TOKEN does not start a workflow run, and
+# changesets/action creates these tags with that token — so the `push` event
+# below is never delivered. Valid file, configured secret, existing tags, and
+# the docs site rebuilt by nothing.
+#
+# Left as-is because fixing it means changing the JS release path, which the
+# pull request that discovered it was not doing. DO NOT ADD A TAG PATTERN HERE
+# expecting it to fire. The EQL half was routed around it: it is now the
+# `eql-docs-rebuild` job in release.yml, firing the webhook from inside the run
+# that published. The same fix applies here.
 on:
   push:
     tags:
       - '@cipherstash/stack@*'
 
+permissions:
+  contents: read
+
 jobs:
   trigger-docs-rebuild:
     name: Trigger Docs Rebuild
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - name: Send webhook
         env: