ci(eql): port and harden the inert EQL release pipeline - #941

Summary

EQL is the PostgreSQL layer that stores and queries encrypted data. Its subtree import brought eleven files under packages/eql/.github/, including the release pipeline, but GitHub only reads workflows from the repository root. The npm package, Rust crate, SQL bundle, docs bundle, and Postgres image therefore had no executable release path in this repository.

This PR ports and hardens the viable release pipeline at the repository root while keeping it inert. It does not arm EQL publishing.

Inertness is derived from FROZEN_PUBLISHERS in scripts/release-gate.mjs, not from a second release flag:

• scripts/eql-pipeline-armed.mjs gates the EQL SQL, docs, crate, image, and prerelease npm jobs.
• Production npm publishing is held by release-gate.mjs, which fails the shared release gate while EQL remains frozen.

Both paths read the same map entry. Removing @cipherstash/eql from that map during cutover arms the complete pipeline; there is no independent switch to forget.

Changes

Release workflows

The imported packages/eql/.github/ directory is deleted. scripts/__tests__/eql-suite-ci.test.mjs asserts that it stays absent and that no root workflow consumes the retired docs webhook secret.

Monorepo path corrections

• The npm manifest lives at packages/eql/packages/eql, two levels below the subtree root.
• Every EQL mise invocation runs from packages/eql, where mise can discover the subtree configuration.
• release-plz/action receives explicit manifest_path and config inputs; composite-action steps do not inherit defaults.run.working-directory.
• Prerelease builds run through Turbo so dependency builds are included.
• Artifact uploads fail when expected SQL or docs files are absent.

Release correctness

• Version classification requires an exact X.Y.Z-(alpha|beta|rc).N prerelease identity before any tag or release is created.
• The SQL release workflow runs mise run --force build --version .... --version is not a declared mise source, so an unforced build can reuse SQL stamped for an earlier release when the SQL sources are unchanged.
• A regression test pins that forced invocation.
• verify-release-assets.mjs validates the SQL schema-version stamp against the package version. Its former eql_v3 substring check also passed placeholder bundles.
• Prereleases no longer move npm's latest tag after GA.
• The EQL run summary includes the shared release gate and production release job, so an inert run is distinguishable from a failed publish.

Supply-chain hardening

• Remote actions are SHA-pinned with version comments.
• Release workflows explicitly disable supported GitHub Actions cache paths.
• Docker setup cache defaults are disabled, and Docker build cache inputs are forbidden on publishing paths.
• Publishing permission checks distinguish jobs allowed to write repository state from the smaller set allowed to request OIDC tokens.
• release-plz.yml runs only for EQL paths and checks crates.io before importing the signing key.
• The Postgres image source label points at cipherstash/stack, preventing a future push from relinking the GHCR package to the old repository.

Guards and audit fixes

• EQL and protect-ffi Cargo workspaces are both covered by crate publish opt-out checks.
• Published README discovery is derived from pnpm-workspace.yaml, including nested EQL and per-platform FFI packages.
• Repository scans skip local .claude/worktrees checkouts.
• pnpm dev reaches nested workspace packages with ./packages/**.
• EQL dependency pins are checked across Cargo manifests, Cargo configuration, package manifests, and pnpm workspace configuration.
• Documentation describes durable release mechanisms instead of asserting mutable registry configuration.

Verification

• pnpm run test:scripts — 49 files, 816 passed, 1 skipped.
• Biome — 866 tracked files checked with zero errors.
• actionlint passes for the changed release workflows.
• scripts/lint-no-workflow-caching.mjs exits 0.
• scripts/lint-no-eql-registry-pins.mjs exits 0.
• git diff --check passes.

A temporary EQL patch bump was used to exercise the lockstep version hook. It moved the npm package, eql-bindings crate, SQL schema stamps, release manifests, and generated TypeScript manifest to one version. In that bumped state, release-gate.mjs refused publishing while EQL remained frozen.

The publish-time SQL verifier was also driven against a DEV-stamped bundle with an otherwise agreeing manifest: it exits non-zero and names the incorrect schema stamp.

The docs workflow still needs its first execution in this repository when the pipeline is armed. It builds and attaches the versioned HTML/XML/Markdown artifact; there is intentionally no external docs-site webhook.

Cutover notes

This PR builds the pipeline but does not perform the cutover. Before removing the EQL entry from FROZEN_PUBLISHERS, verify the external publisher configuration required by npm and crates.io and the GHCR release path. The postgres-eql image is also currently a major version behind EQL, so moving its floating tags should be deliberate.

Related

Refs #885

Review notes

Start with scripts/eql-pipeline-armed.mjs and scripts/release-gate.mjs, then review the production and prerelease EQL paths in .github/workflows/release.yml.

workflow_dispatch is the notable behavior change to the existing shared release workflow. Production jobs are explicitly gated so a dispatch from a feature branch cannot publish JS or FFI packages.

No changeset: this PR changes repository tooling, tests, and documentation. The modified EQL prepublishOnly verifier is excluded from the published package by its files allowlist.