ci(eql): port and harden the inert EQL release pipeline

.github/workflows/_build-eql-docs.yml

@@ -0,0 +1,95 @@
+name: "Build EQL docs (reusable)"
+
+# Builds the EQL docs bundle and attaches it to the release _build-eql-sql.yml
+# created earlier in the same run. Called by release.yml on both paths.
+#
+# Ported from packages/eql/.github/workflows/_build-docs.yml — see
+# _build-eql-sql.yml for the rename and the path rewrites.
+#
+# This pipeline has never executed here: `docs:generate:json` had no caller at
+# all until this file landed. The apt install below is load-bearing — mise does
+# not provide doxygen.
+on:
+  workflow_call:
+    inputs:
+      ref:
+        description: "Git ref/SHA to build docs from. Empty -> default checkout."
+        required: false
+        type: string
+        default: ""
+      tag:
+        description: "Full release tag. Empty -> build only, no attach."
+        required: false
+        type: string
+        default: ""
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+  MISE_VERBOSE: "1"
+
+defaults:
+  run:
+    working-directory: packages/eql
+
+permissions:
+  contents: write
+
+jobs:
+  publish-docs:
+    name: Build and publish documentation
+    runs-on: blacksmith-16vcpu-ubuntu-2204
+    timeout-minutes: 20
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+          ref: ${{ inputs.ref }}
+
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
+        with:
+          version: 2026.4.0
+          install: true
+          cache: false # publish path; see _build-eql-sql.yml
+          working_directory: packages/eql
+
+      - name: Install Doxygen
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y doxygen
+
+      - name: Generate documentation
+        env:
+          TAG: ${{ inputs.tag }}
+        run: |
+          mise run docs:generate
+          mise run docs:generate:markdown -- "${TAG}"
+          mise run docs:generate:json -- "${TAG}"
+
+      - name: Package documentation
+        env:
+          TAG: ${{ inputs.tag }}
+        run: mise run docs:package "${TAG}"
+
+      - name: Upload documentation artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: eql-docs
+          path: |
+            packages/eql/release/eql-docs-*.zip
+            packages/eql/release/eql-docs-*.tar.gz
+          # `warn` is the default, and a warning here is indistinguishable from
+          # a successful upload on the run page. These paths are the one thing
+          # the subtree import could plausibly get wrong — they are workspace-
+          # root relative and so are NOT covered by `defaults.run.working-
+          # directory` — and a wrong one publishes a release with no assets.
+          if-no-files-found: error
+
+      - name: Publish documentation to release
+        if: ${{ inputs.tag != '' }}
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
+        with:
+          tag_name: ${{ inputs.tag }}
+          files: |
+            packages/eql/release/eql-docs-*.zip
+            packages/eql/release/eql-docs-*.tar.gz

.github/workflows/_build-eql-sql.yml

@@ -0,0 +1,124 @@
+name: "Build EQL SQL (reusable)"
+
+# Builds the EQL SQL bundle and attaches it to a GitHub release. Called by
+# release.yml on both the production and the prerelease path, so an EQL SQL
+# release has one build path.
+#
+# Ported from packages/eql/.github/workflows/_build-sql.yml, which GitHub never
+# read. Renamed on the way in (nothing binds to the filename; "SQL" names
+# nothing on its own in a monorepo), and every path moved down one level.
+#
+# The Multitudes deploy ping upstream ended this job with was dropped:
+# MULTITUDES_ACCESS_TOKEN does not exist in this repository, so the step would
+# have failed on every release under its own `continue-on-error`.
+
+on:
+  workflow_call:
+    inputs:
+      ref:
+        description: "Git ref/SHA to build from. Empty -> default checkout."
+        required: false
+        type: string
+        default: ""
+      tag:
+        description: "Full release tag (e.g. eql-3.0.6). Empty -> DEV build, no attach."
+        required: false
+        type: string
+        default: ""
+      attach:
+        description: "Attach the built .sql artefacts to a GitHub Release."
+        required: false
+        type: boolean
+        default: false
+      target_commitish:
+        description: "Non-empty -> create a release at this commit; empty -> attach to the existing release named by tag."
+        required: false
+        type: string
+        default: ""
+      prerelease:
+        description: "Mark the created release as a prerelease (create path only)."
+        required: false
+        type: boolean
+        default: false
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+  MISE_VERBOSE: "1"
+
+defaults:
+  run:
+    # Every `run:` here is written against the EQL root, one level down.
+    working-directory: packages/eql
+    # No `shell: bash {0}` override (upstream had one): that disables errexit.
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    name: Build EQL
+    runs-on: blacksmith-16vcpu-ubuntu-2204
+    timeout-minutes: 20
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+          ref: ${{ inputs.ref }}
+
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
+        with:
+          version: 2026.4.0
+          install: true
+          # Defaults to true; forbidden on a publish path by
+          # scripts/lint-no-workflow-caching.mjs. Upstream had `cache: true`.
+          cache: false
+          # `defaults.run` does not reach a `uses:` step, and mise reads config
+          # from cwd and its parents only.
+          working_directory: packages/eql
+
+      - name: Build EQL release
+        # Strip `eql-` so eql_v3.version() reports bare semver. An empty TAG
+        # falls through to tasks/build.sh's `${usage_version:-DEV}` default.
+        # `--version` is not one of build.sh's declared mise sources, so force
+        # regeneration when unchanged SQL is being stamped for a new release.
+        env:
+          TAG: ${{ inputs.tag }}
+        run: mise run --force build --version "${TAG#eql-}"
+
+      # Artifact and release paths are workspace-root relative.
+      - name: Upload EQL artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: eql-release
+          path: |
+            packages/eql/release/cipherstash-encrypt.sql
+            packages/eql/release/cipherstash-encrypt-uninstall.sql
+          # `warn` is the default, and a warning here is indistinguishable from
+          # a successful upload on the run page. These paths are the one thing
+          # the subtree import could plausibly get wrong — they are workspace-
+          # root relative and so are NOT covered by `defaults.run.working-
+          # directory` — and a wrong one publishes a release with no assets.
+          if-no-files-found: error
+
+      - name: Attach artefacts to existing release
+        if: ${{ inputs.attach && inputs.target_commitish == '' }}
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
+        with:
+          tag_name: ${{ inputs.tag }}
+          files: |
+            packages/eql/release/cipherstash-encrypt.sql
+            packages/eql/release/cipherstash-encrypt-uninstall.sql
+
+      - name: Create release at commit
+        if: ${{ inputs.attach && inputs.target_commitish != '' }}
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
+        with:
+          tag_name: ${{ inputs.tag }}
+          target_commitish: ${{ inputs.target_commitish }}
+          prerelease: ${{ inputs.prerelease }}
+          name: ${{ inputs.tag }}
+          body: "The standalone eql_v3 SQL surface. See packages/eql/CHANGELOG.md."
+          files: |
+            packages/eql/release/cipherstash-encrypt.sql
+            packages/eql/release/cipherstash-encrypt-uninstall.sql

.github/workflows/lint-release.yml

@@ -10,27 +10,37 @@ name: Lint release tooling
 # shellcheck over every `run:` block — which is why the workflows it gates
 # avoid `sed`-into-`export` (SC2001, SC2155), `ls | wc -l` (SC2012), and
 # dollar-braces or backticks inside single-quoted `node -e` arguments (SC2016).
+#
+# The EQL release workflows are in scope. They came from `packages/eql/.github/`,
+# where an EQL-local copy of this file linted them and ran on nothing — along
+# with its two unique checks, the `prepare-bindings-assets` shellcheck and that
+# wrapper's bash unit test, neither of which ran anywhere here until now.
 
 on:
   pull_request:
-    # Exactly what the job reads: the four workflows actionlint is pointed at,
-    # plus the config it resolves the Blacksmith label from. The filter also
-    # named scripts/release-gate.mjs, scripts/ffi-release-matrix.mjs,
-    # scripts/lint-no-workflow-caching.mjs and package.json — none of which this
-    # job looks at, since it deliberately does not run `test:scripts` (see the
-    # job comment). Editing one booted a runner and downloaded a Go binary to
-    # lint four unchanged files, which is how a job trains reviewers to ignore
-    # it. `tests.yml`'s `lint` job runs `test:scripts` unfiltered on every PR,
-    # so those four are already covered.
+    # Exactly what the job reads: the workflows actionlint is pointed at, the
+    # config it resolves the Blacksmith label from, and the two shell scripts
+    # the last two steps run. The filter also named scripts/release-gate.mjs,
+    # scripts/ffi-release-matrix.mjs, scripts/lint-no-workflow-caching.mjs and
+    # package.json — none of which this job looks at, since it deliberately does
+    # not run `test:scripts` (see the job comment). Editing one booted a runner
+    # and downloaded a Go binary to lint four unchanged files, which is how a
+    # job trains reviewers to ignore it. `tests.yml`'s `lint` job runs
+    # `test:scripts` unfiltered on every PR, so those four are already covered.
     #
-    # `lint-release-scope.test.mjs` asserts this list and the actionlint
-    # argument list below stay the same set.
+    # `lint-release-scope.test.mjs` asserts the `.github/workflows/` half of
+    # this list and the actionlint argument list below stay the same set.
     paths:
       - .github/workflows/release.yml
       - .github/workflows/_build-ffi-artifacts.yml
       - .github/workflows/ffi-preflight.yml
+      - .github/workflows/_build-eql-sql.yml
+      - .github/workflows/_build-eql-docs.yml
+      - .github/workflows/release-plz.yml
+      - .github/workflows/release-postgres-eql-image.yml
       - .github/workflows/lint-release.yml
       - .github/actionlint.yaml
+      - packages/eql/tasks/release/*.sh
   workflow_dispatch: {}
 
 permissions:
@@ -46,15 +56,15 @@ concurrency:
 
 jobs:
   # No pnpm, no Node, no install: actionlint is a downloaded Go binary and
-  # shellcheck ships in the runner image, so this job is a checkout and one
-  # command.
+  # shellcheck ships in the runner image, so this job is a checkout and a few
+  # commands.
   #
   # It deliberately does NOT also run `test:scripts` or `lint:workflow-cache`.
   # `tests.yml`'s `lint` job runs `test:scripts` on every pull request with no
   # path filter, and `tests-supply-chain.yml` runs both — so a copy here would
   # be the second and third run of the same checks on any PR touching the
   # release machinery, each behind its own uncached full-workspace install. What
-  # this workflow uniquely has is actionlint.
+  # this workflow uniquely has is actionlint, and the two shell checks below.
   lint:
     name: actionlint (release workflows)
     runs-on: ubuntu-latest
@@ -81,5 +91,21 @@ jobs:
             .github/workflows/release.yml \
             .github/workflows/_build-ffi-artifacts.yml \
             .github/workflows/ffi-preflight.yml \
+            .github/workflows/_build-eql-sql.yml \
+            .github/workflows/_build-eql-docs.yml \
+            .github/workflows/release-plz.yml \
+            .github/workflows/release-postgres-eql-image.yml \
             .github/workflows/lint-release.yml
 
+      # `prepare-bindings-assets.sh` stamps the SQL bundle and rewrites the four
+      # release manifests during `pnpm run version`, so a shell mistake in it
+      # lands mid-release with every manifest already rewritten.
+      - name: shellcheck (EQL release wrappers)
+        run: |
+          set -euo pipefail
+          shellcheck \
+            packages/eql/tasks/release/prepare-bindings-assets.sh \
+            packages/eql/tasks/release/prepare-bindings-assets.test.sh
+
+      - name: prepare-bindings-assets validation unit test
+        run: bash packages/eql/tasks/release/prepare-bindings-assets.test.sh