Skip to content

ci: run JS and FFI suites only on changes that can reach them #1290

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
coderdan wants to merge 2 commits into
base: next
Choose a base branch
from
+1,403 −103
Open

ci: run JS and FFI suites only on changes that can reach them #1290

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5814858
ci: key the FFI cache and its workflow filters to the eql-bindings fi…
coderdan Oct 19, 2026
039a665
ci(tests): run the live JS jobs only when a pull request can reach them
coderdan Oct 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 32 additions & 12 deletions .github/actions/build-ffi-binding/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ runs:
# Edit either and the Rust hash is unchanged, so the cache hit skips
# the build step below and the job proceeds on a stale index.node.
#
# The last two are NOT in this package. `crates/protect-ffi/Cargo.toml`
# The EQL entries are NOT in this package. `crates/protect-ffi/Cargo.toml`
# carries `eql-bindings = { path = "../../../../../../packages/eql/crates/eql-bindings" }`
# — an in-tree path dependency that compiles into `index.node` and into
# the wasm build below. A path dep has no registry checksum, so a
Expand All @@ -67,14 +67,24 @@ runs:
# observed, not theoretical: the crate went 3.0.4 -> 4.0.0 -> 3.0.5
# across three commits and neither key here changed by a byte.)
#
# `crates/**` rather than the one crate, deliberately. `eql-bindings`
# has no path deps of its own TODAY, so the narrower glob would be exact
# — and would silently stop being exact the moment it gains one on a
# sibling in that workspace, which is the same hole one level down. The
# cost of the wider glob is a spurious miss when an unrelated EQL crate
# changes; the cost of the narrower one is a stale binary. Guarded by
# `scripts/__tests__/ffi-binding-action.test.mjs`, which discovers the
# path deps from the manifest rather than trusting this comment.
# The files cargo compiles from that crate, not the crate directory and
# not `packages/eql/crates/**`. protect-ffi builds eql-bindings with no
# features, so its `v4` and `encryption` modules (feature
# `stack-encrypt`) never reach the binding, and its tests, docs and
# generated `bindings/` / `schema/` are not compile inputs at all. The
# wider glob hashed all of that, plus eql-codegen and the other crates
# beside it: each such edit missed this cache, and every workflow whose
# `paths:` copies the glob started its suites over a change that cannot
# reach them. An EQL v4 pull request ran every TypeScript integration
# suite that way.
#
# The list is derived, not remembered.
# `scripts/__tests__/ffi-binding-action.test.mjs` walks the path
# dependencies from the manifest, follows each crate's modules from
# `src/lib.rs` under the features it is built with, and fails both
# ways: a compiled file this key misses (a new module, a new path dep,
# a feature turned on), and a file beside those crates that it hashes
# and cargo does not read.
#
# The EQL workspace root manifest comes with it: cargo reads it for the
# crate's workspace context, so a `<key>.workspace = true` added to
Expand All @@ -87,7 +97,12 @@ runs:
'languages/typescript/packages/protect-ffi/Cargo.lock',
'languages/typescript/packages/protect-ffi/package.json',
'languages/typescript/packages/protect-ffi/mise.toml',
'packages/eql/crates/**',
'packages/eql/crates/eql-bindings/Cargo.toml',
'packages/eql/crates/eql-bindings/src/lib.rs',
'packages/eql/crates/eql-bindings/src/sql.rs',
'packages/eql/crates/eql-bindings/src/from_v2/**',
'packages/eql/crates/eql-bindings/src/v3/**',
'packages/eql/crates/eql-bindings/sql/**',
'packages/eql/Cargo.toml') }}

# Always, hit or miss: `lib/` is `tsc` over `src/`, which is seconds, and
Expand Down Expand Up @@ -165,7 +180,7 @@ runs:
# never reads. ffi-binding-action.test.mjs walks the tsconfig's imports
# and fails if this stops being the complete input set.
#
# `packages/eql/**` is here for the reason spelled out on the native key
# The EQL entries are here for the reason spelled out on the native key
# above, and it is NOT redundant with it: wasm-pack compiles the same
# `eql-bindings` path dependency for wasm32 into
# `protect_ffi_inline.js`, which is the bundle
Expand All @@ -176,7 +191,12 @@ runs:
hashFiles('languages/typescript/packages/protect-ffi/crates/**',
'languages/typescript/packages/protect-ffi/Cargo.toml',
'languages/typescript/packages/protect-ffi/Cargo.lock',
'packages/eql/crates/**',
'packages/eql/crates/eql-bindings/Cargo.toml',
'packages/eql/crates/eql-bindings/src/lib.rs',
'packages/eql/crates/eql-bindings/src/sql.rs',
'packages/eql/crates/eql-bindings/src/from_v2/**',
'packages/eql/crates/eql-bindings/src/v3/**',
'packages/eql/crates/eql-bindings/sql/**',
'packages/eql/Cargo.toml',
'languages/typescript/packages/protect-ffi/dist/wasm/*.d.ts',
'languages/typescript/packages/protect-ffi/src/errors.ts',
Expand Down
32 changes: 30 additions & 2 deletions .github/workflows/integration-drizzle.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,8 +104,22 @@ on:
# `.github/actions/build-ffi-binding` hash them, so an edit here misses
# that cache and rebuilds the bundle the `integration/wasm/**` suites
# load. Same argument as the two entries above, same guard.
- 'packages/eql/crates/**'
# Only the eql-bindings files cargo compiles into the binding, as
# the cache key lists them: not its tests, docs or generated
# bindings, not the `v4` / `encryption` modules behind a feature
# protect-ffi never enables, and not the other EQL crates.
# ffi-binding-action.test.mjs derives the list from the manifests.
- 'packages/eql/crates/eql-bindings/Cargo.toml'
- 'packages/eql/crates/eql-bindings/src/lib.rs'
- 'packages/eql/crates/eql-bindings/src/sql.rs'
- 'packages/eql/crates/eql-bindings/src/from_v2/**'
- 'packages/eql/crates/eql-bindings/src/v3/**'
- 'packages/eql/crates/eql-bindings/sql/**'
- 'packages/eql/Cargo.toml'
# The SQL this suite installs. `stash eql install` and the Prisma
# Next baseline migration read the bundle from `@cipherstash/eql`, a
# workspace package, so an EQL release bump edits only this directory.
- 'packages/eql/packages/eql/**'
pull_request:
branches: ['**']
# Repeated verbatim: GitHub Actions does not support YAML anchors/aliases.
Expand Down Expand Up @@ -198,8 +212,22 @@ on:
# `.github/actions/build-ffi-binding` hash them, so an edit here misses
# that cache and rebuilds the bundle the `integration/wasm/**` suites
# load. Same argument as the two entries above, same guard.
- 'packages/eql/crates/**'
# Only the eql-bindings files cargo compiles into the binding, as
# the cache key lists them: not its tests, docs or generated
# bindings, not the `v4` / `encryption` modules behind a feature
# protect-ffi never enables, and not the other EQL crates.
# ffi-binding-action.test.mjs derives the list from the manifests.
- 'packages/eql/crates/eql-bindings/Cargo.toml'
- 'packages/eql/crates/eql-bindings/src/lib.rs'
- 'packages/eql/crates/eql-bindings/src/sql.rs'
- 'packages/eql/crates/eql-bindings/src/from_v2/**'
- 'packages/eql/crates/eql-bindings/src/v3/**'
- 'packages/eql/crates/eql-bindings/sql/**'
- 'packages/eql/Cargo.toml'
# The SQL this suite installs. `stash eql install` and the Prisma
# Next baseline migration read the bundle from `@cipherstash/eql`, a
# workspace package, so an EQL release bump edits only this directory.
- 'packages/eql/packages/eql/**'

jobs:
integration:
Expand Down
36 changes: 32 additions & 4 deletions .github/workflows/integration-prisma-next.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,12 +56,26 @@ on:
# EQL wire types are linked into the `index.node` this job encrypts
# through. The native cache key in `.github/actions/build-ffi-binding`
# hashes both, so an edit here misses that cache and the binding gets
# rebuilt — correctly. Without these two entries the miss never happens,
# rebuilt — correctly. Without these entries the miss never happens,
# because the workflow does not trigger at all: a payload-encoding change
# under packages/eql/crates merges with this suite green by absence.
# Pinned by scripts/__tests__/wasm-build-inputs-paths-filter.test.mjs.
- 'packages/eql/crates/**'
# Only the eql-bindings files cargo compiles into the binding, as
# the cache key lists them: not its tests, docs or generated
# bindings, not the `v4` / `encryption` modules behind a feature
# protect-ffi never enables, and not the other EQL crates.
# ffi-binding-action.test.mjs derives the list from the manifests.
- 'packages/eql/crates/eql-bindings/Cargo.toml'
- 'packages/eql/crates/eql-bindings/src/lib.rs'
- 'packages/eql/crates/eql-bindings/src/sql.rs'
- 'packages/eql/crates/eql-bindings/src/from_v2/**'
- 'packages/eql/crates/eql-bindings/src/v3/**'
- 'packages/eql/crates/eql-bindings/sql/**'
- 'packages/eql/Cargo.toml'
# The SQL this suite installs. `stash eql install` and the Prisma
# Next baseline migration read the bundle from `@cipherstash/eql`, a
# workspace package, so an EQL release bump edits only this directory.
- 'packages/eql/packages/eql/**'
pull_request:
branches: ['**']
# Repeated verbatim: GitHub Actions does not support YAML anchors/aliases.
Expand Down Expand Up @@ -104,12 +118,26 @@ on:
# EQL wire types are linked into the `index.node` this job encrypts
# through. The native cache key in `.github/actions/build-ffi-binding`
# hashes both, so an edit here misses that cache and the binding gets
# rebuilt — correctly. Without these two entries the miss never happens,
# rebuilt — correctly. Without these entries the miss never happens,
# because the workflow does not trigger at all: a payload-encoding change
# under packages/eql/crates merges with this suite green by absence.
# Pinned by scripts/__tests__/wasm-build-inputs-paths-filter.test.mjs.
- 'packages/eql/crates/**'
# Only the eql-bindings files cargo compiles into the binding, as
# the cache key lists them: not its tests, docs or generated
# bindings, not the `v4` / `encryption` modules behind a feature
# protect-ffi never enables, and not the other EQL crates.
# ffi-binding-action.test.mjs derives the list from the manifests.
- 'packages/eql/crates/eql-bindings/Cargo.toml'
- 'packages/eql/crates/eql-bindings/src/lib.rs'
- 'packages/eql/crates/eql-bindings/src/sql.rs'
- 'packages/eql/crates/eql-bindings/src/from_v2/**'
- 'packages/eql/crates/eql-bindings/src/v3/**'
- 'packages/eql/crates/eql-bindings/sql/**'
- 'packages/eql/Cargo.toml'
# The SQL this suite installs. `stash eql install` and the Prisma
# Next baseline migration read the bundle from `@cipherstash/eql`, a
# workspace package, so an EQL release bump edits only this directory.
- 'packages/eql/packages/eql/**'

jobs:
integration:
Expand Down
24 changes: 22 additions & 2 deletions .github/workflows/integration-protect-ffi.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,7 +85,17 @@ on:
# cache and rebuilds the binding — without these entries it would be
# rebuilt and no suite that loads it would start. Pinned by
# scripts/__tests__/wasm-build-inputs-paths-filter.test.mjs.
- 'packages/eql/crates/**'
# Only the eql-bindings files cargo compiles into the binding, as
# the cache key lists them: not its tests, docs or generated
# bindings, not the `v4` / `encryption` modules behind a feature
# protect-ffi never enables, and not the other EQL crates.
# ffi-binding-action.test.mjs derives the list from the manifests.
- 'packages/eql/crates/eql-bindings/Cargo.toml'
- 'packages/eql/crates/eql-bindings/src/lib.rs'
- 'packages/eql/crates/eql-bindings/src/sql.rs'
- 'packages/eql/crates/eql-bindings/src/from_v2/**'
- 'packages/eql/crates/eql-bindings/src/v3/**'
- 'packages/eql/crates/eql-bindings/sql/**'
- 'packages/eql/Cargo.toml'
- '.github/workflows/integration-protect-ffi.yml'
- '.github/actions/build-ffi-binding/**'
Expand Down Expand Up @@ -124,7 +134,17 @@ on:
# cache and rebuilds the binding — without these entries it would be
# rebuilt and no suite that loads it would start. Pinned by
# scripts/__tests__/wasm-build-inputs-paths-filter.test.mjs.
- 'packages/eql/crates/**'
# Only the eql-bindings files cargo compiles into the binding, as
# the cache key lists them: not its tests, docs or generated
# bindings, not the `v4` / `encryption` modules behind a feature
# protect-ffi never enables, and not the other EQL crates.
# ffi-binding-action.test.mjs derives the list from the manifests.
- 'packages/eql/crates/eql-bindings/Cargo.toml'
- 'packages/eql/crates/eql-bindings/src/lib.rs'
- 'packages/eql/crates/eql-bindings/src/sql.rs'
- 'packages/eql/crates/eql-bindings/src/from_v2/**'
- 'packages/eql/crates/eql-bindings/src/v3/**'
- 'packages/eql/crates/eql-bindings/sql/**'
- 'packages/eql/Cargo.toml'
- '.github/workflows/integration-protect-ffi.yml'
- '.github/actions/build-ffi-binding/**'
Expand Down
36 changes: 32 additions & 4 deletions .github/workflows/integration-supabase.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,12 +83,26 @@ on:
# EQL wire types are linked into the `index.node` this job encrypts
# through. The native cache key in `.github/actions/build-ffi-binding`
# hashes both, so an edit here misses that cache and the binding gets
# rebuilt — correctly. Without these two entries the miss never happens,
# rebuilt — correctly. Without these entries the miss never happens,
# because the workflow does not trigger at all: a payload-encoding change
# under packages/eql/crates merges with this suite green by absence.
# Pinned by scripts/__tests__/wasm-build-inputs-paths-filter.test.mjs.
- 'packages/eql/crates/**'
# Only the eql-bindings files cargo compiles into the binding, as
# the cache key lists them: not its tests, docs or generated
# bindings, not the `v4` / `encryption` modules behind a feature
# protect-ffi never enables, and not the other EQL crates.
# ffi-binding-action.test.mjs derives the list from the manifests.
- 'packages/eql/crates/eql-bindings/Cargo.toml'
- 'packages/eql/crates/eql-bindings/src/lib.rs'
- 'packages/eql/crates/eql-bindings/src/sql.rs'
- 'packages/eql/crates/eql-bindings/src/from_v2/**'
- 'packages/eql/crates/eql-bindings/src/v3/**'
- 'packages/eql/crates/eql-bindings/sql/**'
- 'packages/eql/Cargo.toml'
# The SQL this suite installs. `stash eql install` and the Prisma
# Next baseline migration read the bundle from `@cipherstash/eql`, a
# workspace package, so an EQL release bump edits only this directory.
- 'packages/eql/packages/eql/**'
pull_request:
branches: ['**']
paths:
Expand Down Expand Up @@ -163,12 +177,26 @@ on:
# EQL wire types are linked into the `index.node` this job encrypts
# through. The native cache key in `.github/actions/build-ffi-binding`
# hashes both, so an edit here misses that cache and the binding gets
# rebuilt — correctly. Without these two entries the miss never happens,
# rebuilt — correctly. Without these entries the miss never happens,
# because the workflow does not trigger at all: a payload-encoding change
# under packages/eql/crates merges with this suite green by absence.
# Pinned by scripts/__tests__/wasm-build-inputs-paths-filter.test.mjs.
- 'packages/eql/crates/**'
# Only the eql-bindings files cargo compiles into the binding, as
# the cache key lists them: not its tests, docs or generated
# bindings, not the `v4` / `encryption` modules behind a feature
# protect-ffi never enables, and not the other EQL crates.
# ffi-binding-action.test.mjs derives the list from the manifests.
- 'packages/eql/crates/eql-bindings/Cargo.toml'
- 'packages/eql/crates/eql-bindings/src/lib.rs'
- 'packages/eql/crates/eql-bindings/src/sql.rs'
- 'packages/eql/crates/eql-bindings/src/from_v2/**'
- 'packages/eql/crates/eql-bindings/src/v3/**'
- 'packages/eql/crates/eql-bindings/sql/**'
- 'packages/eql/Cargo.toml'
# The SQL this suite installs. `stash eql install` and the Prisma
# Next baseline migration read the bundle from `@cipherstash/eql`, a
# workspace package, so an EQL release bump edits only this directory.
- 'packages/eql/packages/eql/**'

jobs:
integration:
Expand Down
36 changes: 32 additions & 4 deletions .github/workflows/prisma-example-readme-e2e.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,12 +39,26 @@ on:
# EQL wire types are linked into the `index.node` this job encrypts
# through. The native cache key in `.github/actions/build-ffi-binding`
# hashes both, so an edit here misses that cache and the binding gets
# rebuilt — correctly. Without these two entries the miss never happens,
# rebuilt — correctly. Without these entries the miss never happens,
# because the workflow does not trigger at all: a payload-encoding change
# under packages/eql/crates merges with this walkthrough green by absence.
# Pinned by scripts/__tests__/wasm-build-inputs-paths-filter.test.mjs.
- 'packages/eql/crates/**'
# Only the eql-bindings files cargo compiles into the binding, as
# the cache key lists them: not its tests, docs or generated
# bindings, not the `v4` / `encryption` modules behind a feature
# protect-ffi never enables, and not the other EQL crates.
# ffi-binding-action.test.mjs derives the list from the manifests.
- 'packages/eql/crates/eql-bindings/Cargo.toml'
- 'packages/eql/crates/eql-bindings/src/lib.rs'
- 'packages/eql/crates/eql-bindings/src/sql.rs'
- 'packages/eql/crates/eql-bindings/src/from_v2/**'
- 'packages/eql/crates/eql-bindings/src/v3/**'
- 'packages/eql/crates/eql-bindings/sql/**'
- 'packages/eql/Cargo.toml'
# The SQL this suite installs. `stash eql install` and the Prisma
# Next baseline migration read the bundle from `@cipherstash/eql`, a
# workspace package, so an EQL release bump edits only this directory.
- 'packages/eql/packages/eql/**'
pull_request:
branches:
- '**'
Expand Down Expand Up @@ -72,12 +86,26 @@ on:
# EQL wire types are linked into the `index.node` this job encrypts
# through. The native cache key in `.github/actions/build-ffi-binding`
# hashes both, so an edit here misses that cache and the binding gets
# rebuilt — correctly. Without these two entries the miss never happens,
# rebuilt — correctly. Without these entries the miss never happens,
# because the workflow does not trigger at all: a payload-encoding change
# under packages/eql/crates merges with this walkthrough green by absence.
# Pinned by scripts/__tests__/wasm-build-inputs-paths-filter.test.mjs.
- 'packages/eql/crates/**'
# Only the eql-bindings files cargo compiles into the binding, as
# the cache key lists them: not its tests, docs or generated
# bindings, not the `v4` / `encryption` modules behind a feature
# protect-ffi never enables, and not the other EQL crates.
# ffi-binding-action.test.mjs derives the list from the manifests.
- 'packages/eql/crates/eql-bindings/Cargo.toml'
- 'packages/eql/crates/eql-bindings/src/lib.rs'
- 'packages/eql/crates/eql-bindings/src/sql.rs'
- 'packages/eql/crates/eql-bindings/src/from_v2/**'
- 'packages/eql/crates/eql-bindings/src/v3/**'
- 'packages/eql/crates/eql-bindings/sql/**'
- 'packages/eql/Cargo.toml'
# The SQL this suite installs. `stash eql install` and the Prisma
# Next baseline migration read the bundle from `@cipherstash/eql`, a
# workspace package, so an EQL release bump edits only this directory.
- 'packages/eql/packages/eql/**'

jobs:
walkthrough:
Expand Down
Loading
Loading