Eql v3

.github/workflows/bench-eql.yml

@@ -15,6 +15,9 @@ on:
       - "src/**/*.sql"
       - "tests/sqlx/**/*"
       - "tasks/**/*"
+      - "crates/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
 
   schedule:
     # 02:00 UTC daily
@@ -50,7 +53,7 @@ jobs:
 
       - uses: Swatinem/rust-cache@v2
         with:
-          workspaces: tests/sqlx
+          workspaces: .
           shared-key: sqlx-tests
 
       - name: Setup database

.github/workflows/macro-expand-eql.yml

@@ -0,0 +1,82 @@
+name: "Macro expand EQL"
+
+# Regenerates the int4 matrix `cargo expand` snapshot and fails if it has
+# drifted from the committed copy. This is a body-level fidelity backstop for
+# the `ordered_numeric_matrix!` / `scalar_domain_matrix!` macros — the
+# name-inventory snapshot (test-eql.yml `matrix-coverage` job) catches
+# add/remove of whole arms; this catches changes *inside* the generated bodies.
+#
+# Non-blocking by design: it is NOT a required PR check. `cargo expand` needs a
+# nightly toolchain, so it is isolated off the PR path.
+#   - nightly schedule (the backstop that flags a forgotten local regen)
+#   - manual workflow_dispatch
+#
+# GAP (intended): there is no `pull_request` trigger, so a change that only
+# touches macro *bodies* (no arm add/remove) can merge without ever running
+# here and will first surface as a red nightly run afterwards. Accept this — the
+# expand lane needs nightly and stays off the PR critical path by design.
+#
+# The pinned nightly date lives in ONE place: the `cargo +nightly-...` invocation
+# in the `test:matrix:expand` mise task. The install step below DERIVES the date
+# from mise.toml (grep), so there is nothing to keep in lockstep — bump it once in
+# mise.toml. The snapshot then only moves when the macro moves, not when nightly
+# reformats its expansion.
+on:
+  schedule:
+    # 03:00 UTC daily
+    - cron: "0 3 * * *"
+
+  workflow_dispatch:
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+  MISE_VERBOSE: "1"
+
+defaults:
+  run:
+    shell: bash -l {0}
+
+permissions:
+  contents: read
+
+jobs:
+  macro-expand:
+    name: "Macro expand drift (nightly)"
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
+        with:
+          version: 2026.4.0
+          install: true
+          cache: true
+
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+        with:
+          workspaces: tests/sqlx
+          shared-key: sqlx-tests
+
+      # Derive the pinned nightly date from mise.toml (single source of truth —
+      # the `cargo +nightly-...` invocation in the `test:matrix:expand` task) so
+      # there is nothing to bump in lockstep here. cargo-expand is likewise pinned
+      # once in mise.toml's [tools] (`cargo:cargo-expand`) and installed by the
+      # mise-action step above, so its version is single-sourced too — no
+      # hardcoded version lives in this workflow. It drives the rustfmt pass, so
+      # an unpinned version could drift the snapshot even with a frozen macro +
+      # nightly. The snapshot then only moves when the macro moves.
+      - name: Install pinned nightly toolchain
+        run: |
+          NIGHTLY=$(grep -oE 'nightly-[0-9]{4}-[0-9]{2}-[0-9]{2}' mise.toml | head -1)
+          test -n "$NIGHTLY" || { echo "could not find pinned nightly in mise.toml"; exit 1; }
+          rustup toolchain install "$NIGHTLY" --profile minimal --component rustfmt
+
+      - name: Regenerate and verify the matrix expansion snapshot
+        run: |
+          mise run test:matrix:expand
+          git diff --exit-code -- tests/sqlx/snapshots/int4_expanded.rs \
+            || { echo "Expansion snapshot stale — run 'mise run test:matrix:expand' (needs the pinned nightly) and commit."; exit 1; }

.github/workflows/test-eql.yml

@@ -9,6 +9,9 @@ on:
       - "sql/**/*.sql"
       - "tests/**/*"
       - "tasks/**/*"
+      - "crates/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
 
   pull_request:
     # run on all pull requests
@@ -18,6 +21,9 @@ on:
       - "sql/**/*.sql"
       - "tests/**/*"
       - "tasks/**/*"
+      - "crates/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
 
   workflow_dispatch:
 
@@ -29,33 +35,167 @@ defaults:
   run:
     shell: bash -l {0}
 
+permissions:
+  contents: read
+
 jobs:
   schema:
     name: "JSON Schema validation"
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
-      - uses: jdx/mise-action@v4
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
         with:
           version: 2026.4.0
           install: true
           cache: true
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
-          workspaces: tests/sqlx
+          workspaces: .
           shared-key: sqlx-tests
 
       - name: Validate v2.2 / v2.3 payload schemas
         run: |
           mise run test:schema
 
+  rust-crates:
+    name: "Rust workspace crates"
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
+        with:
+          version: 2026.4.0
+          install: true
+          cache: true
+
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+        with:
+          workspaces: .
+          shared-key: sqlx-tests
+
+      # fmt + clippy + test for the std-only catalog/generator crates. No
+      # Postgres: these never touch a database, so they run standalone and fast.
+      - name: Compile, lint and test the Rust workspace crates
+        run: |
+          export active_rust_toolchain=$(rustup show active-toolchain | cut -d' ' -f1)
+          rustup component add --toolchain ${active_rust_toolchain} rustfmt clippy
+          mise run test:crates
+
+  codegen:
+    name: "Encrypted-domain codegen"
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
+        with:
+          version: 2026.4.0
+          install: true
+          cache: true
+
+      # Shared with the sibling Rust jobs so the eql-codegen build artifacts the
+      # parity gate needs are reused rather than rebuilt from scratch.
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+        with:
+          workspaces: .
+          shared-key: sqlx-tests
+
+      # Crate compile/lint/test (cargo test -p eql-scalars -p eql-codegen) runs
+      # in the dedicated `test:crates` job; this job covers the codegen-specific
+      # gate only — golden parity. The plaintext fixture lists are no longer a
+      # generated file: they live in the catalog (`eql_scalars::INT4_VALUES` /
+      # `INT2_VALUES`) and are pinned by `eql-scalars`'s own unit tests, so there
+      # is nothing to regenerate-and-diff here.
+
+      # Parity gate: assert the Rust eql-codegen output is line-normalized-equal
+      # to the int4 golden reference. Python is no longer an oracle (retired in
+      # P2). No Postgres needed — the generator runs offline.
+      - name: Verify generator parity (golden)
+        run: |
+          mise run codegen:parity
+
+  self-contained-v3:
+    name: "eql_v3 self-containment"
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
+        with:
+          version: 2026.4.0
+          install: true
+          cache: true
+
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+        with:
+          workspaces: .
+          shared-key: sqlx-tests
+
+      # Build to materialise release/cipherstash-encrypt-v3.sql and
+      # src/deps-ordered-v3.txt, then assert no eql_v2 symbol/file leakage.
+      - name: Build EQL
+        run: mise run --force build
+
+      - name: Assert eql_v3 is self-contained
+        run: mise run test:self_contained_v3
+
+  matrix-coverage:
+    name: "Matrix coverage inventory"
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
+        with:
+          version: 2026.4.0
+          install: true
+          cache: true
+
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+        with:
+          workspaces: .
+          shared-key: sqlx-tests
+
+      # Verify the matrix test-name set against the SINGLE canonical snapshot
+      # (snapshots/matrix_tests.txt) with the SAME pinned feature set the local
+      # task uses (`--no-default-features`, scale excluded), and cross-check the
+      # binary's discovered type set against `eql-codegen list-types`. A coverage
+      # change shows up as a diff in the snapshot; a catalog type missing its
+      # matrix wiring fails the cross-check. No Postgres needed: `--list` only
+      # enumerates, the suite uses runtime queries.
+      - name: Verify the matrix test-name inventory
+        run: |
+          mise run test:matrix:inventory
+          # Diff the whole snapshots/ directory so the single canonical file
+          # isn't hardcoded here; the mise task discovers the type set from the
+          # binary and reconciles it against `eql-codegen list-types`.
+          git add -N tests/sqlx/snapshots
+          git diff --exit-code -- tests/sqlx/snapshots \
+            || { echo "Coverage inventory stale — run 'mise run test:matrix:inventory' and commit."; exit 1; }
+
   test:
     name: "Test & Validate EQL (Postgres ${{ matrix.postgres-version }})"
     runs-on: ubuntu-latest-m
-    needs: schema
+    needs: [schema, codegen]
 
     strategy:
       fail-fast: false
@@ -64,19 +204,30 @@ jobs:
 
     env:
       POSTGRES_VERSION: ${{ matrix.postgres-version }}
+      # CS_* are required for `mise run test:sqlx` to regenerate the
+      # cipherstash-client-encrypted fixtures before the suite runs.
+      # This repository does not accept fork PRs, so the secrets-on-
+      # `pull_request` constraint that breaks the fork CI flow does not
+      # apply here — leave the env block unconditional.
+      CS_CLIENT_ACCESS_KEY: ${{ secrets.CS_CLIENT_ACCESS_KEY }}
+      CS_WORKSPACE_CRN: ${{ secrets.CS_WORKSPACE_CRN }}
+      CS_CLIENT_ID: ${{ secrets.CS_CLIENT_ID }}
+      CS_CLIENT_KEY: ${{ secrets.CS_CLIENT_KEY }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
-      - uses: jdx/mise-action@v4
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
         with:
           version: 2026.4.0
           install: true # [default: true] run `mise install`
           cache: true # [default: true] cache mise using GitHub's cache
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
-          workspaces: tests/sqlx
+          workspaces: .
           shared-key: sqlx-tests
 
       - name: Setup database (Postgres ${{ matrix.postgres-version }})
@@ -93,6 +244,11 @@ jobs:
           rustup component add --toolchain ${active_rust_toolchain} rustfmt clippy
           mise run --output prefix test --postgres ${POSTGRES_VERSION}
 
+      - name: Clean-DB v3 install smoke (Postgres ${{ matrix.postgres-version }})
+        run: |
+          mise run build
+          mise run test:clean_install_v3
+
   splinter:
     name: "Supabase splinter"
     runs-on: ubuntu-latest-m
@@ -101,9 +257,11 @@ jobs:
       POSTGRES_VERSION: "17"
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
-      - uses: jdx/mise-action@v4
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
         with:
           version: 2026.4.0
           install: true
@@ -126,4 +284,3 @@ jobs:
           mise run --output prefix test:splinter --postgres ${POSTGRES_VERSION}
 
 
-