Dependabot EQL PRs edit the root workspace's exact pins and break CI — ignore recipher, cllw-ore and vitaminc on the /packages/eql entry #1207

Background

This repository has several separate Cargo workspaces, and .github/dependabot.yml has one cargo entry per workspace root. Two matter here:

• The root workspace: the stack-* crates, plus the Go WASI guests and fuzz crates, which are listed as separate directories on the same entry.
• The EQL workspace (/packages/eql): EQL is the SQL library this repo installs into customers' Postgres databases.

The root workspace pins recipher and cllw-ore exactly (= requirements) in its [workspace.dependencies]. The Go guest pins recipher exactly as well. These crates come from cipherstash-suite and move together, by hand. So the root Dependabot entry ignores recipher, cllw-ore, vitaminc*, cts-common and zerokms-protocol.

Problem

The EQL workspace isn't independent of the root one:

• packages/eql/tests/encryption depends by path on the in-tree stack-kms and stack-encrypt crates;
• eql-bindings depends by path on stack-encrypt.

Those crates declare recipher, cllw-ore and vitaminc-* as { workspace = true }, so their requirements come from the root Cargo.toml, even when built inside the EQL workspace.

The /packages/eql Dependabot entry groups every crate (patterns: ["*"]) and doesn't ignore any of these. So its monthly PR:

1. bumps recipher and cllw-ore in the EQL Cargo.lock;
2. to satisfy the exact pins, edits the root Cargo.toml, which is outside the workspace it is updating;
3. updates neither the root Cargo.lock nor the Go guest's own recipher pin.

That happened in #1205 (recipher =0.3.1 → =0.3.2, cllw-ore =0.5.0 → =0.5.1):

• Root workspace jobs (fmt, clippy, nextest, doctests, rustdoc) fail with cannot update the lock file …/Cargo.lock because --locked was passed.
• The Go job (WASI check, guests and Go (Linux)) fails with failed to select a version for recipher … previously selected package recipher v0.3.1 … of package stack-encrypt-guest.

It will happen again every month until the EQL entry ignores the same crates.

vitaminc* has the same exposure. eql-bindings must build on the same vitaminc line as stack-encrypt and the Go guest, and the root entry ignores vitaminc* because the guests' FfiValue: Decrypt bound fails when two versions resolve. If an EQL-only bump moves vitaminc in the EQL lock, the two workspaces disagree.

Nothing catches this today. The two ignore lists are hand-written copies with no check that they agree, and the failure only shows up after Dependabot opens the PR.

What to build

The /packages/eql Dependabot entry must never propose a change to a crate the root workspace moves by hand while the EQL workspace inherits it, and a repository test must fail if the two ignore lists drift apart.

1. Add the ignores. Add recipher, cllw-ore and vitaminc* to the ignore list of the /packages/eql cargo entry in .github/dependabot.yml. The comment should say why: the EQL workspace inherits these through its path dependencies on stack-kms and stack-encrypt; the root workspace and the Go guest pin them, and they move by hand with the suite; vitaminc* keeps eql-bindings on the same line as stack-encrypt and the guest. cts-common is already ignored there. Consider zerokms-protocol too, which the root entry ignores, if the EQL workspace resolves it through the same path dependencies.

2. Add a drift test in the repo's scripts/__tests__ suite (vitest, run by pnpm run test:scripts on every PR):

   • every crate the root cargo entry ignores is also ignored by the /packages/eql entry;
   • except for crates the EQL workspace provably doesn't resolve, each listed with a written reason;
   • while the EQL workspace still has path dependencies into root-workspace crates.

   Derive what you can, such as the EQL workspace's path dependencies from its manifests, rather than hard-coding it, so a new path dependency is covered automatically. A stale exemption, one naming a crate no longer in the root ignore list, should fail too.

Acceptance criteria

• The /packages/eql cargo entry in .github/dependabot.yml ignores recipher, cllw-ore and vitaminc* (and zerokms-protocol if the EQL workspace resolves it), with a comment explaining the inheritance through path dependencies.
• A test in scripts/__tests__ fails when the root cargo entry ignores a crate that the /packages/eql entry doesn't, unless an exemption with a reason covers it.
• The test fails on a stale exemption.
• The test was shown to fail by removing one of the new ignores, then passing once it was restored.
• pnpm run test:scripts passes.

Blocked by

None (can start immediately).

Related

• chore(deps): bump the cargo-minor-patch group across 1 directory with 11 updates #1205, the Dependabot PR that broke this way. Close it rather than repair it: moving recipher and cllw-ore is a by-hand change across the root Cargo.toml, the root Cargo.lock and the Go guest pins.