ci(dependabot): keep the EQL entry out of the root workspace's manifests

[tobyhede]

Summary

Last month's Dependabot PR for the EQL workspace (#1205) broke CI for the whole repository. EQL is the SQL library this repo installs into customers' Postgres databases; it has its own Cargo workspace under packages/eql. To bump two crates there, Dependabot rewrote the root workspace's Cargo.toml, but didn't update the root Cargo.lock or the Go guest that pins the same crate. Every root --locked build and the Go guest job then failed.

This PR stops the EQL Dependabot entry from ever editing a manifest, makes it ignore the crates the root workspace moves by hand, and adds a test so the two Dependabot entries can't drift apart again.

Changes

• .github/dependabot.yml, the /packages/eql cargo entry:

  • versioning-strategy: lockfile-only: the entry can no longer edit any Cargo.toml, the root one included. An update that would need a manifest change is dropped rather than proposed.
  • New ignores: recipher, cllw-ore, zerokms-protocol and vitaminc*. These are the root entry's hand-moved crates that the EQL lockfile also resolves. cts-common was already ignored.
  • The comments explain why: tests/encryption depends by path on stack-kms and stack-encrypt, and eql-bindings on stack-encrypt. Those crates declare these dependencies { workspace = true }, so the requirements come from the root Cargo.toml. I also fixed the stale "five members" count in the entry's header, which is six now, tests/encryption included.

• New scripts/__tests__/dependabot-eql-inherited-ignores.test.mjs, which fails when:

  • the EQL entry stops being lockfile-only;
  • the root cargo entry ignores a crate the EQL entry doesn't, unless an exemption with a reason covers it;
  • an exemption is stale;
  • the EQL workspace no longer depends by path on any root-workspace crate, so the file has to be retired rather than passing with nothing to check.

  It reads the path dependencies from the tracked EQL manifests, so a new one is covered automatically.

Verification

• The new test failed on main, listing the four missing crates. With the change, 5 of 5 pass.
• Each check fails when its condition is broken:
  • removing versioning-strategy fails the lockfile-only test;
  • removing the cllw-ore ignore fails the comparison, naming cllw-ore;
  • adding a fake exemption fails the stale-exemption test.
• pnpm exec vitest run --config scripts/vitest.config.mjs: 76 files, 1357 tests pass.
• e2e/tests/supply-chain.e2e.test.ts, which also reads dependabot.yml: 29 of 29 pass.
• pnpm run code:check: 0 errors.
• Not verifiable before merge: how Dependabot behaves under lockfile-only. The next monthly EQL run will show it.

Related

• Closes Dependabot EQL PRs edit the root workspace's exact pins and break CI — ignore recipher, cllw-ore and vitaminc on the /packages/eql entry #1207.
• Fixes the cause of chore(deps): bump the cargo-minor-patch group across 1 directory with 11 updates #1205, which was closed unmerged.

Review notes

• I added lockfile-only beyond what Dependabot EQL PRs edit the root workspace's exact pins and break CI — ignore recipher, cllw-ore and vitaminc on the /packages/eql entry #1207 asked for, following review. The ignores alone covered only the root entry's named crates. Any other inherited root requirement would still have been raised in the root manifest, and lockfile-only closes that too.
• The comparison matches dependency-name patterns as exact strings, for example vitaminc* against vitaminc*. This is deliberate: it asks for the same entry in both lists rather than reasoning about glob coverage.
• No changeset: CI configuration and a repo-tooling test only.

Summary by CodeRabbit

• Chores
  • Restricted EQL dependency updates to lockfile-only changes.
  • Expanded the workspace description and adjusted ignored dependencies.
• Tests
  • Added checks to verify EQL dependency update settings and consistency between ignored dependencies and workspace path dependencies.

[changeset-bot]

⚠️ No Changeset found

Latest commit: b1ab8c8

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 6aa12a14-f3be-4443-b4d1-9055b0fcec5f

📥 Commits

Reviewing files that changed from the base of the PR and between 4e2c723 and b1ab8c8.

📒 Files selected for processing: 2

• .github/dependabot.yml
• scripts/__tests__/dependabot-eql-inherited-ignores.test.mjs

Included review availability: This review used your included allowance. 3 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

📝 Walkthrough

The EQL Dependabot entry now uses lockfile-only updates and ignores additional dependencies. A new script test checks the entry’s settings and compares its unconditional ignores with those in the root Cargo entry.

Changes: EQL Dependabot policy

Layer / File(s)	Summary
EQL Dependabot settings .github/dependabot.yml	The EQL workspace description adds tests/encryption. The EQL Cargo entry uses lockfile-only and adds ignores for recipher, cllw-ore, zerokms-protocol, and vitaminc*.
Ignore-list drift test scripts/__tests__/dependabot-eql-inherited-ignores.test.mjs	The test discovers EQL path dependencies into root workspace members. It checks the EQL update strategy, ignore coverage against the root entry, and whether exemptions remain valid.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix · Severity of issue fixed: Medium

Suggested reviewers: auxesis

Merge Risk: ⚪ Minimal · up to b1ab8

No actionable issue was established in the Dependabot settings or drift test. The change is mergeable after normal checks.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Linked Issues check		The PR implements the required ignores for #1207, sets the EQL entry to lockfile-only, documents the path-dependency reason, and adds checks for missing and stale exemptions. However, EXEMPT is ac…	Update scripts/__tests__/dependabot-eql-inherited-ignores.test.mjs to assert that every EXEMPT value is a non-empty written reason before the exemption can satisfy the missing-ignore check. Add a test case or assertion that rejects an e…

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the main change: configuring the EQL Dependabot entry so it does not modify root workspace manifests.
Out of Scope Changes check		The changed Dependabot comment, lockfile-only setting, inherited-crate ignores, member-count correction, and drift test all support #1207's Dependabot and repository-test objectives. No unrelated ch…
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 1 files. (1 skipped: 1 …

Full details: Linked Issues check

Explanation

The PR implements the required ignores for #1207, sets the EQL entry to lockfile-only, documents the path-dependency reason, and adds checks for missing and stale exemptions. However, EXEMPT is accepted by EXEMPT.has(name) only. The test never checks the map value. An exemption with an empty or whitespace-only reason can therefore bypass the required written-reason condition. The reported tests do not cover this case.

Resolution

Update scripts/__tests__/dependabot-eql-inherited-ignores.test.mjs to assert that every EXEMPT value is a non-empty written reason before the exemption can satisfy the missing-ignore check. Add a test case or assertion that rejects an empty reason.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-14T07:17:00.557937Z	b1ab8c8	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[cipherstash-agent]

Review attestation: automated /code-review medium + /cross-check-review-findings on b1ab8c8.

Result: no critical or blocking findings.

Checked by reading the diff against the repo (the new test was not run, see the last bullet):

• Ignore list matches the root entry. The root cargo entry (.github/dependabot.yml:236-276) ignores cts-common, zerokms-protocol, recipher, cllw-ore and vitaminc*. The EQL entry already ignored cts-common; this PR adds the other four, so the two lists now agree.
• Manifest edits are blocked. versioning-strategy: lockfile-only is a valid option for the cargo ecosystem and stops the EQL entry from editing the root Cargo.toml, which caused the #1205 and #1207 breakage.
• The test's inputs resolve.
  • js-yaml is a root devDependency, and scripts/__tests__/lib/repo-root.mjs exists.
  • The members regex matches the root Cargo.toml layout.
  • The path-dependency scan finds stack-encrypt and stack-kms from tests/encryption and eql-bindings. The vacuity guard is therefore not trivially green.
  • Ignore rules that carry update-types (the semver-major rule) are correctly not counted as ignores.
• No changeset needed. The change is CI and tooling only, with no published package or skills/ impact. AGENTS.md already lists tests/encryption as an EQL workspace member, so there is no meta-file drift.
• Not verified here. node_modules is not installed in this run, so the new test was not executed. Please rely on CI for that.

Nit, non-blocking: the rewritten comment line at .github/dependabot.yml:142-143 (tests/encryption) and its own Cargo.lock. It needs its own entry because Dependabot's cargo) runs well past the wrapping of the lines around it.

---

Generated by Claude Code

[freshtonic]

Review of b1ab8c8. No blocking defects.

Checks. All checks pass. I ran the tests again in a worktree at this head:

• scripts/vitest.config.mjs: 76 files, 1357 tests pass. The new file gives 5 of 5.
• e2e/tests/supply-chain.e2e.test.ts: 29 of 29 pass.
• The other repo tests that read .github/dependabot.yml (scripts/__tests__/impact-workflow.test.mjs, scripts/__tests__/musl-build-image.test.mjs) also pass.

Correctness:

• Rationale. The rationale is correct. #1205 changed only the root Cargo.toml (+2 -2) and packages/eql/Cargo.lock.
• lockfile-only is valid for cargo. The GitHub Dependabot options reference lists cargo as an ecosystem that supports versioning-strategy.
• Directories and ecosystems do not change. No manifest loses its entry.
• The new ignores have an effect. packages/eql/Cargo.lock resolves recipher 0.3.1, cllw-ore 0.5.0, zerokms-protocol and vitaminc 0.5.1 through stack-encrypt and stack-kms, so each new ignore stops a real update.

Suggested follow-up PR:

1. Write the security-update effect in the comment. The options reference marks versioning-strategy as an option for both version updates and security updates. Thus, after this PR, the EQL entry also drops a security fix that needs a manifest edit. The new comment at .github/dependabot.yml:153-158 does not say this. The earlier text at :163-165 ("Security fixes are unaffected") can now cause confusion. Give the same caveat that the ignore block gives at :193-195, and refer to osv-scanner.
2. prettyplease loses its Dependabot updates. packages/eql/crates/eql-codegen/Cargo.toml:16 pins prettyplease = "=0.2.37". With lockfile-only, Dependabot cannot propose any change to it. If the pin is intentional (stable codegen output), write that in the manifest. If not, change it to a caret requirement.
3. The protect-ffi entry has the same risk, one level down. languages/typescript/packages/protect-ffi/crates/protect-ffi/Cargo.toml:37 depends by path on eql-bindings, which is in the EQL workspace. The protect-ffi cargo entry (.github/dependabot.yml:62-137) does not use lockfile-only. Thus a protect-ffi Dependabot PR can edit packages/eql/crates/eql-bindings/Cargo.toml without a change to packages/eql/Cargo.lock. The risk is small today, because eql-bindings uses plain caret requirements and protect-ffi does not enable the stack-encrypt feature. But the new test examines only the EQL-to-root edge. Think about making the test general: every cargo entry with a path dependency outside its own workspace must be lockfile-only.

The EXEMPT reason check (CodeRabbit) and the line-wrap nit at :142-143 (earlier review) are still open. I do not repeat them.