[auxesis]

Summary

Test EQL tests EQL, the SQL that stores and queries encrypted values in Postgres. It used one list of paths to decide whether to run its heavy jobs. That list included the stack-* Rust crates. So a pull request that changed only stack-encrypt ran the whole Postgres test suite on 16-vCPU machines. From 30 September to 20 October 2026, 42 pull requests did that.

After this change, such a pull request runs only the job that compiles those crates.

This pull request is stacked on #1416. Merge that one first.

Changes

• Selector job: the first job in test-eql.yml, changes, is now selector. It runs on a GitHub-hosted runner, because every gated job waits for it.
• Two path filters: nine jobs read eql. The "Rust workspace crates" job reads rust_crates. That filter adds the stack-* crates and the root Cargo.toml.
• Failing when it cannot decide: on a pull request, the selector fails when a filter gives no answer. Before, every gated job was skipped, and ci-required counts skipped as passed.
• New test: scripts/__tests__/eql-selector.test.mjs runs the selector's own script for a simulated pull request. Then it evaluates each job's real if: against the outputs.
• Changed tests: five test files follow the new job and filter names. The shared glob matcher moved to scripts/__tests__/lib/paths-filter.mjs as pathsGlobToRegExp.

Only "Rust workspace crates" compiles the stack-* crates. It does so through the stack-encrypt feature of eql-bindings. I checked every cargo command in packages/eql/mise.toml and its task scripts. The SQLx suite and the codegen crates never enable that feature.

Verification

• pnpm run test:scripts: 81 files, 1,428 tests passed, 3 skipped.
• actionlint 1.7.12 with shellcheck 0.11.0 on test-eql.yml: no findings.
• The README of the pinned dorny/paths-filter version documents the *alias form that rust_crates uses.
• Not yet verified: a run on GitHub. This pull request changes test-eql.yml, so Test EQL runs every gated job here.

Related

• Stacked on docs(ci): record the decisions that bring CI spending under budget #1416. That pull request adds ADR 0003, and the workflow comments refer to it.
• No GitHub issue.

Review notes

• Look first at the selector job and at the if: of the rust-crates job.
• Merge queue runs still select every job. Comparing a queue commit with the entry ahead of it comes with the merge queue change.
• ci-required and the setup job stay on Blacksmith. Light jobs move together in a later change.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 02ff027

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}