ci: open a PR when a new EQL patch release lands - #76
Open
coderdan wants to merge 1 commit into
Open
Conversation
Copy link
Copy Markdown
Contributor
Sorry, something went wrong.
Adds a daily workflow that checks whether the pinned EQL release has a newer patch in the same minor and, if so, applies the bump, runs the drift check against the new manifest, and opens a PR whose body says whether the bump is clean or which symbols no longer resolve. The pin is not auto-followed. The drift check fails the build on any schema-qualified symbol the pinned manifest does not ship, so a floating pin would redden an unrelated PR with no commit of its author's to explain it. This removes the need to remember, not the review. Lives on `main` because GitHub only runs scheduled workflows from the default branch, but checks out and targets `v2`, where the docs actually live. Both are set via DOCS_BRANCH at the top of the file; change it if that flips. Requires scripts/check-eql-pin.ts on v2 (#75), since the workflow runs it from the v2 checkout — merge that one first. Claude-Session: https://claude.ai/code/session_01NkuQNMvw9BpB4BWWeKtfV8
Copy link
Copy Markdown
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Sorry, something went wrong.
This was referenced Jul 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The scheduled half of #75. Daily, it checks whether the pinned EQL release has a newer patch in the same minor and, if so: applies the bump, runs the drift check against the new manifest, and opens a PR whose body states whether the bump is clean or which symbols no longer resolve.
So a new EQL release shows up as a PR you review, rather than something to remember. See #75 for why it proposes rather than follows the pin, and for the 3.0.0 → 3.0.1 evidence that patch releases still carry breaking API changes.
Why this one targets main
GitHub only runs scheduled workflows from the default branch, so the file has to be on main even though the docs live on v2. It therefore checks out v2, bumps there, and opens its PR into v2. Both are driven by DOCS_BRANCH at the top of the file — one line to change if that ever flips.
Worth flagging while you are here: main is 98 commits behind v2 and its package.json still has the old three-step prebuild. If v2 is the line that matters now, making it the default branch would remove this split entirely.
Behaviour
Verified
The workflow itself cannot run until #75 merges, so what I checked here: YAML parses and resolves to 7 steps; the PR-body step's script passes bash -n; the heredoc terminator lands at column 0 after YAML block-scalar dedent (a real trap — an indented terminator would have failed at runtime); and the body was rendered end-to-end with representative values, including the failing-drift and newer-minor branches.
bun.lock and tsx are both present on v2, so bun install --frozen-lockfile and bun run check-eql-pin resolve there.
Important
Merge #75 first — this runs scripts/check-eql-pin.ts from the v2 checkout.
https://claude.ai/code/session_01NkuQNMvw9BpB4BWWeKtfV8