fix: pin EQL install scripts and migrate the bench CI to the postgres-eql image

.github/workflows/tests-bench.yml

@@ -52,8 +52,8 @@ jobs:
       - name: Build @cipherstash/stack
         run: pnpm exec turbo run build --filter @cipherstash/stack
 
-      # Builds the local EQL-enabled Postgres image (local/Dockerfile),
-      # starts it, and waits for the pg_isready healthcheck to pass.
+      # Starts the pinned postgres-eql container (PostgreSQL 17 + EQL
+      # pre-installed) via local/docker-compose.yml; waits for healthcheck.
       - name: Start local Postgres (EQL)
         working-directory: local
         run: docker compose up --wait --wait-timeout 60

local/docker-compose.yml

@@ -1,8 +1,8 @@
 services:
   postgres: &postgres
-    build:
-      context: .
-      dockerfile: Dockerfile
+    # PostgreSQL 17 with CipherStash EQL pre-installed (official image).
+    # Pinned by tag — bump in lockstep with the EQL version the code targets.
+    image: ghcr.io/cipherstash/postgres-eql:17-2.2.1
     environment:
       PGPORT: 5432
       POSTGRES_DB: "cipherstash"

packages/cli/src/installer/index.ts

@@ -2,10 +2,13 @@ import { existsSync, readFileSync } from 'node:fs'
 import { dirname, join, resolve } from 'node:path'
 import pg from 'pg'
 
+// EQL release, pinned to match the EQL payload format this package emits.
+// Bump in lockstep with @cipherstash/protect-ffi.
+const EQL_VERSION = 'eql-2.2.1'
 const EQL_INSTALL_URL =
-  'https://github.com/cipherstash/encrypt-query-language/releases/latest/download/cipherstash-encrypt.sql'
+  `https://github.com/cipherstash/encrypt-query-language/releases/download/${EQL_VERSION}/cipherstash-encrypt.sql`
 const EQL_INSTALL_NO_OPERATOR_FAMILY_URL =
-  'https://github.com/cipherstash/encrypt-query-language/releases/latest/download/cipherstash-encrypt-supabase.sql'
+  `https://github.com/cipherstash/encrypt-query-language/releases/download/${EQL_VERSION}/cipherstash-encrypt-supabase.sql`
 const EQL_SCHEMA_NAME = 'eql_v2'
 
 /**

packages/drizzle/GENERATE_EQL_MIGRATION_CLI.md

@@ -98,7 +98,7 @@ Or use your custom migration workflow.
 ### Before (manual):
 ```bash
 npx drizzle-kit generate --custom --name=install-eql
-curl -sL https://github.com/cipherstash/encrypt-query-language/releases/latest/download/cipherstash-encrypt.sql > drizzle/0001_install-eql.sql
+curl -sL https://github.com/cipherstash/encrypt-query-language/releases/download/eql-2.2.1/cipherstash-encrypt.sql > drizzle/0001_install-eql.sql
 npx drizzle-kit migrate
 ```
 

packages/drizzle/README.md

@@ -64,7 +64,7 @@ If you prefer to install EQL manually:
 
 ```bash
 npx drizzle-kit generate --custom --name=install-eql
-curl -sL https://github.com/cipherstash/encrypt-query-language/releases/latest/download/cipherstash-encrypt.sql > drizzle/0001_install-eql.sql
+curl -sL https://github.com/cipherstash/encrypt-query-language/releases/download/eql-2.2.1/cipherstash-encrypt.sql > drizzle/0001_install-eql.sql
 npx drizzle-kit migrate
 ```
 

packages/drizzle/src/bin/generate-eql-migration.ts

@@ -4,8 +4,11 @@ import { readdir } from 'node:fs/promises'
 import { join, resolve } from 'node:path'
 import { detectRunner } from './runner.js'
 
+// EQL release, pinned to match the EQL payload format this package emits.
+// Bump in lockstep with @cipherstash/protect-ffi.
+const EQL_VERSION = 'eql-2.2.1'
 const EQL_INSTALL_URL =
-  'https://github.com/cipherstash/encrypt-query-language/releases/latest/download/cipherstash-encrypt.sql'
+  `https://github.com/cipherstash/encrypt-query-language/releases/download/${EQL_VERSION}/cipherstash-encrypt.sql`
 
 type CliArgs = {
   migrationName: string

packages/protect/README.md

@@ -814,17 +814,17 @@ CREATE TABLE users (
 
 To enable searchable encryption in PostgreSQL, [install the EQL custom types and functions](https://github.com/cipherstash/encrypt-query-language?tab=readme-ov-file#installation).
 
-1. Download the latest EQL install script:
+1. Download the EQL install script. The version is pinned to match this release of Protect.js — install exactly this version:
 
    ```sh
-   curl -sLo cipherstash-encrypt.sql https://github.com/cipherstash/encrypt-query-language/releases/latest/download/cipherstash-encrypt.sql
+   curl -sLo cipherstash-encrypt.sql https://github.com/cipherstash/encrypt-query-language/releases/download/eql-2.2.1/cipherstash-encrypt.sql
    ```
 
    Using [Supabase](https://supabase.com/)? We ship an EQL release specifically for Supabase.
-   Download the latest EQL install script:
+   Download the matching Supabase EQL install script:
 
    ```sh
-   curl -sLo cipherstash-encrypt-supabase.sql https://github.com/cipherstash/encrypt-query-language/releases/latest/download/cipherstash-encrypt-supabase.sql
+   curl -sLo cipherstash-encrypt-supabase.sql https://github.com/cipherstash/encrypt-query-language/releases/download/eql-2.2.1/cipherstash-encrypt-supabase.sql
    ```
 
 2. Run this command to install the custom types and functions: