eql-3.0.4's eql-docs-eql-3.0.4.zip contains a manifest stamped with the placeholder version:
$ gh release download eql-3.0.4 -p 'eql-docs-*.zip' && unzip -o eql-docs-eql-3.0.4.zip
$ jq -r .version json/eql-manifest.json
DEV
eql-3.0.3 was stamped correctly (3.0.3), so this is a regression in the release path rather than a long-standing default.
Cause
tasks/docs/generate/json.sh treats a missing or empty version argument as DEV:
VERSION=${ARGC_VERSION:-DEV}_build-docs.yml passes the tag straight through:
env:
TAG: ${{ inputs.tag }}
run: |
mise run docs:generate:json -- "${TAG}"inputs.tag is declared optional ("Full release tag. Empty -> build only, no attach.", default ""). When it arrives empty, -- "" sets ARGC_VERSION to the empty string, :- substitutes, and the manifest is stamped DEV — silently, with a zero exit. The docs zip still gets attached, so nothing downstream notices.
Worth confirming which of the two _build-docs.yml call sites in release.yml (the production path at ~L195 and the prerelease path at ~L251) passed an empty tag for 3.0.4, since 3.0.3 came through fine.
Why it matters
The manifest is a published release asset and its version is what consumers display. In the docs site it feeds the EQL_VERSION constant behind the version banner on every EQL reference page, so an unversioned manifest reads as "EQL DEV" to readers.
The docs site is not affected in practice — it stamps the pinned tag over the manifest's field, and cipherstash/docs#74 extends that to warn on any disagreement rather than only on DEV. But that is a consumer working around a bad asset, and any other consumer reading the field gets DEV with no indication anything is wrong.
Suggested fix
Fail rather than default, at least when a tag was supplied to the release path:
VERSION=${ARGC_VERSION:?refusing to stamp a manifest without a version}DEV is a reasonable default for a local mise run docs:generate:json with no argument, so the guard probably belongs in _build-docs.yml — assert TAG is non-empty before the generate steps whenever the caller intends to attach — or in docs:package, which could refuse to package a manifest whose version is DEV while being handed a real tag. The latter is a single check that closes the hole regardless of how the version went missing.
Found while pinning the docs site to 3.0.4 (cipherstash/docs#74) to pick up the manifest fixes from #427.
eql-3.0.4'seql-docs-eql-3.0.4.zipcontains a manifest stamped with the placeholder version:eql-3.0.3was stamped correctly (3.0.3), so this is a regression in the release path rather than a long-standing default.Cause
tasks/docs/generate/json.shtreats a missing or empty version argument asDEV:VERSION=${ARGC_VERSION:-DEV}_build-docs.ymlpasses the tag straight through:inputs.tagis declared optional ("Full release tag. Empty -> build only, no attach.", default""). When it arrives empty,-- ""setsARGC_VERSIONto the empty string,:-substitutes, and the manifest is stampedDEV— silently, with a zero exit. The docs zip still gets attached, so nothing downstream notices.Worth confirming which of the two
_build-docs.ymlcall sites inrelease.yml(the production path at ~L195 and the prerelease path at ~L251) passed an empty tag for 3.0.4, since 3.0.3 came through fine.Why it matters
The manifest is a published release asset and its
versionis what consumers display. In the docs site it feeds theEQL_VERSIONconstant behind the version banner on every EQL reference page, so an unversioned manifest reads as "EQL DEV" to readers.The docs site is not affected in practice — it stamps the pinned tag over the manifest's field, and cipherstash/docs#74 extends that to warn on any disagreement rather than only on
DEV. But that is a consumer working around a bad asset, and any other consumer reading the field getsDEVwith no indication anything is wrong.Suggested fix
Fail rather than default, at least when a tag was supplied to the release path:
VERSION=${ARGC_VERSION:?refusing to stamp a manifest without a version}DEVis a reasonable default for a localmise run docs:generate:jsonwith no argument, so the guard probably belongs in_build-docs.yml— assertTAGis non-empty before the generate steps whenever the caller intends to attach — or indocs:package, which could refuse to package a manifest whoseversionisDEVwhile being handed a real tag. The latter is a single check that closes the hole regardless of how the version went missing.Found while pinning the docs site to 3.0.4 (cipherstash/docs#74) to pick up the manifest fixes from #427.