ci: register release-alpha coordinator on main (dispatchable)

.github/workflows/_build-docs.yml

@@ -0,0 +1,85 @@
+name: "Build docs (reusable)"
+
+# Reusable docs build+attach, extracted from release-eql.yml's publish-docs job.
+# The target release already exists: _build-sql.yml creates it for alphas, and
+# a human-created release exists for finals.
+
+on:
+  workflow_call:
+    inputs:
+      ref:
+        description: "Git ref/SHA to build docs from. Empty -> default checkout (github.sha)."
+        required: false
+        type: string
+        default: ""
+      tag:
+        description: "Full release tag. Empty -> build only, no attach."
+        required: false
+        type: string
+        default: ""
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+  MISE_VERBOSE: "1"
+
+defaults:
+  run:
+    shell: bash {0}
+
+permissions:
+  contents: write
+
+jobs:
+  publish-docs:
+    runs-on: blacksmith-16vcpu-ubuntu-2204
+    name: Build and Publish Documentation
+    timeout-minutes: 10
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+          ref: ${{ inputs.ref }}
+
+      - uses: jdx/mise-action@v3
+        with:
+          version: 2026.4.0
+          install: true
+          cache: true
+
+      - name: Install Doxygen
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y doxygen
+
+      - name: Generate documentation
+        env:
+          TAG: ${{ inputs.tag }}
+        run: |
+          set -euo pipefail
+          mise run docs:generate
+          mise run docs:generate:markdown -- "${TAG}"
+          mise run docs:generate:json -- "${TAG}"
+
+      - name: Package documentation
+        env:
+          TAG: ${{ inputs.tag }}
+        run: |
+          mise run docs:package "${TAG}"
+
+      - name: Upload documentation artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: eql-docs
+          path: |
+            release/eql-docs-*.zip
+            release/eql-docs-*.tar.gz
+
+      - name: Publish documentation to release
+        if: ${{ inputs.tag != '' }}
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ inputs.tag }}
+          files: |
+            release/eql-docs-*.zip
+            release/eql-docs-*.tar.gz

.github/workflows/_build-sql.yml

@@ -0,0 +1,114 @@
+name: "Build SQL (reusable)"
+
+# Reusable SQL build+attach, extracted from release-eql.yml's build-and-publish
+# job. Called inline by release-alpha.yml and release-eql.yml so SQL releases
+# have one build path.
+
+on:
+  workflow_call:
+    inputs:
+      ref:
+        description: "Git ref/SHA to build from. Empty -> default checkout (github.sha)."
+        required: false
+        type: string
+        default: ""
+      tag:
+        description: "Full release tag (e.g. eql-3.0.0-alpha.2). Empty -> DEV build, no attach."
+        required: false
+        type: string
+        default: ""
+      attach:
+        description: "Attach the built .sql artefacts to a GitHub Release."
+        required: false
+        type: boolean
+        default: false
+      target_commitish:
+        description: "Non-empty -> create a prerelease at this commit; empty -> attach to the existing release named by tag."
+        required: false
+        type: string
+        default: ""
+      prerelease:
+        description: "Mark the created release as a prerelease (create path only)."
+        required: false
+        type: boolean
+        default: false
+    secrets:
+      MULTITUDES_ACCESS_TOKEN:
+        required: false
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+  MISE_VERBOSE: "1"
+
+defaults:
+  run:
+    shell: bash {0}
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    runs-on: blacksmith-16vcpu-ubuntu-2204
+    name: Build EQL
+    timeout-minutes: 5
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+          ref: ${{ inputs.ref }}
+
+      - uses: jdx/mise-action@v3
+        with:
+          version: 2026.4.0
+          install: true
+          cache: true
+
+      - name: Build EQL release
+        # Strip `eql-` so eql_v3.version() reports bare semver. Empty TAG
+        # intentionally falls through build.sh's ${usage_version:-DEV} default.
+        env:
+          TAG: ${{ inputs.tag }}
+        run: |
+          mise run build --version "${TAG#eql-}"
+
+      - name: Upload EQL artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: eql-release
+          path: |
+            release/cipherstash-encrypt.sql
+            release/cipherstash-encrypt-uninstall.sql
+
+      - name: Attach artefacts to existing release
+        if: ${{ inputs.attach && inputs.target_commitish == '' }}
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ inputs.tag }}
+          files: |
+            release/cipherstash-encrypt.sql
+            release/cipherstash-encrypt-uninstall.sql
+
+      - name: Create prerelease at commit
+        if: ${{ inputs.attach && inputs.target_commitish != '' }}
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ inputs.tag }}
+          target_commitish: ${{ inputs.target_commitish }}
+          prerelease: ${{ inputs.prerelease }}
+          name: ${{ inputs.tag }}
+          body: "Preview (prerelease) of the standalone eql_v3 surface. See [Unreleased] in CHANGELOG.md."
+          files: |
+            release/cipherstash-encrypt.sql
+            release/cipherstash-encrypt-uninstall.sql
+
+      - name: Notify Multitudes
+        if: ${{ github.event_name == 'release' }}
+        run: |
+          curl --request POST \
+            --fail-with-body \
+            --url "https://api.developer.multitudes.co/deployments" \
+            --header "Content-Type: application/json" \
+            --header "Authorization: ${{ secrets.MULTITUDES_ACCESS_TOKEN }}" \
+            --data '{"commitSha": "${{ github.sha }}", "environmentName":"production"}'