plugin-compat.yml

---
name: Plugin Compatibility Matrix

# Verify that each (release × deployment) build cell's pinned requirement set
# still installs and imports against its matching edx-platform branch.
#
#   * On a PR, the enumerate job computes the affected cells from the diff and
#     runs only those; a PR touching no requirements yields an empty matrix and
#     the check job is skipped. The workflow deliberately has NO top-level
#     `paths:` filter: a workflow skipped by a path filter never reports its
#     status, which would leave an unrelated PR pending on a required check.
#     Running enumerate on every PR (it's cheap) and gating only the matrix job
#     keeps the check reportable on every PR.
#   * On the weekly schedule (and manual dispatch with `all`), run every cell,
#     to catch drift in cells no recent PR touched.
#
# build_manifest.yaml is the source of truth (see plans/06) — each cell's
# `packages`/`overrides` lines are the direct input this matrix tests, so a
# manifest edit here is tested exactly as-is, not via a separate proxy file.
on:
  pull_request:
  schedule:
    # Mondays 06:00 UTC — full matrix.
  - cron: "0 6 * * 1"
  workflow_dispatch:
    inputs:
      all_cells:
        description: Run the full matrix instead of only diff-affected cells.
        type: boolean
        default: false

concurrency:
  group: plugin-compat-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# Least privilege: both jobs only read the repo (checkout + diff); the Dagger
# check needs no token scopes. Resolves the CodeQL "workflow does not limit the
# permissions of the GITHUB_TOKEN" finding.
permissions:
  contents: read

jobs:
  enumerate:
    runs-on: ubuntu-latest
    outputs:
      any: ${{ steps.matrix.outputs.any }}
      cells: ${{ steps.matrix.outputs.cells }}
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        # Full history so the PR base is available to diff against.
        fetch-depth: 0
        persist-credentials: false
    - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
      with:
        enable-cache: true
    - run: uv sync --all-groups
    - id: matrix
      env:
        EVENT_NAME: ${{ github.event_name }}
        RUN_ALL: ${{ inputs.all_cells }}
        BASE_SHA: ${{ github.event.pull_request.base.sha }}
        DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
      run: |
        set -euo pipefail
        if [ "$EVENT_NAME" = "schedule" ] || [ "$RUN_ALL" = "true" ]; then
          json="$(uv run lehrer compat matrix --all)"
        else
          # PRs carry a base sha; a manual (workflow_dispatch) run does not, so
          # fall back to the default branch. Without this, `git diff "" HEAD`
          # exits fatally under `set -e` and the manual run never enumerates.
          if [ -n "$BASE_SHA" ]; then
            base="$BASE_SHA"
          else
            git fetch --quiet --depth=1 origin "$DEFAULT_BRANCH"
            base="origin/$DEFAULT_BRANCH"
          fi
          json="$(git diff --name-only "$base" HEAD \
            | uv run lehrer compat matrix)"
        fi
        echo "any=$(echo "$json" | jq -r '.any')" >> "$GITHUB_OUTPUT"
        echo "cells=$(echo "$json" | jq -c '.cells')" >> "$GITHUB_OUTPUT"
        {
          echo "### Plugin-compat cells"
          echo '```json'
          echo "$json" | jq .
          echo '```'
        } >> "$GITHUB_STEP_SUMMARY"

  check:
    needs: enumerate
    if: needs.enumerate.outputs.any == 'true'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        cell: ${{ fromJSON(needs.enumerate.outputs.cells) }}
    name: ${{ matrix.cell.group }}/${{ matrix.cell.release }}/${{ matrix.cell.deployment
      }}
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false
    # Installs the CLI and starts an engine that pulls Docker Hub images
    # through a caching mirror; see the action for why.
    - uses: ./.github/actions/dagger-engine
    - name: check-deployment
      env:
        MANIFEST: ${{ matrix.cell.manifest }}
        RELEASE: ${{ matrix.cell.release }}
        DEPLOYMENT: ${{ matrix.cell.deployment }}
      run: |
        set -euo pipefail
        dagger call platform check-deployment \
          --build-manifest "$MANIFEST" \
          --release-name "$RELEASE" \
          --deployment-name "$DEPLOYMENT"

  # Single always-reporting status suitable as the required branch-protection
  # check. The per-cell `check` job can't be required directly: it is skipped
  # on PRs that touch no requirements, and a skipped-but-required job wedges
  # every unrelated PR. This job runs on every PR, passing when the matrix
  # succeeded OR was legitimately skipped, and failing when any cell failed —
  # so a broken plugin bump actually blocks merge while unrelated PRs stay
  # green. Require `gate` (not `enumerate`, which stays green even when a cell
  # fails, nor `check`, which skips).
  gate:
    needs: [enumerate, check]
    if: always()
    runs-on: ubuntu-latest
    steps:
    - name: Evaluate plugin-compat result
      env:
        ENUM_RESULT: ${{ needs.enumerate.result }}
        CHECK_RESULT: ${{ needs.check.result }}
      run: |
        set -euo pipefail
        echo "enumerate: $ENUM_RESULT / check: $CHECK_RESULT"
        if [ "$ENUM_RESULT" != "success" ]; then
          echo "::error::enumerate did not succeed ($ENUM_RESULT)."
          exit 1
        fi
        if [ "$CHECK_RESULT" = "failure" ] || [ "$CHECK_RESULT" = "cancelled" ]; then
          echo "::error::One or more plugin-compat cells failed."
          exit 1
        fi
        echo "plugin-compat gate passed (matrix: $CHECK_RESULT)."