Enforce rollback safety PR checks

.github/pull_request_template.md

@@ -7,6 +7,18 @@
 <!-- If this is an API or ABI breaking change, please apply the
 corresponding GitHub label. -->
 
+# Rollback safety impact
+
+<!--
+If this PR is safe to roll back after deployment and has no impact on the rollback safety of any prior PRs, write `n/a` below.
+
+Otherwise, list every prerequisite PR that must be included in a release before this PR can merge. This PR must not be deployed until each prerequisite has been deployed and sufficiently observed or tested in the live deployment that we are confident it will not be rolled back. Supported forms include #123, SpacetimeDB#123, clockworklabs/SpacetimeDB#123, and GitHub PR URLs.
+
+Consider whether this PR:
+- newly writes to a previously introduced but unused ControlDB table or reducer, system table, or on-disk data format; or
+- clears, deletes, incompatibly changes, or renders unsupported a previously available ControlDB table or reducer, system table, or on-disk data format.
+-->
+
 # Expected complexity level and risk
 
 <!--

.github/workflows/check-pr-base.yml

@@ -2,10 +2,15 @@ name: Git tree checks
 
 on:
   pull_request:
-    types: [opened, edited]
+    types: [opened, reopened, edited]
+  # TODO: This isn't used, probably remove it?
   merge_group:
 permissions: read-all
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.inputs.pr_number || format('sha-{0}', github.sha) }}
+  cancel-in-progress: true
+
 jobs:
   check_base_ref:
     name: Based on `master`
@@ -18,3 +23,27 @@ jobs:
         run: |
           echo "This PR is not based on master. Please wait until the base PR merges."
           exit 1
+
+  release_dependencies:
+    if: ${{ github.event_name == 'pull_request' }}
+    name: Check release dependencies
+    runs-on: spacetimedb-new-runner-2
+    permissions:
+      contents: read
+      pull-requests: read
+    env:
+      GH_TOKEN: ${{ github.token }}
+      CARGO_TARGET_DIR: ${{ github.workspace }}/target
+      RUST_LOG: rollback_coordination=info
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # We inspect local tags and git commits in order to determine whether things have been released
+          fetch-depth: 0
+      - uses: dsherret/rust-toolchain-file@v1
+      - name: Check release dependencies
+        run: >-
+          cargo ci other-workflows check-release-deps
+          --current-repo .
+          --allowed-reference-repo .
+          --pr-number "${{ github.event.pull_request.number }}"

Cargo.toml

@@ -84,13 +84,15 @@ members = [
   "tools/ci/commands/cla-assistant",
   "tools/ci/commands/coordinate-internal-tests",
   "tools/ci/commands/workflow-watch",
+  "tools/ci/commands/check-release-deps",
   "tools/ci/common",
   "tools/keynote-bench-harness",
   "tools/license-check",
   "tools/replace-spacetimedb",
   "tools/generate-client-api",
   "tools/gen-bindings",
   "tools/release",
+  "tools/rollback-coordination",
   "tools/regen",
   "tools/xtask-llm-benchmark",
   "crates/bindings-typescript/test-app/server",

tools/ci/commands/check-release-deps/Cargo.toml

@@ -0,0 +1,13 @@
+[package]
+name = "ci-check-release-deps"
+version = "0.1.0"
+edition.workspace = true
+
+[dependencies]
+anyhow.workspace = true
+clap.workspace = true
+rollback-coordination = { path = "../../../rollback-coordination" }
+tracing-subscriber = { workspace = true, features = ["env-filter"] }
+
+[lints]
+workspace = true

tools/ci/commands/check-release-deps/src/main.rs

@@ -0,0 +1,49 @@
+#![allow(clippy::disallowed_macros)]
+
+use anyhow::{Context, Result};
+use clap::Parser;
+use rollback_coordination::{earliest_rollback_point, Gh};
+use std::fs;
+use std::path::PathBuf;
+
+#[derive(Parser)]
+#[command(
+    about = "Checks the `Rollback safety impact` section and verifies that every referenced PR has been released."
+)]
+struct Args {
+    #[arg(long)]
+    current_repo: PathBuf,
+    /// Paths to local clones of the repos that are allowed to be considered as release dependencies in the rollback safety PR section
+    #[arg(long = "allowed-reference-repo", required = true)]
+    allowed_reference_repos: Vec<PathBuf>,
+    #[arg(long)]
+    pr_number: u64,
+}
+
+fn main() -> Result<()> {
+    tracing_subscriber::fmt()
+        .with_env_filter(tracing_subscriber::EnvFilter::from_default_env())
+        .with_writer(std::io::stderr)
+        .init();
+    let args = Args::parse();
+    let template = fs::read_to_string(args.current_repo.join(".github/pull_request_template.md"))
+        .context("failed to read .github/pull_request_template.md")?;
+    let allowed_reference_repos = args
+        .allowed_reference_repos
+        .iter()
+        .map(PathBuf::as_path)
+        .collect::<Vec<_>>();
+    let point = earliest_rollback_point(
+        &Gh,
+        &args.current_repo,
+        &allowed_reference_repos,
+        Some(&template),
+        false,
+        &[args.pr_number],
+    )?;
+    match point {
+        Some(release) => println!("All mentioned PRs have been released. Earliest rollback point: {release}"),
+        None => println!("No PR mentions found, so trivially succeeding."),
+    }
+    Ok(())
+}

tools/ci/src/main.rs

@@ -76,6 +76,10 @@ const COMMANDS: &[Command] = &[
         path: &["other-workflows", "watch"],
         package: "ci-workflow-watch",
     },
+    Command {
+        path: &["other-workflows", "check-release-deps"],
+        package: "ci-check-release-deps",
+    },
 ];
 
 fn print_help() {

tools/rollback-coordination/Cargo.toml

@@ -0,0 +1,19 @@
+[package]
+name = "rollback-coordination"
+version = "0.1.0"
+edition.workspace = true
+
+[dependencies]
+anyhow.workspace = true
+duct.workspace = true
+regex.workspace = true
+semver.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+tracing.workspace = true
+
+[dev-dependencies]
+tempfile.workspace = true
+
+[lints]
+workspace = true

tools/rollback-coordination/src/gh.rs

@@ -0,0 +1,47 @@
+//! Thin wrappers around GitHub API requests. Business logic belongs in the
+//! calling coordination modules, not here.
+
+use anyhow::{Context, Result};
+use duct::cmd;
+use serde::de::DeserializeOwned;
+use serde::Deserialize;
+use std::path::Path;
+
+#[derive(Deserialize)]
+pub struct PullRequest {
+    pub body: Option<String>,
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct RepositoryInfo {
+    pub name_with_owner: String,
+}
+
+pub trait Github {
+    fn get<T: DeserializeOwned>(&self, endpoint: &str) -> Result<T>;
+    fn repository_info(&self, path: &Path) -> Result<RepositoryInfo>;
+
+    fn pull_request(&self, repo: &str, number: u64) -> Result<PullRequest> {
+        self.get(&format!("repos/{repo}/pulls/{number}"))
+    }
+}
+
+pub struct Gh;
+
+impl Github for Gh {
+    fn get<T: DeserializeOwned>(&self, endpoint: &str) -> Result<T> {
+        let output = cmd!("gh", "api", endpoint)
+            .read()
+            .with_context(|| format!("failed to run `gh api {endpoint}`"))?;
+        serde_json::from_str(&output).with_context(|| format!("invalid response from {endpoint}"))
+    }
+
+    fn repository_info(&self, path: &Path) -> Result<RepositoryInfo> {
+        let output = cmd!("gh", "repo", "view", "--json", "nameWithOwner")
+            .dir(path)
+            .read()
+            .with_context(|| format!("failed to run `gh repo view` in {}", path.display()))?;
+        serde_json::from_str(&output).context("invalid response from `gh repo view`")
+    }
+}