Run Composer compatibility on every related change

The composer compatibility workflow now also runs for vendor, patch,
manifest, lockfile and command changes. Docker composer tests fail
instead of skipping when SOCKET_PATCH_DOCKER_E2E_REQUIRED=1, and the
source-fallback test disables autocrlf so Windows compares LF bytes.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: mikolalysenko

.github/workflows/composer-compatibility.yml

@@ -24,15 +24,23 @@ on:
     paths:
       - '.github/workflows/composer-compatibility.yml'
       - 'tests/docker/Dockerfile.composer'
-      - 'crates/socket-patch-core/src/vendor/composer_lock.rs'
-      - 'crates/socket-patch-core/src/vendor/composer_lock/**'
-      - 'crates/socket-patch-core/src/vendor/lock_inventory/composer.rs'
-      - 'crates/socket-patch-core/src/patch/redirect/**'
+      - 'Cargo.lock'
+      - 'Cargo.toml'
+      - 'crates/*/Cargo.toml'
+      - 'crates/socket-patch-core/src/vendor/**'
+      - 'crates/socket-patch-core/src/patch/**'
+      - 'crates/socket-patch-core/src/manifest/**'
+      - 'crates/socket-patch-core/tests/fixtures/redirect/composer/**'
+      - 'crates/socket-patch-core/tests/fixtures/composer-version-vectors.json'
       - 'crates/socket-patch-core/src/crawlers/composer_crawler.rs'
       - 'crates/socket-patch-core/src/utils/composer*.rs'
       - 'crates/socket-patch-core/src/utils/purl.rs'
       - 'crates/socket-patch-core/src/vex/**'
       - 'crates/socket-patch-cli/src/commands/vendor*'
+      - 'crates/socket-patch-cli/src/commands/get*.rs'
+      - 'crates/socket-patch-cli/src/commands/apply.rs'
+      - 'crates/socket-patch-cli/src/commands/rollback.rs'
+      - 'crates/socket-patch-cli/src/commands/remove.rs'
       - 'crates/socket-patch-cli/src/commands/composer_hints.rs'
       - 'crates/socket-patch-cli/src/commands/scan/**'
       - 'crates/socket-patch-cli/src/commands/vex*.rs'
@@ -197,4 +205,6 @@ jobs:
           load: true
 
       - name: Run the vendored composer Docker capstone
+        env:
+          SOCKET_PATCH_DOCKER_E2E_REQUIRED: '1'
         run: cargo test -p socket-patch-cli --features docker-e2e --test docker_e2e_vendor_composer

crates/socket-patch-cli/tests/composer_e2e_common/mod.rs

@@ -147,7 +147,9 @@ pub fn composer_major(suite: &str) -> Option<u32> {
 /// Run `composer <args>` in `cwd` with a PRIVATE home + cache (the host's
 /// composer state must neither leak in nor be polluted). The home's
 /// `config.json` disables `secure-http`: the hosted capstone's patch server
-/// is a plain-http loopback wiremock.
+/// is a plain-http loopback wiremock. Git runs with `core.autocrlf=false`:
+/// Git for Windows' system default converts a source install's checkout to
+/// CRLF, so its bytes would never equal the upstream archive's.
 pub fn composer(cwd: &Path, args: &[&str], home: &Path, cache: &Path) -> Output {
     std::fs::create_dir_all(home).unwrap();
     std::fs::create_dir_all(cache).unwrap();
@@ -163,6 +165,9 @@ pub fn composer(cwd: &Path, args: &[&str], home: &Path, cache: &Path) -> Output
     super::cache_env::isolate(&mut cmd);
     cmd.env("COMPOSER_HOME", home)
         .env("COMPOSER_CACHE_DIR", cache)
+        .env("GIT_CONFIG_COUNT", "1")
+        .env("GIT_CONFIG_KEY_0", "core.autocrlf")
+        .env("GIT_CONFIG_VALUE_0", "false")
         .output()
         .expect("failed to run composer")
 }

crates/socket-patch-cli/tests/docker_vendor_common/mod.rs

@@ -58,20 +58,35 @@ pub fn cov_docker_args() -> Vec<String> {
 /// reports `ok`. Build locally with
 /// `docker build -f tests/docker/Dockerfile.<eco> -t <image> .`
 /// (after `Dockerfile.base` → `socket-patch-test-base:latest`).
+///
+/// With `SOCKET_PATCH_DOCKER_E2E_REQUIRED=1` (a CI job that built the image
+/// itself) a missing docker or image fails the test instead, so a tag
+/// mismatch cannot pass the job with zero assertions.
 #[must_use]
 pub fn skip_if_no_image(image: &str) -> bool {
-    let Ok(out) = Command::new("docker")
+    skip_or_require_image(
+        image,
+        std::env::var("SOCKET_PATCH_DOCKER_E2E_REQUIRED").is_ok_and(|v| v == "1"),
+    )
+}
+
+/// [`skip_if_no_image`] with the required switch passed in.
+#[must_use]
+pub fn skip_or_require_image(image: &str, required: bool) -> bool {
+    let reason = match Command::new("docker")
         .args(["image", "inspect", image])
         .output()
-    else {
-        eprintln!("skipping: `docker` not on PATH");
-        return true;
+    {
+        Err(_) => "`docker` not on PATH".to_string(),
+        Ok(out) if !out.status.success() => format!("docker image `{image}` not present"),
+        Ok(_) => return false,
     };
-    if !out.status.success() {
-        eprintln!("skipping: docker image `{image}` not present");
-        return true;
-    }
-    false
+    assert!(
+        !required,
+        "{reason}; SOCKET_PATCH_DOCKER_E2E_REQUIRED=1 forbids skipping"
+    );
+    eprintln!("skipping: {reason}");
+    true
 }
 
 fn docker_run(image: &str, host_dir: &Path, script: &str, extra: &[&str]) -> Output {

crates/socket-patch-cli/tests/docker_vendor_common_selftest.rs

@@ -18,7 +18,7 @@ use sha2::{Digest, Sha256};
 #[path = "docker_vendor_common/mod.rs"]
 mod docker_vendor_common;
 
-use docker_vendor_common::{bash_prelude, stage_patch_fn};
+use docker_vendor_common::{bash_prelude, skip_or_require_image, stage_patch_fn};
 
 /// The docker images always have coreutils `sha256sum`; macOS dev hosts may
 /// only have perl `shasum`, so shim it for these local runs.
@@ -164,3 +164,13 @@ fn stage_patch_records_git_blob_sha256_and_stages_blob() {
     let blob = dir.path().join(".socket/blobs").join(git_sha256(after));
     assert_eq!(std::fs::read(&blob).unwrap(), after, "staged blob bytes");
 }
+
+/// A required docker suite fails on a missing image instead of skipping;
+/// an optional one skips.
+#[test]
+fn a_required_docker_suite_fails_on_a_missing_image() {
+    let image = "socket-patch-test-does-not-exist:never";
+    assert!(skip_or_require_image(image, false));
+    let required = std::panic::catch_unwind(|| skip_or_require_image(image, true));
+    assert!(required.is_err(), "a required suite must not skip");
+}