make sure cabal-install is compatible with Cabal

See haskell#9833

If a ghc ships with a compatible Cabal, it will be preferred by
the solver on `cabal install cabal-install`; the new `cabal-install`
should in fact be compatible. So we test this on release branches
that have had at least one release on Hackage. (Ideally we'd check
ghc instead, but we can't do that from GHA. Even checking Hackage
is pretty painful.)

.github/workflows/validate.yml

@@ -221,6 +221,20 @@ jobs:
         if: matrix.ghc == env.GHC_FOR_SOLVER_BENCHMARKS
         run: sh validate.sh $FLAGS -s solver-benchmarks-run
 
+      # Save the release sdists for later validation
+      # only do this on one platform/ghc because the sdists are the same everywhere
+      # NB. we only test cabal-install, and any ghc will do here since it's not used
+      - name: Create release sdists
+        if: runner.os == 'Linux' && matrix.ghc == env.GHC_FOR_RELEASE
+        run: cabal sdist cabal-install
+
+      - name: Upload release sdists to workflow artifacts
+        if: runner.os == 'Linux' && matrix.ghc == env.GHC_FOR_RELEASE
+        uses: actions/upload-artifact@v4
+        with:
+          name: cabal-sdists
+          path: dist-newstyle/sdist/*
+
   validate-old-ghcs:
     name: Validate old ghcs ${{ matrix.extra-ghc }}
     runs-on: ubuntu-latest
@@ -390,6 +404,60 @@ jobs:
       - name: Build using cabal HEAD
         run: sh validate.sh ${{ env.COMMON_FLAGS }} --with-cabal ./cabal-head/cabal -s build
 
+  # Dogfood the generated sdists, to avoid bugs like https://github.com/haskell/cabal/issues/9833
+  # No caching, since the point is to verify they can be installed "from scratch"
+  dogfood-sdists:
+    name: Dogfood validated sdists on ${{ matrix.os }} ghc-${{ matrix.ghc }}
+    runs-on: ${{ matrix.os }}
+    if: ${{ github.ref_name }} != 'master'
+    needs: validate
+    strategy:
+      matrix:
+        os: [ubuntu-latest]
+        # this should be kept up to date with the list above
+        # sharing these with the main validate job is possible but extremely painful; sadly,
+        # you can't simply reference another job's matrix
+        ghc:
+          [
+            "9.10.1",
+            "9.8.2",
+            "9.6.4",
+            "9.4.8",
+            "9.2.8",
+            "9.0.2",
+            "8.10.7",
+            "8.8.4",
+          ]
+
+    steps:
+
+      - uses: haskell-actions/setup@v2
+        id: setup-haskell
+        with:
+          ghc-version: ${{ matrix.ghc }}
+          cabal-version: latest
+
+      - name: Download sdists from workflow artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: cabal-sdists
+          path: .
+
+      - name: Install from sdists
+        run: |
+          # skip if a suitable Cabal isn't in the index (i.e. new major version, not released yet)
+          # we only want to test cabal-install, to ensure that it works with existing Cabals
+          sdist="$(ls cabal-install-*.tar.gz | sed -n '/^cabal-install-[0-9.]*\.tar\.gz$/{;p;q;}')"
+          tar xf "$sdist" cabal-install.cabal
+          # (don't look at this too closely)
+          ver="$(sed -n '/^[Vv]ersion:[ \t]*\([0-9][0-9]*\.[0-9][0-9]*\)\.[0-9.]*$/{;s//\1/;p;q;}' cabal-install.cabal)"
+          # why???
+          if cabal list --simple-output Cabal | grep -q "^Cabal $cbl\\.""; then
+            cabal build "$sdist" --prefer-oldest
+          else
+            exit 0
+          fi
+
   prerelease-head:
     name: Create a GitHub prerelease with the binary artifacts
     runs-on: ubuntu-latest
@@ -437,7 +505,7 @@ jobs:
     name: Validate post job
     runs-on: ubuntu-latest
     # IMPORTANT! Any job added to the workflow should be added here too
-    needs: [validate, validate-old-ghcs, build-alpine, dogfooding]
+    needs: [validate, validate-old-ghcs, build-alpine, dogfooding, dogfood-sdists]
 
     steps:
       - run: |