make sure cabal-install is compatible with Cabal

See haskell#9833

If a ghc ships with a compatible Cabal, it will be preferred by
the solver on `cabal install cabal-install`; the new `cabal-install`
should in fact be compatible. So we test this on release branches
that have had at least one release on Hackage. (Ideally we'd check
ghc instead, but we can't do that from GHA. Even checking Hackage
is pretty painful.)

.github/workflows/validate.yml

@@ -221,6 +221,20 @@ jobs:
         if: matrix.ghc == env.GHC_FOR_SOLVER_BENCHMARKS
         run: sh validate.sh $FLAGS -s solver-benchmarks-run
 
+      # Save the release sdist for later validation
+      # only do this on one platform/ghc because the sdists are the same everywhere
+      # NB. we only test cabal-install
+      - name: Create release sdist
+        if: runner.os == 'Linux' && matrix.ghc == env.GHC_FOR_RELEASE
+        run: cabal sdist cabal-install
+
+      - name: Upload release sdist to workflow artifacts
+        if: runner.os == 'Linux' && matrix.ghc == env.GHC_FOR_RELEASE
+        uses: actions/upload-artifact@v4
+        with:
+          name: cabal-sdists
+          path: dist-newstyle/sdist/*
+
   validate-old-ghcs:
     name: Validate old ghcs ${{ matrix.extra-ghc }}
     runs-on: ubuntu-latest
@@ -390,12 +404,71 @@ jobs:
       - name: Build using cabal HEAD
         run: sh validate.sh ${{ env.COMMON_FLAGS }} --with-cabal ./cabal-head/cabal -s build
 
+  # Dogfood the generated sdist, to avoid bugs like https://github.com/haskell/cabal/issues/9833
+  # No caching, since the point is to verify they can be installed "from scratch"
+  dogfood-sdists:
+    name: Dogfood validated sdist on ${{ matrix.os }} ghc-${{ matrix.ghc }}
+    runs-on: ${{ matrix.os }}
+    if: ${{ github.ref }} != 'refs/heads/master' && ${{ github.base_ref }} != 'master'
+    needs: validate
+    strategy:
+      matrix:
+        os: [ubuntu-latest]
+        # this should be kept up to date with the list above
+        # sharing these with the main validate job is possible but extremely painful; sadly,
+        # you can't simply reference another job's matrix
+        ghc:
+          [
+            "9.10.1",
+            "9.8.2",
+            "9.6.4",
+            "9.4.8",
+            "9.2.8",
+            "9.0.2",
+            "8.10.7",
+            "8.8.4",
+          ]
+
+    steps:
+
+      - uses: haskell-actions/setup@v2
+        id: setup-haskell
+        with:
+          ghc-version: ${{ matrix.ghc }}
+          cabal-version: latest
+
+      - name: Download sdist from workflow artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: cabal-sdists
+          path: .
+
+      - name: Install from sdist
+        run: |
+          echo "running for ${{ github.base_ref }} / ${{ github.ref }}"
+          # skip if a suitable Cabal isn't in the index (i.e. new major version, not released yet)
+          # we only want to test cabal-install, to ensure that it works with existing Cabals
+          sdist="$(ls cabal-install-*.tar.gz | sed -n '/^cabal-install-[0-9.]*\.tar\.gz$/{;p;q;}')"
+          # extract the cabal-install major version
+          # this could be done from the sdist's name as well, and possibly should
+          tar xfz "$sdist" "${sdist/.tar.gz}/cabal-install.cabal"
+          # (don't look at this too closely)
+          ver="$(sed -n '/^[Vv]ersion:[ \t]*\([0-9][0-9]*\.[0-9][0-9]*\)\.[0-9.]*$/{;s//\1/;p;q;}' "${sdist/.tar.gz}/cabal-install.cabal")"
+          # why does `cabal list` force me to do this???
+          if cabal list --simple-output Cabal | grep -q "^Cabal $cbl\\."; then
+            cabal build "$sdist" --prefer-oldest
+          else
+            echo No released Cabal version to test against.
+            exit 0
+          fi
+
   prerelease-head:
     name: Create a GitHub prerelease with the binary artifacts
     runs-on: ubuntu-latest
     if: github.ref == 'refs/heads/master'
 
     # IMPORTANT! Any job added to the workflow should be added here too
+    # NB: dogfood-sdists isn't here because it's pointless on master
     needs: [validate, validate-old-ghcs, build-alpine, dogfooding]
 
     steps:
@@ -437,7 +510,7 @@ jobs:
     name: Validate post job
     runs-on: ubuntu-latest
     # IMPORTANT! Any job added to the workflow should be added here too
-    needs: [validate, validate-old-ghcs, build-alpine, dogfooding]
+    needs: [validate, validate-old-ghcs, build-alpine, dogfooding, dogfood-sdists]
 
     steps:
       - run: |