From eb16ad0e90d4713a9d00b338f9755a4a907ac7ba Mon Sep 17 00:00:00 2001
From: brandon s allbery kf8nh <allbery.b@gmail.com>
Date: Fri, 1 Nov 2024 19:27:14 -0400
Subject: [PATCH] attempt to use local actions

Extremely experimental, and with all the limitations and
restrictions I keep finding in GitHub Actions it'll probably fail
in the messiest way it can.

At present this is incomplete but sufficient to see if this has
any chance of working to begin with. If it somehow does, I'll
look into abstracting out the other sub-jobs, then making an
overnight validate for Tier 2 platforms and probably a prerelease
job (which would fix the recently revealed problem where if there
is no need to rebase on merge, no prerelease is made).
---
 .github/actions/cabal-setup/action.yml        | 161 ++++++++
 .github/actions/validate-full/action.yml      | 145 ++++++++
 .github/config.yml                            |  16 +
 .github/workflows/validate.yml                | 347 ++++--------------
 .../BuildDeps/SameDepsAllRound/lemon.hs       |   2 +
 5 files changed, 399 insertions(+), 272 deletions(-)
 create mode 100644 .github/actions/cabal-setup/action.yml
 create mode 100644 .github/actions/validate-full/action.yml
 create mode 100644 .github/config.yml

diff --git a/.github/actions/cabal-setup/action.yml b/.github/actions/cabal-setup/action.yml
new file mode 100644
index 00000000000..f516f5685bd
--- /dev/null
+++ b/.github/actions/cabal-setup/action.yml
@@ -0,0 +1,161 @@
+name: Cabal setup
+description: Set up a workflow for Cabal
+
+inputs:
+  ghc:
+    description: ghc version to use
+    required: true
+  extra-ghc:
+    description: additional ghc for tests
+    required: false
+    default: ''
+  allow-newer:
+    description: allow-newer line
+    required: false
+    default: ''
+  constraints:
+    description: constraints line
+    required: false
+    default: ''
+  static:
+    description: whether to build statically
+    required: false
+    default: 'false'
+  shell:
+    description: shell to use
+    required: false
+    default: 'bash'
+  with_cache:
+    description: whether to instantiate cache
+    required: false
+    default: 'true'
+
+outputs:
+  ghc-exe:
+    description: Path to ghc installed by setup-haskell
+    value: ${{ steps.setup-haskell.outputs.ghc-exe }}
+
+runs:
+  using: composite
+  steps:
+    - name: Make sure ghc is specified
+      if: inputs.ghc == ''
+      shell: ${{ inputs.shell }}
+      run: exit 1
+
+    - name: Work around existence of XDG directories (haskell-actions/setup#62)
+      if: runner.os == 'macOS'
+      shell: ${{ inputs.shell }}
+      run: |
+        rm -rf ~/.config/cabal
+        rm -rf ~/.cache/cabal
+
+    - name: "WIN: Setup TMP environment variable"
+      if: runner.os == 'Windows'
+      shell: ${{ inputs.shell }}
+      run: |
+        echo "TMP=${{ runner.temp }}" >> "$GITHUB_ENV"
+
+    # See https://github.com/haskell/cabal/blob/master/CONTRIBUTING.md#hackage-revisions
+    - name: Add manually supplied allow-newer
+      if: inputs.allow-newer != ''
+      shell: ${{ inputs.shell }}
+      run: |
+        echo "allow-newer: ${{ inputs.allow-newer }}" >> cabal.validate.project
+
+    - name: Add manually supplied constraints
+      if: inputs.constraints != ''
+      shell: ${{ inputs.shell }}
+      run: |
+        echo "constraints: ${{ inputs.constraints }}" >> cabal.validate.project
+
+    - name: Enable statically linked executables
+      if: inputs.static == 'true'
+      shell: ${{ inputs.shell }}
+      run: |
+        echo 'executable-static: true' >> cabal.validate.project
+
+    # must happen before the main setup so the correct ghc is default
+    # hm, but what if setup-haskell needs to install ghcup?
+    - name: Install extra ghc for tests
+      if: inputs.extra_ghc != ''
+      shell: ${{ inputs.shell }}
+      run: |
+        ghcup install ghc ${{ inputs.extra_ghc }}
+
+    - uses: haskell-actions/setup@v2
+      id: setup-haskell
+      with:
+        ghc-version: ${{ inputs.ghc }}
+        cabal-version: 3.12.1.0 # see https://github.com/haskell/cabal/pull/10251
+        ghcup-release-channel: https://raw.githubusercontent.com/haskell/ghcup-metadata/master/ghcup-prereleases-0.0.8.yaml
+
+    # See the following link for a breakdown of the following step
+    # https://github.com/haskell/actions/issues/7#issuecomment-745697160
+    - uses: actions/cache@v4
+      if: inputs.with_cache != 'false'
+      with:
+        # validate.sh uses a special build dir
+        path: |
+          ${{ steps.setup-haskell.outputs.cabal-store }}
+          dist-*
+        key: ${{ runner.os }}-${{ inputs.ghc }}-${{ github.sha }}
+        restore-keys: ${{ runner.os }}-${{ inputs.ghc }}-
+
+    # The tool is not essential to the rest of the test suite. If
+    # hackage-repo-tool is not present, any test that requires it will
+    # be skipped.
+    # We want to keep this in the loop but we don't want to fail if
+    # hackage-repo-tool breaks or fails to support a newer GHC version.
+    - name: Install hackage-repo-tool
+      continue-on-error: true
+      shell: ${{ inputs.shell }}
+      run: |
+        cabal install --ignore-project hackage-repo-tool
+
+    # Needed by cabal-testsuite/PackageTests/Configure/setup.test.hs
+    - name: "MAC: Install Autotools"
+      if: runner.os == 'macOS'
+      shell: ${{ inputs.shell }}
+      run: |
+        brew install automake
+
+    # Needed by cabal-testsuite/PackageTests/Configure/setup.test.hs
+    - name: "WIN: Install Autotools"
+      if: runner.os == 'Windows'
+      shell: ${{ inputs.shell }}
+      run: |
+        /usr/bin/pacman --noconfirm -S autotools
+
+    - name: Set validate inputs
+      shell: ${{ inputs.shell }}
+      run: |
+        FLAGS="$COMMON_FLAGS"
+        if [[ "${{ inputs.ghc }}" == "$GHC_FOR_SOLVER_BENCHMARKS" ]]; then
+          FLAGS="$FLAGS --solver-benchmarks"
+        fi
+        if [[ "${{ matrix.ghc }}" == "$GHC_FOR_COMPLETE_HACKAGE_TESTS" ]]; then
+          FLAGS="$FLAGS --complete-hackage-tests"
+        fi
+        echo "FLAGS=$FLAGS" >> "$GITHUB_ENV"
+
+    - name: Validate print-config
+      shell: ${{ inputs.shell }}
+      run: |
+        sh validate.sh $FLAGS -s print-config
+
+    - name: Validate print-tool-versions
+      shell: ${{ inputs.shell }}
+      run: |
+        sh validate.sh $FLAGS -s print-tool-versions
+
+    - name: Canonicalize architecture
+      shell: ${{ inputs.shell }}
+      run: |
+        case ${{ runner.arch }} in
+          X86) arch=i386 ;;
+          X64) arch=x86_64 ;;
+          ARM64) arch=aarch64 ;;
+          *) echo "Unsupported architecture, please fix validate.yaml" 2>/dev/null; exit 1 ;;
+        esac
+        echo "CABAL_ARCH=$arch" >> "$GITHUB_ENV"
diff --git a/.github/actions/validate-full/action.yml b/.github/actions/validate-full/action.yml
new file mode 100644
index 00000000000..97cdd0850d5
--- /dev/null
+++ b/.github/actions/validate-full/action.yml
@@ -0,0 +1,145 @@
+name: Validate full
+description: Run a full validate on a ghc version
+inputs:
+  ghc:
+    description: ghc version to use
+    required: true
+  allow-newer:
+    description: allow-newer line
+    required: false
+  constraints:
+    description: constraints line
+    required: false
+  static:
+    description: whether to build statically
+    required: false
+    default: 'false'
+  shell:
+    description: shell to use
+    required: false
+    default: 'bash'
+  with_cache:
+    description: whether to instantiate cache
+    required: false
+    default: 'true'
+
+runs:
+  using: composite
+  steps:
+    - uses: ./.github/actions/cabal-setup
+      id: cabal-setup
+      with:
+        shell: ${{ inputs.shell }}
+        ghc: ${{ inputs.ghc }}
+        allow-newer: ${{ inputs.allow-newer }}
+        constraints: ${{ inputs.constraints }}
+        static: ${{ inputs.static }}
+        with_cache: ${{ inputs.with_cache }}
+
+    - name: Validate build
+      shell: ${{ inputs.shell }}
+      run: |
+        echo ::group::Build
+        sh validate.sh $FLAGS -s build
+
+    - name: Tar cabal head executable
+      if: matrix.ghc == env.GHC_FOR_RELEASE
+      shell: ${{ inputs.shell }}
+      run: |
+        echo ::group::Tar
+        CABAL_EXEC=$(cabal list-bin --builddir=dist-newstyle-validate-ghc-${{ matrix.ghc }} --project-file=cabal.validate.project cabal-install:exe:cabal)
+        # We have to tar the executable to preserve executable permissions
+        # see https://github.com/actions/upload-artifact/issues/38
+        if [[ "${{ runner.os }}" == "Windows" ]]; then
+          # `cabal list-bin` gives us a windows path but tar needs the posix one
+          CABAL_EXEC=$(cygpath "$CABAL_EXEC")
+        fi
+        if [[ "${{ runner.os }}" == "macOS" ]]; then
+            # Workaround to avoid bsdtar corrupting the executable
+            # such that executing it after untar throws `cannot execute binary file`
+            # see https://github.com/actions/virtual-environments/issues/2619#issuecomment-788397841
+            sudo /usr/sbin/purge
+        fi
+        DIR=$(dirname "$CABAL_EXEC")
+        FILE=$(basename "$CABAL_EXEC")
+        CABAL_EXEC_TAR="cabal-head-${{ runner.os }}-$CABAL_ARCH.tar.gz"
+        tar -czvf "$CABAL_EXEC_TAR" -C "$DIR" "$FILE"
+        echo "CABAL_EXEC_TAR=$CABAL_EXEC_TAR" >> "$GITHUB_ENV"
+
+    # We upload the cabal executable built with the ghc used in the release for:
+    # - Reuse it in the dogfooding job (although we could use the cached build dir)
+    # - Make it available in the workflow to make easier testing it locally
+    - name: Upload cabal-install executable to workflow artifacts
+      if: inputs.ghc == env.GHC_FOR_RELEASE
+      uses: actions/upload-artifact@v4
+      with:
+        name: cabal-${{ runner.os }}-${{ env.CABAL_ARCH }}
+        path: ${{ env.CABAL_EXEC_TAR }}
+
+    # We want all the tests to be run even if one fails, but we want to fail the validate
+    # if any of them fail. It turns out that there is a way to get at the outcome of a step
+    # before `continue-on-error`` is applied, so the last step uses that.
+    #
+    # Note that we can't use filter syntax to look for any such failure, because the
+    # hackage-repo-tool install is also `continue-on-error` and its failure is legitimate
+    # (see the comment there). So the final step must list all of the tests, not that I expect
+    # any new ones to be added.
+
+    - name: Validate lib-tests
+      id: lib-tests
+      continue-on-error: true
+      env:
+        # `rawSystemStdInOut reports text decoding errors`
+        # test does not find ghc without the full path in windows
+        GHCPATH: ${{ steps.setup-haskell.outputs.ghc-exe }}
+      shell: ${{ inputs.shell }}
+      run: |
+        echo ::group::Validate lib-tests
+        sh validate.sh $FLAGS -s lib-tests
+
+    - name: Validate lib-suite
+      id: lib-suite
+      continue-on-error: true
+      shell: ${{ inputs.shell }}
+      run: |
+        echo ::group::Validate lib-suite
+        sh validate.sh $FLAGS -s lib-suite
+
+    - name: Validate cli-tests
+      id: cli-tests
+      continue-on-error: true
+      shell: ${{ inputs.shell }}
+      run: |
+        echo ::group::Validate cli-tests
+        sh validate.sh $FLAGS -s cli-tests
+
+    - name: Validate cli-suite
+      id: cli-suite
+      continue-on-error: true
+      shell: ${{ inputs.shell }}
+      run: |
+        echo ::group::Validate cli-suite
+        sh validate.sh $FLAGS -s cli-suite
+
+    - name: Validate solver-benchmarks-tests
+      id: solver-benchmarks-tests
+      continue-on-error: true
+      if: "matrix.ghc == env.GHC_FOR_SOLVER_BENCHMARKS"
+      shell: ${{ inputs.shell }}
+      run: |
+        echo ::group::Validate solver-benchmarks-tests
+        sh validate.sh $FLAGS -s solver-benchmarks-tests
+
+    - name: Validate solver-benchmarks-run
+      id: solver-benchmarks-run
+      continue-on-error: true
+      if: "matrix.ghc == env.GHC_FOR_SOLVER_BENCHMARKS"
+      shell: ${{ inputs.shell }}
+      run: |
+        echo ::group::Validate solver-benchmarks-run
+        sh validate.sh $FLAGS -s solver-benchmarks-run
+
+    - name: Collect test results
+      if: steps.lib-tests.outcome == 'failure' || steps.lib-suite.outcome == 'failure' || steps.cli-tests.outcome == 'failure' || steps.cli-suite.outcome == 'failure' || steps.solver-benchmarks-tests.outcome == 'failure' || steps.solver-benchmarks-run.outcome == 'failure'
+      shell: ${{ inputs.shell }}
+      run: exit 1
diff --git a/.github/config.yml b/.github/config.yml
new file mode 100644
index 00000000000..a96662b9cbf
--- /dev/null
+++ b/.github/config.yml
@@ -0,0 +1,16 @@
+# all of these will get "GHC_" prepended
+# the single quotes will be consumed by the JSON parser
+# note: FOR_RELEASE must be an element of both FOR_VALIDATE and FOR_BOOTSTRAP!
+FOR_RELEASE: '9.4.8'
+FOR_SOLVER_BENCHMARKS: '${GHC_FOR_RELEASE}'
+FOR_COMPLETE_HACKAGE_TESTS: '${GHC_FOR_RELEASE}'
+# these will be decoded with fromJSON
+# If you remove something from here, then add it to the old-ghcs job.
+# Also a removed GHC from here means that we are actually dropping
+# support, so the PR *must* have a changelog entry.
+FOR_VALIDATE: '["9.10.1", "9.8.2", "9.6.6", "9.4.8", "9.2.8", "9.0.2", "8.10.7", "8.8.4"]'
+## GHC 7.10.3 does not install on ubuntu-22.04 with ghcup.
+## Older GHCs are not supported by ghcup in the first place.
+FOR_VALIDATE_OLD: '["8.4.4", "8.2.2", "8.0.2"]'
+FOR_BOOTSTRAP: '["9.8.2", "9.6.6", "9.4.8", "9.2.8", "9.0.2"]'
+COMMON_FLAGS: '-j 2 -v'
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 9395720b417..b5d11fe65d3 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -49,25 +49,39 @@ on:
         required: false
         type: string
 
-env:
-  # We choose a stable ghc version across all os's
-  # which will be used to do the next release
-  GHC_FOR_RELEASE: "9.4.8"
-  # Ideally we should use the version about to be released for hackage tests and benchmarks
-  GHC_FOR_SOLVER_BENCHMARKS: "9.4.8"
-  GHC_FOR_COMPLETE_HACKAGE_TESTS: "9.4.8"
-  COMMON_FLAGS: "-j 2 -v"
+jobs:
 
-  # See https://github.com/haskell/cabal/blob/master/CONTRIBUTING.md#hackage-revisions
-  ALLOWNEWER: ${{ github.event.inputs.allow-newer }}
-  CONSTRAINTS: ${{ github.event.inputs.constraints }}
+  config:
+    runs-on: ubuntu-latest
+    # `matrix` can't access `env`, but it can access `outputs` from `needs` jobs.
+    # So we have to "export" some things here as job outputs.
+    # Oh, also the action documents a set-environment option that it doesn't honor.
+    outputs:
+      GHC_FOR_RELEASE: ${{ steps.conf.outputs['FOR_RELEASE'] }}
+      GHC_FOR_VALIDATE: ${{ steps.conf.outputs['FOR_VALIDATE'] }}
+      GHC_FOR_VALIDATE_OLD: ${{ steps.conf.outputs['FOR_VALIDATE_OLD'] }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pietrobolcato/action-read-yaml@1.0.0
+        id: conf
+        with:
+          config: ${{ github.workspace }}/.github/config.yml
+
+      - run: |
+          # can't enumerate the keys of `outputs`, of course (Thanks, GitHub!)
+          # nor can I use a shell loop because GHA can't see the shell variable
+          echo "GHC_FOR_RELEASE=${{ steps.conf.outputs['FOR_RELEASE'] }}" >> "$GITHUB_ENV"
+          echo "GHC_FOR_SOLVER_BENCHMARKS=${{ steps.conf.outputs['FOR_SOLVER_BENCHMARKS'] }}" >> "$GITHUB_ENV"
+          echo "GHC_FOR_COMPLETE_HACKAGE_TESTS=${{ steps.conf.outputs['FOR_COMPLETE_HACKAGE_TESTS'] }}" >> "$GITHUB_ENV"
+          echo "GHC_FOR_VALIDATE=${{ steps.conf.outputs['FOR_VALIDATE'] }}" >> "$GITHUB_ENV"
+          echo "GHC_FOR_VALIDATE_OLD=${{ steps.conf.outputs['FOR_VALIDATE_OLD'] }}" >> "$GITHUB_ENV"
+          echo "COMMON_FLAGS=${{ steps.conf.outputs['COMMON_FLAGS'] }}" >> "$GITHUB_ENV"
 
-jobs:
   validate:
     name: Validate ${{ matrix.sys.os }} ghc-${{ matrix.ghc }}
     runs-on: ${{ matrix.sys.os }}
-    outputs:
-      GHC_FOR_RELEASE: ${{ format('["{0}"]', env.GHC_FOR_RELEASE) }}
+    needs: config
     strategy:
       fail-fast: false
       matrix:
@@ -75,20 +89,7 @@ jobs:
           - { os: windows-latest, shell: "C:/msys64/usr/bin/bash.exe -e {0}" }
           - { os: ubuntu-22.04, shell: bash }
           - { os: macos-latest, shell: bash }
-        # If you remove something from here, then add it to the old-ghcs job.
-        # Also a removed GHC from here means that we are actually dropping
-        # support, so the PR *must* have a changelog entry.
-        ghc:
-          [
-            "9.10.1",
-            "9.8.2",
-            "9.6.6",
-            "9.4.8",
-            "9.2.8",
-            "9.0.2",
-            "8.10.7",
-            "8.8.4",
-          ]
+        ghc: ${{ fromJSON(needs.config.outputs.GHC_FOR_VALIDATE) }}
         exclude:
           # Throws fatal "cabal-tests.exe: fd:8: hGetLine: end of file" exception
           # even with --io-manager=native
@@ -116,157 +117,17 @@ jobs:
           - sys:
               { os: macos-latest, shell: bash }
             ghc: "8.8.4"
-    defaults:
-      run:
-        shell: ${{ matrix.sys.shell }}
     steps:
-      - name: Work around XDG directories existence (haskell-actions/setup#62)
-        if: runner.os == 'macOS'
-        run: |
-          rm -rf ~/.config/cabal
-          rm -rf ~/.cache/cabal
-
-      - name: "WIN: Setup TMP environment variable"
-        if: runner.os == 'Windows'
-        run: |
-           echo "TMP=${{ runner.temp }}" >> "$GITHUB_ENV"
-
-      - uses: actions/checkout@v4
-
-      # See https://github.com/haskell/cabal/blob/master/CONTRIBUTING.md#hackage-revisions
-      - name: Add manually supplied allow-newer
-        if: github.event_name == 'workflow_dispatch' && github.event.inputs.allow-newer != ''
-        run: |
-          echo "allow-newer: ${{ github.event.inputs.allow-newer }}" >> cabal.validate.project
-
-      - name: Add manually supplied constraints
-        if: github.event_name == 'workflow_dispatch' && github.event.inputs.constraints != ''
-        run: |
-          echo "constraints: ${{ github.event.inputs.constraints }}" >> cabal.validate.project
-
-      - uses: haskell-actions/setup@v2
-        id: setup-haskell
-        with:
-          ghc-version: ${{ matrix.ghc }}
-          cabal-version: 3.12.1.0 # see https://github.com/haskell/cabal/pull/10251
-          ghcup-release-channel: https://raw.githubusercontent.com/haskell/ghcup-metadata/master/ghcup-prereleases-0.0.8.yaml
-
-      #  See the following link for a breakdown of the following step
-      #  https://github.com/haskell/actions/issues/7#issuecomment-745697160
-      - uses: actions/cache@v4
-        with:
-          # validate.sh uses a special build dir
-          path: |
-            ${{ steps.setup-haskell.outputs.cabal-store }}
-            dist-*
-          key: ${{ runner.os }}-${{ matrix.ghc }}-${{ github.sha }}
-          restore-keys: ${{ runner.os }}-${{ matrix.ghc }}-
-
-      # The tool is not essential to the rest of the test suite. If
-      # hackage-repo-tool is not present, any test that requires it will
-      # be skipped.
-      # We want to keep this in the loop but we don't want to fail if
-      # hackage-repo-tool breaks or fails to support a newer GHC version.
-      - name: Install hackage-repo-tool
-        continue-on-error: true
-        run: cabal install --ignore-project hackage-repo-tool
-
-      # Needed by cabal-testsuite/PackageTests/Configure/setup.test.hs
-      - name: "MAC: Install Autotools"
-        if: runner.os == 'macOS'
-        run: brew install automake
-
-      # Needed by cabal-testsuite/PackageTests/Configure/setup.test.hs
-      - name: "WIN: Install Autotools"
-        if: runner.os == 'Windows'
-        run: /usr/bin/pacman --noconfirm -S autotools
-
-      - name: Set validate inputs
-        run: |
-          FLAGS="${{ env.COMMON_FLAGS }}"
-          if [[ "${{ matrix.ghc }}" == "${{ env.GHC_FOR_SOLVER_BENCHMARKS }}" ]]; then
-            FLAGS="$FLAGS --solver-benchmarks"
-          fi
-          if [[ "${{ matrix.ghc }}" == "${{ env.GHC_FOR_COMPLETE_HACKAGE_TESTS }}" ]]; then
-            FLAGS="$FLAGS --complete-hackage-tests"
-          fi
-          echo "FLAGS=$FLAGS" >> "$GITHUB_ENV"
+    - uses: actions/checkout@v4
 
-      - name: Validate print-config
-        run: sh validate.sh $FLAGS -s print-config
-
-      - name: Validate print-tool-versions
-        run: sh validate.sh $FLAGS -s print-tool-versions
-
-      - name: Validate build
-        run: sh validate.sh $FLAGS -s build
-
-      - name: Canonicalize architecture
-        run: |
-          case ${{ runner.arch }} in
-            X86) arch=i386 ;;
-            X64) arch=x86_64 ;;
-            ARM64) arch=aarch64 ;;
-            *) echo "Unsupported architecture, please fix validate.yaml" 2>/dev/null; exit 1 ;;
-          esac
-          echo "CABAL_ARCH=$arch" >> "$GITHUB_ENV"
-
-      - name: Tar cabal head executable
-        if: matrix.ghc == env.GHC_FOR_RELEASE
-        run: |
-          CABAL_EXEC=$(cabal list-bin --builddir=dist-newstyle-validate-ghc-${{ matrix.ghc }} --project-file=cabal.validate.project cabal-install:exe:cabal)
-          # We have to tar the executable to preserve executable permissions
-          # see https://github.com/actions/upload-artifact/issues/38
-          if [[ "${{ runner.os }}" == "Windows" ]]; then
-            # `cabal list-bin` gives us a windows path but tar needs the posix one
-            CABAL_EXEC=$(cygpath "$CABAL_EXEC")
-          fi
-          if [[ "${{ runner.os }}" == "macOS" ]]; then
-             # Workaround to avoid bsdtar corrupts the executable
-             # so executing it after untar throws `cannot execute binary file`
-             # see https://github.com/actions/virtual-environments/issues/2619#issuecomment-788397841
-             sudo /usr/sbin/purge
-          fi
-          DIR=$(dirname "$CABAL_EXEC")
-          FILE=$(basename "$CABAL_EXEC")
-          CABAL_EXEC_TAR="cabal-head-${{ runner.os }}-$CABAL_ARCH.tar.gz"
-          tar -czvf "$CABAL_EXEC_TAR" -C "$DIR" "$FILE"
-          echo "CABAL_EXEC_TAR=$CABAL_EXEC_TAR" >> "$GITHUB_ENV"
-
-      # We upload the cabal executable built with the ghc used in the release for:
-      # - Reuse it in the dogfooding job (although we could use the cached build dir)
-      # - Make it available in the workflow to make easier testing it locally
-      - name: Upload cabal-install executable to workflow artifacts
-        if: matrix.ghc == env.GHC_FOR_RELEASE
-        uses: actions/upload-artifact@v4
-        with:
-          name: cabal-${{ runner.os }}-${{ env.CABAL_ARCH }}
-          path: ${{ env.CABAL_EXEC_TAR }}
-
-      - name: Validate tests
-        env:
-          # `rawSystemStdInOut reports text decoding errors`
-          # test does not find ghc without the full path in windows
-          GHCPATH: ${{ steps.setup-haskell.outputs.ghc-exe }}
-        run: |
-          set +e
-          rc=0
-          tests="lib-tests lib-suite cli-tests cli-suite"
-          if [ "${{ matrix.ghc }}" = "${{ env.GHC_FOR_SOLVER_BENCHMARKS }}" ]; then
-            tests="$tests solver-benchmarks-tests solver-benchmarks-run"
-          fi
-          for test in $tests; do
-            echo Validate "$test"
-            sh validate.sh $FLAGS -s "$test" || rc=1
-            echo End "$test"
-          done
-          exit $rc
-      # The above ensures all the tests get run, for a single platform+ghc.
-      # Trying to ensure they run for *all* combinations but still fail
-      # at the end seems to be extremely difficult at best. It's doable,
-      # but it requires a continuously growing stack of conditions and
-      # one possibly nightmarish final conditional. 'fail-fast' gets us
-      # partway there, at least, but is still imperfect.
+    # N.B. Local actions must start with "./" to distinguish them from remote actions, which
+    # start with "X/" where X is an organization (which can't be ".")
+    - uses: ./.github/actions/validate-full
+      with:
+        shell: ${{ matrix.sys.shell }}
+        ghc: ${{ matrix.ghc }}
+        allow-newer: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.allow_newer || '' }}
+        constraints: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.constraints || '' }}
 
   validate-old-ghcs:
     name: Validate old ghcs ${{ matrix.extra-ghc }}
@@ -275,65 +136,41 @@ jobs:
 
     strategy:
       matrix:
-        extra-ghc:
-          ["8.4.4", "8.2.2", "8.0.2"]
-          ## GHC 7.10.3 does not install on ubuntu-22.04 with ghcup.
-          ## Older GHCs are not supported by ghcup in the first place.
+        extra-ghc: ${{ fromJSON(needs.config.outputs.GHC_FOR_VALIDATE_OLD) }}
       fail-fast: false
 
     steps:
-      - uses: actions/checkout@v4
-
       - name: Install prerequisites for old GHCs
         run: |
           sudo apt-get update
           sudo apt-get install libncurses5 libtinfo5
 
-      - name: Install extra compiler
-        run: ghcup install ghc ${{ matrix.extra-ghc }}
-
-      - name: GHCup logs
-        if: always()
-        run: cat /usr/local/.ghcup/logs/*
+      - uses: actions/checkout@v4
 
-      - name: Install primary compiler
-        uses: haskell-actions/setup@v2
-        id: setup-haskell
+      - uses: ./.github/actions/cabal-setup
         with:
-          ghc-version: ${{ env.GHC_FOR_RELEASE }}
-          cabal-version: latest
+          ghc: ${{ env.GHC_FOR_RELEASE }}
+          extra_ghc: ${{ matrix.extra-ghc }}
 
       - name: GHC versions
         run: |
           ghc --version
           "ghc-${{ matrix.extra-ghc }}" --version
 
-      # As we are reusing the cached build dir from the previous step
-      # the generated artifacts are available here,
-      # including the cabal executable and the test suite
-      - uses: actions/cache@v4
-        with:
-          path: |
-            ${{ steps.setup-haskell.outputs.cabal-store }}
-            dist-*
-          key: ${{ runner.os }}-${{ env.GHC_FOR_RELEASE }}-${{ github.sha }}
-          restore-keys: ${{ runner.os }}-${{ env.GHC_FOR_RELEASE }}-
-
       - name: Validate build
         id: build
-        run: sh validate.sh ${{ env.COMMON_FLAGS }} -s build
+        run: |
+          sh validate.sh $COMMON_FLAGS -s build
 
       - name: "Validate lib-suite-extras --extra-hc ghc-${{ matrix.extra-ghc }}"
-        env:
-          EXTRA_GHC: ghc-${{ matrix.extra-ghc }}
-        run: sh validate.sh ${{ env.COMMON_FLAGS }} --lib-only -s lib-suite-extras --extra-hc "${{ env.EXTRA_GHC }}"
-      # See the comment above about running all tests but still failing if one
-      # of them does; it also applies here.
+        run: |
+          sh validate.sh $COMMON_FLAGS --lib-only -s lib-suite-extras --extra-hc "ghc-${{ matrix.extra-ghc }}"
 
   build-alpine:
     name: Build statically linked using alpine
     runs-on: ubuntu-latest
     container: "alpine:3.19"
+    needs: config
     steps:
       - name: Install extra dependencies
         shell: sh
@@ -345,52 +182,35 @@ jobs:
 
       - uses: actions/checkout@v4
 
-      # See https://github.com/haskell/cabal/blob/master/CONTRIBUTING.md#hackage-revisions
-      - name: Manually supplied constraints/allow-newer
-        if: github.event_name == 'workflow_dispatch'
-        run: |
-          echo "allow-newer: ${ALLOWNEWER}"  >> cabal.validate.project
-          echo "constraints: ${CONSTRAINTS}" >> cabal.validate.project
-
-      - uses: haskell-actions/setup@v2
-        id: setup-haskell
-        with:
-          ghc-version: ${{ env.GHC_FOR_RELEASE }}
-          cabal-version: latest # latest is mandatory for cabal-testsuite, see https://github.com/haskell/cabal/issues/8133
-
-      #  See the following link for a breakdown of the following step
-      #  https://github.com/haskell/actions/issues/7#issuecomment-745697160
-      - uses: actions/cache@v4
+      - uses: ./.github/actions/cabal-setup
         with:
-          # validate.sh uses a special build dir
-          path: |
-            ${{ steps.setup-haskell.outputs.cabal-store }}
-            dist-*
-          key: ${{ runner.os }}-${{ env.GHC_FOR_RELEASE }}-${{ github.sha }}
-          restore-keys: ${{ runner.os }}-${{ env.GHC_FOR_RELEASE }}-
-
-      - name: Enable statically linked executables
-        run: |
-          echo 'executable-static: true' >> cabal.validate.project
+          ghc: ${{ env.GHC_FOR_RELEASE }}
+          static: 'true'
+          allow-newer: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.allow_newer || '' }}
+          constraints: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.constraints || '' }}
 
       - name: Build
+        # $FLAGS is set by the cabal-setup action (perhaps it should be an output instead)
         run: sh validate.sh $FLAGS -s build
 
       - name: Tar cabal head executable
         run: |
-          CABAL_EXEC=$(cabal list-bin --builddir=dist-newstyle-validate-ghc-${{ env.GHC_FOR_RELEASE }} --project-file=cabal.validate.project cabal-install:exe:cabal)
+          ::group::dump env
+          env
+          ::endgroup::
+          CABAL_EXEC=$(cabal list-bin --builddir=dist-newstyle-validate-ghc-$GHC_FOR_RELEASE --project-file=cabal.validate.project cabal-install:exe:cabal)
           # We have to tar the executable to preserve executable permissions
           # see https://github.com/actions/upload-artifact/issues/38
           DIR=$(dirname "$CABAL_EXEC")
           FILE=$(basename "$CABAL_EXEC")
-          CABAL_EXEC_TAR="cabal-head-${{ runner.os }}-static-x86_64.tar.gz"
+          CABAL_EXEC_TAR="cabal-head-${{ runner.os }}-static-$CABAL_ARCH.tar.gz"
           tar -czvf "$CABAL_EXEC_TAR" -C "$DIR" "$FILE"
           echo "CABAL_EXEC_TAR=$CABAL_EXEC_TAR" >> "$GITHUB_ENV"
 
       - name: Upload cabal-install executable to workflow artifacts
         uses: actions/upload-artifact@v4
         with:
-          name: cabal-${{ runner.os }}-static-x86_64
+          name: cabal-${{ runner.os }}-static-${{ env.CABAL_ARCH }}
           path: ${{ env.CABAL_EXEC_TAR }}
 
   # The previous jobs use a released version of cabal to build cabal HEAD itself
@@ -409,41 +229,21 @@ jobs:
         # We only use one ghc version the used one for the next release (defined at top of the workflow)
         # We need to build an array dynamically to inject the appropiate env var in a previous job,
         # see https://docs.github.com/en/actions/learn-github-actions/expressions#fromjson
-        ghc: ${{ fromJSON (needs.validate.outputs.GHC_FOR_RELEASE) }}
+        ghc: ${{ fromJSON (needs.config.outputs.GHC_FOR_RELEASE) }}
     defaults:
       run:
         shell: ${{ matrix.sys.shell }}
 
     steps:
-      # TODO: make a reusable action for this
-      - name: Canonicalize architecture
-        run: |
-          case ${{ runner.arch }} in
-            X86) arch=i386 ;;
-            X64) arch=x86_64 ;;
-            ARM64) arch=aarch64 ;;
-            *) echo "Unsupported architecture" 2>/dev/null; exit 1 ;;
-          esac
-          echo "CABAL_ARCH=$arch" >> "$GITHUB_ENV"
-
-      - name: "MAC: Work around XDG directories existence (haskell-actions/setup#62)"
-        if: runner.os == 'macOS'
-        run: |
-          rm -rf ~/.config/cabal
-          rm -rf ~/.cache/cabal
-
-      - name: "WIN: Setup TMP environment variable"
-        if: runner.os == 'Windows'
-        run: |
-           echo "TMP=${{ runner.temp }}" >> "$GITHUB_ENV"
-
       - uses: actions/checkout@v4
 
-      - uses: haskell-actions/setup@v2
-        id: setup-haskell
+      - uses: ./.github/actions/cabal-setup
         with:
-          ghc-version: ${{ matrix.ghc }}
-          cabal-version: latest # default, we are not using it in this job
+          ghc: ${{ matrix.ghc }}
+          shell: ${{ matrix.sys.shell }}
+          allow-newer: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.allow_newer || '' }}
+          constraints: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.constraints || '' }}
+          with_cache: 'false'
 
       - name: Download cabal executable from workflow artifacts
         uses: actions/download-artifact@v4
@@ -452,15 +252,18 @@ jobs:
           path: cabal-head
 
       - name: Untar the cabal executable
-        run: tar -xzf "./cabal-head/cabal-head-${{ runner.os }}-$CABAL_ARCH.tar.gz" -C cabal-head
+        run: |
+          tar -xzf "./cabal-head/cabal-head-${{ runner.os }}-$CABAL_ARCH.tar.gz" -C cabal-head
 
       - name: print-config using cabal HEAD
-        run: sh validate.sh ${{ env.COMMON_FLAGS }} --with-cabal ./cabal-head/cabal -s print-config
+        run: |
+          sh validate.sh $COMMON_FLAGS --with-cabal ./cabal-head/cabal -s print-config
 
-      # We dont use cache to force a build with a fresh store dir and build dir
+      # We don't use cache to force a build with a fresh store dir and build dir
       # This way we check cabal can build all its dependencies
       - name: Build using cabal HEAD
-        run: sh validate.sh ${{ env.COMMON_FLAGS }} --with-cabal ./cabal-head/cabal -s build
+        run: |
+          sh validate.sh $COMMON_FLAGS --with-cabal ./cabal-head/cabal -s build
 
   prerelease-head:
     name: Create a GitHub prerelease with the binary artifacts
@@ -504,7 +307,6 @@ jobs:
         path: binaries
 
     - run: |
-        # bash-ism, but we forced bash above
         cd binaries
         for f in cabal-*; do
           mv "$f" "cabal-lts-${f##cabal-}"
@@ -517,6 +319,7 @@ jobs:
       uses: softprops/action-gh-release@v2
       with:
         tag_name: cabal-lts-head
+        target_commitish: '3.12'
         prerelease: true
         files: binaries/cabal-*
 
diff --git a/cabal-testsuite/PackageTests/BuildDeps/SameDepsAllRound/lemon.hs b/cabal-testsuite/PackageTests/BuildDeps/SameDepsAllRound/lemon.hs
index a775b158cc1..7f3da431021 100644
--- a/cabal-testsuite/PackageTests/BuildDeps/SameDepsAllRound/lemon.hs
+++ b/cabal-testsuite/PackageTests/BuildDeps/SameDepsAllRound/lemon.hs
@@ -1,6 +1,8 @@
 import qualified Data.ByteString.Char8 as C
 import Text.PrettyPrint
 
+deliberate syntax error for testing
+
 main = do
     putStrLn (render (text "foo"))
     let text = "lemon"