Enforce rollback safety PR checks

.github/pull_request_template.md

@@ -7,6 +7,18 @@
 <!-- If this is an API or ABI breaking change, please apply the
 corresponding GitHub label. -->
 
+# Rollback safety impact
+
+<!--
+If this PR is safe to roll back after deployment and has no impact on the rollback safety of any prior PRs, write `n/a` below.
+
+Otherwise, list every prerequisite PR that must be included in a release before this PR can merge. This PR must not be deployed until each prerequisite has been deployed and sufficiently observed or tested in the live deployment that we are confident it will not be rolled back. Supported forms include #123, SpacetimeDB#123, clockworklabs/SpacetimeDB#123, and GitHub PR URLs.
+
+Consider whether this PR:
+- newly writes to a previously introduced but unused ControlDB table or reducer, system table, or on-disk data format; or
+- clears, deletes, incompatibly changes, or renders unsupported a previously available ControlDB table or reducer, system table, or on-disk data format.
+-->
+
 # Expected complexity level and risk
 
 <!--

.github/workflows/check-pr-base.yml

@@ -2,10 +2,15 @@ name: Git tree checks
 
 on:
   pull_request:
-    types: [opened, edited]
+    types: [opened, reopened, edited]
+  # TODO: This isn't used, probably remove it?
   merge_group:
 permissions: read-all
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.inputs.pr_number || format('sha-{0}', github.sha) }}
+  cancel-in-progress: true
+
 jobs:
   check_base_ref:
     name: Based on `master`
@@ -18,3 +23,22 @@ jobs:
         run: |
           echo "This PR is not based on master. Please wait until the base PR merges."
           exit 1
+
+  release_dependencies:
+    if: ${{ github.event_name == 'pull_request' }}
+    name: Check release dependencies
+    runs-on: spacetimedb-new-runner-2
+    permissions:
+      contents: read
+      pull-requests: read
+    env:
+      GH_TOKEN: ${{ github.token }}
+      CARGO_TARGET_DIR: ${{ github.workspace }}/target
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dsherret/rust-toolchain-file@v1
+      - name: Check release dependencies
+        run: >-
+          cargo ci other-workflows check-release-deps
+          --repo clockworklabs/SpacetimeDB
+          --pr-number "${{ github.event.pull_request.number }}"

.github/workflows/ci.yml

@@ -512,6 +512,7 @@ jobs:
       RUST_BACKTRACE: full
       TARGET_TRIPLE: x86_64-unknown-linux-gnu
       OPENSSL_CACHE_SUFFIX: ""
+      GH_TOKEN: ${{ github.token }}
     steps:
       - name: Find Git ref
         env:

Cargo.toml

@@ -84,13 +84,15 @@ members = [
   "tools/ci/commands/cla-assistant",
   "tools/ci/commands/coordinate-internal-tests",
   "tools/ci/commands/workflow-watch",
+  "tools/ci/commands/check-release-deps",
   "tools/ci/common",
   "tools/keynote-bench-harness",
   "tools/license-check",
   "tools/replace-spacetimedb",
   "tools/generate-client-api",
   "tools/gen-bindings",
   "tools/release",
+  "tools/lookup-pr-release",
   "tools/regen",
   "tools/xtask-llm-benchmark",
   "crates/bindings-typescript/test-app/server",

tools/ci/commands/check-release-deps/Cargo.toml

@@ -0,0 +1,14 @@
+[package]
+name = "ci-check-release-deps"
+version = "0.1.0"
+edition.workspace = true
+
+[dependencies]
+anyhow.workspace = true
+clap.workspace = true
+lookup-pr-release = { path = "../../../lookup-pr-release" }
+regex.workspace = true
+serde.workspace = true
+
+[lints]
+workspace = true