fix(ci): make the extension version guard usable as a required check and quoting-proof

Address Copilot review round 1 on #4395.

Workflow: drop the `paths: extensions/**` filter. A required status check
that is skipped by path filtering stays in "Expected" state and blocks
every PR that does not touch extensions/**, which defeats the point of
making the guard a merge requirement. The job now runs on every pull
request; the script already reports success when nothing under
extensions/ changed, so unrelated PRs pass in one short job.

Script: read the changed-path list with `git diff --name-only -z`. With
git's default core.quotePath, a path containing non-ASCII or control
characters is C-quoted with the quotes included
(`"extensions/demo/caf\303\251.txt"`), so its first component was no
longer `extensions` and an unbumped change to such a file escaped the
guard. NUL-delimited output is emitted verbatim; paths are decoded with
surrogateescape so an undecodable byte cannot crash the check, and only
the ASCII `extensions/<id>/` prefix is ever interpreted.

Tests: pin both behaviors. The non-ASCII case fails against the previous
script and passes now; the no-extension-changes case backs the workflow
change. core.quotePath is pinned to true in the fixture repo so the
regression exercises the quoting path even where a developer's global
config disables it.

Refs #4345

Assisted-by: Claude Code (model: claude-fable-5-1)
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: Jakub Baranowski

.github/scripts/check_extension_version_bump.py

@@ -37,7 +37,7 @@
 import json
 import subprocess
 import sys
-from pathlib import Path
+from pathlib import PurePosixPath
 
 import yaml
 from packaging.version import InvalidVersion, Version
@@ -46,10 +46,29 @@
 CATALOG_PATH = f"{EXTENSIONS_ROOT}/catalog.json"
 
 
-def _git(*args: str) -> str:
-    return subprocess.run(
-        ["git", *args], check=True, capture_output=True, text=True
+def _changed_paths(base_ref: str, head_ref: str) -> list[str]:
+    """Paths under extensions/ that differ between *base_ref* and *head_ref*.
+
+    Uses NUL-delimited output (``-z``): without it git C-quotes any path
+    containing non-ASCII or control characters (``"extensions/x/caf\\303\\251"``,
+    quotes included), so the leading component would no longer equal
+    ``extensions`` and that change would silently escape the guard. Paths
+    are decoded with surrogateescape so an undecodable byte can never crash
+    the check; only the ASCII ``extensions/<id>/`` prefix is interpreted.
+    """
+    raw = subprocess.run(
+        [
+            "git", "diff", "--name-only", "-z", "--no-renames",
+            base_ref, head_ref, "--", EXTENSIONS_ROOT,
+        ],
+        check=True,
+        capture_output=True,
     ).stdout
+    return [
+        chunk.decode("utf-8", errors="surrogateescape")
+        for chunk in raw.split(b"\0")
+        if chunk
+    ]
 
 
 def _show(ref: str, path: str) -> str | None:
@@ -87,13 +106,10 @@ def main(argv: list[str]) -> int:
     errors: list[str] = []
 
     # -- Invariant 1: content change requires a version bump ---------------
-    changed = _git(
-        "diff", "--name-only", "--no-renames", base_ref, head_ref, "--", EXTENSIONS_ROOT
-    ).splitlines()
     changed_ids = {
         parts[1]
-        for line in changed
-        if len(parts := Path(line.strip()).parts) >= 3 and parts[0] == EXTENSIONS_ROOT
+        for path in _changed_paths(base_ref, head_ref)
+        if len(parts := PurePosixPath(path).parts) >= 3 and parts[0] == EXTENSIONS_ROOT
     }
 
     for ext_id in sorted(changed_ids):

.github/workflows/extension-version-guard.yml

@@ -9,10 +9,13 @@ permissions:
 # Content changes shipped without a bump go silently stale on every
 # project that already installed the extension (#4345). This guard turns
 # "please remember to bump" into a merge requirement.
+#
+# Deliberately no `paths:` filter: a required status check that is skipped
+# by path filtering stays in "Expected" state and blocks every PR that does
+# not touch extensions/**. The check runs on every pull request instead and
+# the script reports success when nothing under extensions/ changed.
 on:
   pull_request:
-    paths:
-      - "extensions/**"
 
 jobs:
   version-bump:

tests/contract/test_extension_version_guard_script.py

@@ -75,6 +75,9 @@ def guard_repo(tmp_path: Path) -> tuple[Path, str]:
     _git(repo, "config", "user.email", "guard-tests@example.com")
     _git(repo, "config", "user.name", "Guard Tests")
     _git(repo, "config", "commit.gpgsign", "false")
+    # git's default; pinned so the non-ASCII regression below exercises the
+    # C-quoting code path even on machines whose global config disables it.
+    _git(repo, "config", "core.quotePath", "true")
 
     _write_extension(repo, "demo", "1.0.0", "echo base")
     _write_extension(repo, "scratch", "1.0.0", "echo base")  # not in catalog
@@ -114,6 +117,34 @@ def test_unbumped_content_change_fails(guard_repo):
     assert "extensions/demo/extension.yml" in result.stdout
 
 
+def test_unbumped_non_ascii_filename_fails(guard_repo):
+    """With core.quotePath (git's default) `git diff --name-only` C-quotes a
+    path like extensions/demo/café.txt, quotes included, so a line-based
+    parser no longer sees `extensions` as the first component and the
+    change escapes the guard. The NUL-delimited diff must still catch it."""
+    repo, base = guard_repo
+    (repo / "extensions" / "demo" / "café.txt").write_text("new\n", encoding="utf-8")
+    _commit_all(repo, "add non-ascii file without bump")
+
+    result = _run_guard(repo, base)
+    assert result.returncode == 1, result.stdout + result.stderr
+    assert "did not increase" in result.stdout
+    assert "extensions/demo/extension.yml" in result.stdout
+
+
+def test_no_extension_changes_passes(guard_repo):
+    """The workflow runs on every pull request (a path-filtered required check
+    would block PRs that skip it), so a PR touching nothing under extensions/
+    must pass rather than be reported as a violation."""
+    repo, base = guard_repo
+    (repo / "README.md").write_text("docs only\n", encoding="utf-8")
+    _commit_all(repo, "unrelated change")
+
+    result = _run_guard(repo, base)
+    assert result.returncode == 0, result.stdout + result.stderr
+    assert "all invariants hold" in result.stdout
+
+
 def test_downgrade_fails(guard_repo):
     repo, base = guard_repo
     _write_extension(repo, "demo", "0.9.0", "echo changed")