feat: checks run after the checks they depend on

Merged
EV
3d ago
+800-97

Description

Second backend PR for the connector checks redesign, stacked on #16156. Checks now run after the checks they depend on, so one cause shows on one row: a rejected token shows on the sign-in row only.

  • depends_on on CapabilityCheck: the check ids it runs after. run_order runs dependencies first; validation checks still run before discovery checks. A dependency that does not apply is left out, so a check can list alternatives, for example both token types' sign-in checks.

  • Not run. A dependency that FAILED, is INCOMPLETE or did not run stops the check. The check makes no call and is SKIPPED with:

    • not_run_reason: dependency_failed, dependency_incomplete or dependency_skipped;
    • blocked_by: the first stopping dependency;
    • a message such as "Not run: Credential signs in to the site failed".

    A dependency that a gate stopped passes its reason and blocker on, so every row of a chain names the check that failed.

  • Rate limit. After a check is rate limited, the rest of the run is SKIPPED with not_run_reason: rate_limited.

  • prior_results replaces required_check_failed. Draft-cache results and the results of an earlier stored run count as dependencies.

  • Creation still runs its checks side by side within its 3 s budget, then applies the same rule (stop_blocked_results). An unfinished check whose finished dependency failed is stored as not run, not as incomplete.

  • Draft runs. A check waits while a dependency waits, for the same fields (wait_for_dependencies). A not-run result is never cached, so it re-runs once the cause is fixed.

  • Producers. Confluence and Jira declare their dependencies in the design's run order. A registry test checks every source: each dependency must be registered, and the order must have no cycle. Other connectors follow in their own PRs.

The frontend needs no change: a not-run row shows its message, and the new fields are additive. The redesigned rows are the frontend owner's work.

How Has This Been Tested?

  • New unit tests (test_check_dependencies.py):
    • run order and cycles;
    • a failed chain makes no calls;
    • incomplete and not-applicable dependencies;
    • prior results;
    • the rate-limit stop;
    • the side-by-side rule;
    • waiting passed down a chain.
  • Registry test: dependencies are registered and have no cycle, for every source.
  • Connector and EE unit tests: 4263 passed.
  • The 93 capability-check external dependency tests pass on a scratch DB. ty and ruff are clean.
  • A local ods stack run: a Confluence draft run with a wrong token fails the sign-in row, and every other row reads "Not run: Credential signs in to the site failed" with blocked_by: confluence_auth, making no call.

Additional Options

  • [Optional] Please cherry-pick this PR to the latest release version.
  • [Optional] Override Linear Check

🤖 Generated with Claude Code

Summary by CodeRabbit

  • New Features
    • Capability checks now run in dependency order. Checks blocked by failed, incomplete, or skipped prerequisites are marked as not run and identify the blocker.
    • When a check is rate-limited, later checks are marked as not run.
    • Draft checks wait for prerequisites, with waiting states and missing or invalid information carried through to dependent checks.
    • Dependency blockers are applied when check results are combined and reported.