feat: fail build if weak dependency fails

Add a mechanism to track weak dependency build results and ensure
that packages check their weak deps before being marked as successful.

Key behavior:
- Builds run in parallel (no blocking) for maximum parallelism
- After build completes, wait for weak deps to finish
- If any weak dep failed, mark this package as failed too
- Weak deps themselves skip this check (their result is signaled to dependents)
- This prevents caching/publishing packages whose weak deps failed

Implementation:
- Add weakDepResult struct with broadcast channel pattern
- Multiple packages can wait on the same weak dep result
- Packages wait for weak deps of themselves AND their hard deps
- Wait happens after build, before RegisterNewlyBuilt()
- IsWeakDep() check skips waiting for packages that are weak deps themselves

Example scenario:
  docker:img -> go-app:app -> go-lib:lib (weak dep)

All three build in parallel. If go-lib tests fail:
1. go-lib:lib fails, signals result (doesn't wait for others)
2. docker:img build completes
3. docker:img waits for weak deps, sees go-lib failed
4. docker:img marked as failed, not cached

Co-authored-by: Ona <no-reply@ona.com>

Author: iQQBot

pkg/leeway/build.go

@@ -82,6 +82,35 @@ type buildContext struct {
 	InFlightChecksums      bool              // Feature enabled flag
 	artifactChecksums      map[string]string // path -> sha256 hex
 	artifactChecksumsMutex sync.RWMutex      // Thread safety for parallel builds
+
+	// Weak dependency result tracking
+	// Allows packages to wait for their weak deps to complete before marking success
+	weakDepResults   map[string]*weakDepResult
+	weakDepResultsMu sync.RWMutex
+}
+
+// weakDepResult tracks the build result of a weak dependency.
+// Uses a closed channel as broadcast mechanism - multiple waiters can wait on the same result.
+type weakDepResult struct {
+	done chan struct{} // Closed when build completes - acts as broadcast
+	err  error         // Build error (nil if success), set before closing done
+}
+
+func newWeakDepResult() *weakDepResult {
+	return &weakDepResult{done: make(chan struct{})}
+}
+
+// Wait blocks until the weak dep build completes and returns the result.
+// Multiple goroutines can call Wait on the same result.
+func (r *weakDepResult) Wait() error {
+	<-r.done
+	return r.err
+}
+
+// Signal marks the weak dep build as complete and broadcasts to all waiters.
+func (r *weakDepResult) Signal(err error) {
+	r.err = err
+	close(r.done)
 }
 
 const (
@@ -229,6 +258,80 @@ func (c *buildContext) ReleaseBuildLock(p *Package) {
 	c.pkgLockCond.L.Unlock()
 }
 
+// InitWeakDepTracking initializes tracking for weak dependency build results.
+// Must be called before starting weak dep builds.
+func (c *buildContext) InitWeakDepTracking(weakDeps []*Package) {
+	c.weakDepResultsMu.Lock()
+	defer c.weakDepResultsMu.Unlock()
+
+	c.weakDepResults = make(map[string]*weakDepResult)
+	for _, wd := range weakDeps {
+		c.weakDepResults[wd.FullName()] = newWeakDepResult()
+	}
+}
+
+// IsWeakDep returns true if the package is being tracked as a weak dependency.
+func (c *buildContext) IsWeakDep(pkg *Package) bool {
+	c.weakDepResultsMu.RLock()
+	defer c.weakDepResultsMu.RUnlock()
+
+	_, ok := c.weakDepResults[pkg.FullName()]
+	return ok
+}
+
+// SignalWeakDepComplete marks a weak dependency build as complete.
+// Broadcasts the result to all packages waiting on this weak dep.
+func (c *buildContext) SignalWeakDepComplete(pkg *Package, err error) {
+	c.weakDepResultsMu.RLock()
+	result, ok := c.weakDepResults[pkg.FullName()]
+	c.weakDepResultsMu.RUnlock()
+
+	if ok {
+		result.Signal(err)
+	}
+}
+
+// WaitForWeakDeps waits for all weak dependencies of a package to complete.
+// This includes weak deps of the package itself AND weak deps of its transitive hard dependencies.
+// Returns an error if any weak dep failed.
+func (c *buildContext) WaitForWeakDeps(pkg *Package) error {
+	// Collect all weak deps: direct weak deps + weak deps of hard deps
+	weakDepsToWait := make(map[string]struct{})
+
+	// Add direct weak deps
+	for _, wd := range pkg.GetTransitiveWeakDependencies() {
+		weakDepsToWait[wd.FullName()] = struct{}{}
+	}
+
+	// Add weak deps of hard dependencies (transitive)
+	for _, dep := range pkg.GetTransitiveDependencies() {
+		for _, wd := range dep.GetTransitiveWeakDependencies() {
+			weakDepsToWait[wd.FullName()] = struct{}{}
+		}
+	}
+
+	if len(weakDepsToWait) == 0 {
+		return nil
+	}
+
+	for wdName := range weakDepsToWait {
+		c.weakDepResultsMu.RLock()
+		result, ok := c.weakDepResults[wdName]
+		c.weakDepResultsMu.RUnlock()
+
+		if !ok {
+			// Not tracked - might be cached or not a weak dep of this build
+			continue
+		}
+
+		if err := result.Wait(); err != nil {
+			return xerrors.Errorf("weak dependency %s failed: %w", wdName, err)
+		}
+	}
+
+	return nil
+}
+
 // LimitConcurrentBuilds blocks until there is a free slot to acutally build.
 // This function effectively limits the number of concurrent builds.
 // We do not do this limiting as part of the build lock, because that would block
@@ -887,12 +990,19 @@ func Build(pkg *Package, opts ...BuildOption) (err error) {
 		return nil
 	}
 
+	// Initialize weak dependency result tracking
+	// This allows packages to wait for their weak deps before marking success
+	ctx.InitWeakDepTracking(weakDeps)
+
 	var buildGroup errgroup.Group
 
+	// Start weak dep builds with result signaling
 	for _, wd := range weakDeps {
 		weakDep := wd
 		buildGroup.Go(func() error {
-			return weakDep.build(ctx)
+			err := weakDep.build(ctx)
+			ctx.SignalWeakDepComplete(weakDep, err)
+			return err
 		})
 	}
 
@@ -1131,35 +1241,6 @@ func (p *Package) buildDependencies(buildctx *buildContext) error {
 	return nil
 }
 
-func (p *Package) buildWeakDeps(buildctx *buildContext) {
-	weakDeps := p.GetTransitiveWeakDependencies()
-	if len(weakDeps) == 0 {
-		return
-	}
-
-	log.WithFields(log.Fields{
-		"package":  p.FullName(),
-		"weakDeps": len(weakDeps),
-	}).Debug("building weak deps in background")
-
-	var wg errgroup.Group
-	for _, dep := range weakDeps {
-		d := dep
-		wg.Go(func() error {
-			return d.build(buildctx)
-		})
-	}
-
-	// Don't block on weak deps - they run in parallel
-	// Errors are logged but don't fail the main build
-	if err := wg.Wait(); err != nil {
-		log.WithFields(log.Fields{
-			"package": p.FullName(),
-			"error":   err,
-		}).Warn("weak dep build failed")
-	}
-}
-
 func (p *Package) build(buildctx *buildContext) (err error) {
 	// Try to obtain lock for building this package
 	doBuild := buildctx.ObtainBuildLock(p)
@@ -1181,10 +1262,6 @@ func (p *Package) build(buildctx *buildContext) (err error) {
 		return err
 	}
 
-	// Start building weak deps in parallel (they don't block this build)
-	// This ensures weak deps are built (for their tests) even when build() is called directly
-	go p.buildWeakDeps(buildctx)
-
 	// Check again after dependencies - might have been built as a dependency
 	if _, alreadyBuilt := buildctx.LocalCache.Location(p); !p.Ephemeral && alreadyBuilt {
 		log.WithField("package", p.FullName()).Info("package was built as dependency, skipping")
@@ -1338,6 +1415,16 @@ func (p *Package) build(buildctx *buildContext) (err error) {
 		}
 	}
 
+	// Wait for weak dependencies before marking success.
+	// Build runs in parallel, but we don't cache/publish if weak deps failed.
+	// Skip this check if we are a weak dependency ourselves - our result will be
+	// signaled to whoever depends on us.
+	if !buildctx.IsWeakDep(p) {
+		if err := buildctx.WaitForWeakDeps(p); err != nil {
+			return err
+		}
+	}
+
 	// Register newly built package
 	return buildctx.RegisterNewlyBuilt(p)
 }