feat: fail build if weak dependency fails

Add a mechanism to track weak dependency build results and ensure
that packages wait for their weak deps to complete before running
build commands. This prevents publishing packages (e.g., docker images)
when their weak dependencies (e.g., Go library tests) have failed.

Implementation:
- Add weakDepResult struct with broadcast channel pattern
- Multiple packages can wait on the same weak dep result
- Packages wait for weak deps of themselves AND their hard deps
- Wait happens before build commands run (prevents docker push, etc.)

Example scenario that now fails correctly:
  docker:img -> go-app:app -> go-lib:lib (weak dep)

If go-lib tests fail, docker:img build will fail before pushing.

Co-authored-by: Ona <no-reply@ona.com>

Author: iQQBot

pkg/leeway/build.go

@@ -82,6 +82,35 @@ type buildContext struct {
 	InFlightChecksums      bool              // Feature enabled flag
 	artifactChecksums      map[string]string // path -> sha256 hex
 	artifactChecksumsMutex sync.RWMutex      // Thread safety for parallel builds
+
+	// Weak dependency result tracking
+	// Allows packages to wait for their weak deps to complete before marking success
+	weakDepResults   map[string]*weakDepResult
+	weakDepResultsMu sync.RWMutex
+}
+
+// weakDepResult tracks the build result of a weak dependency.
+// Uses a closed channel as broadcast mechanism - multiple waiters can wait on the same result.
+type weakDepResult struct {
+	done chan struct{} // Closed when build completes - acts as broadcast
+	err  error         // Build error (nil if success), set before closing done
+}
+
+func newWeakDepResult() *weakDepResult {
+	return &weakDepResult{done: make(chan struct{})}
+}
+
+// Wait blocks until the weak dep build completes and returns the result.
+// Multiple goroutines can call Wait on the same result.
+func (r *weakDepResult) Wait() error {
+	<-r.done
+	return r.err
+}
+
+// Signal marks the weak dep build as complete and broadcasts to all waiters.
+func (r *weakDepResult) Signal(err error) {
+	r.err = err
+	close(r.done)
 }
 
 const (
@@ -229,6 +258,71 @@ func (c *buildContext) ReleaseBuildLock(p *Package) {
 	c.pkgLockCond.L.Unlock()
 }
 
+// InitWeakDepTracking initializes tracking for weak dependency build results.
+// Must be called before starting weak dep builds.
+func (c *buildContext) InitWeakDepTracking(weakDeps []*Package) {
+	c.weakDepResultsMu.Lock()
+	defer c.weakDepResultsMu.Unlock()
+
+	c.weakDepResults = make(map[string]*weakDepResult)
+	for _, wd := range weakDeps {
+		c.weakDepResults[wd.FullName()] = newWeakDepResult()
+	}
+}
+
+// SignalWeakDepComplete marks a weak dependency build as complete.
+// Broadcasts the result to all packages waiting on this weak dep.
+func (c *buildContext) SignalWeakDepComplete(pkg *Package, err error) {
+	c.weakDepResultsMu.RLock()
+	result, ok := c.weakDepResults[pkg.FullName()]
+	c.weakDepResultsMu.RUnlock()
+
+	if ok {
+		result.Signal(err)
+	}
+}
+
+// WaitForWeakDeps waits for all weak dependencies of a package to complete.
+// This includes weak deps of the package itself AND weak deps of its transitive hard dependencies.
+// Returns an error if any weak dep failed.
+func (c *buildContext) WaitForWeakDeps(pkg *Package) error {
+	// Collect all weak deps: direct weak deps + weak deps of hard deps
+	weakDepsToWait := make(map[string]struct{})
+
+	// Add direct weak deps
+	for _, wd := range pkg.GetTransitiveWeakDependencies() {
+		weakDepsToWait[wd.FullName()] = struct{}{}
+	}
+
+	// Add weak deps of hard dependencies (transitive)
+	for _, dep := range pkg.GetTransitiveDependencies() {
+		for _, wd := range dep.GetTransitiveWeakDependencies() {
+			weakDepsToWait[wd.FullName()] = struct{}{}
+		}
+	}
+
+	if len(weakDepsToWait) == 0 {
+		return nil
+	}
+
+	for wdName := range weakDepsToWait {
+		c.weakDepResultsMu.RLock()
+		result, ok := c.weakDepResults[wdName]
+		c.weakDepResultsMu.RUnlock()
+
+		if !ok {
+			// Not tracked - might be cached or not a weak dep of this build
+			continue
+		}
+
+		if err := result.Wait(); err != nil {
+			return xerrors.Errorf("weak dependency %s failed: %w", wdName, err)
+		}
+	}
+
+	return nil
+}
+
 // LimitConcurrentBuilds blocks until there is a free slot to acutally build.
 // This function effectively limits the number of concurrent builds.
 // We do not do this limiting as part of the build lock, because that would block
@@ -887,12 +981,19 @@ func Build(pkg *Package, opts ...BuildOption) (err error) {
 		return nil
 	}
 
+	// Initialize weak dependency result tracking
+	// This allows packages to wait for their weak deps before marking success
+	ctx.InitWeakDepTracking(weakDeps)
+
 	var buildGroup errgroup.Group
 
+	// Start weak dep builds with result signaling
 	for _, wd := range weakDeps {
 		weakDep := wd
 		buildGroup.Go(func() error {
-			return weakDep.build(ctx)
+			err := weakDep.build(ctx)
+			ctx.SignalWeakDepComplete(weakDep, err)
+			return err
 		})
 	}
 
@@ -1131,35 +1232,6 @@ func (p *Package) buildDependencies(buildctx *buildContext) error {
 	return nil
 }
 
-func (p *Package) buildWeakDeps(buildctx *buildContext) {
-	weakDeps := p.GetTransitiveWeakDependencies()
-	if len(weakDeps) == 0 {
-		return
-	}
-
-	log.WithFields(log.Fields{
-		"package":  p.FullName(),
-		"weakDeps": len(weakDeps),
-	}).Debug("building weak deps in background")
-
-	var wg errgroup.Group
-	for _, dep := range weakDeps {
-		d := dep
-		wg.Go(func() error {
-			return d.build(buildctx)
-		})
-	}
-
-	// Don't block on weak deps - they run in parallel
-	// Errors are logged but don't fail the main build
-	if err := wg.Wait(); err != nil {
-		log.WithFields(log.Fields{
-			"package": p.FullName(),
-			"error":   err,
-		}).Warn("weak dep build failed")
-	}
-}
-
 func (p *Package) build(buildctx *buildContext) (err error) {
 	// Try to obtain lock for building this package
 	doBuild := buildctx.ObtainBuildLock(p)
@@ -1181,10 +1253,6 @@ func (p *Package) build(buildctx *buildContext) (err error) {
 		return err
 	}
 
-	// Start building weak deps in parallel (they don't block this build)
-	// This ensures weak deps are built (for their tests) even when build() is called directly
-	go p.buildWeakDeps(buildctx)
-
 	// Check again after dependencies - might have been built as a dependency
 	if _, alreadyBuilt := buildctx.LocalCache.Location(p); !p.Ephemeral && alreadyBuilt {
 		log.WithField("package", p.FullName()).Info("package was built as dependency, skipping")
@@ -1233,6 +1301,12 @@ func (p *Package) build(buildctx *buildContext) (err error) {
 	buildctx.LimitConcurrentBuilds()
 	defer buildctx.ReleaseConcurrentBuild()
 
+	// Wait for weak dependencies before running build commands.
+	// This ensures we don't do work with side effects (like docker push) if a weak dep failed.
+	if err := buildctx.WaitForWeakDeps(p); err != nil {
+		return err
+	}
+
 	// Build the package based on its type
 	var (
 		result, _ = buildctx.LocalCache.Location(p)