CI: No Hackage candidate for published version (copy #3186)

[mergify]

Since haskell/hackage-server#1469 (Check candidate uploads against main index), Hackage no longer allows candidates for published versions.

But we use the .ci/publish_sdist.sh script from our stable branches to publish a candidate before we do the final release, so we do want it to run for nightlies on our stable branch. But we need to differentiate between runs that do not contain a new version and runs that do contain a new version.

So we do this check in the CI job, and exit with a special exit code to flag when we did not upload a candidate. This means normal nightlies will have an exclamation mark in an orange circle next to the hackage-release-candidate, indicating a failure that does not cause the pipeline as a whole to fail.

When the "special" nightly before a release is run, the developer inspecting the result should verify a candidate was published (check mark in green circle). In the usual case, where only one candidate will be uploaded before release, they will also necessarily notice that the candidate is simply not on Hackage if they forget to check the CI job's result.

Because we don't have control over the exit codes of any binaries we invoke, a trap handler is added in .ci/functions.sh that makes sure no other exits will have the exit code we reserve for allowed-to-fail. Currently, GitLab runners will not actually propagate the exit code of a failing step in the script, but this might very well change in an update. So we also proof our .ci/setup.sh script against such exits so they don't trigger unwantedly in the hackage-release-candidate job.

Still TODO:

• Write a changelog entry (see changelog/README.md)
• Check copyright notices are up to date in edited files

---

This is an automatic copy of pull request #3186 done by [Mergify](https://mergify.com).