ci: merge version check into plugin-checks, share packaging as a composite action

- one PR workflow (plugin-checks) with version-changelog, package, phpunit jobs
- .gitea/actions/package: package + validate + assert, used by PR and release
- phpunit: FORCE_INSTALL so the TestBootstrapper installs its own test DB
- protect-main.sh: required context is now plugin-checks / version-changelog

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.gitea/workflows/plugin-checks.yml

@@ -17,6 +17,41 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  # Every PR into main must bump the version and document it in CHANGELOG.md.
+  version-changelog:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Check version bump and changelog entry
+        run: |
+          set -e
+          PR_VERSION=$(grep -m1 '"version"' composer.json | sed -E 's/.*"version"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/')
+          MAIN_VERSION=$(git show origin/main:composer.json | grep -m1 '"version"' | sed -E 's/.*"version"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/')
+
+          echo "main version: $MAIN_VERSION"
+          echo "PR version:   $PR_VERSION"
+
+          if [ "$MAIN_VERSION" = "$PR_VERSION" ]; then
+            echo "::error::composer.json version ($PR_VERSION) was not bumped from main ($MAIN_VERSION)"
+            exit 1
+          fi
+
+          HIGHEST=$(printf '%s\n%s\n' "$MAIN_VERSION" "$PR_VERSION" | sort -V | tail -n1)
+          if [ "$HIGHEST" != "$PR_VERSION" ]; then
+            echo "::error::composer.json version ($PR_VERSION) is not greater than main's ($MAIN_VERSION)"
+            exit 1
+          fi
+
+          if ! grep -qF "## [$PR_VERSION]" CHANGELOG.md; then
+            echo "::error::CHANGELOG.md is missing a '## [$PR_VERSION]' heading"
+            exit 1
+          fi
+
+          echo "OK: version bumped to $PR_VERSION and documented in CHANGELOG.md"
+
   # Packages the extension (builds admin/storefront assets) and validates the resulting zip,
   # which is the artifact that ships. A separate directory validate would only repeat these checks.
   package:
@@ -27,19 +62,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: actions/cache@v4
-        with:
-          path: |
-            ~/.npm
-            ~/.cache/shopware-cli
-          key: swcli-${{ runner.os }}-${{ hashFiles('composer.json', 'src/Resources/app/**/package*.json') }}
-          restore-keys: swcli-${{ runner.os }}-
-      - name: Package extension
-        run: shopware-cli extension package . --output-directory .build --filename package.zip --git-commit "$GITHUB_SHA"
-      - name: Validate packaged zip
-        run: shopware-cli extension validate .build/package.zip
-      - name: Assert built JS is in the zip
-        run: scripts/ci/assert-built-assets.sh .build/package.zip
+      - uses: ./.gitea/actions/package
       # The release workflow reuses this tested zip when main ends up with the same tree
       # (it falls back to packaging again otherwise).
       - name: Tree hash of the packaged commit
@@ -68,6 +91,7 @@ jobs:
       APP_URL: http://localhost
       APP_SECRET: ci-secret-not-for-production
       INSTANCE_ID: ci
+      FORCE_INSTALL: '1' # TestBootstrapper then always installs its own test DB (no separate system:install)
       COMPOSER_MEMORY_LIMIT: '-1'
       COMPOSER_ALLOW_SUPERUSER: '1'
     steps: