@@ -35,7 +35,7 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Install the pinned Docker Compose
-        # Always the pinned version, not whatever the runner has: ubuntu-latest's own Compose recreated every node container when the role ran a second time, which the pinned version does not. The user plugin directory takes precedence over the system one.
+        # Always the pinned version, not whatever the runner has: ubuntu-latest's own Compose is older than the cluster role's github_runner_cluster_compose_min_version, which the role refuses. The user plugin directory takes precedence over the system one.
         run: |
           set -euo pipefail
           docker version --format 'Docker Engine {{.Server.Version}}'
 
@@ -1,6 +1,6 @@
 name: Mesh integration
 
-# Brings up three k3s nodes in Docker and joins them through Headscale with the cluster role (tests/mesh/run.sh), once per scenario: headscale_hosted, headscale_in_cluster, and the headscale_existing policy check. Only on changes that can affect how nodes join the mesh.
+# Brings up three k3s nodes in Docker and joins them through Headscale with the cluster role (tests/mesh/run.sh), once per scenario: headscale_hosted, headscale_in_cluster, and the headscale_existing policy check, plus the role's refusal of a Docker Compose older than its minimum. Only on changes that can affect how nodes join the mesh.
 #
 # Runs on GitHub-hosted ubuntu-latest, whose Docker daemon runs the privileged containers the test needs (k3s, and Tailscale inside it). The work directory sits under runner.temp, which the job always has write access to.
 
@@ -25,22 +25,32 @@ permissions:
 
 jobs:
   mesh:
-    name: Mesh (${{ matrix.scenario }})
+    name: Mesh (${{ matrix.scenario }}, Compose ${{ matrix.compose }})
     runs-on: ubuntu-latest
     timeout-minutes: 45
     strategy:
       fail-fast: false
       matrix:
-        scenario: [existing, hosted, in_cluster]
-    env:
-      COMPOSE_VERSION: v5.5.1
+        # compose is a release tag, or "minimum" for the cluster role's own github_runner_cluster_compose_min_version. The hosted scenario also runs on that minimum, so its rerun check proves the oldest version the role accepts keeps every node running. compose_minimum runs on 2.38.2, the newest release with the rerun fault (docker/compose#13047), and checks the role refuses it.
+        include:
+          - {scenario: existing, compose: v5.5.1}
+          - {scenario: hosted, compose: v5.5.1}
+          - {scenario: in_cluster, compose: v5.5.1}
+          - {scenario: hosted, compose: minimum}
+          - {scenario: compose_minimum, compose: v2.38.2}
     steps:
       - uses: actions/checkout@v7
 
-      - name: Install the pinned Docker Compose
-        # Always the pinned version, not whatever the runner has: ubuntu-latest's own Compose recreated every node container when the role ran a second time, which the pinned version does not. The user plugin directory takes precedence over the system one.
+      - name: Install Docker Compose ${{ matrix.compose }}
+        # Always the matrix's version, not whatever the runner has, so a runner image update never changes what a scenario tests. The user plugin directory takes precedence over the system one.
+        env:
+          COMPOSE_VERSION: ${{ matrix.compose }}
         run: |
           set -euo pipefail
+          if [ "$COMPOSE_VERSION" = minimum ]; then
+            COMPOSE_VERSION="v$(sed -n 's/^github_runner_cluster_compose_min_version: "\(.*\)"$/\1/p' roles/github_runner_cluster/defaults/main.yml)"
+            [ "$COMPOSE_VERSION" != v ] || { echo "No github_runner_cluster_compose_min_version in the role's defaults" >&2; exit 1; }
+          fi
           docker version --format 'Docker Engine {{.Server.Version}}'
           case "$(uname -m)" in
             x86_64) arch=x86_64 ;;
 
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Mesh integration test for the github_runner_cluster role: stands up three k3s nodes in Docker on one machine, each in its own copy of the Compose project, and has the role join them through Headscale. Scenarios: hosted      headscale_hosted: the role runs Headscale under Compose beside the first node. in_cluster  headscale_in_cluster: the role runs Headscale inside the cluster, on the bootstrap server. existing    headscale_existing: the policy check fails, with the entry to add, against a server whose policy lacks autoApprovers, and passes once it has one. Every scenario uses automatic server selection (three hosts, no overrides, so three servers). The cluster scenarios assert that etcd has three members, that every node is Ready, and that pods on different nodes reach each other over the mesh.
+# Mesh integration test for the github_runner_cluster role: stands up three k3s nodes in Docker on one machine, each in its own copy of the Compose project, and has the role join them through Headscale. Scenarios: hosted      headscale_hosted: the role runs Headscale under Compose beside the first node. in_cluster  headscale_in_cluster: the role runs Headscale inside the cluster, on the bootstrap server. existing    headscale_existing: the policy check fails, with the entry to add, against a server whose policy lacks autoApprovers, and passes once it has one. Every scenario uses automatic server selection (three hosts, no overrides, so three servers). compose_minimum  the role refuses a Docker Compose older than its minimum before writing anything (run it under such a Compose; it is not in the default set). The cluster scenarios assert that etcd has three members, that every node is Ready, and that pods on different nodes reach each other over the mesh.
 #
 # Usage: tests/mesh/run.sh <scenario>... (default: all three). Needs Docker with Compose, and Python 3 with ansible-core (ANSIBLE_PLAYBOOK overrides which ansible-playbook runs). Creates only Docker objects named grtest-*, and removes them again on exit unless GRTEST_KEEP=1.
 set -euo pipefail
@@ -274,6 +274,37 @@ scenario_cluster() {
   fi
 }
 
+# The role must refuse a Docker Compose older than its minimum before it writes anything to the host. The workflow installs such a Compose for this scenario; every other scenario runs under a supported one and so also shows the check lets that through.
+scenario_compose_minimum() {
+  local output node
+  reset_environment
+  node="$(node_name 1)"
+  mkdir -p "${work}/${node}"
+  cat > "${work}/inventory.yml" <<EOF
+all:
+  vars:
+    ansible_connection: local
+    ansible_python_interpreter: $(command -v python3)
+  children:
+    github_runner_cluster:
+      vars:
+        github_runner_cluster_k3s_token: ${k3s_token}
+      hosts:
+        ${node}:
+          github_runner_cluster_dir: ${work}/${node}
+          github_runner_cluster_compose_project: ${node}
+EOF
+  log "The role must refuse Docker Compose $(docker compose version --short) before touching the host"
+  if output=$(run_role 2>&1); then
+    echo "$output"; fail "the role ran with a Compose older than its minimum"
+  fi
+  echo "$output" | grep -F "Fail if this host's Docker Compose is older than the role supports" >/dev/null || { echo "$output"; fail "the role failed, but not at the Compose version check"; }
+  echo "$output" | grep -F 'Upgrade the Docker Compose plugin on this host' >/dev/null || { echo "$output"; fail "the failure did not say to upgrade Compose"; }
+  [ -z "$(ls -A "${work}/${node}")" ] || fail "the role wrote to the cluster directory before refusing: $(ls -A "${work}/${node}")"
+  echo "$output" | grep -F 'Upgrade the Docker Compose plugin' | head -n 1
+  log "It did"
+}
+
 scenario_existing() {
   reset_environment
   local fixtures="${repo_root}/tests/mesh/fixtures/headscale-existing" api_url api_key output
@@ -322,6 +353,7 @@ for scenario in "${scenarios[@]}"; do
   case "$scenario" in
     hosted | in_cluster) scenario_cluster "$scenario" ;;
     existing) scenario_existing ;;
+    compose_minimum) scenario_compose_minimum ;;
     # Re-checks a cluster a previous run kept with GRTEST_KEEP=1 and the same GRTEST_WORK, without rebuilding it.
     assert) assert_cluster ;;
     *) fail "unknown scenario ${scenario}" ;;