Merge pull request #1958 from vyos/yuriy/fix-update-version-tags-race

ci: serialize update-version-tags runs to close back-to-back-push race

1 files changed, 50 insertions, 15 deletions

diff --git a/.github/workflows/update-version-tags.yml b/.github/workflows/update-version-tags.yml
index 04ccd1e4..d6b642f4 100644
--- a/.github/workflows/update-version-tags.yml
+++ b/.github/workflows/update-version-tags.yml
@@ -13,22 +13,16 @@ on:
 permissions:
   contents: write
 
-concurrency:
-  # Include github.sha so a stale "Re-run jobs" replay (which carries the
-  # original SHA) cannot cancel an in-progress run for the current branch
-  # HEAD. Same-SHA re-runs still deduplicate.
-  group: version-tag-${{ github.ref_name }}-${{ github.sha }}
-  cancel-in-progress: true
-
 jobs:
-  retag:
+  check_head:
     runs-on: ubuntu-latest
+    outputs:
+      is_current: ${{ steps.head_check.outputs.is_current }}
+      tag: ${{ steps.branch_tag.outputs.tag }}
     steps:
-      - name: Move version tag to pushed SHA
+      - name: Resolve version tag for branch
+        id: branch_tag
         env:
-          GH_TOKEN: ${{ github.token }}
-          REPO: ${{ github.repository }}
-          SHA: ${{ github.sha }}
           BRANCH: ${{ github.ref_name }}
         run: |
           set -euo pipefail
@@ -38,13 +32,54 @@ jobs:
             sagitta)  TAG=1.4 ;;
             *) echo "Unexpected branch: $BRANCH" >&2; exit 1 ;;
           esac
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
 
-          # Skip stale re-runs: GitHub's "Re-run jobs" replays the original
-          # event SHA, which would move the version tag backward to a stale
-          # commit. Compare event SHA against the current branch HEAD.
+      - name: Check event SHA matches current branch HEAD
+        id: head_check
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          SHA: ${{ github.sha }}
+          BRANCH: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
           HEAD_SHA="$(gh api "repos/$REPO/branches/$BRANCH" --jq '.commit.sha')"
           if [ "$HEAD_SHA" != "$SHA" ]; then
             echo "Skipping stale run: event SHA=$SHA, current $BRANCH HEAD=$HEAD_SHA"
+            echo "is_current=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "is_current=true" >> "$GITHUB_OUTPUT"
+
+  retag:
+    needs: check_head
+    if: needs.check_head.outputs.is_current == 'true'
+    runs-on: ubuntu-latest
+    concurrency:
+      # Per-branch job concurrency serializes tag moves while letting stale
+      # re-runs exit before they contend for the single pending slot.
+      group: version-tag-${{ github.ref_name }}
+      cancel-in-progress: false
+    steps:
+      - name: Move version tag to pushed SHA
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          SHA: ${{ github.sha }}
+          BRANCH: ${{ github.ref_name }}
+          TAG: ${{ needs.check_head.outputs.tag }}
+        run: |
+          set -euo pipefail
+
+          # Re-validate HEAD inside retag too: GitHub's "Re-run failed jobs"
+          # can re-execute retag in isolation without re-running check_head,
+          # and the branch HEAD may have advanced since the original run.
+          # Without this guard, a re-run of just retag would PATCH the tag
+          # to a stale github.sha.
+          HEAD_SHA="$(gh api "repos/$REPO/branches/$BRANCH" --jq '.commit.sha')"
+          if [ "$HEAD_SHA" != "$SHA" ]; then
+            echo "Skipping stale retag: event SHA=$SHA, current $BRANCH HEAD=$HEAD_SHA"
             exit 0
           fi