ci: re-validate HEAD inside retag job

Both Copilot and CodeRabbit flagged the same hole on PR #1958: GitHub's
"Re-run failed jobs" can execute retag in isolation, skipping
check_head. If the branch HEAD advanced since the original run, the
isolated retag would PATCH the tag to a stale github.sha.

Add the same HEAD-equivalence guard inside retag, immediately before
the PATCH/POST. Defense-in-depth — both jobs check, so neither full
re-runs nor selective retag re-runs can move the tag backward.

🤖 Generated by [robots](https://vyos.io)

1 files changed, 12 insertions, 0 deletions

diff --git a/.github/workflows/update-version-tags.yml b/.github/workflows/update-version-tags.yml
index a9eb463f..d6b642f4 100644
--- a/.github/workflows/update-version-tags.yml
+++ b/.github/workflows/update-version-tags.yml
@@ -71,6 +71,18 @@ jobs:
           TAG: ${{ needs.check_head.outputs.tag }}
         run: |
           set -euo pipefail
+
+          # Re-validate HEAD inside retag too: GitHub's "Re-run failed jobs"
+          # can re-execute retag in isolation without re-running check_head,
+          # and the branch HEAD may have advanced since the original run.
+          # Without this guard, a re-run of just retag would PATCH the tag
+          # to a stale github.sha.
+          HEAD_SHA="$(gh api "repos/$REPO/branches/$BRANCH" --jq '.commit.sha')"
+          if [ "$HEAD_SHA" != "$SHA" ]; then
+            echo "Skipping stale retag: event SHA=$SHA, current $BRANCH HEAD=$HEAD_SHA"
+            exit 0
+          fi
+
           echo "Pointing tag '$TAG' at $SHA (branch $BRANCH)"
 
           # PATCH the tag if it exists; create on 404; fail loud on any other