ci: keep stale reruns out of version-tag queue

Agent-Logs-Url: https://github.com/vyos/vyos-documentation/sessions/74be7b98-780e-4cbf-8177-11534c4ec2d7

Co-authored-by: andamasov <12631358+andamasov@users.noreply.github.com>

1 files changed, 38 insertions, 17 deletions

diff --git a/.github/workflows/update-version-tags.yml b/.github/workflows/update-version-tags.yml
index 669d94ed..a9eb463f 100644
--- a/.github/workflows/update-version-tags.yml
+++ b/.github/workflows/update-version-tags.yml
@@ -13,24 +13,16 @@ on:
 permissions:
   contents: write
 
-concurrency:
-  # Per-branch group so concurrent runs serialize: back-to-back pushes
-  # land their tag-moves in commit order rather than racing.
-  # cancel-in-progress: false because a stale "Re-run jobs" replay would
-  # otherwise cancel the in-progress current-HEAD run; the HEAD-equivalence
-  # guard in the job body handles stale re-runs by exiting 0.
-  group: version-tag-${{ github.ref_name }}
-  cancel-in-progress: false
-
 jobs:
-  retag:
+  check_head:
     runs-on: ubuntu-latest
+    outputs:
+      is_current: ${{ steps.head_check.outputs.is_current }}
+      tag: ${{ steps.branch_tag.outputs.tag }}
     steps:
-      - name: Move version tag to pushed SHA
+      - name: Resolve version tag for branch
+        id: branch_tag
         env:
-          GH_TOKEN: ${{ github.token }}
-          REPO: ${{ github.repository }}
-          SHA: ${{ github.sha }}
           BRANCH: ${{ github.ref_name }}
         run: |
           set -euo pipefail
@@ -40,16 +32,45 @@ jobs:
             sagitta)  TAG=1.4 ;;
             *) echo "Unexpected branch: $BRANCH" >&2; exit 1 ;;
           esac
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
 
-          # Skip stale re-runs: GitHub's "Re-run jobs" replays the original
-          # event SHA, which would move the version tag backward to a stale
-          # commit. Compare event SHA against the current branch HEAD.
+      - name: Check event SHA matches current branch HEAD
+        id: head_check
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          SHA: ${{ github.sha }}
+          BRANCH: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
           HEAD_SHA="$(gh api "repos/$REPO/branches/$BRANCH" --jq '.commit.sha')"
           if [ "$HEAD_SHA" != "$SHA" ]; then
             echo "Skipping stale run: event SHA=$SHA, current $BRANCH HEAD=$HEAD_SHA"
+            echo "is_current=false" >> "$GITHUB_OUTPUT"
             exit 0
           fi
 
+          echo "is_current=true" >> "$GITHUB_OUTPUT"
+
+  retag:
+    needs: check_head
+    if: needs.check_head.outputs.is_current == 'true'
+    runs-on: ubuntu-latest
+    concurrency:
+      # Per-branch job concurrency serializes tag moves while letting stale
+      # re-runs exit before they contend for the single pending slot.
+      group: version-tag-${{ github.ref_name }}
+      cancel-in-progress: false
+    steps:
+      - name: Move version tag to pushed SHA
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          SHA: ${{ github.sha }}
+          BRANCH: ${{ github.ref_name }}
+          TAG: ${{ needs.check_head.outputs.tag }}
+        run: |
+          set -euo pipefail
           echo "Pointing tag '$TAG' at $SHA (branch $BRANCH)"
 
           # PATCH the tag if it exists; create on 404; fail loud on any other