ci: prevent stale branch builds and image promotion

Author: Aethersailor

.github/workflows/build-dockerhub.yml

@@ -31,13 +31,54 @@ permissions:
 
 concurrency:
   group: dockerhub-${{ inputs.overwrite_existing_release && inputs.release_tag || github.ref_name }}
-  cancel-in-progress: true
+  cancel-in-progress: false
 
 jobs:
+  source-head:
+    name: "🧭 Verify Current Source Head"
+    runs-on: ubuntu-latest
+    outputs:
+      current: ${{ steps.verify.outputs.current }}
+    steps:
+      - name: Skip stale branch events
+        id: verify
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
+        with:
+          script: |
+            const isBranch = context.ref.startsWith('refs/heads/');
+            const checksBranchHead =
+              isBranch &&
+              (context.eventName === 'push' || context.eventName === 'workflow_dispatch');
+
+            if (!checksBranchHead) {
+              core.setOutput('current', 'true');
+              return;
+            }
+
+            const branch = context.ref.slice('refs/heads/'.length);
+            const { data } = await github.rest.repos.getBranch({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              branch,
+            });
+            const currentSha = data.commit.sha;
+            const isCurrent = currentSha === context.sha;
+
+            core.setOutput('current', String(isCurrent));
+            if (isCurrent) {
+              core.info(`${context.sha} is still the current head of ${branch}.`);
+            } else {
+              core.notice(
+                `Skipping stale ${context.eventName} event for ${context.sha}; ` +
+                `${branch} now points to ${currentSha}.`
+              );
+            }
+
   prepare:
     name: "🔧 Prepare Metadata"
     runs-on: ubuntu-latest
-    if: github.actor != 'dependabot[bot]' && !contains(github.event.head_commit.message, '[skip ci]') && !contains(github.event.head_commit.message, '[ci skip]')
+    needs: source-head
+    if: needs.source-head.outputs.current == 'true' && github.actor != 'dependabot[bot]' && !contains(github.event.head_commit.message, '[skip ci]') && !contains(github.event.head_commit.message, '[ci skip]')
     outputs:
       sha_short: ${{ steps.vars.outputs.sha_short }}
       version: ${{ steps.mode.outputs.version }}
@@ -578,6 +619,53 @@ jobs:
     needs: [prepare, build-linux]
     if: github.event_name != 'pull_request' && needs.prepare.outputs.mode != 'master'
     steps:
+      - name: Prevent stale dev image promotion
+        if: needs.prepare.outputs.mode == 'dev'
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
+        env:
+          SOURCE_SHA: ${{ github.sha }}
+        with:
+          script: |
+            const branch = context.ref.replace('refs/heads/', '');
+            const sourceSha = process.env.SOURCE_SHA;
+            const { data: branchData } = await github.rest.repos.getBranch({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              branch,
+            });
+            const currentSha = branchData.commit.sha;
+
+            if (currentSha === sourceSha) {
+              core.info(`${sourceSha} is still the current head of ${branch}.`);
+              return;
+            }
+
+            const { data: currentCommit } = await github.rest.repos.getCommit({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              ref: currentSha,
+            });
+            const generatedCommitTitle =
+              'chore: update generated development inputs after build [skip ci]';
+            const isExpectedGeneratedChild =
+              currentCommit.parents.length === 1 &&
+              currentCommit.parents[0].sha === sourceSha &&
+              currentCommit.commit.message.split('\n', 1)[0] === generatedCommitTitle &&
+              currentCommit.committer?.login === 'github-actions[bot]';
+
+            if (isExpectedGeneratedChild) {
+              core.info(
+                `${currentSha} is the expected generated child of ${sourceSha}; ` +
+                'promotion remains valid.'
+              );
+              return;
+            }
+
+            core.setFailed(
+              `Refusing to promote stale image for ${sourceSha}; ` +
+              `${branch} now points to ${currentSha}.`
+            );
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
 

.github/workflows/codeql.yml

@@ -9,13 +9,54 @@ on:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  cancel-in-progress: false
 
 jobs:
+  source-head:
+    name: Verify Current Source Head
+    runs-on: ubuntu-latest
+    outputs:
+      current: ${{ steps.verify.outputs.current }}
+    steps:
+      - name: Skip stale branch events
+        id: verify
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
+        with:
+          script: |
+            const isBranch = context.ref.startsWith('refs/heads/');
+            const checksBranchHead =
+              isBranch &&
+              (context.eventName === 'push' || context.eventName === 'workflow_dispatch');
+
+            if (!checksBranchHead) {
+              core.setOutput('current', 'true');
+              return;
+            }
+
+            const branch = context.ref.slice('refs/heads/'.length);
+            const { data } = await github.rest.repos.getBranch({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              branch,
+            });
+            const currentSha = data.commit.sha;
+            const isCurrent = currentSha === context.sha;
+
+            core.setOutput('current', String(isCurrent));
+            if (isCurrent) {
+              core.info(`${context.sha} is still the current head of ${branch}.`);
+            } else {
+              core.notice(
+                `Skipping stale ${context.eventName} event for ${context.sha}; ` +
+                `${branch} now points to ${currentSha}.`
+              );
+            }
+
   analyze:
     name: Analyze (${{ matrix.language }})
     runs-on: ubuntu-latest
-    if: github.actor != 'dependabot[bot]'
+    needs: source-head
+    if: needs.source-head.outputs.current == 'true' && github.actor != 'dependabot[bot]'
     permissions:
       actions: read
       contents: read