From 8de21d019fa4af70c88fe25996427aec3c5361ea Mon Sep 17 00:00:00 2001
From: Kodflow <133899878+kodflow@users.noreply.github.com>
Date: Thu, 27 Aug 2026 02:31:13 +0200
Subject: [PATCH] fix(stub): stop a stale run from drafting a pull request a
 newer commit fixed
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The ready_for_review retry path introduced a race, caught in review. Push a
fix while the previous failing run is still going and its block-merge job
drafts the pull request anyway — undoing a ready state the newer, passing
commit had earned, with a notice pointing at a verdict that no longer holds.

Two changes, because one is not enough. A workflow-level concurrency group
cancels an older run when a newer one starts, which covers the common case.
It does not cover a block-merge job already executing, so the job now compares
the head it judged against the pull request's current head and stands down
when they differ.

Grouping on head_ref for pull requests and ref otherwise keeps branches
independent: a run on one branch must never cancel another's verdict.
---
 stub/post-commit.yml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/stub/post-commit.yml b/stub/post-commit.yml
index 1968aa2..7bbd66d 100644
--- a/stub/post-commit.yml
+++ b/stub/post-commit.yml
@@ -26,6 +26,13 @@ on:
   # repository whether it is still clean; you have to push something to find out.
   workflow_dispatch:
 
+# One verdict at a time, per branch. Without this the ready_for_review retry
+# path lets an older run finish after a newer one: the stale failure would put
+# a pull request back into draft that the newer commit already fixed.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
@@ -67,6 +74,16 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           PR: ${{ github.event.pull_request.number }}
           REPO: ${{ github.repository }}
+          JUDGED: ${{ github.event.pull_request.head.sha }}
         run: |
+          # Cancellation narrows the race but does not close it: this job can
+          # already be running when a newer commit lands. Only act if the head
+          # this run judged is still the head, or a stale failure would undo a
+          # ready state that a later, passing commit earned.
+          CURRENT="$(gh pr view "$PR" -R "$REPO" --json headRefOid --jq .headRefOid)"
+          if [ "$CURRENT" != "$JUDGED" ]; then
+              echo "::notice::head moved on from ${JUDGED:0:8} to ${CURRENT:0:8}; the newer run owns the verdict. Not drafting."
+              exit 0
+          fi
           gh pr ready --undo "$PR" -R "$REPO"
           echo "::notice::post-commit failed — pull request put back into draft. Fix the history, then mark it ready: that re-runs the gate."