improvement(ci): promote superseded first-attempt runs forward

The stale-promotion guard skipped any run whose commit was no longer the
branch head. If commit A passed its gate but was superseded mid-run by
commit B, and B then failed tests, A's promotion was skipped and the
deploy tags stayed on pre-A code with no automatic recovery (Cursor
finding on #5712).

A first-attempt run promoting an ancestor of the branch head is always a
forward deploy — runs on a ref are serialized by the concurrency group,
so nothing newer can have promoted first. Only re-runs of superseded
commits (a rollback attempt) and force-pushed-away commits are skipped.
Same semantics applied to the GHCR latest-tag guard.

Author: waleedlatif1

.github/workflows/ci.yml

@@ -300,17 +300,34 @@ jobs:
 
       # Re-running this job from an old run would retag the deploy tags back
       # to that run's commit and immediately trigger a production deploy of
-      # stale code. Only promote while this commit is still the branch head;
-      # when superseded, skip cleanly — the newer run's promotion covers it.
+      # stale code. A first-attempt run whose commit is an ancestor of the
+      # branch head is still a forward deploy (runs on a ref are serialized
+      # by the concurrency group, so nothing newer can have promoted first) —
+      # it promotes even when superseded, so a failing successor can't strand
+      # a passing commit. Only re-runs of superseded commits (a rollback
+      # attempt) and force-pushed-away commits are skipped.
       - name: Guard against stale promotion
         id: guard
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
           HEAD_SHA="$(git ls-remote "https://github.com/${{ github.repository }}.git" "refs/heads/${GITHUB_REF_NAME}" | cut -f1)"
-          if [ "$HEAD_SHA" != "${{ github.sha }}" ]; then
-            echo "::warning::Skipping promotion of ${{ github.sha }}: ${GITHUB_REF_NAME} has moved to ${HEAD_SHA}. Moving the deploy tags to this commit would deploy stale code; push a revert commit to roll back instead."
+          if [ "$HEAD_SHA" = "${{ github.sha }}" ]; then
+            echo "fresh=true" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+          if [ "${{ github.run_attempt }}" != "1" ]; then
+            echo "::warning::Skipping promotion of ${{ github.sha }} (re-run): ${GITHUB_REF_NAME} has moved to ${HEAD_SHA}. Moving the deploy tags back would deploy stale code; push a revert commit to roll back instead."
             echo "fresh=false" >> $GITHUB_OUTPUT
-          else
+            exit 0
+          fi
+          STATUS="$(gh api "repos/${{ github.repository }}/compare/${{ github.sha }}...${HEAD_SHA}" --jq '.status' || echo "unknown")"
+          if [ "$STATUS" = "ahead" ]; then
+            echo "::notice::${GITHUB_REF_NAME} has moved to ${HEAD_SHA}, but ${{ github.sha }} is its ancestor — promoting forward."
             echo "fresh=true" >> $GITHUB_OUTPUT
+          else
+            echo "::warning::Skipping promotion of ${{ github.sha }}: ${GITHUB_REF_NAME} has moved to ${HEAD_SHA} (compare status: ${STATUS})."
+            echo "fresh=false" >> $GITHUB_OUTPUT
           fi
 
       - name: Promote images to deploy tags
@@ -420,17 +437,32 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       # Same protection as promote-images: a re-run of an old run must not
-      # move the public latest tags back to a stale commit. Immutable tags
-      # (sha and version) are still published — only latest moves are gated.
+      # move the public latest tags back to a stale commit, but a superseded
+      # first-attempt run whose commit is an ancestor of head still publishes
+      # forward. Immutable tags (sha and version) are always published — only
+      # latest moves are gated.
       - name: Guard against stale latest tags
         id: guard
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
           HEAD_SHA="$(git ls-remote "https://github.com/${{ github.repository }}.git" "refs/heads/${GITHUB_REF_NAME}" | cut -f1)"
-          if [ "$HEAD_SHA" != "${{ github.sha }}" ]; then
-            echo "::warning::${GITHUB_REF_NAME} has moved to ${HEAD_SHA}; publishing immutable tags for ${{ github.sha }} but skipping the latest tags."
+          if [ "$HEAD_SHA" = "${{ github.sha }}" ]; then
+            echo "fresh=true" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+          if [ "${{ github.run_attempt }}" != "1" ]; then
+            echo "::warning::${GITHUB_REF_NAME} has moved to ${HEAD_SHA} and this is a re-run; publishing immutable tags for ${{ github.sha }} but skipping the latest tags."
             echo "fresh=false" >> $GITHUB_OUTPUT
-          else
+            exit 0
+          fi
+          STATUS="$(gh api "repos/${{ github.repository }}/compare/${{ github.sha }}...${HEAD_SHA}" --jq '.status' || echo "unknown")"
+          if [ "$STATUS" = "ahead" ]; then
+            echo "::notice::${GITHUB_REF_NAME} has moved to ${HEAD_SHA}, but ${{ github.sha }} is its ancestor — publishing latest tags forward."
             echo "fresh=true" >> $GITHUB_OUTPUT
+          else
+            echo "::warning::${GITHUB_REF_NAME} has moved to ${HEAD_SHA} (compare status: ${STATUS}); publishing immutable tags for ${{ github.sha }} but skipping the latest tags."
+            echo "fresh=false" >> $GITHUB_OUTPUT
           fi
 
       - name: Publish tags and manifests