improvement(ci): promote superseded first-attempt runs forward

[waleedlatif1]

Problem

Cursor Bugbot finding on #5712 (discussion): the stale-promotion guard skips moving deploy tags whenever the run's commit is no longer the branch head, assuming the newer run will promote. But if commit A passes its gate and was superseded mid-run by commit B, and B then fails lint/tests/migrate, B never promotes — and A was skipped too. latest/staging stay on pre-A code with no automatic recovery until another push.

Fix

Sharpen the guard from "head only" to "monotonic forward":

• Commit == branch head → promote (unchanged)
• First-attempt run, commit is an ancestor of head (checked via the GitHub compare API) → promote forward. This is always safe: the ci-<ref> concurrency group serializes runs per branch, so a superseded first-attempt run executes before its successor — nothing newer can have promoted first.
• Re-run (run_attempt > 1) of a superseded commit → skip with a warning. This is the actual rollback hazard the guard exists for: re-running an old run must not retag deploy tags back to stale code.
• Commit not an ancestor of head (force-push) or compare API failure → skip (fail safe).

Same semantics applied to both guards (promote-images ECR deploy tags, create-ghcr-manifests GHCR latest tags). Immutable sha/version tags remain ungated by the guard, as before.

Failure-mode table

Scenario	Before	After
A passes, superseded by B, B passes	B deploys (A skipped, covered by B)	same
A passes, superseded by B, B fails	nothing deploys (stuck pre-A)	A deploys
Re-run old run on moved branch	skipped	skipped
Re-run of current head (transient retry)	promotes	promotes
Force-pushed-away commit	skipped	skipped

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Jul 16, 2026 8:02pm

[cursor]

PR Summary

Medium Risk
Changes deploy-gating logic for ECR/GHCR mutable tags; incorrect conditions could deploy stale images or skip valid promotions, though immutable sha/version tags stay ungated.

Overview
Deploy-tag guards in promote-images (ECR latest/staging) and create-ghcr-manifests (GHCR latest) no longer require the run commit to be branch head. They use the GitHub compare API (compare/<sha>...<ref>) and promote when the run is at head (identical) or, on first attempt only, when the run commit is an ancestor of head (ahead).

That fixes the case where commit A passes the gate but was superseded by B, and B fails—previously neither run moved deploy tags; now A can promote forward. Re-runs (run_attempt > 1) of a superseded commit still skip mutable tags to avoid rolling deploy tags back. Compare failures or non-ancestor commits still skip (fail-safe). Guards now set GH_TOKEN for gh api; create-ghcr-manifests adds contents: read for that call.

^{Reviewed by Cursor Bugbot for commit 80c5dbd. Configure here.}

[greptile-apps]

Greptile Summary

This PR changes how CI promotes mutable deployment tags when a run is superseded. The main changes are:

• Allows first-attempt runs to promote when their commit is an ancestor of the branch head.
• Skips superseded re-runs, force-pushed commits, and failed comparison checks.
• Applies the same guard to ECR deploy tags and GHCR latest tags.
• Grants the GHCR manifest job read access for repository comparisons.

Confidence Score: 5/5

No additional blocking issue was found for this follow-up.

• The remaining promotion-order risk is already covered by the existing review finding.
• No separate failure requiring another code change was identified.

Important Files Changed

Filename	Overview
.github/workflows/ci.yml	Adds ancestor-aware promotion guards for ECR and GHCR mutable tags, with fail-safe handling for stale re-runs and comparison failures.

_{Reviews (3): Last reviewed commit: "fix(ci): grant contents:read to create-g..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 80c5dbd. Configure here.}