ci: serialise versioning runs and skip a dev deploy older than the live version

A stack merge closes its PRs a second apart; both versioning runs read the
same latest tag and the two dev deploys can queue with the older tag last.
The versioning workflow now runs one at a time, and the dev deploy guard
skips an automatic deploy of a tag older than the one dev serves.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: daithihearn

.github/workflows/README.md

@@ -6,7 +6,7 @@ Automated CI/CD for Block Explorer. Dev, prod and previews all serve one static
 
 ```
 PR merged to main
-  → codebase-versioning.yml tags v.X.Y.Z (increment:* label picks the bump)
+  → codebase-versioning.yml tags v.X.Y.Z (increment:* label picks the bump; one run at a time)
   → publish-bundle.yml builds the static bundle, or finds one it already has
   → deploy.yml copies it into dev's bucket and points dev at it
   → prepare-release.yml leaves exactly one draft release
@@ -51,7 +51,7 @@ same bundle, so parity is structural rather than maintained by hand.
 | Manual dispatch | either, chosen by the `environment` input (break-glass, e.g. to roll back) |
 
 **Jobs:**
-1. `guard` - Resolves the target, the tag and its content SHA, refuses anything not reachable from `main`, and derives the stack list below
+1. `guard` - Resolves the target, the tag and its content SHA, refuses anything not reachable from `main`, and derives the stack list below, and skips an automatic dev deploy of a tag older than the one dev already serves
 2. `terraform` - Applies each stack serially in dependency order, planning immediately before each apply
 3. `publish` - Copies the bundle artifact into that environment's bucket, unless the prefix is already there
 4. `activate` - Writes `<env>/runtime-config.json`, points the environment's hosts at the new bundle, invalidates the config, then checks the CDN by its own name

.github/workflows/codebase-versioning.yml

@@ -6,6 +6,12 @@ on:
       - main
     types: [closed]
 
+# One run at a time: a stack merge closes every PR in it within a second, and
+# each run computes its tag from the newest one it can see.
+concurrency:
+  group: codebase-versioning
+  cancel-in-progress: false
+
 jobs:
   semantic-versioning:
     uses: vechain/github-actions-public/.github/workflows/semantic-versioning.yaml@c8645e5723b09ce657b865f78924b87a357df036 # v.2.3.1

.github/workflows/deploy.yml

@@ -56,6 +56,7 @@ jobs:
       app_sha: ${{ steps.derive.outputs.app_sha }}
       stacks: ${{ steps.derive.outputs.stacks }}
       domain: ${{ steps.derive.outputs.domain }}
+      stale: ${{ steps.freshness.outputs.stale }}
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -170,11 +171,35 @@ jobs:
           } >> "$GITHUB_OUTPUT"
           echo "${TAG} carries app content ${APP_SHA}, deploying to ${domain}."
 
+      # Two merges landing together queue two dev deploys here, and the older
+      # tag can be the one that runs last. Skip it rather than roll dev back.
+      - name: Skip a dev tag older than the one dev serves
+        id: freshness
+        if: github.event_name == 'workflow_run'
+        env:
+          TAG: ${{ steps.resolve.outputs.tag }}
+          DOMAIN: ${{ steps.derive.outputs.domain }}
+        run: |
+          set -euo pipefail
+
+          live=$(curl -fsS --max-time 15 "https://${DOMAIN}/runtime-config.json" | jq -r '.appVersion // empty' || true)
+          stale=false
+          if [[ "$live" =~ ^v\. ]] && [ "$live" != "$TAG" ]; then
+            newest=$(printf '%s\n%s\n' "$TAG" "$live" | sort -V | tail -n1)
+            if [ "$newest" = "$live" ]; then
+              stale=true
+              echo "::notice::${DOMAIN} already serves ${live}, newer than ${TAG}. Nothing to deploy."
+            fi
+          fi
+          echo "stale=${stale}" >> "$GITHUB_OUTPUT"
+
   # Serial, each stack planned immediately before its own apply — see workflows/README.md.
   terraform:
     name: Apply Terraform
     runs-on: ubuntu-latest
     needs: guard
+    # A stale dev tag stops here; every job below needs this one.
+    if: needs.guard.outputs.stale != 'true'
     permissions:
       id-token: write
       contents: read