From 1b168f89a355fac714660b0d73107c4998d9eb28 Mon Sep 17 00:00:00 2001
From: "Mark E. DeYoung" <1854350+mark-e-deyoung@users.noreply.github.com>
Date: Mon, 31 Aug 2026 15:39:39 +0200
Subject: [PATCH] ci: prevent superseded rolling publishers

---
 .github/workflows/compile-observer-smoke.yml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.github/workflows/compile-observer-smoke.yml b/.github/workflows/compile-observer-smoke.yml
index c7213ad72e..204711c432 100644
--- a/.github/workflows/compile-observer-smoke.yml
+++ b/.github/workflows/compile-observer-smoke.yml
@@ -220,6 +220,9 @@ jobs:
       - linux-engine-build
       - windows-engine-build
     if: github.event_name == 'push' && github.ref == 'refs/heads/semper/compile-observer'
+    concurrency:
+      group: semper-exp-current-publisher
+      cancel-in-progress: true
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -355,6 +358,12 @@ jobs:
           set -euo pipefail
           CANDIDATE_SHA="${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}"
           TAG="${EXPERIMENTAL_TAG}"
+          BRANCH="semper/compile-observer"
+          CURRENT_HEAD="$(gh api "repos/${GITHUB_REPOSITORY}/git/ref/heads/${BRANCH}" --jq '.object.sha')"
+          if [[ "${CURRENT_HEAD}" != "${CANDIDATE_SHA}" ]]; then
+            echo "refusing to publish superseded candidate ${CANDIDATE_SHA}; ${BRANCH} is now ${CURRENT_HEAD}" >&2
+            exit 1
+          fi
 
           if gh api "repos/${GITHUB_REPOSITORY}/git/ref/tags/${TAG}" >/dev/null 2>&1; then
             gh api --method PATCH "repos/${GITHUB_REPOSITORY}/git/refs/tags/${TAG}" \