From 23e5c5dc51b2fd2f8cf4b433567fe333f9c01e2e Mon Sep 17 00:00:00 2001
From: Codex <codex@local>
Date: Mon, 25 May 2026 11:01:04 +0800
Subject: [PATCH] fix: guard G14 GitOps promotion against stale source

---
 scripts/g14-gitops-render.mjs | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/scripts/g14-gitops-render.mjs b/scripts/g14-gitops-render.mjs
index 7381ab2c..a52e8ee1 100644
--- a/scripts/g14-gitops-render.mjs
+++ b/scripts/g14-gitops-render.mjs
@@ -364,8 +364,24 @@ ssh-keyscan github.com >> /root/.ssh/known_hosts 2>/dev/null || true
 export GIT_SSH_COMMAND="ssh -i /root/.ssh/id_rsa -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new"
 cd /workspace/source/repo
 test "$(git rev-parse HEAD)" = "$(params.revision)"
+
+check_source_head() {
+  phase="$1"
+  latest="$(git ls-remote "$(params.git-url)" "refs/heads/$(params.source-branch)" | cut -f1)"
+  if [ -z "$latest" ]; then
+    echo '{"status":"failed","reason":"source-head-unresolved","phase":"'"$phase"'","sourceBranch":"'"$(params.source-branch)"'","sourceRevision":"'"$(params.revision)"'"}'
+    exit 1
+  fi
+  if [ "$latest" != "$(params.revision)" ]; then
+    echo '{"status":"skipped-stale-source","phase":"'"$phase"'","sourceBranch":"'"$(params.source-branch)"'","sourceRevision":"'"$(params.revision)"'","latestRevision":"'"$latest"'"}'
+    exit 0
+  fi
+}
+
+check_source_head before-render
 node scripts/g14-gitops-render.mjs --source-revision "$(params.revision)" --source-repo "$(params.git-url)" --source-branch "$(params.source-branch)" --gitops-branch "$(params.gitops-branch)" --registry-prefix "$(params.registry-prefix)"
 node scripts/g14-gitops-render.mjs --source-revision "$(params.revision)" --source-repo "$(params.git-url)" --source-branch "$(params.source-branch)" --gitops-branch "$(params.gitops-branch)" --registry-prefix "$(params.registry-prefix)" --check
+check_source_head before-push
 git config --global user.name "HWLAB G14 GitOps Bot"
 git config --global user.email "hwlab-g14-gitops-bot@users.noreply.github.com"
 workdir="$(mktemp -d)"