fix(ci): serialize concurrent gh-pages deploys

[TimeToBuildBob]

Why

Master CI run 35056225053 failed deploying 8feb760e (docs(blog): publish it-found-the-dead-analytics-it-called-them-p2). The Build step succeeded; Deploy failed with:

! [remote rejected] ... -> gh-pages (cannot lock ref 'refs/heads/gh-pages':
  is at 7ed346e3... but expected fa0eaee4...)

Cause: two master pushes 9 seconds apart (8feb760e at 04:36:02Z, 7fd414e5 at 04:36:11Z) both force-pushed gh-pages via JamesIves. The later run succeeded and is an ancestor of HEAD, so the failed SHA's content is already live. Do not rerun 35056225053 — that would roll gh-pages back to the older SHA.

Change

• Serialize same-ref workflow runs so they cannot force-push gh-pages concurrently.
• Do not cancel an already-running master deploy; cancel superseded feature-branch builds.
• Before deploying, query the current master ref and skip any queued run whose SHA is stale. GitHub concurrency does not guarantee FIFO ordering, so serialization alone is insufficient.

Checks

• Failed SHA 8feb760e is parent of the later successful master SHA 7fd414e5
• Later master run 35056234103 conclusion=success
• tests/test_check_deploy_is_current.py covers current-head deploy and stale-run skip
• pytest tests/test_check_deploy_is_current.py -q
• check-yaml pre-commit hook
• PR CI green on e8cfa560973b65253498f693d1d7a4a1998f2574

No site content change.

[TimeToBuildBob]

Review guide (auto-posted)

Structured warm-up for reviewers — what changed, what to run, where to look.

Key files

• .github/workflows/pages.yml (+9/-0, Δ9)

Suggested verification

• Run the repo's usual CI-equivalent checks locally

Known risks / watch points

• No automatic high-risk tags; use file list + diff for judgment.

Suggested review focus

• Confirm behavior matches the PR description acceptance criteria.
• Skim the largest diffs first (listed above).
• If CI is green, spot-check the highest-risk paths called out here.

Generated by scripts/github/pr-warmup-review-guide.py for #95.

[TimeToBuildBob]

CI-green and mergeable — waiting only on a maintainer click.

Self-merge not eligible here (policy gate): .github/workflows/pages.yml is a sensitive/infra path. Waiting for human review or merge.

[TimeToBuildBob]

🤖 AI code review

Safe to merge — 1 P1 disposed (fixed in 12ce1de)

_{Updated after inline dispositions on finding threads — this is the current state; the verdict below is frozen at review time and is kept as the historical record of that pass.}

Finding disposition

Finding	Severity	State
.github/workflows/pages.yml:53	P1	superseded by latest review (not reproduced)
.github/workflows/pages.yml:59	P1	fixed in 12ce1de452b08c39308151456e721bd10947a8e3
.github/workflows/pages.yml:18	P2	resolved (no disposition on record)

Not safe to merge — 1 P1 open

Confidence 3/5

1 finding · ❌ 1 P1

❌ P1 high — .github/workflows/pages.yml:59

github.output is not a GitHub Actions context property; step output files are exposed through the GITHUB_OUTPUT environment variable. This expression therefore resolves to an empty value, so the script receives --github-output ""; Path("") denotes the current directory and opening it for append raises IsADirectoryError. Consequently, every current-master deployment fails at this guard instead of reaching the deploy action. Pass "$GITHUB_OUTPUT" here instead.

Previous review passes

commit	score	findings	engine	when
570c19bc08a6	5/5	0	llm	2026-09-16 05:21 UTC
570c19bc08a6	5/5	0	agent	2026-09-20 11:23 UTC
570c19bc08a6	4/5	1	agent	2026-09-20 11:54 UTC
e8cfa560973b	3/5	1	agent	2026-09-20 12:40 UTC

_{Reviewed 12ce1de452b0 · openai-subscription/gpt-5.6-sol · agent engine · 246s · about this reviewer}

_{Maintainer commands}

_{@TimeToBuildBob review (own line) — fresh review · @TimeToBuildBob fix — a worker acts on the findings. Once per comment; 👀 = received.}

[TimeToBuildBob]

@greptileai review

[TimeToBuildBob]

Fixed one additional workflow bug in 12ce1de452b08c39308151456e721bd10947a8e3: the guard now writes to the runner-provided $GITHUB_OUTPUT file rather than the nonexistent github.output context. Local guard tests and YAML validation pass; fresh CI and reviews are running on this head.