- Shipped
- 14 Kasım 2026 19:22 UTC
- Author
- Kamo
- Commit
- 295ccda
The build gate only checks "am I head of main?" when the build starts. A deploy job that was still waiting in rollout status when a newer push changed the Deployment ended up waiting on that rollout, then saw pods off its own digest, took it for a same-commit rebuild and forced a rollout restart (a second full rollout) before failing verification. Seen 2026-11-14 in securityservice: task 20028 (7b8405e2) restarted the Deployment after 12f148fb had rolled out and held a runner ~25 minutes. - New deploy-job step: on a push, skip apply + set image when main has moved on (workflow_dispatch always deploys). Fails open if ls-remote fails. - After the first rollout status, stop with success if the Deployment no longer carries this run's image. Timeouts and concurrency/cancel policy are unchanged.