From ce061c19772a2052a0dff8728a853ab043d62f19 Mon Sep 17 00:00:00 2001
From: "Gan, Jimmy" <jimmy.gan@adidas.com>
Date: Tue, 3 Mar 2026 00:28:02 +0800
Subject: [PATCH] fix: scope deploy triggers and cancel stale workflow runs

Limit workflow path triggers to each workflow file, add concurrency groups to cancel outdated runs, and checkout the exact triggering SHA for deterministic deploys.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .gitea/workflows/deploy-claude-dev-dev.yml | 13 +++++++++++--
 .gitea/workflows/deploy-dev.yml            | 15 ++++++++++++---
 .gitea/workflows/deploy.yml                | 15 ++++++++++++---
 3 files changed, 35 insertions(+), 8 deletions(-)

diff --git a/.gitea/workflows/deploy-claude-dev-dev.yml b/.gitea/workflows/deploy-claude-dev-dev.yml
index 6756c50..36f56b7 100644
--- a/.gitea/workflows/deploy-claude-dev-dev.yml
+++ b/.gitea/workflows/deploy-claude-dev-dev.yml
@@ -11,6 +11,10 @@ on:
         description: 'Optional full image ref (for rollback), e.g. claude-dev:dev-abc123'
         required: false
 
+concurrency:
+  group: deploy-claude-dev-dev
+  cancel-in-progress: true
+
 jobs:
   deploy-claude-dev-dev:
     runs-on: ubuntu-latest
@@ -19,8 +23,13 @@ jobs:
         - /var/packages/ContainerManager/target/usr/bin/docker:/usr/bin/docker
         - /volume1/docker/claude-dev:/claude-dev-runtime
     steps:
-      - name: Checkout dev branch
-        run: git clone --depth 1 --branch dev http://gitea:3000/jimmy/nas-tools.git .
+      - name: Checkout exact commit
+        run: |
+          set -euo pipefail
+          git init .
+          git remote add origin http://gitea:3000/jimmy/nas-tools.git
+          git fetch --depth 1 origin "$GITHUB_SHA"
+          git checkout --detach FETCH_HEAD
 
       - name: Resolve image tags
         run: |
diff --git a/.gitea/workflows/deploy-dev.yml b/.gitea/workflows/deploy-dev.yml
index 49e83b7..50ed66f 100644
--- a/.gitea/workflows/deploy-dev.yml
+++ b/.gitea/workflows/deploy-dev.yml
@@ -4,7 +4,11 @@ on:
     branches: [dev]
     paths:
       - 'dashboard/**'
-      - '.gitea/workflows/**'
+      - '.gitea/workflows/deploy-dev.yml'
+
+concurrency:
+  group: deploy-dashboard-dev
+  cancel-in-progress: true
 
 jobs:
   deploy-dev:
@@ -14,8 +18,13 @@ jobs:
         - /var/packages/ContainerManager/target/usr/bin/docker:/usr/bin/docker
         - /volume1/docker/nas-dashboard:/nas-dashboard
     steps:
-      - name: Checkout dev branch
-        run: git clone --depth 1 --branch dev http://gitea:3000/jimmy/nas-tools.git .
+      - name: Checkout exact commit
+        run: |
+          set -euo pipefail
+          git init .
+          git remote add origin http://gitea:3000/jimmy/nas-tools.git
+          git fetch --depth 1 origin "$GITHUB_SHA"
+          git checkout --detach FETCH_HEAD
       - name: Build dev image
         run: DOCKER_BUILDKIT=0 docker build --cache-from nas-dashboard-dev:latest -t nas-dashboard-dev:latest dashboard/
       - name: Deploy dev
diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 1d5abd9..4f5906d 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -4,7 +4,11 @@ on:
     branches: [main]
     paths:
       - 'dashboard/**'
-      - '.gitea/workflows/**'
+      - '.gitea/workflows/deploy.yml'
+
+concurrency:
+  group: deploy-dashboard-main
+  cancel-in-progress: true
 
 jobs:
   deploy:
@@ -14,8 +18,13 @@ jobs:
         - /var/packages/ContainerManager/target/usr/bin/docker:/usr/bin/docker
         - /volume1/docker/nas-dashboard:/nas-dashboard
     steps:
-      - name: Checkout
-        run: git clone --depth 1 http://gitea:3000/jimmy/nas-tools.git .
+      - name: Checkout exact commit
+        run: |
+          set -euo pipefail
+          git init .
+          git remote add origin http://gitea:3000/jimmy/nas-tools.git
+          git fetch --depth 1 origin "$GITHUB_SHA"
+          git checkout --detach FETCH_HEAD
       - name: Build
         run: DOCKER_BUILDKIT=0 docker build -t nas-dashboard:latest dashboard/
       - name: Deploy