Fix older publishes overwriting newer deploys

.github/workflows/axe-scan.yml

@@ -41,7 +41,6 @@ jobs:
       contents: write # commits _axe-report.md to the branch
     outputs:
       changes_detected: ${{ steps.auto-commit.outputs.changes_detected }}
-      commit: ${{ steps.auto-commit.outputs.commit_hash }}
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -169,7 +168,7 @@ jobs:
       contents: read
       statuses: write
     with:
-      ref: ${{ needs.scan.outputs.commit }}
+      ref: ${{ inputs.branch }}
       prerelease: ${{ inputs.prerelease }}
     secrets:
       NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}

.github/workflows/publish.yml

@@ -8,7 +8,7 @@ on:
     inputs:
       ref: 
         required: true
-        description: 'The ref to trigger the workflow on'
+        description: 'The branch to publish; its tip is checked out when the job starts'
         type: string
       prerelease:
         required: true
@@ -27,7 +27,13 @@ permissions:
   statuses: write # for the Netlify deploy status
 
 concurrency:
-  group: ${{ format('{0} - {1} - {2}', github.workflow, github.ref, inputs.prerelease && 'prerelease' || 'main') }}
+  # One group per deployed site, whichever workflow calls it, so an older
+  # build cannot finish last and overwrite a newer deploy. Each run checks
+  # out the branch tip, so the run that wins includes every earlier change.
+  # Same site selection as the deploy steps: an explicit prerelease input wins
+  # over the caller's ref. A run that deploys neither site (a dispatch from
+  # another branch) gets its own group, so it never cancels a deploy.
+  group: ${{ format('publish - {0}', (inputs.prerelease || (format('{0}', inputs.prerelease) != 'false' && github.ref == 'refs/heads/prerelease')) && 'prerelease' || (format('{0}', inputs.prerelease) == 'false' || github.ref == 'refs/heads/main') && 'main' || github.ref) }}
   cancel-in-progress: true
 
 jobs:
@@ -37,8 +43,9 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          # if called from workflow_call event, checkout the ref otherwise use default
-          ref: ${{ inputs.ref || '' }}
+          # The branch tip, not the triggering commit: a run that cancels an
+          # older one must not deploy older content than it.
+          ref: ${{ inputs.ref || github.ref }}
           persist-credentials: false # deploys with NETLIFY_AUTH_TOKEN, never pushes
 
       - name: Get latest pre-release from github
@@ -81,7 +88,7 @@ jobs:
       - name: Render 
         uses: quarto-dev/quarto-actions/render@v2
         env:
-          QUARTO_PROFILE: ${{ (inputs.prerelease || (contains(fromJSON('["push", "workflow_dispatch"]'), github.event_name) && github.ref == 'refs/heads/prerelease')) && 'prerelease-docs' || '' }}
+          QUARTO_PROFILE: ${{ (inputs.prerelease || (format('{0}', inputs.prerelease) != 'false' && contains(fromJSON('["push", "workflow_dispatch"]'), github.event_name) && github.ref == 'refs/heads/prerelease')) && 'prerelease-docs' || '' }}
 
       - name: Publish release website
         # Only do this step if 

.github/workflows/update-downloads.yml

@@ -11,8 +11,6 @@ jobs:
       contents: write # commits the regenerated JSON and syncs it to prerelease
     outputs:
       changes_detected: ${{ steps.auto-commit.outputs.changes_detected }}
-      commit: ${{ steps.auto-commit.outputs.commit_hash }}
-      commit_prerelease: ${{ steps.sync-prerelease.outputs.commit_hash }}
       prerelease_version: ${{ steps.get-versions.outputs.prerelease_version }}
     steps:
       - name: Checkout Repo
@@ -49,7 +47,6 @@ jobs:
           commit_author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 
       - name: Sync generated downloads to prerelease branch
-        id: sync-prerelease
         if: ${{ steps.auto-commit.outputs.changes_detected == 'true' }}
         env:
           MAIN_SHA: ${{ steps.auto-commit.outputs.commit_hash }}
@@ -67,11 +64,9 @@ jobs:
             git commit -m "Sync generated download redirects from main"
             git push origin prerelease
           fi
-          echo "commit_hash=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
 
-  # If a new commit has been made with updated downloads, 
-  # then publish the changes using the new commit as ref to checkout
-  # in the reusable publish workflow
+  # If a new commit has been made with updated downloads,
+  # then publish main with the reusable publish workflow
   publish-changes-release:
     needs: [ update-downloads ]
     if: ${{ needs.update-downloads.outputs.changes_detected == 'true' }}
@@ -81,14 +76,13 @@ jobs:
       contents: read
       statuses: write
     with:
-      ref: ${{ needs.update-downloads.outputs.commit }}
+      ref: main
       prerelease: false
     secrets:
       NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}
 
   # If a new commit has been made with updated downloads,
-  # then publish the changes using the new commit as ref to checkout
-  # in the reusable publish workflow
+  # then publish prerelease with the reusable publish workflow
   publish-changes-prerelease:
     needs: [ update-downloads ]
     if: ${{ needs.update-downloads.outputs.changes_detected == 'true' }}
@@ -98,7 +92,7 @@ jobs:
       contents: read
       statuses: write
     with:
-      ref: ${{ needs.update-downloads.outputs.commit_prerelease }}
+      ref: prerelease
       prerelease: true
     secrets:
       NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}