ci: harden workflow pushes to main

Author: niclasko

.github/workflows/build-docs.yml

@@ -7,6 +7,9 @@ on:
 jobs:
   build-docs:
     runs-on: ubuntu-latest
+    concurrency:
+      group: flowquery-main-writers-${{ github.ref_name }}
+      cancel-in-progress: false
     permissions:
       contents: write
     steps:
@@ -40,5 +43,26 @@ jobs:
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git add docs/
-          git diff --staged --quiet || git commit -m "chore: rebuild docs [skip ci]"
-          git push
+
+          if git diff --staged --quiet; then
+            exit 0
+          fi
+
+          git commit -m "chore: rebuild docs [skip ci]"
+
+          for attempt in 1 2 3; do
+            git fetch origin main:refs/remotes/origin/main
+
+            if ! git rebase origin/main; then
+              git rebase --abort || true
+            elif git push origin HEAD:main; then
+              break
+            fi
+
+            if [ "$attempt" -eq 3 ]; then
+              echo "Failed to push docs rebuild after 3 attempts."
+              exit 1
+            fi
+
+            sleep 5
+          done

.github/workflows/python-publish.yml

@@ -27,6 +27,9 @@ jobs:
     name: Bump version
     if: github.event_name == 'push' && github.ref == 'refs/heads/main' && !startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
+    concurrency:
+      group: flowquery-main-writers-${{ github.ref_name }}
+      cancel-in-progress: false
     outputs:
       new_version: ${{ steps.bump.outputs.new_version }}
 
@@ -57,7 +60,23 @@ jobs:
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git add pyproject.toml
           git commit -m "chore(py): bump version to $NEW_VERSION [skip ci]"
-          git push
+
+          for attempt in 1 2 3; do
+            git fetch origin main:refs/remotes/origin/main
+
+            if ! git rebase origin/main; then
+              git rebase --abort || true
+            elif git push origin HEAD:main; then
+              break
+            fi
+
+            if [ "$attempt" -eq 3 ]; then
+              echo "Failed to push Python version bump after 3 attempts."
+              exit 1
+            fi
+
+            sleep 5
+          done
 
           echo "new_version=$NEW_VERSION" >> $GITHUB_OUTPUT
 

.github/workflows/release.yml

@@ -14,6 +14,9 @@ permissions:
 jobs:
   build-and-release:
     runs-on: ubuntu-latest
+    concurrency:
+      group: flowquery-main-writers-${{ github.ref_name }}
+      cancel-in-progress: false
 
     steps:
       - name: Checkout code
@@ -80,10 +83,23 @@ jobs:
           git add -A
           git diff --cached --quiet || git commit --amend --no-verify --no-edit
 
-          # Refresh the tracking ref before rebasing so push uses the current remote tip.
-          git fetch origin main:refs/remotes/origin/main
-          git rebase origin/main
-          git push origin HEAD:main
+          # Retry the rebase/push sequence in case another workflow updates main first.
+          for attempt in 1 2 3; do
+            git fetch origin main:refs/remotes/origin/main
+
+            if ! git rebase origin/main; then
+              git rebase --abort || true
+            elif git push origin HEAD:main; then
+              break
+            fi
+
+            if [ "$attempt" -eq 3 ]; then
+              echo "Failed to push version bump after 3 attempts."
+              exit 1
+            fi
+
+            sleep 5
+          done
 
       - name: Install VS Code extension dependencies
         working-directory: ./flowquery-vscode