From 23789107abb328b0d042fd27ca6daffcad0f1cfe Mon Sep 17 00:00:00 2001
From: Chris Coutinho <chris@coutinho.io>
Date: Sat, 13 Jun 2026 18:26:09 +0200
Subject: [PATCH] ci(pact): use $GITHUB_SHA env var, add concurrency + timeout

Review round 1 follow-ups:
- Reference the built-in $GITHUB_SHA env var in run scripts instead of
  interpolating ${{ github.sha }}, removing the GitHub Actions script-injection
  surface (SonarCloud security rating on new code).
- Add a concurrency group (cancel-in-progress: false) to
  pact-record-deployment.yml so back-to-back tag pushes don't race the recording.
- Add timeout-minutes: 5 to guard against a hung tailnet join.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/pact-record-deployment.yml | 9 ++++++++-
 .github/workflows/pact.yml                   | 2 +-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/pact-record-deployment.yml b/.github/workflows/pact-record-deployment.yml
index eafd9f38..84ee58a3 100644
--- a/.github/workflows/pact-record-deployment.yml
+++ b/.github/workflows/pact-record-deployment.yml
@@ -31,6 +31,12 @@ on:
 permissions:
   contents: read
 
+# A re-tag (e.g. after a botched release) could push the same/overlapping tag
+# twice; don't cancel an in-flight recording — let it complete.
+concurrency:
+  group: pact-record-deployment-${{ github.ref }}
+  cancel-in-progress: false
+
 env:
   PACT_BROKER: ${{ secrets.PACT_BROKER }}
   PACT_USERNAME: ${{ secrets.PACT_USERNAME }}
@@ -40,6 +46,7 @@ jobs:
   record-deployment:
     name: Record production deployment
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - name: Join tailnet
         if: ${{ env.PACT_BROKER != '' }}
@@ -63,5 +70,5 @@ jobs:
             --broker-username "$PACT_USERNAME" \
             --broker-password "$PACT_PASSWORD" \
             --pacticipant nextcloud-mcp-server \
-            --version "${{ github.sha }}" \
+            --version "$GITHUB_SHA" \
             --environment production
diff --git a/.github/workflows/pact.yml b/.github/workflows/pact.yml
index 7e52e9e8..260bc127 100644
--- a/.github/workflows/pact.yml
+++ b/.github/workflows/pact.yml
@@ -166,7 +166,7 @@ jobs:
             --broker-username "$PACT_USERNAME" \
             --broker-password "$PACT_PASSWORD" \
             --pacticipant nextcloud-mcp-server \
-            --version "${{ github.sha }}" \
+            --version "$GITHUB_SHA" \
             --to-environment production
           rc=$?
           if [ "$rc" -ne 0 ]; then