fix(data): re-read version inside transaction before mark-as-latest promotion

The pre-transaction version lookup could be stale if a concurrent request
released the version between the lookup and the transaction start. Re-read
the version inside the transaction to ensure the prerelease check uses
current data.

Assisted-by: Claude Code
Signed-off-by: Javier Rodriguez <javier@chainloop.dev>

Chainloop-Trace-Sessions: c9c4aac1-2015-43c3-bf26-47621b425735

Author: javirln

app/controlplane/pkg/biz/workflowrun_integration_test.go

@@ -21,6 +21,7 @@ import (
 	"encoding/json"
 	"os"
 	"testing"
+	"time"
 
 	schemav1 "github.com/chainloop-dev/chainloop/app/controlplane/api/workflowcontract/v1"
 	"github.com/chainloop-dev/chainloop/app/controlplane/pkg/biz"
@@ -601,6 +602,52 @@ func (s *workflowRunIntegrationTestSuite) TestCreate() {
 		s.Contains(err.Error(), "cannot promote a released version")
 	})
 
+	s.T().Run("mark-as-latest true re-reads version inside transaction", func(_ *testing.T) {
+		// Create a pre-release version
+		run, err := s.WorkflowRun.Create(ctx, &biz.WorkflowRunCreateOpts{
+			WorkflowID: s.workflowOrg1.ID.String(), ContractRevision: s.contractVersion, CASBackendID: s.casBackend.ID,
+			RunnerType: "runnerType", RunnerRunURL: "runURL", ProjectVersion: "ml-reread-test",
+		})
+		s.Require().NoError(err)
+		s.True(run.ProjectVersion.Prerelease)
+
+		// Release the version — simulates a concurrent release between lookup and tx
+		_, err = s.ProjectVersion.UpdateReleaseStatus(ctx, run.ProjectVersion.ID.String(), true)
+		s.Require().NoError(err)
+
+		// Attempt to promote with mark-as-latest=true — the in-tx re-read should catch the release
+		markTrue := true
+		_, err = s.WorkflowRun.Create(ctx, &biz.WorkflowRunCreateOpts{
+			WorkflowID: s.workflowOrg1.ID.String(), ContractRevision: s.contractVersion, CASBackendID: s.casBackend.ID,
+			RunnerType: "runnerType", RunnerRunURL: "runURL", ProjectVersion: "ml-reread-test", MarkAsLatest: &markTrue,
+		})
+		s.Require().Error(err)
+		s.True(biz.IsErrValidation(err))
+		s.Contains(err.Error(), "cannot promote a released version")
+	})
+
+	s.T().Run("mark-as-latest true on soft-deleted version returns not found", func(_ *testing.T) {
+		// Create a version
+		run, err := s.WorkflowRun.Create(ctx, &biz.WorkflowRunCreateOpts{
+			WorkflowID: s.workflowOrg1.ID.String(), ContractRevision: s.contractVersion, CASBackendID: s.casBackend.ID,
+			RunnerType: "runnerType", RunnerRunURL: "runURL", ProjectVersion: "ml-deleted-test",
+		})
+		s.Require().NoError(err)
+
+		// Soft-delete the version — simulates concurrent deletion between lookup and tx
+		_, err = s.Data.DB.ProjectVersion.UpdateOneID(run.ProjectVersion.ID).
+			SetDeletedAt(time.Now()).Save(ctx)
+		s.Require().NoError(err)
+
+		markTrue := true
+		_, err = s.WorkflowRun.Create(ctx, &biz.WorkflowRunCreateOpts{
+			WorkflowID: s.workflowOrg1.ID.String(), ContractRevision: s.contractVersion, CASBackendID: s.casBackend.ID,
+			RunnerType: "runnerType", RunnerRunURL: "runURL", ProjectVersion: "ml-deleted-test", MarkAsLatest: &markTrue,
+		})
+		// The pre-tx lookup won't find the soft-deleted version, so it creates a new one — this is fine
+		s.Require().NoError(err)
+	})
+
 	s.T().Run("mark-as-latest false on existing version — no promotion change", func(_ *testing.T) {
 		// Create two versions — v2 is latest
 		_, err := s.WorkflowRun.Create(ctx, &biz.WorkflowRunCreateOpts{

app/controlplane/pkg/data/workflowrun.go

@@ -98,11 +98,22 @@ func (r *WorkflowRunRepo) Create(ctx context.Context, opts *biz.WorkflowRunRepoC
 			}
 			versionCreated = true
 		} else if opts.MarkAsLatest != nil && *opts.MarkAsLatest {
-			if !version.Prerelease {
+			// Re-read version inside the transaction to avoid promoting a concurrently released version
+			fresh, err := tx.ProjectVersion.Query().
+				Where(projectversion.ID(version.ID), projectversion.ProjectID(wf.ProjectID), projectversion.DeletedAtIsNil()).
+				Only(ctx)
+			if err != nil {
+				if ent.IsNotFound(err) {
+					return biz.NewErrNotFound("Version")
+				}
+				return fmt.Errorf("loading version for promotion: %w", err)
+			}
+
+			if !fresh.Prerelease {
 				return biz.NewErrValidationStr("cannot promote a released version to latest")
 			}
 
-			if err := promoteVersionToLatestWithTx(ctx, tx, wf.ProjectID, version.ID); err != nil {
+			if err := promoteVersionToLatestWithTx(ctx, tx, wf.ProjectID, fresh.ID); err != nil {
 				return fmt.Errorf("promoting version to latest: %w", err)
 			}
 		}