ci(pages): wait for releases/latest before deploying on a release publish

.github/workflows/deploy-pages.yml

@@ -45,6 +45,46 @@ jobs:
         working-directory: site
         run: bun install --frozen-lockfile
 
+      # Guard against the publish→deploy propagation race. The `release:
+      # published` event fires the deploy seconds before GitHub's
+      # `releases/latest` endpoint recomputes which release is "latest", so the
+      # build below would resolve the PREVIOUS tag and ship stale version +
+      # download links (observed on v0.4.36: the auto-deploy ran 6s after
+      # publish and shipped v0.4.35). The cache-busting in site/src/lib/version.ts
+      # defeats CDN staleness but not this server-side lag — a fresh body still
+      # names the old release until propagation completes.
+      #
+      # So when a release publish triggers this run, poll until the API reflects
+      # the just-published tag before building. Only for non-prereleases: the
+      # landing page tracks the latest *stable* release (resolveLatestRelease →
+      # releases/latest), which never reports a prerelease, so gating a beta
+      # publish on it would spin until timeout. A push / manual dispatch has no
+      # specific tag to wait for and skips this entirely.
+      - name: Wait for releases/latest to reflect this release
+        if: github.event_name == 'release' && github.event.release.prerelease == false
+        env:
+          GH_TOKEN: ${{ github.token }}
+          EXPECTED_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          set -euo pipefail
+          echo "Waiting for releases/latest to report ${EXPECTED_TAG}..."
+          for attempt in $(seq 1 30); do
+            # Cache-bust the CDN (its key includes the query string) and force
+            # revalidation, mirroring site/src/lib/version.ts.
+            latest=$(gh api \
+              -H "Cache-Control: no-cache" \
+              "repos/${GITHUB_REPOSITORY}/releases/latest?_cb=${attempt}-${RANDOM}" \
+              --jq '.tag_name' 2>/dev/null || echo "")
+            if [ "$latest" = "$EXPECTED_TAG" ]; then
+              echo "releases/latest is ${latest} (attempt ${attempt}); proceeding."
+              exit 0
+            fi
+            echo "attempt ${attempt}: releases/latest=${latest:-<none>}, want ${EXPECTED_TAG}; retrying in 10s"
+            sleep 10
+          done
+          echo "::error::releases/latest never reported ${EXPECTED_TAG} after ~5 min. Refusing to deploy a stale site; re-run this job once the API catches up." >&2
+          exit 1
+
       - name: Build Astro
         working-directory: site
         env: