fix(ci): isolate report queues and verify propagated Pages assets

.github/workflows/reports-native.yml

@@ -7,8 +7,8 @@ permissions:
   contents: read
 
 concurrency:
-  group: reports-pages
-  cancel-in-progress: false
+  group: ${{ github.event_name == 'pull_request' && format('reports-native-pr-{0}', github.event.pull_request.number) || github.ref == 'refs/heads/main' && 'reports-native-pages' || format('reports-native-ref-{0}', github.ref) }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   reports:
@@ -20,6 +20,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          fetch-depth: 0
           persist-credentials: false
       - name: Checkout dev-tools workflow helpers
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -128,12 +129,25 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Verify public documentation identity
+        shell: bash
         env:
           PAGE_URL: ${{ needs.deploy.outputs.page-url }}
           LOGO_SHA: ${{ needs.reports.outputs.logo-sha }}
           DASH_SHA: ${{ needs.reports.outputs.dash-sha }}
         run: |
-          curl --fail --location --retry 8 --retry-all-errors --retry-delay 5 --max-time 30 "${PAGE_URL}images/fast-forward-logo-dark.svg" -o "$RUNNER_TEMP/published-logo.svg"
-          curl --fail --location --retry 8 --retry-all-errors --retry-delay 5 --max-time 30 "${PAGE_URL}images/dash-reading.png" -o "$RUNNER_TEMP/published-dash.png"
-          printf '%s  %s\n' "$LOGO_SHA" "$RUNNER_TEMP/published-logo.svg" | sha256sum --check --strict
-          printf '%s  %s\n' "$DASH_SHA" "$RUNNER_TEMP/published-dash.png" | sha256sum --check --strict
+          verify_asset() {
+            local asset_name="$1" expected_sha="$2" destination="$RUNNER_TEMP/$1"
+            for attempt in $(seq 1 12); do
+              if curl --fail --silent --show-error --location --max-time 30 "${PAGE_URL}images/${asset_name}" -o "$destination" &&
+                printf '%s  %s\n' "$expected_sha" "$destination" | sha256sum --check --strict; then
+                return 0
+              fi
+              if [ "$attempt" -lt 12 ]; then
+                sleep 5
+              fi
+            done
+            echo "Identity verification failed after 12 attempts: $asset_name" >&2
+            return 1
+          }
+          verify_asset fast-forward-logo-dark.svg "$LOGO_SHA"
+          verify_asset dash-reading.png "$DASH_SHA"

CHANGELOG.md

@@ -21,6 +21,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- Isolate native Pages PR builds from production deployment queues, preserve full repository history in generated metrics, and retry downloaded identity hashes during CDN propagation.
+
 - Keep required per-version statuses current across normal and Dependabot reruns through checkout-free lifecycle publishers using verified GitHub run and job metadata.
 - Keep Composer audit and nested dependency-health checks plugin-free after CI installs without plugins, so consumer allowlists do not block vulnerability or dependency analysis.
 - Isolate completed per-version status publication from repository-controlled test jobs, preserve access to private GitHub job metadata, and disable persisted checkout credentials in the reusable test workflow.

resources/github-actions-optional/reports-native.md

@@ -11,3 +11,5 @@ The caller's `contents: read`, `pages: write` and `id-token: write` values are c
 The build requires template 2.1.0 or newer, records its selected version/reference and validates rendered identity assets against the installed template. Deployment verification compares the public assets' SHA-256 values with those produced by the build. It preserves generation of documentation, coverage and metrics; failures stop publication.
 
 Existing ^2.0 template constraints accept 2.1.0. Consumers with a committed lock must update `fast-forward/phpdoc-bootstrap-template` before running this workflow. A locally cached vendor directory can still contain an older template; use clean dependency resolution and inspect the logged version.
+
+PR builds use separate per-PR concurrency groups and may cancel their own obsolete runs; they never share the production deployment queue. Main deployments remain serialized, and other feature refs have their own queues. Metrics use a full repository checkout. Public identity checks retry the complete download-and-hash operation up to twelve times per asset, so stale HTTP 200 responses during Pages propagation do not pass validation or immediately fail a successful deployment.