fix: resolve multiple workflow issues (#737, #738, #740, #741)

[teefeh-07]

🚀 Description

This PR introduces several important improvements to our GitHub Actions workflows to enhance security, prevent race conditions, and increase reliability. It resolves multiple active issues surrounding workflow concurrency and dependency immutability.

📋 Tasks & Fixes Made

1. Secured Vercel Action Dependency (Fixes #737)

• Context: preview-deploy.yml previously used amondnet/vercel-action@v25, a mutable major-version tag. This is a security risk as the underlying action code could change unexpectedly without our explicit approval.
• Fix: Replaced @v25 with its full immutable commit SHA (16e87c0a08142b0d0d33b76aeaf20823c381b9b9).
• Result: Previews will continue to deploy securely, and Dependabot/Renovate can now correctly track and propose updates based on the exact SHA.

2. Prevented Concurrent Semantic Releases (Fixes #738)

• Context: release.yml triggers via workflow_run on main completions without a concurrency group. Two quick merges could trigger overlapping semantic-release invocations, causing duplicate git tags and conflicting CHANGELOG commits.
• Fix: Added a concurrency group scoped to the workflow and branch (release-${{ github.ref }}) with cancel-in-progress: false.
• Result: If a release is running, a new trigger will queue instead of race or cancel, guaranteeing one clean release at a time.

3. Prevented Conflicting Rollback Drills (Fixes #740)

• Context: rollback-drill.yml executes on a monthly schedule and manual dispatch without concurrency bounds. Since it submits real on-chain rollback transactions to the testnet, concurrent runs could corrupt contract state.
• Fix: Added a global workflow-scoped concurrency group with cancel-in-progress: false.
• Result: A manual dispatch triggered while a scheduled drill is active will safely queue instead of executing simultaneously.

4. Bound Rollback Drill Execution Time (Fixes #741)

• Context: rollback-drill.yml polls the Stellar testnet for transaction confirmation but lacked a timeout-minutes bound, risking indefinite hangs if network issues occur.
• Fix: Enforced a timeout-minutes: 15 limit on the rollback-drill job.
• Result: Stalled RPC polls will cleanly fail within 15 minutes, allowing the failure notification step to fire as intended.

🔗 Related Issues

• Resolves SHA-pin amondnet/vercel-action in preview-deploy.yml #737
• Resolves Add concurrency group to release.yml to prevent concurrent semantic-release runs #738
• Resolves Add concurrency group to rollback-drill.yml to prevent concurrent contract-mutating drills #740
• Resolves Add timeout-minutes to rollback-drill.yml #741

🛠️ Verification

• Verified amondnet/vercel-action SHA corresponds to v25.
• Verified cancel-in-progress is set to false for queuing rather than cancellation.
• Verified timeout-minutes: 15 applies to the rollback drill.

Closes #737
Closes #738
Closes #740
Closes #741

[vercel]

Deployment failed with the following error:

The `vercel.json` schema validation failed with the following message: should NOT have additional property `rootDirectory`

Learn More: https://vercel.com/docs/concepts/projects/project-configuration

[drips-wave]

@teefeh-07 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
tariff-shield-web	Error		Jul 29, 2026 11:54pm