fix(ci): skip stale code review runs

.gitea/workflows/code-review.yaml

@@ -6,6 +6,7 @@ on:
     paths:
       - 'apps/**'
       - 'k8s/**'
+      - '!k8s/awoooi-prod/kustomization.yaml'
       - 'ops/**'
       - 'scripts/**'
       - '.gitea/workflows/**'
@@ -29,8 +30,26 @@ jobs:
         with:
           fetch-depth: 50
 
+      - name: Skip Stale Main Push
+        id: stale
+        run: |
+          set -euo pipefail
+          BRANCH="${GITHUB_REF_NAME:-${GITHUB_REF#refs/heads/}}"
+          if [ "${GITHUB_EVENT_NAME:-}" != "push" ] || [ "$BRANCH" != "main" ]; then
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          LATEST="$(git ls-remote origin refs/heads/main | awk '{print $1}')"
+          if [ -n "$LATEST" ] && [ "$LATEST" != "$GITHUB_SHA" ]; then
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            echo "Skip stale code review: current=$GITHUB_SHA latest=$LATEST"
+          else
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Prepare Review Context
         id: ctx
+        if: steps.stale.outputs.skip != 'true'
         env:
           BASE_SHA: ${{ github.event.before }}
         run: |
@@ -81,6 +100,7 @@ jobs:
           } >> "$GITHUB_OUTPUT"
 
       - name: Notify Code Review Start
+        if: steps.stale.outputs.skip != 'true'
         env:
           TG_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
           TG_CHAT_ID: ${{ env.TELEGRAM_ALERT_CHAT_ID }}
@@ -104,6 +124,7 @@ jobs:
             >/dev/null
 
       - name: Run Deterministic Review
+        if: steps.stale.outputs.skip != 'true'
         env:
           BASE_SHA: ${{ steps.ctx.outputs.base_sha }}
         run: |
@@ -116,7 +137,7 @@ jobs:
           jq . /tmp/code-review-report.json
 
       - name: Notify Code Review Completion
-        if: always()
+        if: always() && steps.stale.outputs.skip != 'true'
         env:
           TG_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
           TG_CHAT_ID: ${{ env.TELEGRAM_ALERT_CHAT_ID }}