Fix cleanup ownership check to read stage-appropriate provenance

Live e2e testing showed cleanup always skipped previews for brand-new
modules. The Control Plane only populates previewGitRef on a PUBLISHED
module that also has a preview sibling; a never-published module IS the
preview (stage PREVIEW) and carries its owning commit in plain gitRef,
with previewGitRef null — the common PR case.

Cleanup now derives the owning commit per module row by stage:
- stage PREVIEW            -> .gitRef
- stage PUBLISHED w/ preview sibling (.previewModuleId set) -> .previewGitRef
- otherwise                -> no preview slot, skip
Prefers a PREVIEW row when both exist. Downstream SHA comparison against
the PR's commits is unchanged, and absent/older provenance fields still
degrade to a safe skip. README cleanup/single-preview-slot section updated
to match.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: anujhydrabadi

module-ci-action/README.md

@@ -44,9 +44,10 @@ modules live at `infra/modules/...`).
 - **raptor version:** the **preview** mode uses `raptor create iac-module --feature-branch`,
   a flag that marks a preview as **unpublishable**. It is newer than the base
   `iac-module` commands, so preview mode requires a `raptor` release that ships
-  `--feature-branch` (and the `previewGitRef` field that cleanup reads). Pin
-  `raptor_version` accordingly if `latest` ever lags. Publish and cleanup-by-metadata
-  work on any recent `raptor`.
+  `--feature-branch` and surfaces module git provenance (`gitRef` / `previewGitRef`) in
+  `raptor get iac-module -o json`, which cleanup's ownership check reads. Pin
+  `raptor_version` accordingly if `latest` ever lags. Publish works on any recent
+  `raptor`; cleanup safely no-ops when those provenance fields are absent.
 
 ## Inputs
 
@@ -116,15 +117,27 @@ stay `auto`; the action derives `preview` / `publish` / `cleanup` from each even
 
 Each module (`intent/flavor/version`) has exactly **one preview slot** on the Control
 Plane. When a PR previews a module, the action registers the preview against the PR's
-**head commit** (`--git-ref`), so the slot records which commit owns it (`previewGitRef`).
+**head commit** (`--git-ref`), so the slot records which commit owns it.
 
 - **Concurrent PRs on the same module:** last write wins. Whichever PR most recently
   ran preview owns the slot; an earlier PR's preview is overwritten.
-- **Cleanup is ownership-checked.** On PR close, the action deletes a module's preview
-  **only if** `previewGitRef` matches one of this PR's commit SHAs. If the slot was
-  taken over by another branch, this PR leaves it untouched — it never deletes a
-  preview owned by someone else. (Cleanup needs `github_token` to read the PR's
-  commits; without it, cleanup is skipped.)
+- **Cleanup is ownership-checked.** On PR close, the action reads each module's owning
+  commit from `raptor get iac-module -o json` and deletes the preview **only if** that
+  commit is one of this PR's commit SHAs. If the slot was taken over by another branch,
+  this PR leaves it untouched — it never deletes a preview owned by someone else.
+  (Cleanup needs `github_token` to read the PR's commits; without it, cleanup is skipped.)
+
+  The owning-commit field depends on the module's stage, because the Control Plane
+  stores preview provenance in two different places:
+
+  - a **brand-new, never-published** module *is* its own preview (stage `PREVIEW`) —
+    its owning commit is the row's plain `gitRef`. This is the common PR case.
+  - a **published** module that also has a live preview sibling (its `previewModuleId`
+    is set) exposes the preview's commit as `previewGitRef` on the `PUBLISHED` row.
+  - anything else has no preview slot, so cleanup skips it.
+
+  Reading only `previewGitRef` would miss every brand-new-module preview (where it is
+  null), so the ownership check consults `gitRef` or `previewGitRef` by stage.
 
 ## Behavior details
 

module-ci-action/action.yml

@@ -322,7 +322,7 @@ runs:
         fi
 
         # This PR's commit SHAs form the ownership set: a preview is only deleted
-        # if its previewGitRef is one of these commits.
+        # if the commit that created it is one of these commits.
         PR_SHAS="$(gh api "repos/${REPO}/pulls/${PR_NUMBER}/commits" --paginate --jq '.[].sha' 2>/dev/null || true)"
         if [ -z "$PR_SHAS" ]; then
           echo "::warning::Could not fetch commits for PR #${PR_NUMBER}; skipping cleanup."
@@ -346,26 +346,41 @@ runs:
           fi
           REF="${TYPE}/${FLAVOR}/${VERSION}"
 
-          PREVIEW_REF="$(printf '%s' "$MODULES_JSON" | jq -r \
-            --arg t "$TYPE" --arg f "$FLAVOR" --arg v "$VERSION" \
-            'map(select(.intent==$t and .flavor==$f and .version==$v)) | (.[0].previewGitRef // "")' 2>/dev/null || true)"
-          if [ -z "$PREVIEW_REF" ] || [ "$PREVIEW_REF" = "null" ]; then
-            echo "No preview slot / previewGitRef recorded for ${REF}; nothing to clean up."
+          # Find the commit that owns this module's preview slot. The provenance
+          # field depends on the module's stage in the list:
+          #   - a brand-new, never-published module IS the preview (stage PREVIEW);
+          #     its owning commit is the row's own .gitRef.
+          #   - a PUBLISHED module with a preview sibling (.previewModuleId set)
+          #     exposes the preview's commit as .previewGitRef.
+          #   - anything else has no preview slot -> skip.
+          # Prefer a PREVIEW row when both exist (its .gitRef is the preview's own
+          # provenance). Absent/older fields yield "" and are treated as "no slot".
+          OWNER_SHA="$(printf '%s' "$MODULES_JSON" | jq -r \
+            --arg t "$TYPE" --arg f "$FLAVOR" --arg v "$VERSION" '
+              map(select(.intent==$t and .flavor==$f and .version==$v)) as $rows
+              | ($rows | map(select(.stage=="PREVIEW"))[0]) as $preview
+              | ($rows | map(select(.stage=="PUBLISHED" and ((.previewModuleId // "") != "")))[0]) as $published
+              | if $preview then ($preview.gitRef // "")
+                elif $published then ($published.previewGitRef // "")
+                else "" end
+            ' 2>/dev/null || true)"
+          if [ -z "$OWNER_SHA" ] || [ "$OWNER_SHA" = "null" ]; then
+            echo "No preview slot recorded for ${REF}; nothing to clean up."
             echo "::endgroup::"; continue
           fi
 
           OWNED="false"
           while IFS= read -r sha; do
             [ -z "$sha" ] && continue
-            if [ "$sha" = "$PREVIEW_REF" ]; then OWNED="true"; break; fi
+            if [ "$sha" = "$OWNER_SHA" ]; then OWNED="true"; break; fi
           done <<< "$PR_SHAS"
 
           if [ "$OWNED" != "true" ]; then
-            echo "Preview for ${REF} is owned by another branch (previewGitRef=${PREVIEW_REF}); leaving it untouched."
+            echo "Preview for ${REF} is owned by another branch (owning commit=${OWNER_SHA}); leaving it untouched."
             echo "::endgroup::"; continue
           fi
 
-          echo "Deleting preview for ${REF} (owned by this PR, previewGitRef=${PREVIEW_REF})..."
+          echo "Deleting preview for ${REF} (owned by this PR, owning commit=${OWNER_SHA})..."
           if ! raptor delete iac-module "$REF" --yes --force; then
             echo "::error::Failed to delete preview for ${REF}"
             echo "${REF} (cleanup)" >> "$FAILURES"