Fix ghost Queued workflow runs from early workflow_job events

[lupita-hom]

Summary

Fixes ghost "Queued" rows appearing in the Workflow History table with missing run number, branch, and event data.

Root Cause

When GitHub sends webhook events, workflow_job events (with status: queued) can arrive before the corresponding workflow_run event. The workflow_job payload lacks run-level fields like head_branch, event, and sometimes run_number.

Previously, processWorkflowJobEvent would create a full WorkflowRun document from this incomplete data via upsert, resulting in a record with:

• No run number (displays as #)
• No branch (displays as -)
• No event (displays as -)
• Duration 0s
• Status stuck on Queued

Additionally, when the workflow_run event arrived later and updated via processWorkflowRun, it would wipe out the existing jobs array since workflow_run payloads don't include job data.

Fixes

Backend (server/src/services/workflowService.js)

1. processWorkflowJobEvent — new run creation: Use $setOnInsert instead of plain upsert when creating a new run from a job event. This ensures that if a workflow_run event arrives and updates the record between the find and update, we don't overwrite it with incomplete data.

2. processWorkflowRun — preserve existing jobs: When a workflow_run event updates an existing record (possibly created by an earlier job event), preserve the existing jobs array instead of wiping it.

3. Explicit null fields: Set event: null and head_branch from job payload (when available) to make it clear the data is incomplete rather than silently empty.

Frontend (client/src/features/workflows/WorkflowHistory.jsx)

4. Defensive display: Show #- instead of #undefined or # when run.number is missing.

Testing

To reproduce:

1. Set up a workflow with multiple jobs
2. Trigger it and observe webhook delivery order in the server logs
3. Verify that queued job events no longer create ghost rows
4. Verify that when the workflow_run event arrives, it fills in all missing fields while preserving jobs

Fixes the ghost Queued run bug reported via screen recording.

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None