Source composition using ArtifactGenerator - how to sync updates of multiple sources

[jaymzmac]

This is just a hypothetical scenario, not a problem I am actually experiencing.

Suppose I have two sources and an ExternalArtifact that combines the sources and a Kustomization that reconciles them:

---
apiVersion: source.toolkit.fluxcd.io/v1
kind: OCIRepository
metadata:
  name: my-backend
spec:
  interval: 5m0s
  url: oci://....
  ref:
    tag: v1.0.0
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: OCIRepository
metadata:
  name: my-frontend
spec:
  interval: 5m0s
  url: oci://....
  ref:
    tag: v1.0.0
---
apiVersion: source.extensions.fluxcd.io/v1beta1
kind: ArtifactGenerator
metadata:
  name: my-app
spec:
  sources:
    - alias: backend
      kind: OCIRepository
      name: my-backend
    - alias: frontend
      kind: OCIRepository
      name: my-frontend
  artifacts:
    - name: my-app-composite
      copy:
        - from: "@backend/deploy/**"
          to: "@artifact/my-app/backend/"
        - from: "@frontend/deploy/*.yaml"
          to: "@artifact/my-app/frontend/"
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: my-app
spec:
  interval: 30m
  sourceRef:
    kind: ExternalArtifact
    name: my-app-composite
  path: "./my-app"
  prune: true
---

And suppose I need to update both sources to v2.0.0 which has breaking changes.

Is there a risk that if I update the spec.ref.tag to v2.0.0 on both OCI repos that a new artifact will be generated with mixed versions, that is v1.0.0 of one source and v2.0.0 of another source? Which will trigger the Kustomization to reconcile, potentially breaking the app?

What is the recommended way of coordinating multi-source updates? Suspend the Kustomization first, wait for the artifact with v2.0.0 from all sources, and then resume?