The short version is that Tolkien changed his mind on the subject repeatedly; at various points in the progression, Gil-galad has been descended from:
- Fëanor
- Finrod
- Fingon
- Orodreth, Finarfin's grandson, which is another complicated story I'll cover in this answer
Descendant of Fëanor
This is how Gil-galad was first devised; he appears this way in the second version of the Fall of Númenor (emphasis mine):
And it is said that in Beleriand there arose a king, who was of Númenórean race, and he was named Elendil, that is Elf-friend. And he took counsel with the Elves that remained in Middle-earth (and these abode then mostly in Beleriand); and he made a league with Gil-galad the Elf-king who was descended from Fëanor.
History of Middle-earth V The Lost Road and Other Writings Part 1: "The Fall of Númenor and the Lost Road" Chapter II "The Fall of Númenor" (iii) The second version of The Fall of Númenor §13
However, this version wouldn't last for long.
Son of Felagund
In the next version of the tale, Gil-galad's lineage has already been changed; he's now the son of Inglor Felagund (later renamed Finrod), first son of Finarfin (who, at the time of the draft, is named Finrod; emphasis mine):
But that land where Lúthien had dwelt remained, and it was called Lindon. A gulf of the sea came through it, and a gap was made in the Mountains through which the River Lhun flowed out. But in the land that was north and south of the gulf the Elves remained, and Gil-galad son of Felagund son of Finrod was their king.
History of Middle-earth V The Lost Road and Other Writings Part 1: "The Fall of Númenor and the Lost Road" Chapter II "The Fall of Númenor" (iv) The further development of The Fall of Númenor
Son of Fingon
The descent from Finrod (Felagund) became a problem, though, when Finrod was later determined to have had no wife, which makes it hard for a good Catholic Elf to have a son. This comes up in the Grey Annals, written in 1951:
About this time it is recorded that Nargothrond was full-wrought, and Finrod's sons were gathered there to a feast and Galadriel came from Doriath and dwelt there a while. Now King Inglor Felagund had no wife, and Galadriel asked him why that was; but foresight came upon Felagund as she spoke, and he said: 'An oath I too shall swear, and must be free to fulfil it and go into darkness. Nor shall anything of all my realm endure that a son should inherit.'
But it is said that not until that hour had such cold thoughts ruled him; for indeed she whom he had loved was Amarië of the Vanyar, and she was not permitted to go with him into exile.
History of Middle-earth XI The War of the Jewels Part 1: "The Grey Annals" §108-109
Tolkien's solution to this problem was to shift Gil-galad to be the son of Finrod's cousin Fingon:
Then in great sorrow Fingon took the lordship of the house of Fingolfin and the kingdom of the Noldor. [Late pencilled addition: But his young son (?Findor) [sic] Gilgalad he sent to the Havens]
History of Middle-earth XI The War of the Jewels Part 1: "The Grey Annals" §157
Son of Orodreth
The reasoning behind Tolkien's decision to shift Gil-galad once again, this time making him the son of Orodreth (Finarfin's grandson and Finrod's nephew), is unrecorded so far as I know. Christopher Tolkien only notes that it was written on a small note in the Elvish genealogies:
In an isolated note found within the genealogies, scribbled at great speed but nonetheless dated, August 1965, my father suggested that the best solution to the problem of Gil-galad's parentage was to find him in 'the son of Orodreth', who is here given the Quenya name of Artaresto, and continued:
Finrod left his wife in Valinor and had no children in exile. Angrod's son was Artaresto, who was beloved by Finrod and escaped when Angrod was slain [in the Battle of the Sudden Flame], and dwelt with Finrod. Finrod made him his 'steward' and he succeeded him in Nargothrond. His Sindarin name was Rodreth (altered to Orodreth because of his love of the mountains.... His children were Finduilas and Artanaro = Rodnor later called Gil-galad. (Their mother was a Sindarin lady of the North. She called her son Gil-galad.) Rodnor Gil-galad escaped [the sacking of Nargothrond] and eventually came to Sirion's Mouth and was King of the Noldor there.
History of Middle-earth XII The Peoples of Middle-earth Chapter 11: "The Shibboleth of Fëanor" The Parentage of Gil-galad
As Christopher Tolkien notes later in the same commentary, this seems to have been Tolkien's final word on the subject.
Why is he Fingon's son in The Silmarillion?
This was an editorial choice on the part of Christopher Tolkien, and one that he later regretted.
Part of the problem is that Tolkien made this decision relatively late in his writings, and never got around to incorporating it into his drafts of the Quenta Silmarillion, as Christopher Tolkien notes:
There can be no doubt that this [the 1965 note above] was my father's last word on the subject; but nothing of this late and radically altered conception ever touched the existing narratives, and it was obviously impossible to introduce it into the published Silmarillion. It would nonetheless have been very much better to have left Gil-galad's parentage obscure.
History of Middle-earth XII The Peoples of Middle-earth Chapter 11: "The Shibboleth of Fëanor" The Parentage of Gil-galad
No other explanation is given, but this is just one of the many small challenges Christopher Tolkien faced in trying to adapt his father's notes into a relatively coherent narrative; considering The Silmarillion was published just four years after Tolkien's death, mistakes and omissions of this sort were inevitable.
Okay, so what about Orodreth?
Orodreth's textual history follows a similar pattern to Gil-galad's; his parentage shifted as it gradually became incompatible with other emerging facts of the Legendarium. Christopher Tolkien summarizes the changes quite concisely in The Peoples of Middle-earth:
Put as concisely as possible, Finrod (Felagund) was first given a son named Artanaro Rhodothir (so contradicting the story in the Grey Annals that he had no wife) the second King of Nargothrond, and father of Finduilas. Thus 'Orodreth' was now moved down a generation, becoming Finrod's son rather than his brother. In the next stage my father (recalling, apparently, the story in the Grey Annals) noted that Finrod 'had no child (he left his wife in Aman)', and moved Artanaro Rhodothir to become, still in the same generation, the son of Finrod's brother Angrod (who with Aegnor held the heights of Dorthonion and was slain in the Battle of Sudden Flame).
History of Middle-earth XII The Peoples of Middle-earth Chapter 11: "The Shibboleth of Fëanor" The Parentage of Gil-galad
Which one is right?
This question gets at the heart of what it means for something in Tolkien's Legendarium to be "canon," something I've written about before, and admitted as a problem with no good solution.
For my part, I'm inclined to accept Tolkien's "last word on the subject," and say that Gil-galad was the son of Orodreth. In addition to being Tolkien's last state of mind, which gives it a certain legitimacy over an idea he had and then rejected, it introduces a pleasantly agnatic consistency to the succession of the High Kingship of the Noldor. And I'm all about bringing consistency to lines of succession.
For what it's worth, it does seem as though the final parentage is the most consistent with Tolkien's thoughts; the only alternative with as much internal consistency is the notion that Gil-galad was the son of Fingon, but Christopher Tolkien finishes his essay in The Peoples of Middle-earth by noting:
Much closer analysis of the admittedly extremely complex material than I had made twenty years ago makes it clear that Gil-galad as the son of Fingon was an ephemeral idea.
History of Middle-earth XII The Peoples of Middle-earth Chapter 11: "The Shibboleth of Fëanor" The Parentage of Gil-galad
Then again, maybe Tolkien would have changed his mind again in a few more years, or maybe he'd already changed his mind but couldn't write it down before he died (or he did write it down, and the note hasn't been discovered yet).
In the end, it's only as canon as you think it is.