fix: verify Pantheon push landed; pre-flight SFTP-mode flip; self-pin…

[square360-george]

… internal refs to v3.2.4

pantheon-systems/push-to-pantheon@0.9.0 doesn't propagate git push's exit code. When Pantheon rejects the push (SFTP-mode env, branch protection, lost-update race), the upstream action reports success and bobheadxi marks the GitHub deployment "success" — while Pantheon still has the old SHA. The PR gets a green check and a "Multidev Environment Ready" comment for a deploy that never happened.

Discovered: YH-571 / yalehealth-yale-edu PR #126. Security fix appeared deployed but drush deploy ran on stale code and re-installed a module we'd intentionally removed.

Two defensive layers added to .github/actions/pantheon-push/action.yml:

• Pre-flight SFTP-mode flip: terminus connection:set git when the env exists and is in any mode other than git. Catches the most common cause of the silent rejection.
• Verify-after-push: compare git rev-parse HEAD against git ls-remote refs/heads/ on the Pantheon repo. Fail loudly on mismatch with an actionable error pointing at the previous step's rejection notice. Catch-all for any silent-fail mode in the upstream action.

PR-comment step in reusable-pantheon-deploy-pr-multidev.yml gated with if: success() so the "Multidev Environment Ready" comment doesn't post on a failed deploy.

Self-pin internal @v3.2.3 → @v3.2.4 across all four reusable workflows.

Deferred: the bobheadxi/deployments@v1 "status: success" call lives inside the upstream pantheon-systems/push-to-pantheon@0.9.0 and runs before our verify step. The deployment record will briefly show success before the job goes red. Fixing requires forking upstream or adding a follow-up "reset to failure" step — not blocking the false-positive fix.

[Copilot]

Pull request overview

This PR hardens the shared Pantheon deployment workflows against a false-positive success case where Pantheon rejects a git push but the upstream pantheon-systems/push-to-pantheon@0.9.0 action still reports success. It adds defensive checks in the in-repo pantheon-push composite action and prevents “Multidev Environment Ready” PR comments from posting when the deploy actually failed.

Changes:

• Add a pre-flight “ensure git mode” step and a post-push verification step to .github/actions/pantheon-push/action.yml to fail loudly when Pantheon did not advance to the expected SHA.
• Gate the PR multidev “Environment Ready” comment on success() so it won’t post after a failed deploy.
• Bump in-repo uses: self-references from @v3.2.3 to @v3.2.4 and document the incident/fix in repo docs.

Reviewed changes

Copilot reviewed 2 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
docs/todo/pantheon-push-swallows-rejection.md	Adds an investigation write-up and records the resolution approach for the silent push-rejection issue.
docs/CHANGELOG-AGENT.md	Documents the fix details and the internal self-pin bump as part of the agent changelog.
.github/workflows/reusable-pantheon-deploy-rc-multidev.yml	Updates internal uses: references to @v3.2.4.
.github/workflows/reusable-pantheon-deploy-pr-multidev.yml	Updates internal uses: references and gates the PR comment step on successful deploys.
.github/workflows/reusable-pantheon-deploy-epic-multidev.yml	Updates internal uses: references to @v3.2.4.
.github/workflows/reusable-pantheon-deploy-dev.yml	Updates internal uses: references to @v3.2.4.
.github/actions/pantheon-push/action.yml	Adds pre-flight connection-mode enforcement and post-push ls-remote verification to detect silent push failures.

Comments suppressed due to low confidence (1)

.github/actions/pantheon-push/action.yml:135

• MODE=$(terminus connection:info ... 2>/dev/null || echo "") suppresses errors and coerces failures into an empty string, which then triggers a connection mode flip with MODE shown as unknown. If connection:info fails (auth/network), it would be better to fail the step (or retry) rather than proceed and potentially attempt connection:set on incomplete info.

        MODE=$(terminus connection:info "${SITE}.${TARGET_ENV}" --field=connection_mode 2>/dev/null || echo "")
        echo "Current connection mode for ${SITE}.${TARGET_ENV}: ${MODE:-unknown}"
        if [[ "${MODE}" != "git" ]]; then
          echo "::warning::${SITE}.${TARGET_ENV} is in '${MODE:-unknown}' mode. Switching to git so the push isn't rejected by the pre-receive hook."
          terminus connection:set "${SITE}.${TARGET_ENV}" git
        fi