Square360 · square360-george · May 22, 2026 · May 22, 2026
diff --git a/.github/actions/pantheon-push/action.yml b/.github/actions/pantheon-push/action.yml
@@ -132,10 +132,15 @@ runs:
           echo "Env ${SITE}.${TARGET_ENV} does not exist yet; multidev:create will provision it in git mode. Skipping connection-mode check."
           exit 0
         fi
-        # No 2>/dev/null fallback — if connection:info errors here (auth, network),
-        # we want the step to fail with terminus's real error rather than coerce
-        # the result to an empty string and attempt connection:set on bad data.
-        MODE=$(terminus connection:info "${SITE}.${TARGET_ENV}" --field=connection_mode)
+        # `connection_mode` lives on env:info, NOT on connection:info (which
+        # only returns the git/sftp connection URLs and commands). v3.2.4
+        # shipped with the wrong command — terminus errors with "The requested
+        # field, 'connection_mode', is not defined" — and the no-stderr-swallow
+        # fix from Copilot's review surfaced it.
+        # No `2>/dev/null` fallback: if terminus errors here (auth, network,
+        # schema drift), we want the step to fail with the real error rather
+        # than coerce the result to empty and attempt connection:set on bad data.
+        MODE=$(terminus env:info "${SITE}.${TARGET_ENV}" --field=connection_mode)
         echo "Current connection mode for ${SITE}.${TARGET_ENV}: ${MODE}"
         if [[ "${MODE}" != "git" ]]; then
           echo "::warning::${SITE}.${TARGET_ENV} is in '${MODE}' mode. Switching to git so the push isn't rejected by the pre-receive hook."

diff --git a/.github/workflows/reusable-pantheon-deploy-dev.yml b/.github/workflows/reusable-pantheon-deploy-dev.yml
@@ -62,7 +62,7 @@ jobs:
   semantic_release:
     name: Semantic Release
     if: ${{ inputs.run_semantic_release }}
-    uses: Square360/shared-workflows/.github/workflows/reusable-semantic-release.yml@v3.2.4
+    uses: Square360/shared-workflows/.github/workflows/reusable-semantic-release.yml@v3.2.5
     secrets:
       CI_GH_TOKEN: ${{ secrets.CI_GH_TOKEN }}
 
@@ -92,7 +92,7 @@ jobs:
           fetch-depth: 1
 
       - name: Install Terminus
-        uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.4
+        uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.5
         with:
           machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
 
@@ -102,7 +102,7 @@ jobs:
       # -----------------------------------------------------------------------
       - name: Push code to Pantheon DEV
         id: deploy_pantheon
-        uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.4
+        uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.5
         with:
           site: ${{ inputs.pantheon_site }}
           target_env: dev
@@ -159,7 +159,7 @@ jobs:
 
       - name: Run post-deploy drush commands
         id: drush_commands
-        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.4
+        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.5
         with:
           site: ${{ inputs.pantheon_site }}
           env: dev

diff --git a/.github/workflows/reusable-pantheon-deploy-epic-multidev.yml b/.github/workflows/reusable-pantheon-deploy-epic-multidev.yml
@@ -126,7 +126,7 @@ jobs:
           echo "Epic multidev: ${TARGET_ENV}"
 
       - name: Install Terminus
-        uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.4
+        uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.5
         with:
           machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
 
@@ -148,7 +148,7 @@ jobs:
 
       - name: Push code to Pantheon epic multidev
         id: deploy
-        uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.4
+        uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.5
         with:
           site: ${{ inputs.pantheon_site }}
           target_env: ${{ steps.derive.outputs.target_env }}
@@ -159,7 +159,7 @@ jobs:
 
       - name: Run post-deploy drush commands
         id: drush_commands
-        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.4
+        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.5
         with:
           site: ${{ inputs.pantheon_site }}
           env: ${{ steps.derive.outputs.target_env }}
@@ -234,7 +234,7 @@ jobs:
     # The security workflow detects epr-* internally and runs unconditionally
     # in strict mode (fails on any High-severity finding) — same gate as rc-*,
     # per the Square360 SOP for epic integration multidevs. No force_run needed.
-    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@v3.2.4
+    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@v3.2.5
     with:
       pantheon_site: ${{ inputs.pantheon_site }}
       target_env: ${{ needs.deploy_epic_multidev.outputs.target_env }}

diff --git a/.github/workflows/reusable-pantheon-deploy-pr-multidev.yml b/.github/workflows/reusable-pantheon-deploy-pr-multidev.yml
@@ -83,7 +83,7 @@ jobs:
         run: echo "target_env=pr-${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT
 
       - name: Install Terminus
-        uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.4
+        uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.5
         with:
           machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
 
@@ -105,7 +105,7 @@ jobs:
 
       - name: Push code to Pantheon multidev
         id: deploy
-        uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.4
+        uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.5
         with:
           site: ${{ inputs.pantheon_site }}
           target_env: ${{ steps.derive.outputs.target_env }}
@@ -116,7 +116,7 @@ jobs:
 
       - name: Run post-deploy drush commands
         id: drush_commands
-        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.4
+        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.5
         with:
           site: ${{ inputs.pantheon_site }}
           env: ${{ steps.derive.outputs.target_env }}
@@ -228,7 +228,7 @@ jobs:
         contains(github.event.pull_request.body, '[run-security]') ||
         contains(github.event.pull_request.body, '[security]')
       }}
-    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@v3.2.4
+    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@v3.2.5
     with:
       pantheon_site: ${{ inputs.pantheon_site }}
       target_env: ${{ needs.deploy_pr_multidev.outputs.target_env }}
@@ -256,7 +256,7 @@ jobs:
         contains(github.event.pull_request.body, '[run-vrt]') ||
         contains(github.event.pull_request.body, '[vrt]')
       }}
-    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-vrt.yml@v3.2.4
+    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-vrt.yml@v3.2.5
     with:
       pantheon_site: ${{ inputs.pantheon_site }}
       target_env: ${{ needs.deploy_pr_multidev.outputs.target_env }}

diff --git a/.github/workflows/reusable-pantheon-deploy-rc-multidev.yml b/.github/workflows/reusable-pantheon-deploy-rc-multidev.yml
@@ -88,7 +88,7 @@ jobs:
           echo "Derived RC multidev name: ${TARGET_ENV}"
 
       - name: Install Terminus
-        uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.4
+        uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.5
         with:
           machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
 
@@ -111,7 +111,7 @@ jobs:
 
       - name: Push code to Pantheon multidev
         id: deploy
-        uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.4
+        uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.5
         with:
           site: ${{ inputs.pantheon_site }}
           target_env: ${{ steps.derive.outputs.target_env }}
@@ -122,7 +122,7 @@ jobs:
 
       - name: Run post-deploy drush commands
         id: drush_commands
-        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.4
+        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.5
         with:
           site: ${{ inputs.pantheon_site }}
           env: ${{ steps.derive.outputs.target_env }}
@@ -165,7 +165,7 @@ jobs:
     needs: deploy_rc_multidev
     # The security workflow detects rc-* internally and runs unconditionally
     # in strict mode (fails on any High-severity finding). No force_run needed.
-    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@v3.2.4
+    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@v3.2.5
     with:
       pantheon_site: ${{ inputs.pantheon_site }}
       target_env: ${{ needs.deploy_rc_multidev.outputs.target_env }}
@@ -193,7 +193,7 @@ jobs:
         contains(github.event.head_commit.message, '[run-vrt]') ||
         contains(github.event.head_commit.message, '[vrt]')
       }}
-    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-vrt.yml@v3.2.4
+    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-vrt.yml@v3.2.5
     with:
       pantheon_site: ${{ inputs.pantheon_site }}
       target_env: ${{ needs.deploy_rc_multidev.outputs.target_env }}

diff --git a/docs/CHANGELOG-AGENT.md b/docs/CHANGELOG-AGENT.md
@@ -2,6 +2,28 @@
 
 This file tracks the work done together with GitHub Copilot on the Square360 Shared Pantheon Workflows repository.
 
+## 2026-05-22 (later)
+
+### Fix - pre-flight terminus field query: `connection:info` → `env:info` (v3.2.5)
+
+- **The bug shipped in v3.2.4.** The pre-flight SFTP-mode check in `.github/actions/pantheon-push/action.yml` was querying the wrong terminus subcommand for the `connection_mode` field:
+
+  ```bash
+  MODE=$(terminus connection:info "${SITE}.${TARGET_ENV}" --field=connection_mode)
+  ```
+
+  `connection_mode` lives on `env:info`, not `connection:info` (which only returns git/sftp connection URLs and commands). Terminus exits 1 with `The requested field, 'connection_mode', is not defined.` The fix is a one-word change:
+
+  ```bash
+  MODE=$(terminus env:info "${SITE}.${TARGET_ENV}" --field=connection_mode)
+  ```
+- **Why this slipped past v3.2.4's Yale Health validation:** the original code had `2>/dev/null || echo ""` swallowing terminus errors, so MODE was always empty, the `!= "git"` check always tripped, and `connection:set git` ran defensively every single time — masking the broken field query. Copilot's review on PR #101 correctly flagged the stderr suppression and we removed it. That surfaced this real bug on the first v3.2.5-released consumer deploy (Yale Health, immediately after the plugin v2.0.18 release).
+- **Out-of-scope but confirmed sound:** `terminus connection:info "${SITE}.${TARGET_ENV}" --field=git_url` in the verify-after-push step is correct — `git_url` is on `connection:info`. Only the pre-flight call was wrong.
+
+### Maintenance - Self-reference bumps to v3.2.5
+
+- **Bumped all in-repo `uses:` self-references from `@v3.2.4` to `@v3.2.5`** across the four `reusable-pantheon-deploy-*.yml` workflows. Same pin-drift-trap discipline as prior releases.
+
 ## 2026-05-22
 
 ### Fix - `pantheon-push` fails loudly when Pantheon rejects the push (v3.2.4)