From a5639e0823753e28777fc6eaec37028539bc0e9c Mon Sep 17 00:00:00 2001
From: George A Heimel <george.heimel@square360.com>
Date: Fri, 22 May 2026 17:15:53 -0400
Subject: [PATCH 1/5] fix(pantheon-push): use full clone to dodge upstream
 shallow-file race

reusable-pantheon-deploy-{dev,rc-multidev,epic-multidev,pr-multidev} all
checked out with fetch-depth: 1. upstream pantheon-systems/push-to-pantheon
@0.9.0's prepare_site_root then trips "fatal: shallow file has changed
since we read it" exit-128 after our pre-commit step writes a new commit
on top of the shallow HEAD.

bumping fetch-depth to 0 removes .git/shallow entirely so the race can't
fire. small checkout cost vs an unrecoverable mid-step failure that aborts
the deploy before the verify-after-push step can run.

scoped to the four reusable workflows that call our pantheon-push composite
(the four with the pre-commit step). reusable-deploy-pantheon.yml and
reusable-deploy-multidev.yml don't call pantheon-push so left alone.

repro: Yale Health rc-2026-21 first-run, 2026-05-22 run id 70394172925.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/workflows/reusable-pantheon-deploy-dev.yml       | 9 +++++++--
 .../workflows/reusable-pantheon-deploy-epic-multidev.yml | 8 +++++++-
 .../workflows/reusable-pantheon-deploy-pr-multidev.yml   | 8 +++++++-
 .../workflows/reusable-pantheon-deploy-rc-multidev.yml   | 8 +++++++-
 4 files changed, 28 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/reusable-pantheon-deploy-dev.yml b/.github/workflows/reusable-pantheon-deploy-dev.yml
index b3ffb02..6372134 100644
--- a/.github/workflows/reusable-pantheon-deploy-dev.yml
+++ b/.github/workflows/reusable-pantheon-deploy-dev.yml
@@ -88,8 +88,13 @@ jobs:
           # github.ref is correct on push triggers; pull_request.base.ref is
           # the safety net if this workflow is wired up via PR events.
           ref: ${{ github.event.pull_request.base.ref || github.ref }}
-          # Shallow clone — pantheon-systems/push-to-pantheon handles unshallowing.
-          fetch-depth: 1
+          # Full clone — upstream pantheon-systems/push-to-pantheon@0.9.0's
+          # prepare_site_root trips "fatal: shallow file has changed since we
+          # read it" when our pre-commit step writes a new commit on top of a
+          # shallow HEAD. A full clone removes the .git/shallow file entirely
+          # and the race can't fire. Small checkout cost vs. unrecoverable
+          # mid-step failure.
+          fetch-depth: 0
 
       - name: Install Terminus
         uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.5
diff --git a/.github/workflows/reusable-pantheon-deploy-epic-multidev.yml b/.github/workflows/reusable-pantheon-deploy-epic-multidev.yml
index 0f22b3c..9dfb365 100644
--- a/.github/workflows/reusable-pantheon-deploy-epic-multidev.yml
+++ b/.github/workflows/reusable-pantheon-deploy-epic-multidev.yml
@@ -83,7 +83,13 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
         with:
-          fetch-depth: 1
+          # Full clone — upstream pantheon-systems/push-to-pantheon@0.9.0's
+          # prepare_site_root trips "fatal: shallow file has changed since we
+          # read it" when our pre-commit step writes a new commit on top of a
+          # shallow HEAD. A full clone removes the .git/shallow file entirely
+          # and the race can't fire. Small checkout cost vs. unrecoverable
+          # mid-step failure.
+          fetch-depth: 0
 
       - name: Derive multidev name from epic branch
         id: derive
diff --git a/.github/workflows/reusable-pantheon-deploy-pr-multidev.yml b/.github/workflows/reusable-pantheon-deploy-pr-multidev.yml
index 79cc487..77decbe 100644
--- a/.github/workflows/reusable-pantheon-deploy-pr-multidev.yml
+++ b/.github/workflows/reusable-pantheon-deploy-pr-multidev.yml
@@ -76,7 +76,13 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
         with:
-          fetch-depth: 1
+          # Full clone — upstream pantheon-systems/push-to-pantheon@0.9.0's
+          # prepare_site_root trips "fatal: shallow file has changed since we
+          # read it" when our pre-commit step writes a new commit on top of a
+          # shallow HEAD. A full clone removes the .git/shallow file entirely
+          # and the race can't fire. Small checkout cost vs. unrecoverable
+          # mid-step failure.
+          fetch-depth: 0
 
       - name: Derive multidev name from PR number
         id: derive
diff --git a/.github/workflows/reusable-pantheon-deploy-rc-multidev.yml b/.github/workflows/reusable-pantheon-deploy-rc-multidev.yml
index 166a0f2..ce8c464 100644
--- a/.github/workflows/reusable-pantheon-deploy-rc-multidev.yml
+++ b/.github/workflows/reusable-pantheon-deploy-rc-multidev.yml
@@ -76,7 +76,13 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
         with:
-          fetch-depth: 1
+          # Full clone — upstream pantheon-systems/push-to-pantheon@0.9.0's
+          # prepare_site_root trips "fatal: shallow file has changed since we
+          # read it" when our pre-commit step writes a new commit on top of a
+          # shallow HEAD. A full clone removes the .git/shallow file entirely
+          # and the race can't fire. Small checkout cost vs. unrecoverable
+          # mid-step failure.
+          fetch-depth: 0
 
       - name: Derive multidev name from ISO week
         id: derive

From 318c115ffbb0ccb9a2b3fd9aee542f47ee5dc48f Mon Sep 17 00:00:00 2001
From: George A Heimel <george.heimel@square360.com>
Date: Fri, 22 May 2026 17:35:26 -0400
Subject: [PATCH 2/5] fix(pantheon-push): patch upstream to tolerate unshallow
 errors
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Upstream pantheon-systems/push-to-pantheon@0.9.0 has an unguarded
`git fetch --unshallow origin` at scripts/main.sh:352 inside
prepare_site_root. Same bug exists 0.8.0 (action.yml:363) through 0.9.2,
never fixed upstream.

The bug fires two ways:
- fetch-depth: 1 → races with "shallow file has changed since we read it"
  (intermittent, exit 128)
- fetch-depth: 0 → "--unshallow on a complete repository does not make
  sense" (deterministic, exit 128)

Both abort the deploy in prepare_site_root before our verify-after-push
step can run. Upstream's bobheadxi/deployments@v1 then marks the GitHub
deployment "success" despite the failure.

Fix: sed-patch upstream's main.sh on the runner before invoking the
action, appending `|| true` to the unshallow call. Safe because upstream
itself does the proper guarded unshallow later in push_to_pantheon (line
382: is-shallow-repository check + `||` fallback) — the line we patch
is redundant defense, not the only deepen.

Patch step is idempotent and fails loudly if upstream changes shape
(missing file, sed pattern miss). UPSTREAM_VERSION env var is the canary
for upstream bumps.

Also reverts the fetch-depth: 0 misadventure on the 4 pantheon-push-
consuming reusables back to fetch-depth: 1 — that was an attempt to
sidestep the race that just traded it for the deterministic error.

Repro: Yale Health rc-2026-21 first-run 2026-05-22 run id 70394172925
(shallow race), follow-up run id 70396096336 (complete-repo error).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/actions/pantheon-push/action.yml      | 49 +++++++++++++++++++
 .../reusable-pantheon-deploy-dev.yml          |  9 +---
 ...reusable-pantheon-deploy-epic-multidev.yml |  8 +--
 .../reusable-pantheon-deploy-pr-multidev.yml  |  8 +--
 .../reusable-pantheon-deploy-rc-multidev.yml  |  8 +--
 5 files changed, 54 insertions(+), 28 deletions(-)

diff --git a/.github/actions/pantheon-push/action.yml b/.github/actions/pantheon-push/action.yml
index 2c6681a..9eb17b9 100644
--- a/.github/actions/pantheon-push/action.yml
+++ b/.github/actions/pantheon-push/action.yml
@@ -147,6 +147,55 @@ runs:
           terminus connection:set "${SITE}.${TARGET_ENV}" git
         fi
 
+    # Upstream pantheon-systems/push-to-pantheon@0.9.0 has an unguarded
+    # `git fetch --unshallow origin` at scripts/main.sh:352 inside
+    # prepare_site_root (the empty-SITE_ROOT branch we take). It blows up two
+    # different ways depending on the checkout state:
+    #   - On a shallow clone (fetch-depth: 1): races with the runner's git
+    #     state and exits 128 with "fatal: shallow file has changed since we
+    #     read it". Intermittent.
+    #   - On a complete clone (fetch-depth: 0): errors deterministically with
+    #     "fatal: --unshallow on a complete repository does not make sense".
+    # Either way it aborts the deploy before our verify-after-push step can
+    # run, and the GitHub deployment is left marked "success" by upstream's
+    # bobheadxi/deployments@v1 wrapper despite the failure.
+    #
+    # Upstream itself does the right thing later in push_to_pantheon (line 382):
+    # `is-shallow-repository` guard + `||` fallback. The bug is specifically
+    # the unguarded call in prepare_site_root.
+    #
+    # We can't edit upstream, so we sed-patch its main.sh on the runner before
+    # invoking the action. The patch appends `|| true` to the unshallow line —
+    # tolerating both failure modes. Safe because the redundant deepen-on-push
+    # at line 382 still runs, properly guarded, before the actual `git push`.
+    #
+    # Pinned to upstream 0.9.0 — if we ever bump that, this step needs to be
+    # re-validated against the new source (sed pattern may not match).
+    - name: Patch upstream push-to-pantheon to tolerate unshallow errors
+      shell: bash
+      env:
+        UPSTREAM_VERSION: "0.9.0"
+      run: |
+        set -euo pipefail
+        UPSTREAM_SCRIPT="/home/runner/work/_actions/pantheon-systems/push-to-pantheon/${UPSTREAM_VERSION}/scripts/main.sh"
+        if [ ! -f "${UPSTREAM_SCRIPT}" ]; then
+          echo "::error::Cannot find upstream main.sh at ${UPSTREAM_SCRIPT}. Has the upstream action version or layout changed?"
+          exit 1
+        fi
+        if grep -qF 'git fetch --unshallow origin || true' "${UPSTREAM_SCRIPT}"; then
+          echo "Upstream already patched; skipping (idempotent re-run)."
+          exit 0
+        fi
+        # The target line is tab-indented in upstream source: `\tgit fetch --unshallow origin`
+        sed -i 's|^\([[:space:]]*\)git fetch --unshallow origin$|\1git fetch --unshallow origin || true|' "${UPSTREAM_SCRIPT}"
+        if ! grep -qF 'git fetch --unshallow origin || true' "${UPSTREAM_SCRIPT}"; then
+          echo "::error::Sed patch did not apply. Upstream main.sh may have changed shape."
+          echo "Lines mentioning unshallow:"
+          grep -n 'unshallow' "${UPSTREAM_SCRIPT}" || true
+          exit 1
+        fi
+        echo "Patched upstream main.sh: prepare_site_root's --unshallow is now tolerant."
+
     - name: Push to Pantheon
       uses: pantheon-systems/push-to-pantheon@0.9.0
       env:
diff --git a/.github/workflows/reusable-pantheon-deploy-dev.yml b/.github/workflows/reusable-pantheon-deploy-dev.yml
index 6372134..b3ffb02 100644
--- a/.github/workflows/reusable-pantheon-deploy-dev.yml
+++ b/.github/workflows/reusable-pantheon-deploy-dev.yml
@@ -88,13 +88,8 @@ jobs:
           # github.ref is correct on push triggers; pull_request.base.ref is
           # the safety net if this workflow is wired up via PR events.
           ref: ${{ github.event.pull_request.base.ref || github.ref }}
-          # Full clone — upstream pantheon-systems/push-to-pantheon@0.9.0's
-          # prepare_site_root trips "fatal: shallow file has changed since we
-          # read it" when our pre-commit step writes a new commit on top of a
-          # shallow HEAD. A full clone removes the .git/shallow file entirely
-          # and the race can't fire. Small checkout cost vs. unrecoverable
-          # mid-step failure.
-          fetch-depth: 0
+          # Shallow clone — pantheon-systems/push-to-pantheon handles unshallowing.
+          fetch-depth: 1
 
       - name: Install Terminus
         uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.5
diff --git a/.github/workflows/reusable-pantheon-deploy-epic-multidev.yml b/.github/workflows/reusable-pantheon-deploy-epic-multidev.yml
index 9dfb365..0f22b3c 100644
--- a/.github/workflows/reusable-pantheon-deploy-epic-multidev.yml
+++ b/.github/workflows/reusable-pantheon-deploy-epic-multidev.yml
@@ -83,13 +83,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
         with:
-          # Full clone — upstream pantheon-systems/push-to-pantheon@0.9.0's
-          # prepare_site_root trips "fatal: shallow file has changed since we
-          # read it" when our pre-commit step writes a new commit on top of a
-          # shallow HEAD. A full clone removes the .git/shallow file entirely
-          # and the race can't fire. Small checkout cost vs. unrecoverable
-          # mid-step failure.
-          fetch-depth: 0
+          fetch-depth: 1
 
       - name: Derive multidev name from epic branch
         id: derive
diff --git a/.github/workflows/reusable-pantheon-deploy-pr-multidev.yml b/.github/workflows/reusable-pantheon-deploy-pr-multidev.yml
index 77decbe..79cc487 100644
--- a/.github/workflows/reusable-pantheon-deploy-pr-multidev.yml
+++ b/.github/workflows/reusable-pantheon-deploy-pr-multidev.yml
@@ -76,13 +76,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
         with:
-          # Full clone — upstream pantheon-systems/push-to-pantheon@0.9.0's
-          # prepare_site_root trips "fatal: shallow file has changed since we
-          # read it" when our pre-commit step writes a new commit on top of a
-          # shallow HEAD. A full clone removes the .git/shallow file entirely
-          # and the race can't fire. Small checkout cost vs. unrecoverable
-          # mid-step failure.
-          fetch-depth: 0
+          fetch-depth: 1
 
       - name: Derive multidev name from PR number
         id: derive
diff --git a/.github/workflows/reusable-pantheon-deploy-rc-multidev.yml b/.github/workflows/reusable-pantheon-deploy-rc-multidev.yml
index ce8c464..166a0f2 100644
--- a/.github/workflows/reusable-pantheon-deploy-rc-multidev.yml
+++ b/.github/workflows/reusable-pantheon-deploy-rc-multidev.yml
@@ -76,13 +76,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
         with:
-          # Full clone — upstream pantheon-systems/push-to-pantheon@0.9.0's
-          # prepare_site_root trips "fatal: shallow file has changed since we
-          # read it" when our pre-commit step writes a new commit on top of a
-          # shallow HEAD. A full clone removes the .git/shallow file entirely
-          # and the race can't fire. Small checkout cost vs. unrecoverable
-          # mid-step failure.
-          fetch-depth: 0
+          fetch-depth: 1
 
       - name: Derive multidev name from ISO week
         id: derive

From 01cff680e7b17b630be646450934ccabd49581bc Mon Sep 17 00:00:00 2001
From: George A Heimel <george.heimel@square360.com>
Date: Fri, 22 May 2026 21:03:19 -0400
Subject: [PATCH 3/5] =?UTF-8?q?fix(pantheon-push):=20verify-after-push=20d?=
 =?UTF-8?q?ev=E2=86=92master=20mapping;=20branch-pin=20internal=20refs?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two fixes stacked together because the dev deploy on v3.2.5 / v3.2.6-branch
exposed both at once on Yale Health rc/dev pushes 2026-05-22.

1. verify-after-push: map TARGET_ENV → Pantheon branch name before
   ls-remote. Pantheon's `dev` env lives on `master`; multidevs use a
   branch with their own name. Mirrors upstream push-to-pantheon's
   push-target logic (scripts/main.sh:369-378). Without this, dev deploys
   false-fail here even though the push lands cleanly — ls-remote for
   refs/heads/dev returns empty because the ref doesn't exist.

   Repro: Yale Health dev deploy run 70400355314. Upstream logged
   `pushing to 'master' branch on Pantheon` and the force-push succeeded
   (HEAD -> master). Our verify step then aborted on refs/heads/dev.

2. Branch-pin internal self-refs across the 4 pantheon-push-consuming
   reusables. Files on the branch were still calling pantheon-push@v3.2.5,
   terminus-install@v3.2.5, pantheon-post-deploy-drush@v3.2.5, and the
   security-scan / vrt / semantic-release reusables at @v3.2.5. That
   meant the upstream-patch step (commit 318c115) was never invoked —
   Yale Health was running tagged v3.2.5 code, not the branch. Earlier
   RC/dev runs only worked because the upstream shallow race didn't fire.

   This is the documented [[release-pin-drift-trap]] / [[branch-pin-
   during-pre-merge-test]] pattern — flipped @v3.2.5 → @fix/v3.2.6-
   shallow-clone-race so the branch's code actually runs end-to-end. To
   revert pre-merge.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/actions/pantheon-push/action.yml      | 23 ++++++++++++++-----
 .../reusable-pantheon-deploy-dev.yml          |  8 +++----
 ...reusable-pantheon-deploy-epic-multidev.yml |  8 +++----
 .../reusable-pantheon-deploy-pr-multidev.yml  | 10 ++++----
 .../reusable-pantheon-deploy-rc-multidev.yml  | 10 ++++----
 5 files changed, 35 insertions(+), 24 deletions(-)

diff --git a/.github/actions/pantheon-push/action.yml b/.github/actions/pantheon-push/action.yml
index 9eb17b9..1b4e07c 100644
--- a/.github/actions/pantheon-push/action.yml
+++ b/.github/actions/pantheon-push/action.yml
@@ -244,8 +244,19 @@ runs:
           echo "::error::Could not determine Pantheon git URL for ${SITE}.${TARGET_ENV}; cannot verify push."
           exit 1
         fi
-        echo "Local HEAD:    ${LOCAL_HEAD}"
-        echo "Pantheon URL:  ${PANTHEON_GIT_URL}"
+        # Pantheon's `dev` environment lives on the `master` branch in the
+        # Pantheon-side git repo; multidevs use a branch with the same name as
+        # the env. Matches upstream push-to-pantheon's push-target logic
+        # (scripts/main.sh:369-378). Without this mapping, dev deploys
+        # false-fail here because ls-remote refs/heads/dev returns empty.
+        if [[ "${TARGET_ENV}" == "dev" ]]; then
+          PANTHEON_BRANCH="master"
+        else
+          PANTHEON_BRANCH="${TARGET_ENV}"
+        fi
+        echo "Local HEAD:        ${LOCAL_HEAD}"
+        echo "Pantheon URL:      ${PANTHEON_GIT_URL}"
+        echo "Pantheon branch:   ${PANTHEON_BRANCH}"
         # Retry ls-remote a few times: for freshly created multidevs there can
         # be a short window where Pantheon has accepted the push but the ref
         # isn't yet visible via ls-remote (related to the propagation race the
@@ -254,7 +265,7 @@ runs:
         # silent-fail.
         REMOTE_HEAD=""
         for attempt in 1 2 3; do
-          REMOTE_HEAD=$(git ls-remote "${PANTHEON_GIT_URL}" "refs/heads/${TARGET_ENV}" | awk '{print $1}')
+          REMOTE_HEAD=$(git ls-remote "${PANTHEON_GIT_URL}" "refs/heads/${PANTHEON_BRANCH}" | awk '{print $1}')
           if [[ -n "${REMOTE_HEAD}" ]]; then
             break
           fi
@@ -266,13 +277,13 @@ runs:
         done
         echo "Pantheon HEAD: ${REMOTE_HEAD:-<empty>}"
         if [[ -z "${REMOTE_HEAD}" ]]; then
-          echo "::error::Pantheon ${TARGET_ENV} has no commits on refs/heads/${TARGET_ENV} after 3 attempts. The upstream push silently failed or the branch was never created."
+          echo "::error::Pantheon ${TARGET_ENV} has no commits on refs/heads/${PANTHEON_BRANCH} after 3 attempts. The upstream push silently failed or the branch was never created."
           echo "::error::Check the previous step's output for 'remote rejected' / 'pre-receive hook declined' / SFTP-mode notices."
           exit 1
         fi
         if [[ "${LOCAL_HEAD}" != "${REMOTE_HEAD}" ]]; then
-          echo "::error::Pantheon ${TARGET_ENV} is at ${REMOTE_HEAD}, expected ${LOCAL_HEAD}. The upstream push silently failed."
+          echo "::error::Pantheon ${TARGET_ENV} (branch ${PANTHEON_BRANCH}) is at ${REMOTE_HEAD}, expected ${LOCAL_HEAD}. The upstream push silently failed."
           echo "::error::Check the previous step's output for 'remote rejected' / 'pre-receive hook declined' / SFTP-mode notices."
           exit 1
         fi
-        echo "✅ Pantheon ${TARGET_ENV} is at ${LOCAL_HEAD} as expected."
+        echo "✅ Pantheon ${TARGET_ENV} (branch ${PANTHEON_BRANCH}) is at ${LOCAL_HEAD} as expected."
diff --git a/.github/workflows/reusable-pantheon-deploy-dev.yml b/.github/workflows/reusable-pantheon-deploy-dev.yml
index b3ffb02..4e785e0 100644
--- a/.github/workflows/reusable-pantheon-deploy-dev.yml
+++ b/.github/workflows/reusable-pantheon-deploy-dev.yml
@@ -62,7 +62,7 @@ jobs:
   semantic_release:
     name: Semantic Release
     if: ${{ inputs.run_semantic_release }}
-    uses: Square360/shared-workflows/.github/workflows/reusable-semantic-release.yml@v3.2.5
+    uses: Square360/shared-workflows/.github/workflows/reusable-semantic-release.yml@fix/v3.2.6-shallow-clone-race
     secrets:
       CI_GH_TOKEN: ${{ secrets.CI_GH_TOKEN }}
 
@@ -92,7 +92,7 @@ jobs:
           fetch-depth: 1
 
       - name: Install Terminus
-        uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.5
+        uses: Square360/shared-workflows/.github/actions/terminus-install@fix/v3.2.6-shallow-clone-race
         with:
           machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
 
@@ -102,7 +102,7 @@ jobs:
       # -----------------------------------------------------------------------
       - name: Push code to Pantheon DEV
         id: deploy_pantheon
-        uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.5
+        uses: Square360/shared-workflows/.github/actions/pantheon-push@fix/v3.2.6-shallow-clone-race
         with:
           site: ${{ inputs.pantheon_site }}
           target_env: dev
@@ -159,7 +159,7 @@ jobs:
 
       - name: Run post-deploy drush commands
         id: drush_commands
-        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.5
+        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@fix/v3.2.6-shallow-clone-race
         with:
           site: ${{ inputs.pantheon_site }}
           env: dev
diff --git a/.github/workflows/reusable-pantheon-deploy-epic-multidev.yml b/.github/workflows/reusable-pantheon-deploy-epic-multidev.yml
index 0f22b3c..47b2efc 100644
--- a/.github/workflows/reusable-pantheon-deploy-epic-multidev.yml
+++ b/.github/workflows/reusable-pantheon-deploy-epic-multidev.yml
@@ -126,7 +126,7 @@ jobs:
           echo "Epic multidev: ${TARGET_ENV}"
 
       - name: Install Terminus
-        uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.5
+        uses: Square360/shared-workflows/.github/actions/terminus-install@fix/v3.2.6-shallow-clone-race
         with:
           machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
 
@@ -148,7 +148,7 @@ jobs:
 
       - name: Push code to Pantheon epic multidev
         id: deploy
-        uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.5
+        uses: Square360/shared-workflows/.github/actions/pantheon-push@fix/v3.2.6-shallow-clone-race
         with:
           site: ${{ inputs.pantheon_site }}
           target_env: ${{ steps.derive.outputs.target_env }}
@@ -159,7 +159,7 @@ jobs:
 
       - name: Run post-deploy drush commands
         id: drush_commands
-        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.5
+        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@fix/v3.2.6-shallow-clone-race
         with:
           site: ${{ inputs.pantheon_site }}
           env: ${{ steps.derive.outputs.target_env }}
@@ -234,7 +234,7 @@ jobs:
     # The security workflow detects epr-* internally and runs unconditionally
     # in strict mode (fails on any High-severity finding) — same gate as rc-*,
     # per the Square360 SOP for epic integration multidevs. No force_run needed.
-    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@v3.2.5
+    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@fix/v3.2.6-shallow-clone-race
     with:
       pantheon_site: ${{ inputs.pantheon_site }}
       target_env: ${{ needs.deploy_epic_multidev.outputs.target_env }}
diff --git a/.github/workflows/reusable-pantheon-deploy-pr-multidev.yml b/.github/workflows/reusable-pantheon-deploy-pr-multidev.yml
index 79cc487..a024d62 100644
--- a/.github/workflows/reusable-pantheon-deploy-pr-multidev.yml
+++ b/.github/workflows/reusable-pantheon-deploy-pr-multidev.yml
@@ -83,7 +83,7 @@ jobs:
         run: echo "target_env=pr-${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT
 
       - name: Install Terminus
-        uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.5
+        uses: Square360/shared-workflows/.github/actions/terminus-install@fix/v3.2.6-shallow-clone-race
         with:
           machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
 
@@ -105,7 +105,7 @@ jobs:
 
       - name: Push code to Pantheon multidev
         id: deploy
-        uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.5
+        uses: Square360/shared-workflows/.github/actions/pantheon-push@fix/v3.2.6-shallow-clone-race
         with:
           site: ${{ inputs.pantheon_site }}
           target_env: ${{ steps.derive.outputs.target_env }}
@@ -116,7 +116,7 @@ jobs:
 
       - name: Run post-deploy drush commands
         id: drush_commands
-        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.5
+        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@fix/v3.2.6-shallow-clone-race
         with:
           site: ${{ inputs.pantheon_site }}
           env: ${{ steps.derive.outputs.target_env }}
@@ -228,7 +228,7 @@ jobs:
         contains(github.event.pull_request.body, '[run-security]') ||
         contains(github.event.pull_request.body, '[security]')
       }}
-    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@v3.2.5
+    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@fix/v3.2.6-shallow-clone-race
     with:
       pantheon_site: ${{ inputs.pantheon_site }}
       target_env: ${{ needs.deploy_pr_multidev.outputs.target_env }}
@@ -256,7 +256,7 @@ jobs:
         contains(github.event.pull_request.body, '[run-vrt]') ||
         contains(github.event.pull_request.body, '[vrt]')
       }}
-    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-vrt.yml@v3.2.5
+    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-vrt.yml@fix/v3.2.6-shallow-clone-race
     with:
       pantheon_site: ${{ inputs.pantheon_site }}
       target_env: ${{ needs.deploy_pr_multidev.outputs.target_env }}
diff --git a/.github/workflows/reusable-pantheon-deploy-rc-multidev.yml b/.github/workflows/reusable-pantheon-deploy-rc-multidev.yml
index 166a0f2..48b23d3 100644
--- a/.github/workflows/reusable-pantheon-deploy-rc-multidev.yml
+++ b/.github/workflows/reusable-pantheon-deploy-rc-multidev.yml
@@ -88,7 +88,7 @@ jobs:
           echo "Derived RC multidev name: ${TARGET_ENV}"
 
       - name: Install Terminus
-        uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.5
+        uses: Square360/shared-workflows/.github/actions/terminus-install@fix/v3.2.6-shallow-clone-race
         with:
           machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
 
@@ -111,7 +111,7 @@ jobs:
 
       - name: Push code to Pantheon multidev
         id: deploy
-        uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.5
+        uses: Square360/shared-workflows/.github/actions/pantheon-push@fix/v3.2.6-shallow-clone-race
         with:
           site: ${{ inputs.pantheon_site }}
           target_env: ${{ steps.derive.outputs.target_env }}
@@ -122,7 +122,7 @@ jobs:
 
       - name: Run post-deploy drush commands
         id: drush_commands
-        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.5
+        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@fix/v3.2.6-shallow-clone-race
         with:
           site: ${{ inputs.pantheon_site }}
           env: ${{ steps.derive.outputs.target_env }}
@@ -165,7 +165,7 @@ jobs:
     needs: deploy_rc_multidev
     # The security workflow detects rc-* internally and runs unconditionally
     # in strict mode (fails on any High-severity finding). No force_run needed.
-    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@v3.2.5
+    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@fix/v3.2.6-shallow-clone-race
     with:
       pantheon_site: ${{ inputs.pantheon_site }}
       target_env: ${{ needs.deploy_rc_multidev.outputs.target_env }}
@@ -193,7 +193,7 @@ jobs:
         contains(github.event.head_commit.message, '[run-vrt]') ||
         contains(github.event.head_commit.message, '[vrt]')
       }}
-    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-vrt.yml@v3.2.5
+    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-vrt.yml@fix/v3.2.6-shallow-clone-race
     with:
       pantheon_site: ${{ inputs.pantheon_site }}
       target_env: ${{ needs.deploy_rc_multidev.outputs.target_env }}

From 7cc46790b7a82b4c3d417911d8ac742d7b1ff60f Mon Sep 17 00:00:00 2001
From: George A Heimel <george.heimel@square360.com>
Date: Fri, 22 May 2026 21:08:16 -0400
Subject: [PATCH 4/5] fix(pantheon-push): use # as sed delimiter in unshallow
 patch (|| collided with |)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The patch step shipped in commit 318c115 used `|` as the sed delimiter, but
the replacement string contains `||` (the bash short-circuit) which sed
parsed as the end-of-replacement separator. Result: `sed: -e expression
#1, char 82: unknown option to 's'`, step exit 1, deploy aborted before
upstream push-to-pantheon was invoked.

Switch delimiter to `#` — not present in pattern or replacement.

Validated locally against the actual upstream main.sh@0.9.0: line 352
correctly gets `|| true` appended, line 384 (already-guarded variant) is
correctly skipped by `^...$` anchoring.

Repro: Yale Health dev deploy run 70400355314 attempt 2.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/actions/pantheon-push/action.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/actions/pantheon-push/action.yml b/.github/actions/pantheon-push/action.yml
index 1b4e07c..bbe4a5a 100644
--- a/.github/actions/pantheon-push/action.yml
+++ b/.github/actions/pantheon-push/action.yml
@@ -186,8 +186,10 @@ runs:
           echo "Upstream already patched; skipping (idempotent re-run)."
           exit 0
         fi
-        # The target line is tab-indented in upstream source: `\tgit fetch --unshallow origin`
-        sed -i 's|^\([[:space:]]*\)git fetch --unshallow origin$|\1git fetch --unshallow origin || true|' "${UPSTREAM_SCRIPT}"
+        # The target line is tab-indented in upstream source: `\tgit fetch --unshallow origin`.
+        # Use `#` as the sed delimiter — the replacement contains `||` and `|` would be
+        # interpreted as the end-of-replacement separator (sed: unknown option to `s`).
+        sed -i 's#^\([[:space:]]*\)git fetch --unshallow origin$#\1git fetch --unshallow origin || true#' "${UPSTREAM_SCRIPT}"
         if ! grep -qF 'git fetch --unshallow origin || true' "${UPSTREAM_SCRIPT}"; then
           echo "::error::Sed patch did not apply. Upstream main.sh may have changed shape."
           echo "Lines mentioning unshallow:"

From 570c7ff3abd945bf88c611f5a7a8df697e816e8e Mon Sep 17 00:00:00 2001
From: George A Heimel <george.heimel@square360.com>
Date: Fri, 22 May 2026 21:22:40 -0400
Subject: [PATCH 5/5] chore(release): self-pin internal refs to v3.2.6
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Flip the four pantheon-push-consuming reusables from the temporary
branch-pin @fix/v3.2.6-shallow-clone-race back to @v3.2.6 ahead of the
v3.2.6 tag. 18 refs across pantheon-push, terminus-install,
pantheon-post-deploy-drush, reusable-semantic-release, reusable-pantheon-
security-scan, and reusable-pantheon-vrt — all now consistent at v3.2.6.

This is the [[release-pin-drift-trap]] discipline: tag a release with
internal refs already pointing at the version being released, so the
release is internally consistent the moment the tag exists.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/workflows/reusable-pantheon-deploy-dev.yml     |  8 ++++----
 .../reusable-pantheon-deploy-epic-multidev.yml         |  8 ++++----
 .../workflows/reusable-pantheon-deploy-pr-multidev.yml | 10 +++++-----
 .../workflows/reusable-pantheon-deploy-rc-multidev.yml | 10 +++++-----
 4 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/reusable-pantheon-deploy-dev.yml b/.github/workflows/reusable-pantheon-deploy-dev.yml
index 4e785e0..72c0a3c 100644
--- a/.github/workflows/reusable-pantheon-deploy-dev.yml
+++ b/.github/workflows/reusable-pantheon-deploy-dev.yml
@@ -62,7 +62,7 @@ jobs:
   semantic_release:
     name: Semantic Release
     if: ${{ inputs.run_semantic_release }}
-    uses: Square360/shared-workflows/.github/workflows/reusable-semantic-release.yml@fix/v3.2.6-shallow-clone-race
+    uses: Square360/shared-workflows/.github/workflows/reusable-semantic-release.yml@v3.2.6
     secrets:
       CI_GH_TOKEN: ${{ secrets.CI_GH_TOKEN }}
 
@@ -92,7 +92,7 @@ jobs:
           fetch-depth: 1
 
       - name: Install Terminus
-        uses: Square360/shared-workflows/.github/actions/terminus-install@fix/v3.2.6-shallow-clone-race
+        uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.6
         with:
           machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
 
@@ -102,7 +102,7 @@ jobs:
       # -----------------------------------------------------------------------
       - name: Push code to Pantheon DEV
         id: deploy_pantheon
-        uses: Square360/shared-workflows/.github/actions/pantheon-push@fix/v3.2.6-shallow-clone-race
+        uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.6
         with:
           site: ${{ inputs.pantheon_site }}
           target_env: dev
@@ -159,7 +159,7 @@ jobs:
 
       - name: Run post-deploy drush commands
         id: drush_commands
-        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@fix/v3.2.6-shallow-clone-race
+        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.6
         with:
           site: ${{ inputs.pantheon_site }}
           env: dev
diff --git a/.github/workflows/reusable-pantheon-deploy-epic-multidev.yml b/.github/workflows/reusable-pantheon-deploy-epic-multidev.yml
index 47b2efc..5901f7d 100644
--- a/.github/workflows/reusable-pantheon-deploy-epic-multidev.yml
+++ b/.github/workflows/reusable-pantheon-deploy-epic-multidev.yml
@@ -126,7 +126,7 @@ jobs:
           echo "Epic multidev: ${TARGET_ENV}"
 
       - name: Install Terminus
-        uses: Square360/shared-workflows/.github/actions/terminus-install@fix/v3.2.6-shallow-clone-race
+        uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.6
         with:
           machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
 
@@ -148,7 +148,7 @@ jobs:
 
       - name: Push code to Pantheon epic multidev
         id: deploy
-        uses: Square360/shared-workflows/.github/actions/pantheon-push@fix/v3.2.6-shallow-clone-race
+        uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.6
         with:
           site: ${{ inputs.pantheon_site }}
           target_env: ${{ steps.derive.outputs.target_env }}
@@ -159,7 +159,7 @@ jobs:
 
       - name: Run post-deploy drush commands
         id: drush_commands
-        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@fix/v3.2.6-shallow-clone-race
+        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.6
         with:
           site: ${{ inputs.pantheon_site }}
           env: ${{ steps.derive.outputs.target_env }}
@@ -234,7 +234,7 @@ jobs:
     # The security workflow detects epr-* internally and runs unconditionally
     # in strict mode (fails on any High-severity finding) — same gate as rc-*,
     # per the Square360 SOP for epic integration multidevs. No force_run needed.
-    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@fix/v3.2.6-shallow-clone-race
+    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@v3.2.6
     with:
       pantheon_site: ${{ inputs.pantheon_site }}
       target_env: ${{ needs.deploy_epic_multidev.outputs.target_env }}
diff --git a/.github/workflows/reusable-pantheon-deploy-pr-multidev.yml b/.github/workflows/reusable-pantheon-deploy-pr-multidev.yml
index a024d62..2f0d1d8 100644
--- a/.github/workflows/reusable-pantheon-deploy-pr-multidev.yml
+++ b/.github/workflows/reusable-pantheon-deploy-pr-multidev.yml
@@ -83,7 +83,7 @@ jobs:
         run: echo "target_env=pr-${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT
 
       - name: Install Terminus
-        uses: Square360/shared-workflows/.github/actions/terminus-install@fix/v3.2.6-shallow-clone-race
+        uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.6
         with:
           machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
 
@@ -105,7 +105,7 @@ jobs:
 
       - name: Push code to Pantheon multidev
         id: deploy
-        uses: Square360/shared-workflows/.github/actions/pantheon-push@fix/v3.2.6-shallow-clone-race
+        uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.6
         with:
           site: ${{ inputs.pantheon_site }}
           target_env: ${{ steps.derive.outputs.target_env }}
@@ -116,7 +116,7 @@ jobs:
 
       - name: Run post-deploy drush commands
         id: drush_commands
-        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@fix/v3.2.6-shallow-clone-race
+        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.6
         with:
           site: ${{ inputs.pantheon_site }}
           env: ${{ steps.derive.outputs.target_env }}
@@ -228,7 +228,7 @@ jobs:
         contains(github.event.pull_request.body, '[run-security]') ||
         contains(github.event.pull_request.body, '[security]')
       }}
-    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@fix/v3.2.6-shallow-clone-race
+    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@v3.2.6
     with:
       pantheon_site: ${{ inputs.pantheon_site }}
       target_env: ${{ needs.deploy_pr_multidev.outputs.target_env }}
@@ -256,7 +256,7 @@ jobs:
         contains(github.event.pull_request.body, '[run-vrt]') ||
         contains(github.event.pull_request.body, '[vrt]')
       }}
-    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-vrt.yml@fix/v3.2.6-shallow-clone-race
+    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-vrt.yml@v3.2.6
     with:
       pantheon_site: ${{ inputs.pantheon_site }}
       target_env: ${{ needs.deploy_pr_multidev.outputs.target_env }}
diff --git a/.github/workflows/reusable-pantheon-deploy-rc-multidev.yml b/.github/workflows/reusable-pantheon-deploy-rc-multidev.yml
index 48b23d3..3d5e328 100644
--- a/.github/workflows/reusable-pantheon-deploy-rc-multidev.yml
+++ b/.github/workflows/reusable-pantheon-deploy-rc-multidev.yml
@@ -88,7 +88,7 @@ jobs:
           echo "Derived RC multidev name: ${TARGET_ENV}"
 
       - name: Install Terminus
-        uses: Square360/shared-workflows/.github/actions/terminus-install@fix/v3.2.6-shallow-clone-race
+        uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.6
         with:
           machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
 
@@ -111,7 +111,7 @@ jobs:
 
       - name: Push code to Pantheon multidev
         id: deploy
-        uses: Square360/shared-workflows/.github/actions/pantheon-push@fix/v3.2.6-shallow-clone-race
+        uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.6
         with:
           site: ${{ inputs.pantheon_site }}
           target_env: ${{ steps.derive.outputs.target_env }}
@@ -122,7 +122,7 @@ jobs:
 
       - name: Run post-deploy drush commands
         id: drush_commands
-        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@fix/v3.2.6-shallow-clone-race
+        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.6
         with:
           site: ${{ inputs.pantheon_site }}
           env: ${{ steps.derive.outputs.target_env }}
@@ -165,7 +165,7 @@ jobs:
     needs: deploy_rc_multidev
     # The security workflow detects rc-* internally and runs unconditionally
     # in strict mode (fails on any High-severity finding). No force_run needed.
-    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@fix/v3.2.6-shallow-clone-race
+    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@v3.2.6
     with:
       pantheon_site: ${{ inputs.pantheon_site }}
       target_env: ${{ needs.deploy_rc_multidev.outputs.target_env }}
@@ -193,7 +193,7 @@ jobs:
         contains(github.event.head_commit.message, '[run-vrt]') ||
         contains(github.event.head_commit.message, '[vrt]')
       }}
-    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-vrt.yml@fix/v3.2.6-shallow-clone-race
+    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-vrt.yml@v3.2.6
     with:
       pantheon_site: ${{ inputs.pantheon_site }}
       target_env: ${{ needs.deploy_rc_multidev.outputs.target_env }}