v3.2.6: patch upstream push-to-pantheon unshallow + fix verify dev→master mapping

.github/actions/pantheon-push/action.yml

@@ -147,6 +147,57 @@ runs:
           terminus connection:set "${SITE}.${TARGET_ENV}" git
         fi
 
+    # Upstream pantheon-systems/push-to-pantheon@0.9.0 has an unguarded
+    # `git fetch --unshallow origin` at scripts/main.sh:352 inside
+    # prepare_site_root (the empty-SITE_ROOT branch we take). It blows up two
+    # different ways depending on the checkout state:
+    #   - On a shallow clone (fetch-depth: 1): races with the runner's git
+    #     state and exits 128 with "fatal: shallow file has changed since we
+    #     read it". Intermittent.
+    #   - On a complete clone (fetch-depth: 0): errors deterministically with
+    #     "fatal: --unshallow on a complete repository does not make sense".
+    # Either way it aborts the deploy before our verify-after-push step can
+    # run, and the GitHub deployment is left marked "success" by upstream's
+    # bobheadxi/deployments@v1 wrapper despite the failure.
+    #
+    # Upstream itself does the right thing later in push_to_pantheon (line 382):
+    # `is-shallow-repository` guard + `||` fallback. The bug is specifically
+    # the unguarded call in prepare_site_root.
+    #
+    # We can't edit upstream, so we sed-patch its main.sh on the runner before
+    # invoking the action. The patch appends `|| true` to the unshallow line —
+    # tolerating both failure modes. Safe because the redundant deepen-on-push
+    # at line 382 still runs, properly guarded, before the actual `git push`.
+    #
+    # Pinned to upstream 0.9.0 — if we ever bump that, this step needs to be
+    # re-validated against the new source (sed pattern may not match).
+    - name: Patch upstream push-to-pantheon to tolerate unshallow errors
+      shell: bash
+      env:
+        UPSTREAM_VERSION: "0.9.0"
+      run: |
+        set -euo pipefail
+        UPSTREAM_SCRIPT="/home/runner/work/_actions/pantheon-systems/push-to-pantheon/${UPSTREAM_VERSION}/scripts/main.sh"
+        if [ ! -f "${UPSTREAM_SCRIPT}" ]; then
+          echo "::error::Cannot find upstream main.sh at ${UPSTREAM_SCRIPT}. Has the upstream action version or layout changed?"
+          exit 1
+        fi
+        if grep -qF 'git fetch --unshallow origin || true' "${UPSTREAM_SCRIPT}"; then
+          echo "Upstream already patched; skipping (idempotent re-run)."
+          exit 0
+        fi
+        # The target line is tab-indented in upstream source: `\tgit fetch --unshallow origin`.
+        # Use `#` as the sed delimiter — the replacement contains `||` and `|` would be
+        # interpreted as the end-of-replacement separator (sed: unknown option to `s`).
+        sed -i 's#^\([[:space:]]*\)git fetch --unshallow origin$#\1git fetch --unshallow origin || true#' "${UPSTREAM_SCRIPT}"
+        if ! grep -qF 'git fetch --unshallow origin || true' "${UPSTREAM_SCRIPT}"; then
+          echo "::error::Sed patch did not apply. Upstream main.sh may have changed shape."
+          echo "Lines mentioning unshallow:"
+          grep -n 'unshallow' "${UPSTREAM_SCRIPT}" || true
+          exit 1
+        fi
+        echo "Patched upstream main.sh: prepare_site_root's --unshallow is now tolerant."
+
     - name: Push to Pantheon
       uses: pantheon-systems/push-to-pantheon@0.9.0
       env:
@@ -195,8 +246,19 @@ runs:
           echo "::error::Could not determine Pantheon git URL for ${SITE}.${TARGET_ENV}; cannot verify push."
           exit 1
         fi
-        echo "Local HEAD:    ${LOCAL_HEAD}"
-        echo "Pantheon URL:  ${PANTHEON_GIT_URL}"
+        # Pantheon's `dev` environment lives on the `master` branch in the
+        # Pantheon-side git repo; multidevs use a branch with the same name as
+        # the env. Matches upstream push-to-pantheon's push-target logic
+        # (scripts/main.sh:369-378). Without this mapping, dev deploys
+        # false-fail here because ls-remote refs/heads/dev returns empty.
+        if [[ "${TARGET_ENV}" == "dev" ]]; then
+          PANTHEON_BRANCH="master"
+        else
+          PANTHEON_BRANCH="${TARGET_ENV}"
+        fi
+        echo "Local HEAD:        ${LOCAL_HEAD}"
+        echo "Pantheon URL:      ${PANTHEON_GIT_URL}"
+        echo "Pantheon branch:   ${PANTHEON_BRANCH}"
         # Retry ls-remote a few times: for freshly created multidevs there can
         # be a short window where Pantheon has accepted the push but the ref
         # isn't yet visible via ls-remote (related to the propagation race the
@@ -205,7 +267,7 @@ runs:
         # silent-fail.
         REMOTE_HEAD=""
         for attempt in 1 2 3; do
-          REMOTE_HEAD=$(git ls-remote "${PANTHEON_GIT_URL}" "refs/heads/${TARGET_ENV}" | awk '{print $1}')
+          REMOTE_HEAD=$(git ls-remote "${PANTHEON_GIT_URL}" "refs/heads/${PANTHEON_BRANCH}" | awk '{print $1}')
           if [[ -n "${REMOTE_HEAD}" ]]; then
             break
           fi
@@ -217,13 +279,13 @@ runs:
         done
         echo "Pantheon HEAD: ${REMOTE_HEAD:-<empty>}"
         if [[ -z "${REMOTE_HEAD}" ]]; then
-          echo "::error::Pantheon ${TARGET_ENV} has no commits on refs/heads/${TARGET_ENV} after 3 attempts. The upstream push silently failed or the branch was never created."
+          echo "::error::Pantheon ${TARGET_ENV} has no commits on refs/heads/${PANTHEON_BRANCH} after 3 attempts. The upstream push silently failed or the branch was never created."
           echo "::error::Check the previous step's output for 'remote rejected' / 'pre-receive hook declined' / SFTP-mode notices."
           exit 1
         fi
         if [[ "${LOCAL_HEAD}" != "${REMOTE_HEAD}" ]]; then
-          echo "::error::Pantheon ${TARGET_ENV} is at ${REMOTE_HEAD}, expected ${LOCAL_HEAD}. The upstream push silently failed."
+          echo "::error::Pantheon ${TARGET_ENV} (branch ${PANTHEON_BRANCH}) is at ${REMOTE_HEAD}, expected ${LOCAL_HEAD}. The upstream push silently failed."
           echo "::error::Check the previous step's output for 'remote rejected' / 'pre-receive hook declined' / SFTP-mode notices."
           exit 1
         fi
-        echo "✅ Pantheon ${TARGET_ENV} is at ${LOCAL_HEAD} as expected."
+        echo "✅ Pantheon ${TARGET_ENV} (branch ${PANTHEON_BRANCH}) is at ${LOCAL_HEAD} as expected."

.github/workflows/reusable-pantheon-deploy-dev.yml

@@ -62,7 +62,7 @@ jobs:
   semantic_release:
     name: Semantic Release
     if: ${{ inputs.run_semantic_release }}
-    uses: Square360/shared-workflows/.github/workflows/reusable-semantic-release.yml@v3.2.5
+    uses: Square360/shared-workflows/.github/workflows/reusable-semantic-release.yml@v3.2.6
     secrets:
       CI_GH_TOKEN: ${{ secrets.CI_GH_TOKEN }}
 
@@ -92,7 +92,7 @@ jobs:
           fetch-depth: 1
 
       - name: Install Terminus
-        uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.5
+        uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.6
         with:
           machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
 
@@ -102,7 +102,7 @@ jobs:
       # -----------------------------------------------------------------------
       - name: Push code to Pantheon DEV
         id: deploy_pantheon
-        uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.5
+        uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.6
         with:
           site: ${{ inputs.pantheon_site }}
           target_env: dev
@@ -159,7 +159,7 @@ jobs:
 
       - name: Run post-deploy drush commands
         id: drush_commands
-        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.5
+        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.6
         with:
           site: ${{ inputs.pantheon_site }}
           env: dev

.github/workflows/reusable-pantheon-deploy-epic-multidev.yml

@@ -126,7 +126,7 @@ jobs:
           echo "Epic multidev: ${TARGET_ENV}"
 
       - name: Install Terminus
-        uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.5
+        uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.6
         with:
           machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
 
@@ -148,7 +148,7 @@ jobs:
 
       - name: Push code to Pantheon epic multidev
         id: deploy
-        uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.5
+        uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.6
         with:
           site: ${{ inputs.pantheon_site }}
           target_env: ${{ steps.derive.outputs.target_env }}
@@ -159,7 +159,7 @@ jobs:
 
       - name: Run post-deploy drush commands
         id: drush_commands
-        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.5
+        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.6
         with:
           site: ${{ inputs.pantheon_site }}
           env: ${{ steps.derive.outputs.target_env }}
@@ -234,7 +234,7 @@ jobs:
     # The security workflow detects epr-* internally and runs unconditionally
     # in strict mode (fails on any High-severity finding) — same gate as rc-*,
     # per the Square360 SOP for epic integration multidevs. No force_run needed.
-    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@v3.2.5
+    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@v3.2.6
     with:
       pantheon_site: ${{ inputs.pantheon_site }}
       target_env: ${{ needs.deploy_epic_multidev.outputs.target_env }}

.github/workflows/reusable-pantheon-deploy-pr-multidev.yml

@@ -83,7 +83,7 @@ jobs:
         run: echo "target_env=pr-${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT
 
       - name: Install Terminus
-        uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.5
+        uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.6
         with:
           machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
 
@@ -105,7 +105,7 @@ jobs:
 
       - name: Push code to Pantheon multidev
         id: deploy
-        uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.5
+        uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.6
         with:
           site: ${{ inputs.pantheon_site }}
           target_env: ${{ steps.derive.outputs.target_env }}
@@ -116,7 +116,7 @@ jobs:
 
       - name: Run post-deploy drush commands
         id: drush_commands
-        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.5
+        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.6
         with:
           site: ${{ inputs.pantheon_site }}
           env: ${{ steps.derive.outputs.target_env }}
@@ -228,7 +228,7 @@ jobs:
         contains(github.event.pull_request.body, '[run-security]') ||
         contains(github.event.pull_request.body, '[security]')
       }}
-    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@v3.2.5
+    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@v3.2.6
     with:
       pantheon_site: ${{ inputs.pantheon_site }}
       target_env: ${{ needs.deploy_pr_multidev.outputs.target_env }}
@@ -256,7 +256,7 @@ jobs:
         contains(github.event.pull_request.body, '[run-vrt]') ||
         contains(github.event.pull_request.body, '[vrt]')
       }}
-    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-vrt.yml@v3.2.5
+    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-vrt.yml@v3.2.6
     with:
       pantheon_site: ${{ inputs.pantheon_site }}
       target_env: ${{ needs.deploy_pr_multidev.outputs.target_env }}

.github/workflows/reusable-pantheon-deploy-rc-multidev.yml

@@ -88,7 +88,7 @@ jobs:
           echo "Derived RC multidev name: ${TARGET_ENV}"
 
       - name: Install Terminus
-        uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.5
+        uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.6
         with:
           machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
 
@@ -111,7 +111,7 @@ jobs:
 
       - name: Push code to Pantheon multidev
         id: deploy
-        uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.5
+        uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.6
         with:
           site: ${{ inputs.pantheon_site }}
           target_env: ${{ steps.derive.outputs.target_env }}
@@ -122,7 +122,7 @@ jobs:
 
       - name: Run post-deploy drush commands
         id: drush_commands
-        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.5
+        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.6
         with:
           site: ${{ inputs.pantheon_site }}
           env: ${{ steps.derive.outputs.target_env }}
@@ -165,7 +165,7 @@ jobs:
     needs: deploy_rc_multidev
     # The security workflow detects rc-* internally and runs unconditionally
     # in strict mode (fails on any High-severity finding). No force_run needed.
-    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@v3.2.5
+    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@v3.2.6
     with:
       pantheon_site: ${{ inputs.pantheon_site }}
       target_env: ${{ needs.deploy_rc_multidev.outputs.target_env }}
@@ -193,7 +193,7 @@ jobs:
         contains(github.event.head_commit.message, '[run-vrt]') ||
         contains(github.event.head_commit.message, '[vrt]')
       }}
-    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-vrt.yml@v3.2.5
+    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-vrt.yml@v3.2.6
     with:
       pantheon_site: ${{ inputs.pantheon_site }}
       target_env: ${{ needs.deploy_rc_multidev.outputs.target_env }}