From ee3b28b5b5d3186f41ec1645c6d36ccfbbf5f8bd Mon Sep 17 00:00:00 2001
From: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
Date: Tue, 29 Sep 2026 22:31:37 +0000
Subject: [PATCH] ci(deploy): freeze CDK pushes to main (PLAT-77) (#55)

* ci(deploy): freeze CDK pushes to main (PLAT-77)

HCP Terraform is the deploy path for the prod move. A push to main must not replace the management-account instance.

* ci(deploy): keep the v1.0.19 CDK workflow pin (PLAT-77)

The freeze should drop the push trigger only. The reusable workflow SHA stays on the version already on main.
---
 .github/workflows/deploy.yaml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index 95053fc..4667c5a 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -1,7 +1,9 @@
 name: Deploy
+# PLAT-77: push-to-main CDK deploy is frozen so HCP Terraform is the only
+# path that can change this stack. workflow_dispatch stays for an explicit
+# rollback of the management-account stack.
 on:
-  push:
-    branches: [main]
+  workflow_dispatch:
 
 permissions:
   id-token: write