From e716bb831ecb676eedb79470f2355b3deb58edfc Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Thu, 1 Oct 2026 21:04:48 -0400
Subject: [PATCH] ci(terraform): pin the isolation check to v1.0.21

The pre-release pin cloned the private .github repo with the caller token and the Terraform job failed. v1.0.21 loads the checker from the workflow commit.
---
 .github/workflows/ci.yaml       | 2 +-
 tests/infra/hcpContract.test.js | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 53e41e8..ce23746 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -31,7 +31,7 @@ jobs:
 
   terraform:
     name: Terraform
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-terraform.yaml@4c3e13a07a20975e44de9b35f69e48e2ce275448 # pre-release
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-terraform.yaml@47185fa602dffddb8297db5f3525d7c9bc05d7cd # v1.0.21
     with:
       terraform-version: "1.16.0"
       working-directory: terraform
diff --git a/tests/infra/hcpContract.test.js b/tests/infra/hcpContract.test.js
index 2e3c7fb..1798a52 100644
--- a/tests/infra/hcpContract.test.js
+++ b/tests/infra/hcpContract.test.js
@@ -75,7 +75,7 @@ describe("HCP Terraform seam (PLAT-79)", () => {
     assert.doesNotMatch(ci, /ci-typescript-cdk/);
     assert.doesNotMatch(ci, /run-sam-validate/);
     assert.match(ci, /npm test/);
-    assert.match(ci, /ci-terraform\.yaml@4c3e13a07a20975e44de9b35f69e48e2ce275448/);
+    assert.match(ci, /ci-terraform\.yaml@47185fa602dffddb8297db5f3525d7c9bc05d7cd/);
     assert.match(ci, /src\//);
     assert.match(ci, /package\.json/);
     assert.match(ci, /package-lock\.json/);