From 63422608c7dee3d926c42866f28bb315e779a116 Mon Sep 17 00:00:00 2001
From: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
Date: Thu, 25 Jun 2026 11:55:29 -0400
Subject: [PATCH] chore(ci): track .github reusable workflows on @main (#173)

Switches all reusable-workflow references from the frozen SHA
c040bfaa (INF-M8 supply-chain pin) to @main, matching every other repo
in the org. This lets proposal-system pick up the actions/checkout v6->v7
bump (and future reusable-workflow changes) automatically instead of
staying frozen on the pre-bump commit.

Note: this intentionally reverses the INF-M8 SHA-pin hardening for
consistency with the rest of the org's @main convention.
---
 .github/workflows/ci.yaml            | 15 +++++----------
 .github/workflows/deploy-mobile.yaml |  3 +--
 .github/workflows/deploy.yaml        |  3 +--
 3 files changed, 7 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 56a22cf..f698695 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -20,16 +20,14 @@ permissions:
 jobs:
   dotnet:
     name: .NET Build & Test
-    # Fix: INF-M8 — pin to SHA for supply chain security (ci-dotnet.yaml@main)
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-dotnet.yaml@c040bfaa223ac9a671cca9047cffdac45b00f3dc
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-dotnet.yaml@main
     with:
       working-directory: api
       solution: ProposalSystem.sln
 
   web:
     name: Web Frontend Check
-    # Fix: INF-M8 — pin to SHA for supply chain security (ci-typescript-cdk.yaml@main)
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@c040bfaa223ac9a671cca9047cffdac45b00f3dc
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@main
     with:
       working-directory: web
       cache-dependency-path: web/package-lock.json
@@ -56,8 +54,7 @@ jobs:
 
   python:
     name: Python Lint
-    # Fix: INF-M8 — pin to SHA for supply chain security (ci-python-sam.yaml@main)
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml@c040bfaa223ac9a671cca9047cffdac45b00f3dc
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml@main
     with:
       source-dirs: "lambdas/"
       run-sam-validate: false
@@ -85,8 +82,7 @@ jobs:
 
   mobile:
     name: Mobile Typecheck
-    # Fix: INF-M8 — pin to SHA for supply chain security (ci-typescript-cdk.yaml@main)
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@c040bfaa223ac9a671cca9047cffdac45b00f3dc
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@main
     with:
       working-directory: mobile
       cache-dependency-path: mobile/package-lock.json
@@ -96,8 +92,7 @@ jobs:
 
   infra:
     name: CDK Synth
-    # Fix: INF-M8 — pin to SHA for supply chain security (ci-typescript-cdk.yaml@main)
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@c040bfaa223ac9a671cca9047cffdac45b00f3dc
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@main
     with:
       working-directory: infra
       cache-dependency-path: infra/package-lock.json
diff --git a/.github/workflows/deploy-mobile.yaml b/.github/workflows/deploy-mobile.yaml
index b3a5434..f8d73e6 100644
--- a/.github/workflows/deploy-mobile.yaml
+++ b/.github/workflows/deploy-mobile.yaml
@@ -15,8 +15,7 @@ permissions:
 jobs:
   deploy-ios:
     name: Build & Upload to TestFlight
-    # Fix: INF-M8 — pin to SHA for supply chain security (cd-mobile-ios.yaml@main)
-    uses: Sea-Haven-Industries/.github/.github/workflows/cd-mobile-ios.yaml@c040bfaa223ac9a671cca9047cffdac45b00f3dc
+    uses: Sea-Haven-Industries/.github/.github/workflows/cd-mobile-ios.yaml@main
     with:
       working-directory: mobile
       cache-dependency-path: mobile/package-lock.json
diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index a0a785c..50c170e 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -15,8 +15,7 @@ permissions:
 jobs:
   deploy:
     name: Deploy to AWS
-    # Fix: INF-M8 — pin to SHA for supply chain security (cd-cdk.yaml@main)
-    uses: Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml@c040bfaa223ac9a671cca9047cffdac45b00f3dc
+    uses: Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml@main
     with:
       cdk-dir: infra
       dotnet-version: "8.0.x"