Merge pull request #232 from Sea-Haven-Industries/fix/deploy-scripts-from-workflow-sha

fix(cd): run deploy scripts from the workflow SHA

.github/workflows/deploy-web.yaml

@@ -15,6 +15,10 @@ name: Deploy Web
 #
 # Bucket and distribution come from SSM after assuming the Environment's
 # DEPLOY_ROLE_ARN. Nothing here creates an HCP run. Quality gates live in CI.
+#
+# The SPA checkout is the resolved content ref. Deploy scripts are copied
+# from github.workflow_sha so workflow_dispatch of an older SHA still runs
+# the current upload/verify path.
 
 on:
   push:
@@ -131,6 +135,27 @@ jobs:
           echo "sha=${sha}" >> "${GITHUB_OUTPUT}"
           echo "Building ${sha}"
 
+      - name: Checkout workflow deploy scripts
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.workflow_sha }}
+          persist-credentials: false
+          sparse-checkout: |
+            scripts
+          sparse-checkout-cone-mode: true
+          path: .workflow-scripts
+
+      - name: Install workflow deploy scripts
+        run: |
+          set -euo pipefail
+          test -f .workflow-scripts/scripts/upload-sourcemaps.sh
+          test -f .workflow-scripts/scripts/verify-cloudfront-release.sh
+          test -f .workflow-scripts/scripts/summarize-cloudfront-live-state.sh
+          mkdir -p scripts
+          cp .workflow-scripts/scripts/upload-sourcemaps.sh scripts/
+          cp .workflow-scripts/scripts/verify-cloudfront-release.sh scripts/
+          cp .workflow-scripts/scripts/summarize-cloudfront-live-state.sh scripts/
+
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "24"