From 06b7a0dc3fb9234ffe2cf63aadd90077d8f9ed83 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Bru=C5=BEina?= <martin@bruzina.cz>
Date: Thu, 6 Aug 2026 20:26:25 +0200
Subject: [PATCH] fix: pin called-repo checkout to the workflow ref

---
 .github/workflows/terraform.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/terraform.yaml b/.github/workflows/terraform.yaml
index 137f0a1..cb2d291 100644
--- a/.github/workflows/terraform.yaml
+++ b/.github/workflows/terraform.yaml
@@ -62,10 +62,14 @@ jobs:
     name: Terraform Apply
     runs-on: ubuntu-latest
     steps:
+      - name: Resolve workflow ref
+        id: workflow-ref
+        run: echo "ref=${GITHUB_WORKFLOW_REF##*@}" >> "$GITHUB_OUTPUT"
       - name: Checkout the called repository
         uses: actions/checkout@v7
         with:
           repository: bruzit/github-organization-as-code
+          ref: ${{ steps.workflow-ref.outputs.ref }}
       - name: Checkout the caller repository
         if: github.repository != 'bruzit/github-organization-as-code'
         uses: actions/checkout@v7