From 5d6871e4596cbdb392900ccebfe855a83072e5db Mon Sep 17 00:00:00 2001
From: Justin Gasper <jmgasper@gmail.com>
Date: Thu, 5 Nov 2026 17:00:31 +1100
Subject: [PATCH] Pin deployment scripts v2.0.9

---
 .circleci/config.yml | 6 +++---
 deploy/MIGRATION.md  | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index aa5115f..f306548 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -21,14 +21,14 @@ commands:
   checkout-suite:
     steps:
     - run:
-        name: Verify deployment suite v2.0.6
+        name: Verify deployment suite v2.0.9
         command: |
           set -euo pipefail
           git init --quiet /tmp/tc-deploy-scripts
           git -C /tmp/tc-deploy-scripts remote add origin https://github.com/topcoder-platform/tc-deploy-scripts.git
-          git -C /tmp/tc-deploy-scripts fetch --quiet --depth 1 origin refs/tags/v2.0.6
+          git -C /tmp/tc-deploy-scripts fetch --quiet --depth 1 origin refs/tags/v2.0.9
           git -C /tmp/tc-deploy-scripts checkout --quiet --detach FETCH_HEAD
-          test "$(git -C /tmp/tc-deploy-scripts rev-parse HEAD)" = 26aaf607463d4a271c0099854c1731214215a9c5
+          test "$(git -C /tmp/tc-deploy-scripts rev-parse HEAD)" = dc06de730f068a230efa9d5f4d4d9c80782d3bfb
 jobs:
   build:
     executor: reviewed
diff --git a/deploy/MIGRATION.md b/deploy/MIGRATION.md
index 7fba568..eb92bcb 100644
--- a/deploy/MIGRATION.md
+++ b/deploy/MIGRATION.md
@@ -1,6 +1,6 @@
 # OIDC deployment migration
 
-This change replaces the Auth0 credential broker and SSM-to-shell deployment path with [tc-deploy-scripts v2.0.6](https://github.com/topcoder-platform/tc-deploy-scripts/releases/tag/v2.0.6), fetched by tag and verified against commit `26aaf607463d4a271c0099854c1731214215a9c5`. Build and deployment run in separate jobs. The deployer cannot read Parameter Store, Secrets Manager or decrypt KMS data, including through another assumed role. ECS continues resolving the existing runtime secret references using the execution role.
+This change replaces the Auth0 credential broker and SSM-to-shell deployment path with [tc-deploy-scripts v2.0.9](https://github.com/topcoder-platform/tc-deploy-scripts/releases/tag/v2.0.9), fetched by tag and verified against commit `dc06de730f068a230efa9d5f4d4d9c80782d3bfb`. Build and deployment run in separate jobs. The deployer cannot read Parameter Store, Secrets Manager or decrypt KMS data, including through another assumed role. ECS continues resolving the existing runtime secret references using the execution role.
 
 ## Production target
 
@@ -28,10 +28,10 @@ IAM templates and detailed AWS baselines are maintained in the private [v6-servi
 
 ## Dev branch refresh
 
-This PR targets `develop` and preserves its current application/dependency fixes. The shared suite is v2.0.6 (92 offline tests); service-specific adapters and their tests remain part of review. Use the current readiness record above for the remaining merge/deployment gates. Updating these files does not provision AWS or CircleCI resources.
+This PR targets `develop` and preserves its current application/dependency fixes. The shared suite is v2.0.9 (92 offline tests); service-specific adapters and their tests remain part of review. Use the current readiness record above for the remaining merge/deployment gates. Updating these files does not provision AWS or CircleCI resources.
 
 Source checkout uses the public HTTPS repository and verifies the exact CircleCI commit, avoiding dependency on failing SSH checkout keys. No GitHub token is added to build or deployment contexts.
 
 ## Reviewed health-check bootstrap
 
-The release wrapper passes the environment-specific health-check JSON to v2.0.6. A missing check is added with the new scanned image; the old image is not restarted with a new probe. An identical existing check is preserved, and a different existing check stops the release. Role, runtime-secret reference, scan, concurrency and healthy-digest checks remain enforced.
+The release wrapper passes the environment-specific health-check JSON to v2.0.9. A missing check is added with the new scanned image; the old image is not restarted with a new probe. An identical existing check is preserved, and a different existing check stops the release. Role, runtime-secret reference, scan, concurrency and healthy-digest checks remain enforced.