From 66e1c0df8b23cb8354b36dd446d9548dc4389191 Mon Sep 17 00:00:00 2001
From: Dotta <34892728+cryppadotta@users.noreply.github.com>
Date: Fri, 28 Aug 2026 11:36:35 -0500
Subject: [PATCH] ci: pin PR base snapshot validation (#12450)

## Summary

- rotate the thin caller from `5ac66b3fdd5dc22c0c4e5fdb234ac063cf1d9ff8`
to `c119c4bee6ebb9c81791d7a6994f1be06d7cc22b`
- keep both exact SHAs authorized during rotation
- keep AWS routing disabled until verification completes

## Validation

- actionlint passes
- workflow-contract tests pass
- internal trust-routing harness passes
---
 .github/workflows/pr.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 2dd7f5f535..d4791275be 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -12,4 +12,4 @@ permissions:
 
 jobs:
   ci:
-    uses: paperclipai/paperclip/.github/workflows/pr-trusted.yml@5ac66b3fdd5dc22c0c4e5fdb234ac063cf1d9ff8
+    uses: paperclipai/paperclip/.github/workflows/pr-trusted.yml@c119c4bee6ebb9c81791d7a6994f1be06d7cc22b