From 77f68a3207152148a2a2e5fc66975f2526029a59 Mon Sep 17 00:00:00 2001
From: Piotr Janus <pjanus@secureauth.com>
Date: Fri, 5 Jun 2026 23:51:32 +0200
Subject: [PATCH 1/2] fix downloading pre-built binary

---
 action.yaml | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/action.yaml b/action.yaml
index a3976da..d046d18 100644
--- a/action.yaml
+++ b/action.yaml
@@ -11,12 +11,22 @@ outputs:
 runs:
   using: 'composite'
   steps:
+    # github.action_ref is empty inside a composite action's run steps (and
+    # leaks the ref of `uses:` steps like actions/cache). github.action_path is
+    # reliable; its last segment is the ref: .../_actions/<owner>/<repo>/<ref>
+    - name: Resolve action ref
+      id: meta
+      shell: bash
+      run: |
+        AP="${{ github.action_path }}"
+        echo "version=${AP##*/}" >> "$GITHUB_OUTPUT"
+
     - name: Restore cached binary
       id: cache
       uses: actions/cache@v4
       with:
         path: /tmp/cac
-        key: cac-${{ runner.os }}-${{ runner.arch }}-${{ github.action_ref || github.ref_name }}
+        key: cac-${{ runner.os }}-${{ runner.arch }}-${{ steps.meta.outputs.version }}
 
     - name: Download pre-built binary
       id: download
@@ -24,8 +34,8 @@ runs:
       shell: bash
       continue-on-error: true
       run: |
-        VERSION="${{ github.action_ref || github.ref_name }}"
-        REPO="${{ github.action_repository }}"
+        VERSION="${{ steps.meta.outputs.version }}"
+        REPO="SecureAuthCorp/ciam-config-as-code"
 
         ARCH=$(uname -m)
         case "$ARCH" in

From 0d92a98cde62d51aa9541b6f6e0be624691e63dd Mon Sep 17 00:00:00 2001
From: Piotr Janus <pjanus@secureauth.com>
Date: Fri, 3 Jul 2026 15:41:31 +0200
Subject: [PATCH 2/2] fix: resolve action repo and version for local and remote
 usage

github.action_path only ends with the ref for remote usage
(uses: owner/repo@ref). For local usage (uses: ./) it is the
checked-out repo directory, so the previous ${AP##*/} resolved the
version to the repo directory name, breaking the download URL and cache
key and forcing a build from source.

Parse owner/repo/ref from the _actions path for remote usage, and fall
back to the caller repo plus the exact checked-out git tag for local
usage. This also removes the hard-coded repository, making the action
portable to forks and renames.
---
 action.yaml | 28 +++++++++++++++++++++++-----
 1 file changed, 23 insertions(+), 5 deletions(-)

diff --git a/action.yaml b/action.yaml
index d046d18..acee65e 100644
--- a/action.yaml
+++ b/action.yaml
@@ -12,14 +12,32 @@ runs:
   using: 'composite'
   steps:
     # github.action_ref is empty inside a composite action's run steps (and
-    # leaks the ref of `uses:` steps like actions/cache). github.action_path is
-    # reliable; its last segment is the ref: .../_actions/<owner>/<repo>/<ref>
-    - name: Resolve action ref
+    # leaks the ref of `uses:` steps like actions/cache), so we resolve the
+    # release repo/tag ourselves.
+    #
+    # When the action is consumed remotely (uses: owner/repo@ref) github.action_path
+    # is .../_actions/<owner>/<repo>/<ref>, so both repo and version come from it.
+    # When it is used locally (uses: ./) github.action_path is just the checked-out
+    # repo directory, so we fall back to the caller repo plus the checked-out tag
+    # (github.ref_name is the workflow trigger ref, which is not the tag for
+    # release-testing jobs, so prefer the exact tag git actually checked out).
+    - name: Resolve action repo and version
       id: meta
       shell: bash
       run: |
         AP="${{ github.action_path }}"
-        echo "version=${AP##*/}" >> "$GITHUB_OUTPUT"
+        if [[ "$AP" == *"/_actions/"* ]]; then
+          REST="${AP#*/_actions/}"
+          OWNER="${REST%%/*}"; REST="${REST#*/}"
+          NAME="${REST%%/*}"; REF="${REST#*/}"
+          REPO="${OWNER}/${NAME}"
+          VERSION="${REF}"
+        else
+          REPO="${{ github.repository }}"
+          VERSION="$(git -C "$AP" describe --tags --exact-match 2>/dev/null || echo "${{ github.ref_name }}")"
+        fi
+        echo "repo=${REPO}" >> "$GITHUB_OUTPUT"
+        echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
 
     - name: Restore cached binary
       id: cache
@@ -35,7 +53,7 @@ runs:
       continue-on-error: true
       run: |
         VERSION="${{ steps.meta.outputs.version }}"
-        REPO="SecureAuthCorp/ciam-config-as-code"
+        REPO="${{ steps.meta.outputs.repo }}"
 
         ARCH=$(uname -m)
         case "$ARCH" in