From 68650b9078480f3c0758bfc70e5f7bc94c367def Mon Sep 17 00:00:00 2001
From: "eric.neumann" <neumann.bend@gmail.com>
Date: Wed, 27 Aug 2025 11:57:45 -0700
Subject: [PATCH 01/10] EN add poly setup and generate step

---
 action.yml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/action.yml b/action.yml
index ebc6deb..04002c0 100644
--- a/action.yml
+++ b/action.yml
@@ -81,6 +81,17 @@ runs:
         pip install --upgrade pip
         pip install -r requirements.txt
 
+    - name: Setup and generate PolyAPI
+      id: poly_setup
+      shell: bash
+      env:
+        POLY_API_KEY: ${{ inputs.poly_api_key }}
+        POLY_API_BASE_URL: ${{ inputs.poly_api_base_url }}
+      run: |
+        cd "${{ inputs.working_directory }}"
+        python -m polyapi setup $POLY_API_KEY $POLY_API_BASE_URL
+        python -m polyapi generate --no-types
+
     - name: Locate PolyAPI installation directory
       id: poly_dir
       shell: bash

From a810b52a065d04a8947317b62b72f607e08c6f58 Mon Sep 17 00:00:00 2001
From: "eric.neumann" <neumann.bend@gmail.com>
Date: Wed, 27 Aug 2025 15:00:30 -0700
Subject: [PATCH 02/10] EN create package folders for schemas, tabi, and vari

---
 action.yml | 18 +++++++-----------
 1 file changed, 7 insertions(+), 11 deletions(-)

diff --git a/action.yml b/action.yml
index 04002c0..61da89b 100644
--- a/action.yml
+++ b/action.yml
@@ -81,17 +81,6 @@ runs:
         pip install --upgrade pip
         pip install -r requirements.txt
 
-    - name: Setup and generate PolyAPI
-      id: poly_setup
-      shell: bash
-      env:
-        POLY_API_KEY: ${{ inputs.poly_api_key }}
-        POLY_API_BASE_URL: ${{ inputs.poly_api_base_url }}
-      run: |
-        cd "${{ inputs.working_directory }}"
-        python -m polyapi setup $POLY_API_KEY $POLY_API_BASE_URL
-        python -m polyapi generate --no-types
-
     - name: Locate PolyAPI installation directory
       id: poly_dir
       shell: bash
@@ -99,6 +88,13 @@ runs:
         cd "${{ inputs.working_directory }}"
         POLY_DIR=$(python -c "import polyapi; import os; print(os.path.dirname(polyapi.__file__))")
         mkdir -p "$POLY_DIR/poly"
+        mkdir -p "$POLY_DIR/schemas"
+        mkdir -p "$POLY_DIR/vari"
+        mkdir -p "$POLY_DIR/tabi"
+        touch "$POLY_DIR/poly"/__init__.py
+        touch "$POLY_DIR/schemas"/__init__.py
+        touch "$POLY_DIR/vari"/__init__.py
+        touch "$POLY_DIR/tabi"/__init__.py
         echo "poly_dir=$POLY_DIR" >> $GITHUB_ENV
 
     - name: Restore cached PolyAPI deployments

From dd8f0a0375947566261751ac248d1fb429c2a79c Mon Sep 17 00:00:00 2001
From: "eric.neumann" <neumann.bend@gmail.com>
Date: Wed, 27 Aug 2025 15:10:00 -0700
Subject: [PATCH 03/10] EN update py to v3.13

---
 action.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/action.yml b/action.yml
index 61da89b..1723ffb 100644
--- a/action.yml
+++ b/action.yml
@@ -61,9 +61,10 @@ runs:
         fi
 
     - name: Setup Python
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v5
       with:
-        python-version: '3.12' # stay under 3.13 for now to avoid build errors with pydantic-core
+        python-version: '3.13'
+        check-latest: true
 
     - name: Restore cached dependencies
       uses: actions/cache@v4

From 0c0f6b4fe6623983d5fa5b2c8f9c423380393b69 Mon Sep 17 00:00:00 2001
From: "eric.neumann" <neumann.bend@gmail.com>
Date: Wed, 17 Sep 2025 15:20:29 -0700
Subject: [PATCH 04/10] EN #5300 enable secure poly setup and generate

---
 README.md  |  2 +-
 action.yml | 27 +++++++++++++++++++--------
 2 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/README.md b/README.md
index 7c8b1d1..e6647c9 100644
--- a/README.md
+++ b/README.md
@@ -38,7 +38,7 @@ To use this action in your workflow:
 
         steps:
           - name: Poly Deploy
-            uses: polyapi/poly-deployment-action-py@v0.0.6
+            uses: polyapi/poly-deployment-action-py@v0.0.8
             with:
               poly_api_key: ${{ secrets.POLY_API_KEY }}
               poly_api_base_url: ${{ secrets.POLY_API_BASE_URL }}
diff --git a/action.yml b/action.yml
index 1723ffb..36603a4 100644
--- a/action.yml
+++ b/action.yml
@@ -82,20 +82,27 @@ runs:
         pip install --upgrade pip
         pip install -r requirements.txt
 
+    - name: Setup and generate PolyAPI
+      id: poly_setup
+      shell: bash
+      env:
+        DEPLOY_POLY_API_KEY: ${{ inputs.poly_api_key }}
+        DEPLOY_POLY_API_BASE_URL: ${{ inputs.poly_api_base_url }}
+      run: |
+        set -euo pipefail
+        echo "::add-mask::${DEPLOY_POLY_API_KEY}"
+
+        cd "${{ inputs.working_directory }}"
+        python -m polyapi setup
+        python -m polyapi generate --no-types
+        rm -f .polyapi/config.json ~/.polyapi/config.json 2>/dev/null || true
+
     - name: Locate PolyAPI installation directory
       id: poly_dir
       shell: bash
       run: |
         cd "${{ inputs.working_directory }}"
         POLY_DIR=$(python -c "import polyapi; import os; print(os.path.dirname(polyapi.__file__))")
-        mkdir -p "$POLY_DIR/poly"
-        mkdir -p "$POLY_DIR/schemas"
-        mkdir -p "$POLY_DIR/vari"
-        mkdir -p "$POLY_DIR/tabi"
-        touch "$POLY_DIR/poly"/__init__.py
-        touch "$POLY_DIR/schemas"/__init__.py
-        touch "$POLY_DIR/vari"/__init__.py
-        touch "$POLY_DIR/tabi"/__init__.py
         echo "poly_dir=$POLY_DIR" >> $GITHUB_ENV
 
     - name: Restore cached PolyAPI deployments
@@ -113,8 +120,12 @@ runs:
         POLY_API_KEY: ${{ inputs.poly_api_key }}
         POLY_API_BASE_URL: ${{ inputs.poly_api_base_url }}
       run: |
+        set -euo pipefail
+        echo "::add-mask::${POLY_API_KEY}"
+
         cd "${{ inputs.working_directory }}"
         python -m polyapi sync
+        rm -f .polyapi/config.json ~/.polyapi/config.json 2>/dev/null || true
 
     - name: Cache PolyAPI deployments
       uses: actions/cache@v4

From 183a27db4b7a08a894d6232de378f8d88d5edade Mon Sep 17 00:00:00 2001
From: "eric.neumann" <neumann.bend@gmail.com>
Date: Wed, 17 Sep 2025 17:06:39 -0700
Subject: [PATCH 05/10] EN #5300 update env var names to match TS client

---
 action.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/action.yml b/action.yml
index 36603a4..09f4d06 100644
--- a/action.yml
+++ b/action.yml
@@ -86,11 +86,11 @@ runs:
       id: poly_setup
       shell: bash
       env:
-        DEPLOY_POLY_API_KEY: ${{ inputs.poly_api_key }}
-        DEPLOY_POLY_API_BASE_URL: ${{ inputs.poly_api_base_url }}
+        POLY_API_KEY: ${{ inputs.poly_api_key }}
+        POLY_API_BASE_URL: ${{ inputs.poly_api_base_url }}
       run: |
         set -euo pipefail
-        echo "::add-mask::${DEPLOY_POLY_API_KEY}"
+        echo "::add-mask::${POLY_API_KEY}"
 
         cd "${{ inputs.working_directory }}"
         python -m polyapi setup

From db6c78bb0118e4f878338bddf3b3ca603455a24a Mon Sep 17 00:00:00 2001
From: "eric.neumann" <neumann.bend@gmail.com>
Date: Thu, 18 Sep 2025 12:02:54 -0700
Subject: [PATCH 06/10] EN re-order steps so generated bits don't get clobbered
 by cache

---
 action.yml | 29 ++++++++++++++---------------
 1 file changed, 14 insertions(+), 15 deletions(-)

diff --git a/action.yml b/action.yml
index 09f4d06..dffadff 100644
--- a/action.yml
+++ b/action.yml
@@ -82,21 +82,6 @@ runs:
         pip install --upgrade pip
         pip install -r requirements.txt
 
-    - name: Setup and generate PolyAPI
-      id: poly_setup
-      shell: bash
-      env:
-        POLY_API_KEY: ${{ inputs.poly_api_key }}
-        POLY_API_BASE_URL: ${{ inputs.poly_api_base_url }}
-      run: |
-        set -euo pipefail
-        echo "::add-mask::${POLY_API_KEY}"
-
-        cd "${{ inputs.working_directory }}"
-        python -m polyapi setup
-        python -m polyapi generate --no-types
-        rm -f .polyapi/config.json ~/.polyapi/config.json 2>/dev/null || true
-
     - name: Locate PolyAPI installation directory
       id: poly_dir
       shell: bash
@@ -113,6 +98,20 @@ runs:
         restore-keys: |
           "${{ runner.os }}-poly-"
 
+    - name: Setup and generate PolyAPI
+      id: poly_setup
+      shell: bash
+      env:
+        POLY_API_KEY: ${{ inputs.poly_api_key }}
+        POLY_API_BASE_URL: ${{ inputs.poly_api_base_url }}
+      run: |
+        set -euo pipefail
+        echo "::add-mask::${POLY_API_KEY}"
+        cd "${{ inputs.working_directory }}"
+        python -m polyapi setup
+        python -m polyapi generate --no-types
+        rm -f .polyapi/config.json ~/.polyapi/config.json 2>/dev/null || true
+
     - name: Deploy
       id: deploy
       shell: bash

From 3e60f71f043c14e2e8d485dbf76da67022b21bab Mon Sep 17 00:00:00 2001
From: "eric.neumann" <neumann.bend@gmail.com>
Date: Thu, 18 Sep 2025 12:30:52 -0700
Subject: [PATCH 07/10] EN revert db6c78bb0118e4f878338bddf3b3ca603455a24a

---
 action.yml | 29 +++++++++++++++--------------
 1 file changed, 15 insertions(+), 14 deletions(-)

diff --git a/action.yml b/action.yml
index dffadff..09f4d06 100644
--- a/action.yml
+++ b/action.yml
@@ -82,6 +82,21 @@ runs:
         pip install --upgrade pip
         pip install -r requirements.txt
 
+    - name: Setup and generate PolyAPI
+      id: poly_setup
+      shell: bash
+      env:
+        POLY_API_KEY: ${{ inputs.poly_api_key }}
+        POLY_API_BASE_URL: ${{ inputs.poly_api_base_url }}
+      run: |
+        set -euo pipefail
+        echo "::add-mask::${POLY_API_KEY}"
+
+        cd "${{ inputs.working_directory }}"
+        python -m polyapi setup
+        python -m polyapi generate --no-types
+        rm -f .polyapi/config.json ~/.polyapi/config.json 2>/dev/null || true
+
     - name: Locate PolyAPI installation directory
       id: poly_dir
       shell: bash
@@ -98,20 +113,6 @@ runs:
         restore-keys: |
           "${{ runner.os }}-poly-"
 
-    - name: Setup and generate PolyAPI
-      id: poly_setup
-      shell: bash
-      env:
-        POLY_API_KEY: ${{ inputs.poly_api_key }}
-        POLY_API_BASE_URL: ${{ inputs.poly_api_base_url }}
-      run: |
-        set -euo pipefail
-        echo "::add-mask::${POLY_API_KEY}"
-        cd "${{ inputs.working_directory }}"
-        python -m polyapi setup
-        python -m polyapi generate --no-types
-        rm -f .polyapi/config.json ~/.polyapi/config.json 2>/dev/null || true
-
     - name: Deploy
       id: deploy
       shell: bash

From dfccc67c415b29d8070201964627f087178c1752 Mon Sep 17 00:00:00 2001
From: "eric.neumann" <neumann.bend@gmail.com>
Date: Thu, 18 Sep 2025 12:58:12 -0700
Subject: [PATCH 08/10] EN scope down cache dir

---
 action.yml | 29 ++++++++++++++---------------
 1 file changed, 14 insertions(+), 15 deletions(-)

diff --git a/action.yml b/action.yml
index 09f4d06..591d2f4 100644
--- a/action.yml
+++ b/action.yml
@@ -82,6 +82,14 @@ runs:
         pip install --upgrade pip
         pip install -r requirements.txt
 
+    - name: Locate PolyAPI installation directory
+      id: poly_dir
+      shell: bash
+      run: |
+        cd "${{ inputs.working_directory }}"
+        POLY_DIR=$(python -c "import polyapi; import os; print(os.path.dirname(polyapi.__file__))")
+        echo "poly_dir=$POLY_DIR" >> $GITHUB_ENV
+
     - name: Setup and generate PolyAPI
       id: poly_setup
       shell: bash
@@ -97,21 +105,13 @@ runs:
         python -m polyapi generate --no-types
         rm -f .polyapi/config.json ~/.polyapi/config.json 2>/dev/null || true
 
-    - name: Locate PolyAPI installation directory
-      id: poly_dir
-      shell: bash
-      run: |
-        cd "${{ inputs.working_directory }}"
-        POLY_DIR=$(python -c "import polyapi; import os; print(os.path.dirname(polyapi.__file__))")
-        echo "poly_dir=$POLY_DIR" >> $GITHUB_ENV
-
     - name: Restore cached PolyAPI deployments
       uses: actions/cache@v4
       with:
-        path: ${{ env.poly_dir }}
-        key: "${{ runner.os }}-poly-${{ inputs.poly_api_base_url }}"
+        path: ${{ env.poly_dir }}/cached_deployables
+        key: "${{ runner.os }}-poly-deployables-${{ inputs.poly_api_base_url }}"
         restore-keys: |
-          "${{ runner.os }}-poly-"
+          "${{ runner.os }}-poly-deployables-"
 
     - name: Deploy
       id: deploy
@@ -122,7 +122,6 @@ runs:
       run: |
         set -euo pipefail
         echo "::add-mask::${POLY_API_KEY}"
-
         cd "${{ inputs.working_directory }}"
         python -m polyapi sync
         rm -f .polyapi/config.json ~/.polyapi/config.json 2>/dev/null || true
@@ -130,10 +129,10 @@ runs:
     - name: Cache PolyAPI deployments
       uses: actions/cache@v4
       with:
-        path: ${{ env.poly_dir }}
-        key: ${{ runner.os }}-poly-${{ inputs.poly_api_base_url }}
+        path: ${{ env.poly_dir }}/cached_deployables
+        key: ${{ runner.os }}-poly-deployables-${{ inputs.poly_api_base_url }}
         restore-keys: |
-          ${{ runner.os }}-poly-
+          "${{ runner.os }}-poly-deployables-"
 
     - name: Commit deployment receipts
       shell: bash

From bfd912f08ff56fb483f4149b822681ee376e21ef Mon Sep 17 00:00:00 2001
From: "eric.neumann" <neumann.bend@gmail.com>
Date: Thu, 18 Sep 2025 13:18:59 -0700
Subject: [PATCH 09/10] EN make cache key more unique for multi env deployments

---
 action.yml | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/action.yml b/action.yml
index 591d2f4..ad7f660 100644
--- a/action.yml
+++ b/action.yml
@@ -99,7 +99,6 @@ runs:
       run: |
         set -euo pipefail
         echo "::add-mask::${POLY_API_KEY}"
-
         cd "${{ inputs.working_directory }}"
         python -m polyapi setup
         python -m polyapi generate --no-types
@@ -109,7 +108,7 @@ runs:
       uses: actions/cache@v4
       with:
         path: ${{ env.poly_dir }}/cached_deployables
-        key: "${{ runner.os }}-poly-deployables-${{ inputs.poly_api_base_url }}"
+        key: "${{ runner.os }}-poly-deployables-${{ inputs.poly_api_base_url }}-${{inputs.working_directory}}"
         restore-keys: |
           "${{ runner.os }}-poly-deployables-"
 
@@ -130,7 +129,7 @@ runs:
       uses: actions/cache@v4
       with:
         path: ${{ env.poly_dir }}/cached_deployables
-        key: ${{ runner.os }}-poly-deployables-${{ inputs.poly_api_base_url }}
+        key: "${{ runner.os }}-poly-deployables-${{ inputs.poly_api_base_url }}-${{inputs.working_directory}}"
         restore-keys: |
           "${{ runner.os }}-poly-deployables-"
 

From 27dc960c5a00935acbd33e58acb92dd069c0f536 Mon Sep 17 00:00:00 2001
From: "eric.neumann" <neumann.bend@gmail.com>
Date: Thu, 18 Sep 2025 13:25:19 -0700
Subject: [PATCH 10/10] EN also cache deployments_revision

---
 action.yml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/action.yml b/action.yml
index ad7f660..766c2e4 100644
--- a/action.yml
+++ b/action.yml
@@ -107,7 +107,9 @@ runs:
     - name: Restore cached PolyAPI deployments
       uses: actions/cache@v4
       with:
-        path: ${{ env.poly_dir }}/cached_deployables
+        path: | 
+          ${{ env.poly_dir }}/cached_deployables
+          ${{ env.poly_dir }}/deployments_revision
         key: "${{ runner.os }}-poly-deployables-${{ inputs.poly_api_base_url }}-${{inputs.working_directory}}"
         restore-keys: |
           "${{ runner.os }}-poly-deployables-"
@@ -128,7 +130,9 @@ runs:
     - name: Cache PolyAPI deployments
       uses: actions/cache@v4
       with:
-        path: ${{ env.poly_dir }}/cached_deployables
+        path: | 
+          ${{ env.poly_dir }}/cached_deployables
+          ${{ env.poly_dir }}/deployments_revision
         key: "${{ runner.os }}-poly-deployables-${{ inputs.poly_api_base_url }}-${{inputs.working_directory}}"
         restore-keys: |
           "${{ runner.os }}-poly-deployables-"