From 3d06449591eb0b187d4228172b59bca1a7581789 Mon Sep 17 00:00:00 2001
From: Ron <45816308+rjaegers@users.noreply.github.com>
Date: Wed, 22 Jul 2026 09:25:58 +0000
Subject: [PATCH 1/2] fix: don't checkout in generate-tool-inventory

---
 .github/actions/generate-tool-inventory/action.yml | 10 +---------
 .github/workflows/wc-build-push.yml                |  6 ++++++
 2 files changed, 7 insertions(+), 9 deletions(-)

diff --git a/.github/actions/generate-tool-inventory/action.yml b/.github/actions/generate-tool-inventory/action.yml
index 0ec84fb2..3a980b45 100644
--- a/.github/actions/generate-tool-inventory/action.yml
+++ b/.github/actions/generate-tool-inventory/action.yml
@@ -29,14 +29,6 @@ outputs:
 runs:
   using: composite
   steps:
-    # The allowlist lives in the caller repository; check out just that file so
-    # the action is self-contained and callers need no separate checkout step.
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      with:
-        persist-credentials: false
-        sparse-checkout: ${{ inputs.allowlist }}
-        sparse-checkout-cone-mode: false
-        path: ${{ runner.temp }}/allowlist
     - shell: bash
       run: |
         set -Eeuo pipefail
@@ -80,6 +72,6 @@ runs:
         echo "${inventory}" | tee "${OUTPUT_FILE}"
       env:
         SBOM: ${{ inputs.sbom }}
-        ALLOWLIST: ${{ runner.temp }}/allowlist/${{ inputs.allowlist }}
+        ALLOWLIST: ${{ inputs.allowlist }}
         FLAVOR: ${{ inputs.flavor }}
         OUTPUT_FILE: ${{ inputs.output-file }}
diff --git a/.github/workflows/wc-build-push.yml b/.github/workflows/wc-build-push.yml
index 3e4b41bd..30812f73 100644
--- a/.github/workflows/wc-build-push.yml
+++ b/.github/workflows/wc-build-push.yml
@@ -282,6 +282,12 @@ jobs:
           registry-password: ${{ secrets.DOCKER_REGISTRY_PASSWORD || github.token }}
           dependency-snapshot: true
           output-file: ${{ runner.temp }}/sbom.spdx.json
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        if: ${{ inputs.tool-inventory-file != '' }}
+        with:
+          persist-credentials: false
+          sparse-checkout: ${{ inputs.tool-inventory-file }}
+          sparse-checkout-cone-mode: false
       - name: Generate tool inventory
         if: ${{ inputs.tool-inventory-file != '' }}
         id: generate-tool-inventory

From d168de5990cfcf95fa26d69d6c4b922ffe8e8ca7 Mon Sep 17 00:00:00 2001
From: Ron <45816308+rjaegers@users.noreply.github.com>
Date: Wed, 22 Jul 2026 10:09:38 +0000
Subject: [PATCH 2/2] docs: update outdated input description

---
 .github/actions/generate-tool-inventory/action.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/actions/generate-tool-inventory/action.yml b/.github/actions/generate-tool-inventory/action.yml
index 3a980b45..6e05f6b0 100644
--- a/.github/actions/generate-tool-inventory/action.yml
+++ b/.github/actions/generate-tool-inventory/action.yml
@@ -11,7 +11,7 @@ inputs:
   allowlist:
     description: >-
       Path to the flavor's tool allowlist JSON, relative to the caller
-      repository root. The file is sparse-checked-out by this action.
+      repository root.
     required: true
   flavor:
     description: Name of the flavor the inventory is generated for