From 374cd15fc13a0adaff419f3f2830e9250445b54b Mon Sep 17 00:00:00 2001
From: Tom Martensen <tmartens@redhat.com>
Date: Tue, 8 Sep 2026 09:54:00 +0200
Subject: [PATCH 01/14] fix: configurable install dir for relacs

---
 release/install-relacs/README.md  |  6 ++++-
 release/install-relacs/action.yml | 45 ++++++++++++++++++++++++++++---
 2 files changed, 47 insertions(+), 4 deletions(-)

diff --git a/release/install-relacs/README.md b/release/install-relacs/README.md
index d43288c..aa2c001 100644
--- a/release/install-relacs/README.md
+++ b/release/install-relacs/README.md
@@ -1,11 +1,13 @@
 # Install relacs CLI
 
 Downloads a [relacs](https://github.com/stackrox/relacs) release binary and
-makes it available in `PATH` for subsequent workflow steps.
+makes it available in a specified directory for subsequent workflow steps.
 
 The binary is verified against the SHA-256 checksums published with each
 release.
 
+The installed binary is cached by runner and version.
+
 ## Recommended permissions
 
 The action requires no special permissions.
@@ -18,6 +20,7 @@ permissions: {}
 
 | Name | Required | Default | Description |
 | --- | --- | --- | --- |
+| `binary_dir` | no | `${HOME}/.local/bin` | Directory where to install `relacs` binary. |
 | `token` | yes |  | GH token to use for authentication for the `relacs` repository. |
 | `version` | no | "" | Release version tag to install (e.g. `v0.4.2`). Omit to install the latest release. |
 
@@ -32,6 +35,7 @@ jobs:
     steps:
     - uses: stackrox/actions/release/install-relacs@v1
       with:
+        binary_dir: /home/runner/.local/bin
         token: ${{ secrets.RHACS_BOT_GITHUB_TOKEN }}
         version: v0.4.2
 
diff --git a/release/install-relacs/action.yml b/release/install-relacs/action.yml
index 95412f3..219171a 100644
--- a/release/install-relacs/action.yml
+++ b/release/install-relacs/action.yml
@@ -1,7 +1,11 @@
 name: Install relacs CLI
-description: Download relacs CLI from GitHub releases to ~/.local/bin
+description: Download relacs CLI from GitHub releases to a specified directory
 
 inputs:
+  binary_dir:
+    description: "Directory where to install `relacs` binary"
+    required: false
+    default: "${HOME}/.local/bin"
   token:
     description: "GitHub token to use for authentication"
     required: true
@@ -13,11 +17,38 @@ inputs:
 runs:
   using: composite
   steps:
-    - name: Download and install relacs
+    # Detect desired or latest relacs version
+    - name: Get desired relacs version
+      id: relacs-version
       shell: bash
       env:
         GH_TOKEN: ${{ inputs.token }}
         VERSION: ${{ inputs.version }}
+      run: |
+        if [ -n "${VERSION:-}" ]; then
+          echo "Using version override: ${VERSION}"
+        else
+          VERSION=$(gh release view --repo stackrox/relacs --json tagName --jq .tagName)
+          echo "Using actual latest version: ${VERSION}"
+        fi
+        echo "version=${VERSION}" >> "${GITHUB_OUTPUT}"
+
+    # Restore relacs binary from cache to avoid re-downloading the same version
+    - name: Restore relacs binary from cache
+      id: get-relacs-from-cache
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # ratchet:actions/cache/restore@v6
+      with:
+        path: ${{ inputs.binary_dir }}/relacs
+        key: relacs-${{ runner.os }}-${{ runner.arch }}-${{ steps.relacs-version.outputs.version }}
+
+    # Only install if cache missed
+    - name: Download and install relacs
+      if: steps.get-relacs-from-cache.outputs.cache-hit != 'true'
+      shell: bash
+      env:
+        BINARY_DIR: ${{ inputs.binary_dir }}
+        GH_TOKEN: ${{ inputs.token }}
+        VERSION: ${{ steps.relacs-version.outputs.version }}
       run: |
         set -euo pipefail
 
@@ -26,8 +57,16 @@ runs:
 
         gh api \
           -H "Accept: application/vnd.github.v3.raw" \
-          "/repos/stackrox/relacs/contents/scripts/install-relacs.sh" \
+          "/repos/stackrox/relacs/contents/scripts/install-relacs.sh?ref=tm/install-relacs-improvement" \
           > "${INSTALLER}"
 
         # Execute installer with version from environment
         bash "${INSTALLER}" "${VERSION}"
+
+    # Save cache only if install succeeded (prevents caching wrong version on install failure)
+    - name: Save relacs binary to cache
+      if: always() && steps.get-relacs-from-cache.outputs.cache-hit != 'true' && steps.install-relacs.outcome == 'success'
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # ratchet:actions/cache/save@v6
+      with:
+        path: ${{ inputs.binary_dir }}/relacs
+        key: relacs-${{ runner.os }}-${{ runner.arch }}-${{ steps.relacs-version.outputs.version }}

From d3116b8543202fe0caf269cdaca49ec892835883 Mon Sep 17 00:00:00 2001
From: Tom Martensen <tmartens@redhat.com>
Date: Tue, 8 Sep 2026 10:07:58 +0200
Subject: [PATCH 02/14] fix defaulting to /Users/tmartens/.local/bnin

---
 release/install-relacs/README.md  |  2 +-
 release/install-relacs/action.yml | 20 +++++++++++++++++---
 2 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/release/install-relacs/README.md b/release/install-relacs/README.md
index aa2c001..feaf2bb 100644
--- a/release/install-relacs/README.md
+++ b/release/install-relacs/README.md
@@ -20,7 +20,7 @@ permissions: {}
 
 | Name | Required | Default | Description |
 | --- | --- | --- | --- |
-| `binary_dir` | no | `${HOME}/.local/bin` | Directory where to install `relacs` binary. |
+| `binary_dir` | no | `$HOME/.local/bin` | Directory where to install `relacs` binary. |
 | `token` | yes |  | GH token to use for authentication for the `relacs` repository. |
 | `version` | no | "" | Release version tag to install (e.g. `v0.4.2`). Omit to install the latest release. |
 
diff --git a/release/install-relacs/action.yml b/release/install-relacs/action.yml
index 219171a..5092302 100644
--- a/release/install-relacs/action.yml
+++ b/release/install-relacs/action.yml
@@ -17,6 +17,15 @@ inputs:
 runs:
   using: composite
   steps:
+    # Input defaults are literal strings, so we need to resolve them first if they include env vars.
+    - name: Resolve binary directory
+      id: binary-dir
+      shell: bash
+      env:
+        BINARY_DIR: ${{ inputs.binary_dir }}
+      run: |
+        echo "path=${BINARY_DIR}" >> "${GITHUB_OUTPUT}"
+
     # Detect desired or latest relacs version
     - name: Get desired relacs version
       id: relacs-version
@@ -38,15 +47,16 @@ runs:
       id: get-relacs-from-cache
       uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # ratchet:actions/cache/restore@v6
       with:
-        path: ${{ inputs.binary_dir }}/relacs
+        path: ${{ steps.binary-dir.outputs.path }}/relacs
         key: relacs-${{ runner.os }}-${{ runner.arch }}-${{ steps.relacs-version.outputs.version }}
 
     # Only install if cache missed
     - name: Download and install relacs
+      id: install-relacs
       if: steps.get-relacs-from-cache.outputs.cache-hit != 'true'
       shell: bash
       env:
-        BINARY_DIR: ${{ inputs.binary_dir }}
+        BINARY_DIR: ${{ steps.binary-dir.outputs.path }}
         GH_TOKEN: ${{ inputs.token }}
         VERSION: ${{ steps.relacs-version.outputs.version }}
       run: |
@@ -63,10 +73,14 @@ runs:
         # Execute installer with version from environment
         bash "${INSTALLER}" "${VERSION}"
 
+    - name: Add binary directory to PATH
+      shell: bash
+      run: echo "${{ steps.binary-dir.outputs.path }}" >> "${GITHUB_PATH}"
+
     # Save cache only if install succeeded (prevents caching wrong version on install failure)
     - name: Save relacs binary to cache
       if: always() && steps.get-relacs-from-cache.outputs.cache-hit != 'true' && steps.install-relacs.outcome == 'success'
       uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # ratchet:actions/cache/save@v6
       with:
-        path: ${{ inputs.binary_dir }}/relacs
+        path: ${{ steps.binary-dir.outputs.path }}/relacs
         key: relacs-${{ runner.os }}-${{ runner.arch }}-${{ steps.relacs-version.outputs.version }}

From 47996b044e2a5ea50972205faecc5b472135c6ae Mon Sep 17 00:00:00 2001
From: Tom Martensen <tmartens@redhat.com>
Date: Tue, 8 Sep 2026 10:12:33 +0200
Subject: [PATCH 03/14] resolve better

---
 release/install-relacs/README.md  |  2 +-
 release/install-relacs/action.yml | 10 ++++++++--
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/release/install-relacs/README.md b/release/install-relacs/README.md
index feaf2bb..a79fe59 100644
--- a/release/install-relacs/README.md
+++ b/release/install-relacs/README.md
@@ -20,7 +20,7 @@ permissions: {}
 
 | Name | Required | Default | Description |
 | --- | --- | --- | --- |
-| `binary_dir` | no | `$HOME/.local/bin` | Directory where to install `relacs` binary. |
+| `binary_dir` | no | `$HOME/.local/bin` | Directory where to install `relacs` binary. Omit to use `$HOME/.local/bin`. |
 | `token` | yes |  | GH token to use for authentication for the `relacs` repository. |
 | `version` | no | "" | Release version tag to install (e.g. `v0.4.2`). Omit to install the latest release. |
 
diff --git a/release/install-relacs/action.yml b/release/install-relacs/action.yml
index 5092302..545f4ff 100644
--- a/release/install-relacs/action.yml
+++ b/release/install-relacs/action.yml
@@ -5,7 +5,7 @@ inputs:
   binary_dir:
     description: "Directory where to install `relacs` binary"
     required: false
-    default: "${HOME}/.local/bin"
+    default: ""
   token:
     description: "GitHub token to use for authentication"
     required: true
@@ -17,13 +17,19 @@ inputs:
 runs:
   using: composite
   steps:
-    # Input defaults are literal strings, so we need to resolve them first if they include env vars.
+    # Input defaults are literal strings; resolve $HOME in bash when unset.
     - name: Resolve binary directory
       id: binary-dir
       shell: bash
       env:
         BINARY_DIR: ${{ inputs.binary_dir }}
       run: |
+        if [ -z "${BINARY_DIR}" ]; then
+          BINARY_DIR="${HOME}/.local/bin"
+        else
+          BINARY_DIR="${BINARY_DIR//\$\{HOME\}/$HOME}"
+          BINARY_DIR="${BINARY_DIR//\$HOME/$HOME}"
+        fi
         echo "path=${BINARY_DIR}" >> "${GITHUB_OUTPUT}"
 
     # Detect desired or latest relacs version

From a0272acfd8ca65a27d450fee5e52d85294f2d9e7 Mon Sep 17 00:00:00 2001
From: Tom Martensen <tmartens@redhat.com>
Date: Tue, 8 Sep 2026 10:20:45 +0200
Subject: [PATCH 04/14] update comment

---
 release/install-relacs/action.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/release/install-relacs/action.yml b/release/install-relacs/action.yml
index 545f4ff..ff84398 100644
--- a/release/install-relacs/action.yml
+++ b/release/install-relacs/action.yml
@@ -18,6 +18,7 @@ runs:
   using: composite
   steps:
     # Input defaults are literal strings; resolve $HOME in bash when unset.
+    # All other environment variables are intentionally not resolved due to security considerations.
     - name: Resolve binary directory
       id: binary-dir
       shell: bash

From 1283a5783c0f20be85edea6e781a3ef084914366 Mon Sep 17 00:00:00 2001
From: Tom Martensen <tmartens@redhat.com>
Date: Tue, 8 Sep 2026 10:46:40 +0200
Subject: [PATCH 05/14] address security finding about interpolating bash
 variables

---
 release/install-relacs/action.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/release/install-relacs/action.yml b/release/install-relacs/action.yml
index ff84398..5a962bc 100644
--- a/release/install-relacs/action.yml
+++ b/release/install-relacs/action.yml
@@ -82,7 +82,9 @@ runs:
 
     - name: Add binary directory to PATH
       shell: bash
-      run: echo "${{ steps.binary-dir.outputs.path }}" >> "${GITHUB_PATH}"
+      env:
+        BINARY_DIR: ${{ steps.binary-dir.outputs.path }}
+      run: printf '%s\n' "$BINARY_DIR" >> "${GITHUB_PATH}"
 
     # Save cache only if install succeeded (prevents caching wrong version on install failure)
     - name: Save relacs binary to cache

From 7d460d3bd737b9741366f9687ae1f172ad8d161e Mon Sep 17 00:00:00 2001
From: Tom Martensen <tmartens@redhat.com>
Date: Wed, 9 Sep 2026 14:05:13 +0200
Subject: [PATCH 06/14] Update bash scripts according to new, memorized style
 guide

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
---
 release/install-relacs/action.yml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/release/install-relacs/action.yml b/release/install-relacs/action.yml
index 5a962bc..1a601f0 100644
--- a/release/install-relacs/action.yml
+++ b/release/install-relacs/action.yml
@@ -25,13 +25,13 @@ runs:
       env:
         BINARY_DIR: ${{ inputs.binary_dir }}
       run: |
-        if [ -z "${BINARY_DIR}" ]; then
+        if [[ -z "${BINARY_DIR}" ]]; then
           BINARY_DIR="${HOME}/.local/bin"
         else
           BINARY_DIR="${BINARY_DIR//\$\{HOME\}/$HOME}"
           BINARY_DIR="${BINARY_DIR//\$HOME/$HOME}"
         fi
-        echo "path=${BINARY_DIR}" >> "${GITHUB_OUTPUT}"
+        echo "path=${BINARY_DIR}" | tee -a "${GITHUB_OUTPUT}"
 
     # Detect desired or latest relacs version
     - name: Get desired relacs version
@@ -41,13 +41,13 @@ runs:
         GH_TOKEN: ${{ inputs.token }}
         VERSION: ${{ inputs.version }}
       run: |
-        if [ -n "${VERSION:-}" ]; then
+        if [[ -n "${VERSION:-}" ]]; then
           echo "Using version override: ${VERSION}"
         else
-          VERSION=$(gh release view --repo stackrox/relacs --json tagName --jq .tagName)
+          VERSION="$(gh release view --repo stackrox/relacs --json tagName --jq .tagName)"
           echo "Using actual latest version: ${VERSION}"
         fi
-        echo "version=${VERSION}" >> "${GITHUB_OUTPUT}"
+        echo "version=${VERSION}" | tee -a "${GITHUB_OUTPUT}"
 
     # Restore relacs binary from cache to avoid re-downloading the same version
     - name: Restore relacs binary from cache
@@ -84,7 +84,7 @@ runs:
       shell: bash
       env:
         BINARY_DIR: ${{ steps.binary-dir.outputs.path }}
-      run: printf '%s\n' "$BINARY_DIR" >> "${GITHUB_PATH}"
+      run: printf '%s\n' "${BINARY_DIR}" | tee -a "${GITHUB_PATH}"
 
     # Save cache only if install succeeded (prevents caching wrong version on install failure)
     - name: Save relacs binary to cache

From 8bcc22bd94d1ab2732d643d69fc39fa1ca8dc190 Mon Sep 17 00:00:00 2001
From: Tom Martensen <tmartens@redhat.com>
Date: Wed, 9 Sep 2026 14:10:21 +0200
Subject: [PATCH 07/14] Rename binary_dir parameter to relacs_install_dir
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Renames the action input parameter and related identifiers to be more
specific to relacs installation. Also improves the parameter description
to document the default value.

Changes:
- Input parameter: binary_dir → relacs_install_dir
- Step ID: binary-dir → relacs-install-dir
- Environment variable: BINARY_DIR → RELACS_INSTALL_DIR
- Updated description to include default value
- Updated README documentation

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
---
 release/install-relacs/README.md  |  4 ++--
 release/install-relacs/action.yml | 28 ++++++++++++++--------------
 2 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/release/install-relacs/README.md b/release/install-relacs/README.md
index a79fe59..2f0cd55 100644
--- a/release/install-relacs/README.md
+++ b/release/install-relacs/README.md
@@ -20,7 +20,7 @@ permissions: {}
 
 | Name | Required | Default | Description |
 | --- | --- | --- | --- |
-| `binary_dir` | no | `$HOME/.local/bin` | Directory where to install `relacs` binary. Omit to use `$HOME/.local/bin`. |
+| `relacs_install_dir` | no | `$HOME/.local/bin` | Directory where to install `relacs` binary. Omit to use `$HOME/.local/bin`. |
 | `token` | yes |  | GH token to use for authentication for the `relacs` repository. |
 | `version` | no | "" | Release version tag to install (e.g. `v0.4.2`). Omit to install the latest release. |
 
@@ -35,7 +35,7 @@ jobs:
     steps:
     - uses: stackrox/actions/release/install-relacs@v1
       with:
-        binary_dir: /home/runner/.local/bin
+        relacs_install_dir: /home/runner/.local/bin
         token: ${{ secrets.RHACS_BOT_GITHUB_TOKEN }}
         version: v0.4.2
 
diff --git a/release/install-relacs/action.yml b/release/install-relacs/action.yml
index 1a601f0..1ef9d0a 100644
--- a/release/install-relacs/action.yml
+++ b/release/install-relacs/action.yml
@@ -2,8 +2,8 @@ name: Install relacs CLI
 description: Download relacs CLI from GitHub releases to a specified directory
 
 inputs:
-  binary_dir:
-    description: "Directory where to install `relacs` binary"
+  relacs_install_dir:
+    description: "Directory where to install `relacs` binary. Defaults to `${HOME}/.local/bin`."
     required: false
     default: ""
   token:
@@ -20,18 +20,18 @@ runs:
     # Input defaults are literal strings; resolve $HOME in bash when unset.
     # All other environment variables are intentionally not resolved due to security considerations.
     - name: Resolve binary directory
-      id: binary-dir
+      id: relacs-install-dir
       shell: bash
       env:
-        BINARY_DIR: ${{ inputs.binary_dir }}
+        RELACS_INSTALL_DIR: ${{ inputs.relacs_install_dir }}
       run: |
-        if [[ -z "${BINARY_DIR}" ]]; then
-          BINARY_DIR="${HOME}/.local/bin"
+        if [[ -z "${RELACS_INSTALL_DIR}" ]]; then
+          RELACS_INSTALL_DIR="${HOME}/.local/bin"
         else
-          BINARY_DIR="${BINARY_DIR//\$\{HOME\}/$HOME}"
-          BINARY_DIR="${BINARY_DIR//\$HOME/$HOME}"
+          RELACS_INSTALL_DIR="${RELACS_INSTALL_DIR//\$\{HOME\}/$HOME}"
+          RELACS_INSTALL_DIR="${RELACS_INSTALL_DIR//\$HOME/$HOME}"
         fi
-        echo "path=${BINARY_DIR}" | tee -a "${GITHUB_OUTPUT}"
+        echo "path=${RELACS_INSTALL_DIR}" | tee -a "${GITHUB_OUTPUT}"
 
     # Detect desired or latest relacs version
     - name: Get desired relacs version
@@ -54,7 +54,7 @@ runs:
       id: get-relacs-from-cache
       uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # ratchet:actions/cache/restore@v6
       with:
-        path: ${{ steps.binary-dir.outputs.path }}/relacs
+        path: ${{ steps.relacs-install-dir.outputs.path }}/relacs
         key: relacs-${{ runner.os }}-${{ runner.arch }}-${{ steps.relacs-version.outputs.version }}
 
     # Only install if cache missed
@@ -63,7 +63,7 @@ runs:
       if: steps.get-relacs-from-cache.outputs.cache-hit != 'true'
       shell: bash
       env:
-        BINARY_DIR: ${{ steps.binary-dir.outputs.path }}
+        RELACS_INSTALL_DIR: ${{ steps.relacs-install-dir.outputs.path }}
         GH_TOKEN: ${{ inputs.token }}
         VERSION: ${{ steps.relacs-version.outputs.version }}
       run: |
@@ -83,13 +83,13 @@ runs:
     - name: Add binary directory to PATH
       shell: bash
       env:
-        BINARY_DIR: ${{ steps.binary-dir.outputs.path }}
-      run: printf '%s\n' "${BINARY_DIR}" | tee -a "${GITHUB_PATH}"
+        RELACS_INSTALL_DIR: ${{ steps.relacs-install-dir.outputs.path }}
+      run: printf '%s\n' "${RELACS_INSTALL_DIR}" | tee -a "${GITHUB_PATH}"
 
     # Save cache only if install succeeded (prevents caching wrong version on install failure)
     - name: Save relacs binary to cache
       if: always() && steps.get-relacs-from-cache.outputs.cache-hit != 'true' && steps.install-relacs.outcome == 'success'
       uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # ratchet:actions/cache/save@v6
       with:
-        path: ${{ steps.binary-dir.outputs.path }}/relacs
+        path: ${{ steps.relacs-install-dir.outputs.path }}/relacs
         key: relacs-${{ runner.os }}-${{ runner.arch }}-${{ steps.relacs-version.outputs.version }}

From 740cc31d12d137633367f114c19c5a4d6aded8d9 Mon Sep 17 00:00:00 2001
From: Tom Martensen <tmartens@redhat.com>
Date: Thu, 10 Sep 2026 10:31:40 +0200
Subject: [PATCH 08/14] document that $HOME will be expanded in custom paths

---
 release/install-relacs/README.md  | 2 +-
 release/install-relacs/action.yml | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/release/install-relacs/README.md b/release/install-relacs/README.md
index 2f0cd55..092115f 100644
--- a/release/install-relacs/README.md
+++ b/release/install-relacs/README.md
@@ -20,7 +20,7 @@ permissions: {}
 
 | Name | Required | Default | Description |
 | --- | --- | --- | --- |
-| `relacs_install_dir` | no | `$HOME/.local/bin` | Directory where to install `relacs` binary. Omit to use `$HOME/.local/bin`. |
+| `relacs_install_dir` | no | `$HOME/.local/bin` | Directory where to install `relacs` binary. Supports expansion of `$HOME` and `${HOME}` in custom paths (other environment variables are not expanded). |
 | `token` | yes |  | GH token to use for authentication for the `relacs` repository. |
 | `version` | no | "" | Release version tag to install (e.g. `v0.4.2`). Omit to install the latest release. |
 
diff --git a/release/install-relacs/action.yml b/release/install-relacs/action.yml
index 1ef9d0a..ed1094f 100644
--- a/release/install-relacs/action.yml
+++ b/release/install-relacs/action.yml
@@ -3,7 +3,7 @@ description: Download relacs CLI from GitHub releases to a specified directory
 
 inputs:
   relacs_install_dir:
-    description: "Directory where to install `relacs` binary. Defaults to `${HOME}/.local/bin`."
+    description: "Directory where to install `relacs` binary. Defaults to `${HOME}/.local/bin`. Supports expansion of `$HOME` and `${HOME}` in custom paths (other environment variables are not expanded)."
     required: false
     default: ""
   token:
@@ -28,6 +28,7 @@ runs:
         if [[ -z "${RELACS_INSTALL_DIR}" ]]; then
           RELACS_INSTALL_DIR="${HOME}/.local/bin"
         else
+          # Expand $HOME and ${HOME} in custom paths
           RELACS_INSTALL_DIR="${RELACS_INSTALL_DIR//\$\{HOME\}/$HOME}"
           RELACS_INSTALL_DIR="${RELACS_INSTALL_DIR//\$HOME/$HOME}"
         fi

From 65d617b01cd50546d12d6f5b4f333c6a13a6cf2e Mon Sep 17 00:00:00 2001
From: Tom Martensen <tmartens@redhat.com>
Date: Thu, 10 Sep 2026 10:38:10 +0200
Subject: [PATCH 09/14] make relacs binary name configurable

---
 release/install-relacs/README.md  | 1 +
 release/install-relacs/action.yml | 9 +++++++--
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/release/install-relacs/README.md b/release/install-relacs/README.md
index 092115f..8d0ce4a 100644
--- a/release/install-relacs/README.md
+++ b/release/install-relacs/README.md
@@ -20,6 +20,7 @@ permissions: {}
 
 | Name | Required | Default | Description |
 | --- | --- | --- | --- |
+| `relacs_binary` | no | `relacs` | Name of the installed `relacs` binary. |
 | `relacs_install_dir` | no | `$HOME/.local/bin` | Directory where to install `relacs` binary. Supports expansion of `$HOME` and `${HOME}` in custom paths (other environment variables are not expanded). |
 | `token` | yes |  | GH token to use for authentication for the `relacs` repository. |
 | `version` | no | "" | Release version tag to install (e.g. `v0.4.2`). Omit to install the latest release. |
diff --git a/release/install-relacs/action.yml b/release/install-relacs/action.yml
index ed1094f..de63dac 100644
--- a/release/install-relacs/action.yml
+++ b/release/install-relacs/action.yml
@@ -2,6 +2,10 @@ name: Install relacs CLI
 description: Download relacs CLI from GitHub releases to a specified directory
 
 inputs:
+  relacs_binary:
+    description: "Binary name to install. Defaults to `relacs`."
+    required: false
+    default: "relacs"
   relacs_install_dir:
     description: "Directory where to install `relacs` binary. Defaults to `${HOME}/.local/bin`. Supports expansion of `$HOME` and `${HOME}` in custom paths (other environment variables are not expanded)."
     required: false
@@ -24,6 +28,7 @@ runs:
       shell: bash
       env:
         RELACS_INSTALL_DIR: ${{ inputs.relacs_install_dir }}
+        RELACS_BINARY: ${{ inputs.relacs_binary }}
       run: |
         if [[ -z "${RELACS_INSTALL_DIR}" ]]; then
           RELACS_INSTALL_DIR="${HOME}/.local/bin"
@@ -55,7 +60,7 @@ runs:
       id: get-relacs-from-cache
       uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # ratchet:actions/cache/restore@v6
       with:
-        path: ${{ steps.relacs-install-dir.outputs.path }}/relacs
+        path: ${{ steps.relacs-install-dir.outputs.path }}/${{ inputs.relacs_binary }}
         key: relacs-${{ runner.os }}-${{ runner.arch }}-${{ steps.relacs-version.outputs.version }}
 
     # Only install if cache missed
@@ -92,5 +97,5 @@ runs:
       if: always() && steps.get-relacs-from-cache.outputs.cache-hit != 'true' && steps.install-relacs.outcome == 'success'
       uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # ratchet:actions/cache/save@v6
       with:
-        path: ${{ steps.relacs-install-dir.outputs.path }}/relacs
+        path: ${{ steps.relacs-install-dir.outputs.path }}/${{ inputs.relacs_binary }}
         key: relacs-${{ runner.os }}-${{ runner.arch }}-${{ steps.relacs-version.outputs.version }}

From 7635557768493e039ab02a322255aca62a04f043 Mon Sep 17 00:00:00 2001
From: Tom Martensen <tmartens@redhat.com>
Date: Thu, 10 Sep 2026 15:53:33 +0200
Subject: [PATCH 10/14] switch to relacs-install-path

---
 release/install-relacs/README.md  |  5 ++--
 release/install-relacs/action.yml | 41 +++++++++++++++----------------
 2 files changed, 22 insertions(+), 24 deletions(-)

diff --git a/release/install-relacs/README.md b/release/install-relacs/README.md
index 8d0ce4a..1afa69e 100644
--- a/release/install-relacs/README.md
+++ b/release/install-relacs/README.md
@@ -20,8 +20,7 @@ permissions: {}
 
 | Name | Required | Default | Description |
 | --- | --- | --- | --- |
-| `relacs_binary` | no | `relacs` | Name of the installed `relacs` binary. |
-| `relacs_install_dir` | no | `$HOME/.local/bin` | Directory where to install `relacs` binary. Supports expansion of `$HOME` and `${HOME}` in custom paths (other environment variables are not expanded). |
+| `relacs_install_path` | no | `$HOME/.local/bin/relacs` | Path where to install `relacs` binary. Supports expansion of `$HOME` and `${HOME}` in custom paths (other environment variables are not expanded). |
 | `token` | yes |  | GH token to use for authentication for the `relacs` repository. |
 | `version` | no | "" | Release version tag to install (e.g. `v0.4.2`). Omit to install the latest release. |
 
@@ -36,7 +35,7 @@ jobs:
     steps:
     - uses: stackrox/actions/release/install-relacs@v1
       with:
-        relacs_install_dir: /home/runner/.local/bin
+        relacs_install_path: /home/runner/.local/bin/relacs
         token: ${{ secrets.RHACS_BOT_GITHUB_TOKEN }}
         version: v0.4.2
 
diff --git a/release/install-relacs/action.yml b/release/install-relacs/action.yml
index de63dac..b635110 100644
--- a/release/install-relacs/action.yml
+++ b/release/install-relacs/action.yml
@@ -2,12 +2,8 @@ name: Install relacs CLI
 description: Download relacs CLI from GitHub releases to a specified directory
 
 inputs:
-  relacs_binary:
-    description: "Binary name to install. Defaults to `relacs`."
-    required: false
-    default: "relacs"
-  relacs_install_dir:
-    description: "Directory where to install `relacs` binary. Defaults to `${HOME}/.local/bin`. Supports expansion of `$HOME` and `${HOME}` in custom paths (other environment variables are not expanded)."
+  relacs_install_path:
+    description: "Path where to install `relacs` binary. Defaults to `${HOME}/.local/bin/relacs`. Supports expansion of `$HOME` and `${HOME}` in custom paths (other environment variables are not expanded)."
     required: false
     default: ""
   token:
@@ -23,21 +19,21 @@ runs:
   steps:
     # Input defaults are literal strings; resolve $HOME in bash when unset.
     # All other environment variables are intentionally not resolved due to security considerations.
-    - name: Resolve binary directory
-      id: relacs-install-dir
+    - name: Resolve relacs install path
+      id: relacs-install-path
       shell: bash
       env:
-        RELACS_INSTALL_DIR: ${{ inputs.relacs_install_dir }}
-        RELACS_BINARY: ${{ inputs.relacs_binary }}
+        RELACS_INSTALL_PATH: ${{ inputs.relacs_install_path }}
       run: |
-        if [[ -z "${RELACS_INSTALL_DIR}" ]]; then
-          RELACS_INSTALL_DIR="${HOME}/.local/bin"
+        if [[ -z "${RELACS_INSTALL_PATH}" ]]; then
+          RELACS_INSTALL_PATH="${HOME}/.local/bin/relacs"
         else
+        # TODO: HOME_SWEET_HOME...
           # Expand $HOME and ${HOME} in custom paths
-          RELACS_INSTALL_DIR="${RELACS_INSTALL_DIR//\$\{HOME\}/$HOME}"
-          RELACS_INSTALL_DIR="${RELACS_INSTALL_DIR//\$HOME/$HOME}"
+          RELACS_INSTALL_PATH="${RELACS_INSTALL_PATH//\$\{HOME\}/$HOME}"
+          RELACS_INSTALL_PATH="${RELACS_INSTALL_PATH//\$HOME/$HOME}"
         fi
-        echo "path=${RELACS_INSTALL_DIR}" | tee -a "${GITHUB_OUTPUT}"
+        echo "path=${RELACS_INSTALL_PATH}" | tee -a "${GITHUB_OUTPUT}"
 
     # Detect desired or latest relacs version
     - name: Get desired relacs version
@@ -60,7 +56,7 @@ runs:
       id: get-relacs-from-cache
       uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # ratchet:actions/cache/restore@v6
       with:
-        path: ${{ steps.relacs-install-dir.outputs.path }}/${{ inputs.relacs_binary }}
+        path: ${{ steps.relacs-install-path.outputs.path }}
         key: relacs-${{ runner.os }}-${{ runner.arch }}-${{ steps.relacs-version.outputs.version }}
 
     # Only install if cache missed
@@ -69,7 +65,7 @@ runs:
       if: steps.get-relacs-from-cache.outputs.cache-hit != 'true'
       shell: bash
       env:
-        RELACS_INSTALL_DIR: ${{ steps.relacs-install-dir.outputs.path }}
+        RELACS_INSTALL_PATH: ${{ steps.relacs-install-path.outputs.path }}
         GH_TOKEN: ${{ inputs.token }}
         VERSION: ${{ steps.relacs-version.outputs.version }}
       run: |
@@ -86,16 +82,19 @@ runs:
         # Execute installer with version from environment
         bash "${INSTALLER}" "${VERSION}"
 
-    - name: Add binary directory to PATH
+    - name: Add relacs install path to PATH
       shell: bash
       env:
-        RELACS_INSTALL_DIR: ${{ steps.relacs-install-dir.outputs.path }}
-      run: printf '%s\n' "${RELACS_INSTALL_DIR}" | tee -a "${GITHUB_PATH}"
+        RELACS_INSTALL_PATH: ${{ steps.relacs-install-path.outputs.path }}
+      run: |
+        set -euo pipefail
+        relacs_path="$(dirname "${RELACS_INSTALL_PATH}")"
+        printf '%s\n' "${relacs_path}" | tee -a "${GITHUB_PATH}"
 
     # Save cache only if install succeeded (prevents caching wrong version on install failure)
     - name: Save relacs binary to cache
       if: always() && steps.get-relacs-from-cache.outputs.cache-hit != 'true' && steps.install-relacs.outcome == 'success'
       uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # ratchet:actions/cache/save@v6
       with:
-        path: ${{ steps.relacs-install-dir.outputs.path }}/${{ inputs.relacs_binary }}
+        path: ${{ steps.relacs-install-path.outputs.path }}
         key: relacs-${{ runner.os }}-${{ runner.arch }}-${{ steps.relacs-version.outputs.version }}

From 91611848b38dc8f0003f318e4da6d749f81d224e Mon Sep 17 00:00:00 2001
From: Tom Martensen <tmartens@redhat.com>
Date: Thu, 10 Sep 2026 15:57:49 +0200
Subject: [PATCH 11/14] add comment about command injection

---
 release/install-relacs/action.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/release/install-relacs/action.yml b/release/install-relacs/action.yml
index b635110..0a8cebd 100644
--- a/release/install-relacs/action.yml
+++ b/release/install-relacs/action.yml
@@ -89,6 +89,7 @@ runs:
       run: |
         set -euo pipefail
         relacs_path="$(dirname "${RELACS_INSTALL_PATH}")"
+        # Use printf to prevent command injection from the relacs_path variable
         printf '%s\n' "${relacs_path}" | tee -a "${GITHUB_PATH}"
 
     # Save cache only if install succeeded (prevents caching wrong version on install failure)

From 353362cd3576814437788a2977b2dc7d330781e0 Mon Sep 17 00:00:00 2001
From: Tom Martensen <tmartens@redhat.com>
Date: Thu, 10 Sep 2026 16:17:07 +0200
Subject: [PATCH 12/14] don't expand HOME_SWEET_HOME

---
 release/install-relacs/action.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/release/install-relacs/action.yml b/release/install-relacs/action.yml
index 0a8cebd..6748f83 100644
--- a/release/install-relacs/action.yml
+++ b/release/install-relacs/action.yml
@@ -28,11 +28,11 @@ runs:
         if [[ -z "${RELACS_INSTALL_PATH}" ]]; then
           RELACS_INSTALL_PATH="${HOME}/.local/bin/relacs"
         else
-        # TODO: HOME_SWEET_HOME...
-          # Expand $HOME and ${HOME} in custom paths
-          RELACS_INSTALL_PATH="${RELACS_INSTALL_PATH//\$\{HOME\}/$HOME}"
-          RELACS_INSTALL_PATH="${RELACS_INSTALL_PATH//\$HOME/$HOME}"
-        fi
+        RELACS_INSTALL_PATH="$(printf '%s' "${RELACS_INSTALL_PATH}" | sed \
+          -e "s|\${HOME}/|$HOME/|g" \
+          -e "s|\${HOME}\$|$HOME|g" \
+          -e "s|\$HOME/|$HOME/|g" \
+          -e "s|\$HOME\$|$HOME|g")"
         echo "path=${RELACS_INSTALL_PATH}" | tee -a "${GITHUB_OUTPUT}"
 
     # Detect desired or latest relacs version

From 501eaacde236c0e8d10c05af4f00b98442bd0303 Mon Sep 17 00:00:00 2001
From: Tom Martensen <tmartens@redhat.com>
Date: Thu, 10 Sep 2026 16:17:42 +0200
Subject: [PATCH 13/14] use install-relacs script from default branch

---
 release/install-relacs/action.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/release/install-relacs/action.yml b/release/install-relacs/action.yml
index 6748f83..50900a0 100644
--- a/release/install-relacs/action.yml
+++ b/release/install-relacs/action.yml
@@ -76,7 +76,7 @@ runs:
 
         gh api \
           -H "Accept: application/vnd.github.v3.raw" \
-          "/repos/stackrox/relacs/contents/scripts/install-relacs.sh?ref=tm/install-relacs-improvement" \
+          "/repos/stackrox/relacs/contents/scripts/install-relacs.sh" \
           > "${INSTALLER}"
 
         # Execute installer with version from environment

From a0d20380d782afc62d733dc871bd9e7338f4255e Mon Sep 17 00:00:00 2001
From: Tom Martensen <tmartens@redhat.com>
Date: Thu, 10 Sep 2026 16:24:54 +0200
Subject: [PATCH 14/14] fix: add fi

---
 release/install-relacs/action.yml | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/release/install-relacs/action.yml b/release/install-relacs/action.yml
index 50900a0..d5c6904 100644
--- a/release/install-relacs/action.yml
+++ b/release/install-relacs/action.yml
@@ -28,11 +28,12 @@ runs:
         if [[ -z "${RELACS_INSTALL_PATH}" ]]; then
           RELACS_INSTALL_PATH="${HOME}/.local/bin/relacs"
         else
-        RELACS_INSTALL_PATH="$(printf '%s' "${RELACS_INSTALL_PATH}" | sed \
-          -e "s|\${HOME}/|$HOME/|g" \
-          -e "s|\${HOME}\$|$HOME|g" \
-          -e "s|\$HOME/|$HOME/|g" \
-          -e "s|\$HOME\$|$HOME|g")"
+          RELACS_INSTALL_PATH="$(printf '%s' "${RELACS_INSTALL_PATH}" | sed \
+            -e "s|\${HOME}/|$HOME/|g" \
+            -e "s|\${HOME}\$|$HOME|g" \
+            -e "s|\$HOME/|$HOME/|g" \
+            -e "s|\$HOME\$|$HOME|g")"
+        fi
         echo "path=${RELACS_INSTALL_PATH}" | tee -a "${GITHUB_OUTPUT}"
 
     # Detect desired or latest relacs version