From 2c8c2bff1edaa7eef6bb4d92cabfacc127780abd Mon Sep 17 00:00:00 2001
From: Juraj Uhlar <juro.uhlar@gmail.com>
Date: Thu, 23 Apr 2026 13:07:46 +0100
Subject: [PATCH 1/3] feat: fetch scopes.yaml from a canonical repo location,
 not per-release

Previously the update-sdk-schema action read scopes.yaml from each
intermediate release's assets during iteration. That ties every scope
allowlist fix to a new release cut - and freezes any broken scopes.yaml
that already shipped in historical releases. When scopes.yaml was out
of sync with the schema (e.g. v3->v4 path renames), every re-run of
the sync action produced silently-truncated SDK PRs.

Adds three inputs to the action:

  scopesRepository  - owner/repo to source scopes.yaml from.
                      Defaults to openApiRepository.
  scopesConfigPath  - path within scopesRepository. Default
                      config/scopes.yaml.
  scopesRef         - git ref to read from. Default main.

The action now fetches scopes.yaml from
raw.githubusercontent.com/<scopesRepository>/<scopesRef>/<scopesConfigPath>
once per iteration. A fix merged to scopesRepository@scopesRef takes
effect on the next sync run, regardless of which historical tags the
action iterates over.

The same inputs are plumbed through the update-server-side-sdk-schema
reusable workflow so consumers can override them (e.g. pin to a release
tag for reproducibility, or point at a different repo).

Trade-off: historical syncs are no longer reproducible against frozen
scope snapshots. In practice that's fine - scopes.yaml is tooling
config, not schema content. The scope surface rarely shrinks; adding
scopes/paths that didn't exist in older schemas is a no-op in
filter-schema.
---
 .../update-sdk-schema/__test__/assets.ts      | 10 ++----
 .github/actions/update-sdk-schema/action.yml  | 21 ++++++++----
 .github/actions/update-sdk-schema/config.ts   | 10 ++++++
 .github/actions/update-sdk-schema/const.ts    |  1 -
 .../actions/update-sdk-schema/dist/index.js   | 21 +++++++++---
 .github/actions/update-sdk-schema/github.ts   | 13 ++++++++
 .../update-schema-for-tag.ts                  | 32 ++++++++++++-------
 .../update-sdk-schema/update-schema.test.ts   |  8 +++++
 .../update-server-side-sdk-schema.yml         | 26 ++++++++++++---
 9 files changed, 107 insertions(+), 35 deletions(-)

diff --git a/.github/actions/update-sdk-schema/__test__/assets.ts b/.github/actions/update-sdk-schema/__test__/assets.ts
index c6e6429..33e875b 100644
--- a/.github/actions/update-sdk-schema/__test__/assets.ts
+++ b/.github/actions/update-sdk-schema/__test__/assets.ts
@@ -14,14 +14,8 @@ const assetsMap = {
     path.resolve(__dirname, './v1.1.0/schema.yaml'),
   'https://github.com/fingerprintjs/fingerprint-pro-server-api-openapi/releases/download/v1.2.0/fingerprint-server-api.yaml':
     path.resolve(__dirname, './v1.2.0/schema.yaml'),
-  'https://github.com/fingerprintjs/fingerprint-pro-server-api-openapi/releases/download/v1.1.0/scopes': path.resolve(
-    __dirname,
-    './v1.1.0/scopes.yaml'
-  ),
-  'https://github.com/fingerprintjs/fingerprint-pro-server-api-openapi/releases/download/v1.2.0/scopes': path.resolve(
-    __dirname,
-    './v1.2.0/scopes.yaml'
-  ),
+  'https://raw.githubusercontent.com/fingerprintjs/fingerprint-pro-server-api-openapi/main/config/scopes.yaml':
+    path.resolve(__dirname, './v1.1.0/scopes.yaml'),
 }
 
 export function maybeMockAsset(url: string) {
diff --git a/.github/actions/update-sdk-schema/action.yml b/.github/actions/update-sdk-schema/action.yml
index 845805d..6b8e6a9 100644
--- a/.github/actions/update-sdk-schema/action.yml
+++ b/.github/actions/update-sdk-schema/action.yml
@@ -22,18 +22,27 @@ inputs:
   openApiRepository:
     description: 'OpenAPI repository in format of owner/repo'
     default: 'fingerprintjs/fingerprint-pro-server-api-openapi'
+  scopesRepository:
+    description: 'Repository to source scopes.yaml from, in format of owner/repo. Defaults to openApiRepository.'
+    default: ''
+  scopesConfigPath:
+    description: 'Path to scopes.yaml within scopesRepository'
+    default: 'config/scopes.yaml'
+  scopesRef:
+    description: 'Git ref (branch, tag, or SHA) to read scopesConfigPath from'
+    default: 'main'
   preRelease:
     description: 'Enable pre-release mode'
-    default: "false"
+    default: 'false'
   preReleaseTag:
     description: 'Tag suffix used for pre-releases'
-    default: "test"
+    default: 'test'
   allowedScopes:
-    description: "List of change scopes to allow, comma separated. If left empty, all scopes are allowed."
-    default: ""
+    description: 'List of change scopes to allow, comma separated. If left empty, all scopes are allowed.'
+    default: ''
   force:
-    description: "Whenever to force update to given tag, even if it was already updated before"
-    default: "false"
+    description: 'Whenever to force update to given tag, even if it was already updated before'
+    default: 'false'
 runs:
   using: 'node24'
   main: 'dist/index.js'
diff --git a/.github/actions/update-sdk-schema/config.ts b/.github/actions/update-sdk-schema/config.ts
index 636ab72..dd2d4ee 100644
--- a/.github/actions/update-sdk-schema/config.ts
+++ b/.github/actions/update-sdk-schema/config.ts
@@ -9,12 +9,18 @@ export interface Config {
   preRelease: boolean
   owner: string
   repo: string
+  scopesOwner: string
+  scopesRepo: string
+  scopesConfigPath: string
+  scopesRef: string
   allowedScopes: string[]
   force: boolean
 }
 
 export function getConfig(): Config {
   const [owner, repo] = core.getInput('openApiRepository').split('/')
+  const scopesRepositoryInput = core.getInput('scopesRepository').trim()
+  const [scopesOwner, scopesRepo] = (scopesRepositoryInput || `${owner}/${repo}`).split('/')
 
   return {
     schemaSource: core.getInput('schemaSource'),
@@ -26,6 +32,10 @@ export function getConfig(): Config {
     force: core.getInput('force') === 'true',
     owner,
     repo,
+    scopesOwner,
+    scopesRepo,
+    scopesConfigPath: core.getInput('scopesConfigPath') || 'config/scopes.yaml',
+    scopesRef: core.getInput('scopesRef') || 'main',
     allowedScopes: core
       .getInput('allowedScopes')
       .split(',')
diff --git a/.github/actions/update-sdk-schema/const.ts b/.github/actions/update-sdk-schema/const.ts
index e4d8bcd..4a5a03b 100644
--- a/.github/actions/update-sdk-schema/const.ts
+++ b/.github/actions/update-sdk-schema/const.ts
@@ -2,4 +2,3 @@ export const RELEASE_NOTES = 'changesets.zip'
 export const EXAMPLES_FILE = 'examples.zip'
 export const EXAMPLE_PATH_TO_REPLACE = 'examples/'
 export const CHANGESETS_PATH = '.changeset'
-export const SCOPES_FILE = 'scopes.yaml'
diff --git a/.github/actions/update-sdk-schema/dist/index.js b/.github/actions/update-sdk-schema/dist/index.js
index d84c6e7..3f600ce 100644
--- a/.github/actions/update-sdk-schema/dist/index.js
+++ b/.github/actions/update-sdk-schema/dist/index.js
@@ -49074,6 +49074,8 @@ function replacePackageName(changeset, name) {
 
 function getConfig() {
     const [owner, repo] = core.getInput('openApiRepository').split('/');
+    const scopesRepositoryInput = core.getInput('scopesRepository').trim();
+    const [scopesOwner, scopesRepo] = (scopesRepositoryInput || `${owner}/${repo}`).split('/');
     return {
         schemaSource: core.getInput('schemaSource'),
         schemaPath: core.getInput('schemaPath'),
@@ -49084,6 +49086,10 @@ function getConfig() {
         force: core.getInput('force') === 'true',
         owner,
         repo,
+        scopesOwner,
+        scopesRepo,
+        scopesConfigPath: core.getInput('scopesConfigPath') || 'config/scopes.yaml',
+        scopesRef: core.getInput('scopesRef') || 'main',
         allowedScopes: core.getInput('allowedScopes')
             .split(',')
             .map((v) => v.trim())
@@ -49152,6 +49158,10 @@ async function downloadAsset(url) {
         throw e;
     }
 }
+async function downloadRepoFile({ owner, repo, path, ref }) {
+    const url = `https://raw.githubusercontent.com/${owner}/${repo}/${ref}/${path}`;
+    return downloadAsset(url);
+}
 async function getRelease({ config, tag, octokit }) {
     const { data } = await withRetry(() => octokit.rest.repos.getReleaseByTag({
         owner: config.owner,
@@ -49212,7 +49222,6 @@ const RELEASE_NOTES = 'changesets.zip';
 const EXAMPLES_FILE = 'examples.zip';
 const EXAMPLE_PATH_TO_REPLACE = 'examples/';
 const CHANGESETS_PATH = '.changeset';
-const SCOPES_FILE = 'scopes.yaml';
 
 ;// CONCATENATED MODULE: ./node_modules/.pnpm/js-yaml@4.1.0/node_modules/js-yaml/dist/js-yaml.mjs
 
@@ -53145,7 +53154,7 @@ function loadScopes(scopesYaml) {
 
 
 
-async function updateSchemaForTag(tag, octokit, packageName, { schemaSource, schemaPath, examplesPath, repo, owner, allowedScopes, generateCommand }, cwd = process.cwd()) {
+async function updateSchemaForTag(tag, octokit, packageName, { schemaSource, schemaPath, examplesPath, repo, owner, allowedScopes, generateCommand, scopesOwner, scopesRepo, scopesConfigPath, scopesRef, }, cwd = process.cwd()) {
     examplesPath = external_path_.join(cwd, examplesPath);
     schemaPath = external_path_.join(cwd, schemaPath);
     console.info('Updating schema for tag:', tag);
@@ -53160,7 +53169,6 @@ async function updateSchemaForTag(tag, octokit, packageName, { schemaSource, sch
     const schemaAsset = findAsset(schemaSource, release.data);
     const releaseNotesAsset = findAsset(RELEASE_NOTES, release.data);
     const examplesAsset = findAsset(EXAMPLES_FILE, release.data);
-    const scopesAsset = findAsset(SCOPES_FILE, release.data);
     const changesets = await getReleaseNotes(releaseNotesAsset, allowedScopes, packageName).catch((e) => {
         console.error('Failed to get release notes', e);
         throw e;
@@ -53170,7 +53178,12 @@ async function updateSchemaForTag(tag, octokit, packageName, { schemaSource, sch
         return;
     }
     const schema = await downloadAsset(schemaAsset.browser_download_url);
-    const scopes = await downloadAsset(scopesAsset.browser_download_url);
+    const scopes = await downloadRepoFile({
+        owner: scopesOwner,
+        repo: scopesRepo,
+        path: scopesConfigPath,
+        ref: scopesRef,
+    });
     const filteredSchema = filterSchema(schema.toString(), loadScopes(scopes.toString()), allowedScopes);
     console.info(`Writing schema (${tag}):\n`, filteredSchema);
     external_fs_.writeFileSync(schemaPath, filteredSchema);
diff --git a/.github/actions/update-sdk-schema/github.ts b/.github/actions/update-sdk-schema/github.ts
index 0df1cfb..c0b365b 100644
--- a/.github/actions/update-sdk-schema/github.ts
+++ b/.github/actions/update-sdk-schema/github.ts
@@ -35,6 +35,19 @@ export async function downloadAsset(url: string) {
   }
 }
 
+interface DownloadRepoFileParams {
+  owner: string
+  repo: string
+  path: string
+  ref: string
+}
+
+export async function downloadRepoFile({ owner, repo, path, ref }: DownloadRepoFileParams) {
+  const url = `https://raw.githubusercontent.com/${owner}/${repo}/${ref}/${path}`
+
+  return downloadAsset(url)
+}
+
 interface ListReleasesBetweenParams {
   octokit: GitHubClient
   config: Pick<Config, 'owner' | 'repo'>
diff --git a/.github/actions/update-sdk-schema/update-schema-for-tag.ts b/.github/actions/update-sdk-schema/update-schema-for-tag.ts
index ce28554..2080c1a 100644
--- a/.github/actions/update-sdk-schema/update-schema-for-tag.ts
+++ b/.github/actions/update-sdk-schema/update-schema-for-tag.ts
@@ -1,12 +1,6 @@
 import { Config } from './config'
-import { downloadAsset, findAsset, getReleaseNotes, GitHubClient } from './github'
-import {
-  CHANGESETS_PATH,
-  EXAMPLE_PATH_TO_REPLACE,
-  EXAMPLES_FILE,
-  RELEASE_NOTES,
-  SCOPES_FILE,
-} from './const'
+import { downloadAsset, downloadRepoFile, findAsset, getReleaseNotes, GitHubClient } from './github'
+import { CHANGESETS_PATH, EXAMPLE_PATH_TO_REPLACE, EXAMPLES_FILE, RELEASE_NOTES } from './const'
 import * as fs from 'fs'
 import * as unzipper from 'unzipper'
 import * as path from 'path'
@@ -19,7 +13,19 @@ export async function updateSchemaForTag(
   tag: string,
   octokit: GitHubClient,
   packageName: string,
-  { schemaSource, schemaPath, examplesPath, repo, owner, allowedScopes, generateCommand }: Config,
+  {
+    schemaSource,
+    schemaPath,
+    examplesPath,
+    repo,
+    owner,
+    allowedScopes,
+    generateCommand,
+    scopesOwner,
+    scopesRepo,
+    scopesConfigPath,
+    scopesRef,
+  }: Config,
   cwd = process.cwd()
 ) {
   examplesPath = path.join(cwd, examplesPath)
@@ -40,7 +46,6 @@ export async function updateSchemaForTag(
   const schemaAsset = findAsset(schemaSource, release.data)
   const releaseNotesAsset = findAsset(RELEASE_NOTES, release.data)
   const examplesAsset = findAsset(EXAMPLES_FILE, release.data)
-  const scopesAsset = findAsset(SCOPES_FILE, release.data)
 
   const changesets = await getReleaseNotes(releaseNotesAsset, allowedScopes, packageName).catch((e) => {
     console.error('Failed to get release notes', e)
@@ -54,7 +59,12 @@ export async function updateSchemaForTag(
   }
 
   const schema = await downloadAsset(schemaAsset.browser_download_url)
-  const scopes = await downloadAsset(scopesAsset.browser_download_url)
+  const scopes = await downloadRepoFile({
+    owner: scopesOwner,
+    repo: scopesRepo,
+    path: scopesConfigPath,
+    ref: scopesRef,
+  })
   const filteredSchema = filterSchema(schema.toString(), loadScopes(scopes.toString()), allowedScopes)
   console.info(`Writing schema (${tag}):\n`, filteredSchema)
   fs.writeFileSync(schemaPath, filteredSchema)
diff --git a/.github/actions/update-sdk-schema/update-schema.test.ts b/.github/actions/update-sdk-schema/update-schema.test.ts
index 1dc3e5c..8c7944d 100644
--- a/.github/actions/update-sdk-schema/update-schema.test.ts
+++ b/.github/actions/update-sdk-schema/update-schema.test.ts
@@ -86,6 +86,10 @@ describe('Update schema', () => {
       config: {
         owner: 'test-owner',
         repo: 'test-repo',
+        scopesOwner: 'fingerprintjs',
+        scopesRepo: 'fingerprint-pro-server-api-openapi',
+        scopesConfigPath: 'config/scopes.yaml',
+        scopesRef: 'main',
         schemaSource: 'fingerprint-server-api-schema-for-sdks.yaml',
         allowedScopes: ['events', 'visitors', 'webhook'],
         githubToken: '',
@@ -127,6 +131,10 @@ describe('Update schema', () => {
       config: {
         owner: 'test-owner',
         repo: 'test-repo',
+        scopesOwner: 'fingerprintjs',
+        scopesRepo: 'fingerprint-pro-server-api-openapi',
+        scopesConfigPath: 'config/scopes.yaml',
+        scopesRef: 'main',
         allowedScopes: ['events', 'visitors', 'webhook'],
         githubToken: '',
         schemaSource: 'fingerprint-server-api-schema-for-sdks.yaml',
diff --git a/.github/workflows/update-server-side-sdk-schema.yml b/.github/workflows/update-server-side-sdk-schema.yml
index 6d1b4b4..79ea114 100644
--- a/.github/workflows/update-server-side-sdk-schema.yml
+++ b/.github/workflows/update-server-side-sdk-schema.yml
@@ -64,12 +64,27 @@ on:
         description: 'Tag suffix used for pre-releases'
         default: 'test'
       allowed-scopes:
-        description: "List of change scopes to allow, comma separated. If left empty, all scopes are allowed."
+        description: 'List of change scopes to allow, comma separated. If left empty, all scopes are allowed.'
         required: false
         type: string
-        default: ""
+        default: ''
+      scopes-repository:
+        description: 'Repository to source scopes.yaml from, in format of owner/repo. Defaults to the OpenAPI repo.'
+        required: false
+        type: string
+        default: ''
+      scopes-config-path:
+        description: 'Path to scopes.yaml within scopes-repository'
+        required: false
+        type: string
+        default: 'config/scopes.yaml'
+      scopes-ref:
+        description: 'Git ref (branch, tag, or SHA) to read scopes-config-path from'
+        required: false
+        type: string
+        default: 'main'
       force:
-        description: "Whenever to force update to given tag, even if it was already updated before"
+        description: 'Whenever to force update to given tag, even if it was already updated before'
         default: false
         type: boolean
         required: false
@@ -132,6 +147,9 @@ jobs:
           githubToken: '${{ steps.app-token.outputs.token }}'
           preRelease: '${{ inputs.pre-release }}'
           allowedScopes: ${{ inputs.allowed-scopes }}
+          scopesRepository: ${{ inputs.scopes-repository }}
+          scopesConfigPath: ${{ inputs.scopes-config-path }}
+          scopesRef: ${{ inputs.scopes-ref }}
           preReleaseTag: '${{ inputs.pre-release-tag }}'
           force: '${{ inputs.force }}'
 
@@ -143,7 +161,6 @@ jobs:
           message: 'feat: sync OpenAPI schema to ${{ inputs.tag }}'
           push: 'false'
 
-
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c
         with:
@@ -151,4 +168,3 @@ jobs:
           body: 'Schema sync for [${{ inputs.tag }}](https://github.com/fingerprintjs/fingerprint-pro-server-api-openapi/releases/tag/${{ inputs.tag }}) OpenAPI schema release.'
           token: ${{ steps.app-token.outputs.token }}
           branch: feat/open-api-${{ inputs.tag }}
-

From 507f0e436ca7d8cd75643f614fc1abf4b9f8336a Mon Sep 17 00:00:00 2001
From: Juraj Uhlar <juro.uhlar@gmail.com>
Date: Thu, 23 Apr 2026 13:32:52 +0100
Subject: [PATCH 2/3] fix: throw on non-2xx responses in downloadAsset

Previously downloadAsset returned the error body as a Buffer on any
non-2xx response. For release assets this was benign (URLs come from
the GitHub API and rarely 404), but the new canonical scopes.yaml
fetch from raw.githubusercontent.com is sensitive to typos in
scopesConfigPath or scopesRef - a 404 would produce a corrupt scopes
YAML that filter-schema would parse as "no allowed paths", silently
reproducing the truncated-schema bug this PR is meant to fix.

Adds a regression test that stubs raw.githubusercontent.com with a
404 and asserts the run aborts before generate runs.
---
 .../actions/update-sdk-schema/dist/index.js   |  8 ++-
 .github/actions/update-sdk-schema/github.ts   |  8 ++-
 .../update-sdk-schema/update-schema.test.ts   | 59 +++++++++++++++++++
 3 files changed, 73 insertions(+), 2 deletions(-)

diff --git a/.github/actions/update-sdk-schema/dist/index.js b/.github/actions/update-sdk-schema/dist/index.js
index 3f600ce..c8cd317 100644
--- a/.github/actions/update-sdk-schema/dist/index.js
+++ b/.github/actions/update-sdk-schema/dist/index.js
@@ -49150,7 +49150,13 @@ function findAsset(name, release) {
 async function downloadAsset(url) {
     try {
         console.info('Downloading asset:', url);
-        const response = await withRetry(() => fetch(url));
+        const response = await withRetry(async () => {
+            const r = await fetch(url);
+            if (!r.ok) {
+                throw new Error(`Failed to download ${url}: ${r.status} ${r.statusText}`);
+            }
+            return r;
+        });
         return Buffer.from(await response.arrayBuffer());
     }
     catch (e) {
diff --git a/.github/actions/update-sdk-schema/github.ts b/.github/actions/update-sdk-schema/github.ts
index c0b365b..106d152 100644
--- a/.github/actions/update-sdk-schema/github.ts
+++ b/.github/actions/update-sdk-schema/github.ts
@@ -25,7 +25,13 @@ export function findAsset(name: string, release: Release) {
 export async function downloadAsset(url: string) {
   try {
     console.info('Downloading asset:', url)
-    const response = await withRetry(() => fetch(url))
+    const response = await withRetry(async () => {
+      const r = await fetch(url)
+      if (!r.ok) {
+        throw new Error(`Failed to download ${url}: ${r.status} ${r.statusText}`)
+      }
+      return r
+    })
 
     return Buffer.from(await response.arrayBuffer())
   } catch (e) {
diff --git a/.github/actions/update-sdk-schema/update-schema.test.ts b/.github/actions/update-sdk-schema/update-schema.test.ts
index 8c7944d..69051e8 100644
--- a/.github/actions/update-sdk-schema/update-schema.test.ts
+++ b/.github/actions/update-sdk-schema/update-schema.test.ts
@@ -151,4 +151,63 @@ describe('Update schema', () => {
     expect(readTestPackageFile('.schema-version').toString()).toEqual('v1.2.0')
     expect(readTestPackageFile('res/fingerprint-server-api.yaml')).toMatchSnapshot('schema')
   })
+
+  it('fails fast when canonical scopes.yaml is not reachable', async () => {
+    listReleases.mockResolvedValue({
+      data: [v120, v110],
+    })
+
+    getReleaseByTag.mockImplementation(({ tag }) => {
+      switch (tag) {
+        case 'v1.1.0':
+          return { data: v110 }
+
+        case 'v1.2.0':
+          return { data: v120 }
+
+        default:
+          throw new Error(`Unexpected tag: ${tag}`)
+      }
+    })
+
+    Object.assign(global, {
+      fetch: jest.fn().mockImplementation(async (url, opts) => {
+        if (url.startsWith('https://raw.githubusercontent.com/')) {
+          return new Response('Not Found', { status: 404, statusText: 'Not Found' })
+        }
+        const response = maybeMockAsset(url)
+        if (response) {
+          return response
+        }
+
+        return orgFetch(url, opts)
+      }),
+    })
+
+    await expect(
+      updateSchema({
+        tag: 'v1.2.0',
+        cwd: TEST_PACKAGE_PATH,
+        config: {
+          owner: 'test-owner',
+          repo: 'test-repo',
+          scopesOwner: 'fingerprintjs',
+          scopesRepo: 'fingerprint-pro-server-api-openapi',
+          scopesConfigPath: 'config/does-not-exist.yaml',
+          scopesRef: 'main',
+          allowedScopes: ['events', 'visitors', 'webhook'],
+          githubToken: '',
+          schemaSource: 'fingerprint-server-api-schema-for-sdks.yaml',
+          examplesPath: 'examples',
+          generateCommand: 'touch ./.generated',
+          preRelease: false,
+          schemaPath: 'res/fingerprint-server-api.yaml',
+          force: false,
+        },
+        packageName: 'test-package',
+      })
+    ).rejects.toThrow(/404|circuit breaker/)
+
+    expect(testPackageFileExists('.generated')).toBeFalsy()
+  }, 30000)
 })

From 3da2067544afb410b81615d7ca7d4101d1c8cee5 Mon Sep 17 00:00:00 2001
From: Juraj Uhlar <juro.uhlar@gmail.com>
Date: Thu, 23 Apr 2026 13:36:05 +0100
Subject: [PATCH 3/3] refactor: fetch scopes.yaml once per sync run

Previously updateSchemaForTag downloaded scopes.yaml on every release
iteration even though the content is identical for the whole run.
Moves the fetch + parse up into updateSchema and threads the parsed
ScopesMap through to each iteration.

Also:
- strip leading slashes from scopesConfigPath in downloadRepoFile so
  a stray leading '/' in the input doesn't produce a 404
- fix 'Whenever' -> 'Whether' in two input descriptions
---
 .github/actions/update-sdk-schema/action.yml  |  2 +-
 .../actions/update-sdk-schema/dist/index.js   | 38 ++++++++++---------
 .github/actions/update-sdk-schema/github.ts   |  3 +-
 .../update-schema-for-tag.ts                  | 27 +++----------
 .../update-sdk-schema/update-schema.ts        | 15 ++++++--
 .../update-server-side-sdk-schema.yml         |  2 +-
 6 files changed, 41 insertions(+), 46 deletions(-)

diff --git a/.github/actions/update-sdk-schema/action.yml b/.github/actions/update-sdk-schema/action.yml
index 6b8e6a9..cb87c29 100644
--- a/.github/actions/update-sdk-schema/action.yml
+++ b/.github/actions/update-sdk-schema/action.yml
@@ -41,7 +41,7 @@ inputs:
     description: 'List of change scopes to allow, comma separated. If left empty, all scopes are allowed.'
     default: ''
   force:
-    description: 'Whenever to force update to given tag, even if it was already updated before'
+    description: 'Whether to force update to given tag, even if it was already updated before'
     default: 'false'
 runs:
   using: 'node24'
diff --git a/.github/actions/update-sdk-schema/dist/index.js b/.github/actions/update-sdk-schema/dist/index.js
index c8cd317..45b159d 100644
--- a/.github/actions/update-sdk-schema/dist/index.js
+++ b/.github/actions/update-sdk-schema/dist/index.js
@@ -49165,7 +49165,8 @@ async function downloadAsset(url) {
     }
 }
 async function downloadRepoFile({ owner, repo, path, ref }) {
-    const url = `https://raw.githubusercontent.com/${owner}/${repo}/${ref}/${path}`;
+    const normalizedPath = path.replace(/^\/+/, '');
+    const url = `https://raw.githubusercontent.com/${owner}/${repo}/${ref}/${normalizedPath}`;
     return downloadAsset(url);
 }
 async function getRelease({ config, tag, octokit }) {
@@ -53144,12 +53145,6 @@ function walkJson(json, key, callback) {
     });
 }
 
-;// CONCATENATED MODULE: ./.github/actions/update-sdk-schema/scopes.ts
-
-function loadScopes(scopesYaml) {
-    return load(scopesYaml);
-}
-
 ;// CONCATENATED MODULE: ./.github/actions/update-sdk-schema/update-schema-for-tag.ts
 
 
@@ -53159,8 +53154,7 @@ function loadScopes(scopesYaml) {
 
 
 
-
-async function updateSchemaForTag(tag, octokit, packageName, { schemaSource, schemaPath, examplesPath, repo, owner, allowedScopes, generateCommand, scopesOwner, scopesRepo, scopesConfigPath, scopesRef, }, cwd = process.cwd()) {
+async function updateSchemaForTag(tag, octokit, packageName, scopes, { schemaSource, schemaPath, examplesPath, repo, owner, allowedScopes, generateCommand }, cwd = process.cwd()) {
     examplesPath = external_path_.join(cwd, examplesPath);
     schemaPath = external_path_.join(cwd, schemaPath);
     console.info('Updating schema for tag:', tag);
@@ -53184,13 +53178,7 @@ async function updateSchemaForTag(tag, octokit, packageName, { schemaSource, sch
         return;
     }
     const schema = await downloadAsset(schemaAsset.browser_download_url);
-    const scopes = await downloadRepoFile({
-        owner: scopesOwner,
-        repo: scopesRepo,
-        path: scopesConfigPath,
-        ref: scopesRef,
-    });
-    const filteredSchema = filterSchema(schema.toString(), loadScopes(scopes.toString()), allowedScopes);
+    const filteredSchema = filterSchema(schema.toString(), scopes, allowedScopes);
     console.info(`Writing schema (${tag}):\n`, filteredSchema);
     external_fs_.writeFileSync(schemaPath, filteredSchema);
     console.info('Schema written in', schemaPath);
@@ -53254,6 +53242,12 @@ function writeSchemaVersion(version, cwd) {
     external_fs_.writeFileSync(external_path_.join(cwd, SCHEMA_VERSION_FILE), version);
 }
 
+;// CONCATENATED MODULE: ./.github/actions/update-sdk-schema/scopes.ts
+
+function loadScopes(scopesYaml) {
+    return load(scopesYaml);
+}
+
 ;// CONCATENATED MODULE: ./.github/actions/update-sdk-schema/update-schema.ts
 
 
@@ -53264,25 +53258,33 @@ function writeSchemaVersion(version, cwd) {
 
 
 
+
 async function updateSchema({ config, tag, packageName, preReleaseTag = 'test', cwd }) {
     if (config.preRelease) {
         startPreRelease(preReleaseTag);
     }
     const octokit = (0,github.getOctokit)(config.githubToken);
+    const scopesBuffer = await downloadRepoFile({
+        owner: config.scopesOwner,
+        repo: config.scopesRepo,
+        path: config.scopesConfigPath,
+        ref: config.scopesRef,
+    });
+    const scopes = loadScopes(scopesBuffer.toString());
     if (config.force) {
         const release = await getRelease({
             config,
             tag,
             octokit,
         });
-        await updateSchemaForTag(release.tag_name, octokit, packageName, config, cwd);
+        await updateSchemaForTag(release.tag_name, octokit, packageName, scopes, config, cwd);
     }
     else {
         // v1.0.0 is the first OpenAPI release that was created
         const schemaVersion = getLatestSchemaVersion() ?? 'v1.0.0';
         const releases = await listReleasesBetween({ octokit, config, fromTag: schemaVersion, toTag: tag });
         for (const release of releases) {
-            await updateSchemaForTag(release.tag_name, octokit, packageName, config, cwd);
+            await updateSchemaForTag(release.tag_name, octokit, packageName, scopes, config, cwd);
         }
     }
     writeSchemaVersion(tag, cwd);
diff --git a/.github/actions/update-sdk-schema/github.ts b/.github/actions/update-sdk-schema/github.ts
index 106d152..c3748df 100644
--- a/.github/actions/update-sdk-schema/github.ts
+++ b/.github/actions/update-sdk-schema/github.ts
@@ -49,7 +49,8 @@ interface DownloadRepoFileParams {
 }
 
 export async function downloadRepoFile({ owner, repo, path, ref }: DownloadRepoFileParams) {
-  const url = `https://raw.githubusercontent.com/${owner}/${repo}/${ref}/${path}`
+  const normalizedPath = path.replace(/^\/+/, '')
+  const url = `https://raw.githubusercontent.com/${owner}/${repo}/${ref}/${normalizedPath}`
 
   return downloadAsset(url)
 }
diff --git a/.github/actions/update-sdk-schema/update-schema-for-tag.ts b/.github/actions/update-sdk-schema/update-schema-for-tag.ts
index 2080c1a..ee3b92b 100644
--- a/.github/actions/update-sdk-schema/update-schema-for-tag.ts
+++ b/.github/actions/update-sdk-schema/update-schema-for-tag.ts
@@ -1,31 +1,20 @@
 import { Config } from './config'
-import { downloadAsset, downloadRepoFile, findAsset, getReleaseNotes, GitHubClient } from './github'
+import { downloadAsset, findAsset, getReleaseNotes, GitHubClient } from './github'
 import { CHANGESETS_PATH, EXAMPLE_PATH_TO_REPLACE, EXAMPLES_FILE, RELEASE_NOTES } from './const'
 import * as fs from 'fs'
 import * as unzipper from 'unzipper'
 import * as path from 'path'
 import * as cp from 'child_process'
 import { filterSchema } from './filter-schema'
-import { loadScopes } from './scopes'
+import { ScopesMap } from './scopes'
 import { withRetry } from './retry'
 
 export async function updateSchemaForTag(
   tag: string,
   octokit: GitHubClient,
   packageName: string,
-  {
-    schemaSource,
-    schemaPath,
-    examplesPath,
-    repo,
-    owner,
-    allowedScopes,
-    generateCommand,
-    scopesOwner,
-    scopesRepo,
-    scopesConfigPath,
-    scopesRef,
-  }: Config,
+  scopes: ScopesMap,
+  { schemaSource, schemaPath, examplesPath, repo, owner, allowedScopes, generateCommand }: Config,
   cwd = process.cwd()
 ) {
   examplesPath = path.join(cwd, examplesPath)
@@ -59,13 +48,7 @@ export async function updateSchemaForTag(
   }
 
   const schema = await downloadAsset(schemaAsset.browser_download_url)
-  const scopes = await downloadRepoFile({
-    owner: scopesOwner,
-    repo: scopesRepo,
-    path: scopesConfigPath,
-    ref: scopesRef,
-  })
-  const filteredSchema = filterSchema(schema.toString(), loadScopes(scopes.toString()), allowedScopes)
+  const filteredSchema = filterSchema(schema.toString(), scopes, allowedScopes)
   console.info(`Writing schema (${tag}):\n`, filteredSchema)
   fs.writeFileSync(schemaPath, filteredSchema)
   console.info('Schema written in', schemaPath)
diff --git a/.github/actions/update-sdk-schema/update-schema.ts b/.github/actions/update-sdk-schema/update-schema.ts
index 5271a25..9e2830c 100644
--- a/.github/actions/update-sdk-schema/update-schema.ts
+++ b/.github/actions/update-sdk-schema/update-schema.ts
@@ -6,7 +6,8 @@ import { startPreRelease } from './changesets'
 import { Config, getConfig } from './config'
 import { updateSchemaForTag } from './update-schema-for-tag'
 import { getLatestSchemaVersion, writeSchemaVersion } from './schema-version'
-import { getRelease, listReleasesBetween } from './github'
+import { downloadRepoFile, getRelease, listReleasesBetween } from './github'
+import { loadScopes } from './scopes'
 
 interface UpdateSchemaParams {
   config: Config
@@ -23,6 +24,14 @@ export async function updateSchema({ config, tag, packageName, preReleaseTag = '
 
   const octokit = getOctokit(config.githubToken)
 
+  const scopesBuffer = await downloadRepoFile({
+    owner: config.scopesOwner,
+    repo: config.scopesRepo,
+    path: config.scopesConfigPath,
+    ref: config.scopesRef,
+  })
+  const scopes = loadScopes(scopesBuffer.toString())
+
   if (config.force) {
     const release = await getRelease({
       config,
@@ -30,14 +39,14 @@ export async function updateSchema({ config, tag, packageName, preReleaseTag = '
       octokit,
     })
 
-    await updateSchemaForTag(release.tag_name, octokit, packageName, config, cwd)
+    await updateSchemaForTag(release.tag_name, octokit, packageName, scopes, config, cwd)
   } else {
     // v1.0.0 is the first OpenAPI release that was created
     const schemaVersion = getLatestSchemaVersion() ?? 'v1.0.0'
     const releases = await listReleasesBetween({ octokit, config, fromTag: schemaVersion, toTag: tag })
 
     for (const release of releases) {
-      await updateSchemaForTag(release.tag_name, octokit, packageName, config, cwd)
+      await updateSchemaForTag(release.tag_name, octokit, packageName, scopes, config, cwd)
     }
   }
 
diff --git a/.github/workflows/update-server-side-sdk-schema.yml b/.github/workflows/update-server-side-sdk-schema.yml
index 79ea114..719507f 100644
--- a/.github/workflows/update-server-side-sdk-schema.yml
+++ b/.github/workflows/update-server-side-sdk-schema.yml
@@ -84,7 +84,7 @@ on:
         type: string
         default: 'main'
       force:
-        description: 'Whenever to force update to given tag, even if it was already updated before'
+        description: 'Whether to force update to given tag, even if it was already updated before'
         default: false
         type: boolean
         required: false