📄 config-poetry/action.yml:47-61 📄 config-poetry/action.yml:117-131
In config-poetry/action.yml, the mise.local.toml file and the MISE_BACKUP temp dir are created by the "Set local action paths" step (lines 47-77), which has NO working-directory, so they live in the GitHub workspace root. But the "Configure Poetry authentication" step (line 120) sets working-directory: ${{ inputs.working-directory }} and then runs the restore logic:

rm mise.local.toml
mv "$MISE_BACKUP"/* ... ./ ...

When working-directory is not ., this runs inside the subdirectory:

• rm mise.local.toml fails because the file is in the workspace root, not the subdir. GitHub Actions runs bash steps with -e, so the step fails and breaks the build.
• Even if it didn't fail, the user's original mise files would be restored into the subdirectory (./) instead of the workspace root, leaving the root in an inconsistent state with config-poetry's mise.local.toml never removed.

Note this diverges from config-npm/action.yml, whose "Configure NPM authentication" step (line 101-114) does the same backup/restore but does NOT set working-directory, keeping creation and restore in the same (root) directory. build-poetry exposes a working-directory input and passes it through, so any consumer using a non-root working directory will hit this regression (previously build-poetry never rm'd the file).

Fix: keep working-directory only for the poetry_config.sh invocation (which needs the project dir) and perform the mise restore relative to the workspace root, or split the restore into a separate step without working-directory (matching config-npm).

📄 config-poetry/action.yml:72-77 📄 config-poetry/action.yml:117-131
In config-poetry/action.yml, the "Set local action paths" step moves the user's real mise files into a temp backup and substitutes config-poetry's mise.local.toml. The restore happens inside the "Configure Poetry authentication" step, which is NOT marked always() and only runs after several intermediate steps (get-build-number, cache, mise-action, vault). If any of those steps fails, the restore never runs: the user's mise files remain stranded in the temp directory and config-poetry's mise.local.toml is left in place. For standalone config-poetry usage, this leaves the checkout in an inconsistent state for any downstream steps. Consider performing the restore in a dedicated if: always() step (see the suggested fix for the working-directory finding, which also addresses this).

📄 config-poetry/action.yml:18-21 📄 build-poetry/action.yml:119
config-poetry/action.yml declares and documents the poetry-virtualenvs-path input (lines 18-21, and in README), and build-poetry/action.yml passes it to the action (line 119), but the value is never referenced in any of the config-poetry steps. Unlike build-poetry, which sets POETRY_VIRTUALENVS_PATH as an env var for build.sh, config-poetry neither exports it to $GITHUB_ENV nor uses it for the cache path.

Impact: when config-poetry is used standalone (the new supported use case), a caller who sets poetry-virtualenvs-path will have it silently ignored; Poetry will use its default virtualenv location, which may fall outside the cached poetry-cache-dir, so virtualenvs won't be cached/restored as the docs imply.

Suggested fix: either export POETRY_VIRTUALENVS_PATH to $GITHUB_ENV in config-poetry so downstream poetry install honors it (consistent with the input's documented purpose), or remove the unused input and the corresponding README/build-poetry wiring to avoid implying behavior that doesn't exist.

📄 config-poetry/action.yml:96-110
The new sanitize_workflow step sanitizes the workflow name for the cache key with workflow_name=${WORKFLOW_NAME// /-}, replacing only spaces. GitHub Actions cache keys cannot contain commas (and github.workflow falls back to the workflow file path when no name: is set, which can contain / and other characters). A workflow whose name contains a comma would produce an invalid cache key and cause the Cache local Poetry cache step to fail. Consider sanitizing more broadly, e.g. replacing any character outside an allowlist:

workflow_name=$(echo "$WORKFLOW_NAME" | tr -c '[:alnum:]._-' '-')

This is a low-probability edge case (most workflow names are simple), hence minor, but worth hardening since the key now feeds a required cache step.