From b15aec80d70c3eaa94dfb1043b2c15b357c0c329 Mon Sep 17 00:00:00 2001
From: Luisina Santos <luisina.santos@conductorone.com>
Date: Thu, 27 Aug 2026 11:23:20 -0300
Subject: [PATCH 1/2] ci: install baton via get-baton action instead of
 conductorone/baton releases

The standalone conductorone/baton CLI (last release built against
baton-sdk v0.8.24) can't read c1z files written by this connector's
newer, pebble-store-backed SDK version, so `baton grants`/`baton
entitlements` fail with "c1z: invalid file" and mask the real sync
assertions behind bogus "no grant" errors. Use
ConductorOne/github-workflows/actions/get-baton@v4, which installs the
baton binary built from conductorone/baton-sdk releases and stays in
step with the SDK version baton-ipa depends on.
---
 .github/workflows/ci.yaml | 23 +++++++++++------------
 1 file changed, 11 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 6be943d6..a9cf1019 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -127,17 +127,16 @@ jobs:
       - name: Build baton-ipa
         run: go build ./cmd/baton-ipa
 
-      # scripts/get-baton.sh resolves the release through an unauthenticated API
-      # call, which is rate limited on shared runner IPs. Use the workflow token.
+      # The standalone conductorone/baton CLI trails baton-sdk releases (it was
+      # last built against baton-sdk v0.8.24), so it can't read a c1z file
+      # written by this connector's newer, pebble-store-backed SDK version and
+      # fails with "c1z: invalid file". get-baton installs the baton binary
+      # built from conductorone/baton-sdk instead, which stays in step.
       - name: Install baton
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          gh release download --repo ConductorOne/baton \
-            --pattern 'baton-*-linux-amd64.tar.gz' --output baton.tar.gz --clobber
-          tar xzf baton.tar.gz
-          ./baton --version
+        uses: ConductorOne/github-workflows/actions/get-baton@v4
+
+      - name: Check baton version
+        run: baton --version
 
       # CXP-842 regression guard. Every assertion below is a grant or
       # entitlement the connector can only produce by resolving an LDAP DN from
@@ -159,7 +158,7 @@ jobs:
 
           assert_grant() {
             local entitlement="$1" principal="$2"
-            if ! ./baton grants --file=sync.c1z --entitlement="$entitlement" --output-format=json \
+            if ! baton grants --file=sync.c1z --entitlement="$entitlement" --output-format=json \
               | jq --exit-status --arg p "$principal" \
                 'any(.grants[]?; .principal.id.resource == $p)' >/dev/null; then
               echo "::error::no grant of '$entitlement' to '$principal'"
@@ -170,7 +169,7 @@ jobs:
 
           assert_entitlement() {
             local entitlement="$1"
-            if ! ./baton entitlements --file=sync.c1z --output-format=json \
+            if ! baton entitlements --file=sync.c1z --output-format=json \
               | jq --exit-status --arg id "$entitlement" \
                 'any(.entitlements[]?; .entitlement.id == $id)' >/dev/null; then
               echo "::error::entitlement '$entitlement' was not synced"

From 580e302a2dbc5cc0b9709700d1a7e59cf8a24721 Mon Sep 17 00:00:00 2001
From: Luisina Santos <luisina.santos@conductorone.com>
Date: Thu, 27 Aug 2026 11:25:19 -0300
Subject: [PATCH 2/2] ci: drop explanatory comment on baton install step

---
 .github/workflows/ci.yaml | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index a9cf1019..2bf5e80f 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -127,11 +127,6 @@ jobs:
       - name: Build baton-ipa
         run: go build ./cmd/baton-ipa
 
-      # The standalone conductorone/baton CLI trails baton-sdk releases (it was
-      # last built against baton-sdk v0.8.24), so it can't read a c1z file
-      # written by this connector's newer, pebble-store-backed SDK version and
-      # fails with "c1z: invalid file". get-baton installs the baton binary
-      # built from conductorone/baton-sdk instead, which stays in step.
       - name: Install baton
         uses: ConductorOne/github-workflows/actions/get-baton@v4