github.action_repository/ref inside a composite action resolve to the current step's action (actions/checkout), not the parent composite action. Use github.action_path which points to the already-downloaded action source.