From c7b2e5e31b460e930b9f996329164d123254bbdd Mon Sep 17 00:00:00 2001 From: Claudio Wunder Date: Sun, 25 Oct 2026 17:41:25 +0100 Subject: [PATCH] setup-environment: allow skipping the dependency cache Add a `cache` input (default `true`, so nothing changes for existing callers). Release jobs can pass `cache: false` so they never restore a pnpm/npm store that another workflow could have poisoned, which zizmor flags as `cache-poisoning` in publishing workflows. `false` also turns off setup-node's automatic `package-manager-cache`. Assisted-by: Claude Opus 5.5 --- actions/setup-environment/action.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/actions/setup-environment/action.yml b/actions/setup-environment/action.yml index bf86360..cc5fc78 100644 --- a/actions/setup-environment/action.yml +++ b/actions/setup-environment/action.yml @@ -33,6 +33,10 @@ inputs: description: "The token to use for checkout" required: false default: ${{ github.token }} + cache: + description: "Whether to restore and save the package manager cache. Set to false in jobs that publish or hold secrets, so a poisoned cache can't reach them" + required: false + default: "true" runs: using: "composite" @@ -60,7 +64,8 @@ runs: with: node-version-file: ".nvmrc" registry-url: ${{ inputs.registry-url }} - cache: ${{ inputs.pnpm == 'true' && 'pnpm' || 'npm' }} + cache: ${{ inputs.cache == 'true' && (inputs.pnpm == 'true' && 'pnpm' || 'npm') || '' }} + package-manager-cache: ${{ inputs.cache == 'true' }} - name: Setup Node.js (with specified version) if: inputs.use-version-file != 'true' @@ -68,7 +73,8 @@ runs: with: node-version: ${{ inputs.node-version }} registry-url: ${{ inputs.registry-url }} - cache: ${{ inputs.pnpm == 'true' && 'pnpm' || 'npm' }} + cache: ${{ inputs.cache == 'true' && (inputs.pnpm == 'true' && 'pnpm' || 'npm') || '' }} + package-manager-cache: ${{ inputs.cache == 'true' }} - name: Install dependencies with pnpm if: inputs.pnpm == 'true'