Disable caching in release workflow

[horgh]

zizmor reports cache-poisoning findings for release.yml (it has a release: published trigger and publishes to npm): a poisoned cache entry restored during a release run could taint the published package. This disables mise's cache and setup-node's package-manager cache in that workflow.

This also closes the open zizmor code-scanning alerts on release.yml, which fail the code-scanning check on any PR touching those lines (as happened on the Dependabot mise-action bump in #58).

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated CI/CD workflow configuration to optimize build processes.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

📝 Walkthrough

Walkthrough

The release workflow disables caching in the build and publish jobs. The build job disables mise caching, while the publish job disables both mise caching and Node package manager caching to ensure fresh tool and dependency resolution during release builds.

Changes

CI Cache Disabling in Release Workflow

Layer / File(s)	Summary
Disable caching in build and publish jobs .github/workflows/release.yml	The build job's jdx/mise-action step and publish job's jdx/mise-action step both set cache: false. The publish job's actions/setup-node step additionally sets package-manager-cache: false.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐰 With caching disabled now, so neat,
Each build starts fresh from the ground beneath,
No stale tools or packages in sight,
The release workflow runs pure and right!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The pull request title 'Disable caching in release workflow' directly and clearly summarizes the main change: disabling caching mechanisms in the release workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch wstorey/fix-zizmor

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/release.yml:
- Around line 22-23: The build job currently forces cache: false under the
"with" block which disables caching for all workflow events; update the workflow
so the build job does not unconditionally disable cache — either remove the
cache: false key from the build job's "with" block or make it conditional based
on the GitHub event (e.g., only disable cache for release events) so that normal
pull_request/push runs keep caching while release runs can opt out; target the
"build" job configuration and the "with: cache" setting in
.github/workflows/release.yml when making this change.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 114ff123-10d8-48fd-8143-41c9e47492ec

📥 Commits

Reviewing files that changed from the base of the PR and between 2b1b262 and fd834e5.

📒 Files selected for processing (1)

• .github/workflows/release.yml