From fd834e5e74088ee0241813c99412024f1b69e27d Mon Sep 17 00:00:00 2001 From: William Storey Date: Thu, 11 Jun 2026 16:13:45 +0000 Subject: [PATCH] Disable caching in release workflow zizmor flags cache-poisoning in workflows that publish artifacts: a poisoned cache entry restored during a release run could taint the published package. Disable mise's cache and setup-node's package manager cache in release.yml. Co-Authored-By: Claude Fable 5 --- .github/workflows/release.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 42fc563..1c4fbfe 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,6 +19,8 @@ jobs: with: persist-credentials: false - uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4.1.0 + with: + cache: false - run: pnpm install --frozen-lockfile - run: pnpm test - run: pnpm run lint @@ -37,9 +39,12 @@ jobs: with: persist-credentials: false - uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4.1.0 + with: + cache: false - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: registry-url: 'https://registry.npmjs.org' + package-manager-cache: false - run: pnpm install --frozen-lockfile - run: pnpm run build - run: pnpm publish --provenance --no-git-checks