GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Add cache-write input for read-only cache mode by salmanmkc · Pull Request #1284 · actions/setup-python

Conversation

@salmanmkc

@salmanmkc salmanmkc commented Mar 9, 2026

Copy link
Copy Markdown
Contributor

Right now if you use cache: pip (or pipenv/poetry) in a PR workflow, the action restores and saves the cache. There's no way to get read-only mode where you benefit from existing caches without writing back. This matters for cache poisoning — an untrusted PR could plant bad packages in the cache that later get picked up by pushes to main.

This adds a cache-write input (defaults to true, no breaking change). Set it to false to skip the post-step save.

Usage:

- uses: actions/setup-python@v6
  with:
    python-version: "3.12"
    cache: pip
    cache-write: ${{ github.event_name != 'pull_request' }}

What changed:

  • action.yml — new cache-write input
  • src/cache-save.ts — early return when cache-write is false
  • dist/ — rebuilt

Same change going into setup-node, setup-go, setup-java, setup-dotnet.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
hugovk reacted with thumbs up emoji
All reactions
  • 👍 1 reaction
@salmanmkc
feat: add cache-write input for read-only cache mode
8a88e9f 
Add a 'cache-write' input (default: true) that controls whether the cache
is saved at the end of the workflow. When set to 'false', the action will
restore cached dependencies but skip saving, providing a read-only cache
mode.

This is useful for preventing cache poisoning attacks from untrusted PR
builds while still benefiting from cached dependencies.
@salmanmkc
salmanmkc requested a review from a team as a code owner March 9, 2026 12:50
Copilot AI review requested due to automatic review settings March 9, 2026 12:50
Copilot started reviewing on behalf of salmanmkc March 9, 2026 12:51
View session
Copilot AI reviewed Mar 9, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds a new action input to support “read-only” cache usage by allowing workflows to restore caches without writing updated caches back, helping mitigate cache poisoning risks for untrusted PRs.

Changes:

  • Introduces a new cache-write input (defaulting to enabled) in action.yml.
  • Skips the post-step cache save when cache-write is set to false.
  • Rebuilds the compiled dist/ output to include the new behavior.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

File Description
action.yml Adds the new cache-write input and documents its purpose.
src/cache-save.ts Implements early return to skip saving cache when cache-write is disabled.
dist/cache-save/index.js Compiled output reflecting the new cache-write behavior.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Comment thread src/cache-save.ts
Comment on lines +12 to +13
const cacheWriteEnabled = core.getInput('cache-write');
if (cacheWriteEnabled === 'false') {

Copilot AI Mar 9, 2026

Copy link

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cache-write is treated as a raw string and only disables saving when the value is exactly 'false'. This is inconsistent with other boolean inputs in this repo (e.g., check-latest uses core.getBooleanInput) and will silently save the cache for values like False/FALSE. Prefer core.getBooleanInput('cache-write') (or normalize/lowercase) and branch on the boolean result.

Suggested change
const cacheWriteEnabled = core.getInput('cache-write');
if (cacheWriteEnabled === 'false') {
const cacheWriteInput = core.getInput('cache-write');
const cacheWriteEnabled =
cacheWriteInput === ''
? true
: core.getBooleanInput('cache-write');
if (!cacheWriteEnabled) {

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Copilot uses AI. Check for mistakes.
Comment thread src/cache-save.ts
Comment on lines +12 to 20
const cacheWriteEnabled = core.getInput('cache-write');
if (cacheWriteEnabled === 'false') {
core.info('Cache write is disabled (read-only mode). Skipping cache save.');
return;
}

const cache = core.getInput('cache');
if (cache) {
await saveCache(cache);

Copilot AI Mar 9, 2026

Copy link

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

New cache-write behavior is not covered by tests. Add a unit test in __tests__/cache-save.test.ts that sets cache-write to false and asserts cache.saveCache is not called (and optionally that the skip message is logged) when cache is enabled.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Copilot uses AI. Check for mistakes.
@salmanmkc
style: run prettier on cache-save.ts
b528417
@dsyme dsyme mentioned this pull request Mar 22, 2026
Tracking issue: all GitHub action scripts that use package caches should support read-only mode for the caches. actions/github-script#705
Open
@coderabbitai coderabbitai Bot mentioned this pull request Jul 10, 2026
ci: two-stage trusted-publishing release workflow thad0ctor/Gefen-X#61
Merged
@brunoborges

brunoborges commented Jul 16, 2026

Copy link
Copy Markdown

After reviewing the current GitHub Actions cache security model, I recommend closing this PR as unnecessary for the stated cache-poisoning threat.

  • pull_request caches are scoped to refs/pull/.../merge and cannot be restored by the base branch or other pull requests.
  • Low-trust events resolving to the default branch receive read-only cache access from the backend.
  • Current @actions/cache releases honor backend cache modes and handle denied writes non-fatally.

The suggested cache-write: ${{ github.event_name != 'pull_request' }} pattern disables useful PR-local caching without adding protection for the default branch, and it remains true for pull_request_target, where backend enforcement is what provides protection.

Explicit restore-only behavior may still be useful ergonomically, but GitHub already recommends composing actions/cache/restore for that case rather than adding a security-specific setup-action input.

References:

  • https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching#restrictions-for-accessing-a-cache
  • https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching#cache-access-for-low-trust-workflow-triggers
  • https://github.com/actions/toolkit/blob/main/packages/cache/RELEASES.md
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
This was referenced Jul 24, 2026
Save/Restore seperately in MacOS/Windows caching workflows. meshtastic/firmware#11199
Merged
Productize neural-mesh as a Samsarix release candidate Deathcharge/neural-mesh#2
Merged

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

At least 1 approving review is required to merge this pull request.

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@salmanmkc @brunoborges
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.