Repository navigation
Leave the package manager cache off unless a caller asks for it - #107
Merged
Merged
Conversation
Contributor
Author
|
@kasperisager FYI |
bavulapati
force-pushed
the
setup-node-cache
branch
from
August 31, 2026 11:51
31cab13 to
d3a93ba
Compare
bavulapati
changed the title
kasperisager
approved these changes
Oct 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
actions/setup-nodecaches the package manager's global directory by default. In a workflow that publishes, that means the release build restores a cache other refs can write, which zizmor reports as a cache poisoning path into what we ship.The version we already pin takes
package-manager-cache, so this passes it through, defaulted off. Callers that want the cache ask for it.Off is the right default here. Publishing is where the cache is dangerous, and it is the case a caller is least likely to think about. It also costs little: these packages do not commit a lockfile and do not set
packageManagerinpackage.json, which is what turns the automatic caching on, so for most repos this changes nothing but the declared intent.Fixes the findings behind holepunchto/bare-kit#109 at the layer that owns them, so no publish workflow has to repeat the opt-out. holepunchto/bare-kit#113 closes in favour of this.