[bavulapati]

Replaces #112, which closed itself when its base branch was deleted on merging #111. Same commit, rebased onto main - I should have retargeted it before merging, not after.

setup-node v6 turns on package-manager caching by default, so the release build restored a cache that jobs on other refs can populate. In a workflow that publishes, that is a path from a poisoned cache into what we ship, which is why zizmor reports it here and not in integrate.yml.

package-manager-cache: false on the four setup-node steps in publish.yml is the documented way off. It costs a clean install per job, on a workflow that runs once per release.

Last of the findings behind #109: with this, zizmor reports nothing on the version CI pins.

[kasperisager]

We should actually use our shared holepunchto/actions/setup-node action and apply the cache option there.

[bavulapati]

Closing in favour of holepunchto/actions#107, which turns the cache off in the shared 'setup-node' action instead.

Two things changed since this was opened. #114 moved these four steps onto 'holepunchto/actions/setup-node', so the raw 'actions/setup-node' calls this patches are gone and it no longer applies. And #114 on its own only hid the finding - zizmor cannot see inside a composite action, so Security went green while the release build still restored the cache.

#107 fixes the behaviour at the layer that owns it, defaulted off, so this workflow needs no opt-out of its own and no other publish workflow inherits the gap.