Add cache-write input for read-only cache mode

[salmanmkc]

Right now if you use cache: pip (or pipenv/poetry) in a PR workflow, the action restores and saves the cache. There's no way to get read-only mode where you benefit from existing caches without writing back. This matters for cache poisoning — an untrusted PR could plant bad packages in the cache that later get picked up by pushes to main.

This adds a cache-write input (defaults to true, no breaking change). Set it to false to skip the post-step save.

Usage:

- uses: actions/setup-python@v6with:
python-version: "3.12"cache: pipcache-write: ${{ github.event_name != 'pull_request' }}

What changed:

• action.yml — new cache-write input
• src/cache-save.ts — early return when cache-write is false
• dist/ — rebuilt

Same change going into setup-node, setup-go, setup-java, setup-dotnet.

[Copilot]

Pull request overview

Adds a new action input to support “read-only” cache usage by allowing workflows to restore caches without writing updated caches back, helping mitigate cache poisoning risks for untrusted PRs.

Changes:

• Introduces a new cache-write input (defaulting to enabled) in action.yml.
• Skips the post-step cache save when cache-write is set to false.
• Rebuilds the compiled dist/ output to include the new behavior.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

File	Description
action.yml	Adds the new cache-write input and documents its purpose.
src/cache-save.ts	Implements early return to skip saving cache when cache-write is disabled.
dist/cache-save/index.js	Compiled output reflecting the new cache-write behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[Copilot]

cache-write is treated as a raw string and only disables saving when the value is exactly 'false'. This is inconsistent with other boolean inputs in this repo (e.g., check-latest uses core.getBooleanInput) and will silently save the cache for values like False/FALSE. Prefer core.getBooleanInput('cache-write') (or normalize/lowercase) and branch on the boolean result.

Suggested change

	constcacheWriteEnabled=core.getInput('cache-write');
	if(cacheWriteEnabled==='false'){
	constcacheWriteInput=core.getInput('cache-write');
	constcacheWriteEnabled=
	cacheWriteInput===''
	? true
	: core.getBooleanInput('cache-write');
	if(!cacheWriteEnabled){

[Copilot]

New cache-write behavior is not covered by tests. Add a unit test in __tests__/cache-save.test.ts that sets cache-write to false and asserts cache.saveCache is not called (and optionally that the skip message is logged) when cache is enabled.

[brunoborges]

After reviewing the current GitHub Actions cache security model, I recommend closing this PR as unnecessary for the stated cache-poisoning threat.

• pull_request caches are scoped to refs/pull/.../merge and cannot be restored by the base branch or other pull requests.
• Low-trust events resolving to the default branch receive read-only cache access from the backend.
• Current @actions/cache releases honor backend cache modes and handle denied writes non-fatally.

The suggested cache-write: ${{ github.event_name != 'pull_request' }} pattern disables useful PR-local caching without adding protection for the default branch, and it remains true for pull_request_target, where backend enforcement is what provides protection.

Explicit restore-only behavior may still be useful ergonomically, but GitHub already recommends composing actions/cache/restore for that case rather than adding a security-specific setup-action input.

References:

• https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching#restrictions-for-accessing-a-cache
• https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching#cache-access-for-low-trust-workflow-triggers
• https://github.com/actions/toolkit/blob/main/packages/cache/RELEASES.md