Add cache-write input for read-only cache mode

action.yml

@@ -20,6 +20,9 @@ inputs:
  default: ${{ github.server_url == 'https://github.com' && github.token || '' }}
  cache-dependency-path:
  description: "Used to specify the path to dependency files. Supports wildcards or a list of file names for caching multiple dependencies."
+ cache-write:
+ description: "Whether to save the cache at the end of the workflow. Set to false for cache read-only mode, useful for preventing cache poisoning from untrusted PR builds."
+ default: true
  update-environment:
  description: "Set this option if you want the action to update environment variables."
  default: true

dist/cache-save/index.js

@@ -44170,6 +44170,11 @@ const cache_distributor_1 = __nccwpck_require__(92326);
 // https://github.com/actions/cache/pull/1217
 async function run(earlyExit) {
  try {
+ const cacheWriteEnabled = core.getInput('cache-write');
+ if (cacheWriteEnabled === 'false') {
+ core.info('Cache write is disabled (read-only mode). Skipping cache save.');
+ return;
+ }
  const cache = core.getInput('cache');
  if (cache) {
  await saveCache(cache);

src/cache-save.ts

@@ -9,6 +9,14 @@ import {State} from './cache-distributions/cache-distributor';
 // https://github.com/actions/cache/pull/1217
 export async function run(earlyExit?: boolean) {
  try {
+ const cacheWriteEnabled = core.getInput('cache-write');
+ if (cacheWriteEnabled === 'false') {
+ core.info(
+ 'Cache write is disabled (read-only mode). Skipping cache save.'
+ );
+ return;
+ }
+
  const cache = core.getInput('cache');
  if (cache) {
  await saveCache(cache);