Merge db56306c3a into 53b83947a5

action.yml

@@ -25,6 +25,9 @@ inputs:
     default: true
   cache-dependency-path:
     description: 'Used to specify the path to a dependency file: package-lock.json, yarn.lock, etc. Supports wildcards or a list of file names for caching multiple dependencies.'
+  cache-write:
+    description: 'Whether to save the cache at the end of the workflow. Set to false for cache read-only mode, useful for preventing cache poisoning from untrusted PR builds.'
+    default: true
   mirror:
     description: 'Used to specify an alternative mirror to download Node.js binaries from'
   mirror-token:

dist/cache-save/index.js

@@ -71532,6 +71532,11 @@ process.on('uncaughtException', e => {
 // Added early exit to resolve issue with slow post action step:
 async function run(earlyExit) {
     try {
+        const cacheWriteEnabled = core.getInput('cache-write');
+        if (cacheWriteEnabled === 'false') {
+            core.info('Cache write is disabled (read-only mode). Skipping cache save.');
+            return;
+        }
         const cacheLock = core.getState(constants_1.State.CachePackageManager);
         if (cacheLock) {
             await cachePackages(cacheLock);

src/cache-save.ts

@@ -16,6 +16,14 @@ process.on('uncaughtException', e => {
 // Added early exit to resolve issue with slow post action step:
 export async function run(earlyExit?: boolean) {
   try {
+    const cacheWriteEnabled = core.getInput('cache-write');
+    if (cacheWriteEnabled === 'false') {
+      core.info(
+        'Cache write is disabled (read-only mode). Skipping cache save.'
+      );
+      return;
+    }
+
     const cacheLock = core.getState(State.CachePackageManager);
 
     if (cacheLock) {