Control GitHub Actions cache access with cache-mode
Least-privilege cache access for GitHub Actions workflows and jobs, using read, write, write-only or none modes, is now generally available.
GitHub Actions now has a cache-mode setting that controls how much cache access a workflow or job gets, aimed at preventing cache poisoning. It can be set at the workflow level or overridden per job, and is enforced by the cache service itself rather than left to convention.
- read: restores caches but cannot save them. This is the default for low-trust triggers like pull_request_target.
- write: restores and saves caches. This is the default for trusted triggers like push.
- write-only: saves caches but cannot restore them.
- none: blocks all cache access.
The setting carries through reusable workflows, so a called workflow can't get more cache access than its caller granted. Declaring cache-mode explicitly also overrides the read-only default on low-trust triggers, and GitHub Actions adds a warning annotation if that declared mode grants write access on one of those triggers. Workflows that don't set cache-mode keep the existing defaults. The feature is generally available on GitHub for all plans.
