actions/setup-uv
2
0
Fork 0
mirror of https://github.com/astral-sh/setup-uv.git synced 2026-09-03 06:09:23 +00:00
Code Activity

Disable automatic caching for sensitive events (#992)

Browse Source 
## Summary

- disable `enable-cache: auto` for `pull_request_target`,
`workflow_run`, and `release` events
- disable automatic caching for tag pushes while leaving branch pushes
unchanged
- preserve explicit `enable-cache: true` as an override
- run a `workflow_run` integration fixture with `act` in pull request CI
and verify caching is disabled
- document the behavior and update the published bundles

## Testing

- `npm run all`
- `actionlint .github/workflows/test.yml
__tests__/workflows/workflow-run.yml`
- `uvx zizmor __tests__/workflows/workflow-run.yml`

Closes #984

Refs: pi-session 019fec42-9b26-714e-a359-830ac4401ecd
This commit is contained in:
Kevin Stillhammer
2026-08-10 18:12:08 +02:00
committed by GitHub
parent b68407c192
commit f45168497b
9 changed files with 181 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/caching.md
+4 -1
View File
@@ -38,7 +38,10 @@ The computed cache key is available as the `cache-key` output:
If you enable caching, the [uv cache](https://docs.astral.sh/uv/concepts/cache/) will be uploaded to
the GitHub Actions cache. This can speed up runs that reuse the cache by several minutes.
Caching is enabled by default on GitHub-hosted runners.
With the default `enable-cache: auto`, caching is enabled on GitHub-hosted runners except for
`release`, tag push, `pull_request_target`, and `workflow_run` events. Caching is disabled for these
events to prevent insecure or release-sensitive jobs from restoring potentially poisoned caches.
Set `enable-cache: true` to explicitly enable caching for any event.
> [!TIP]
>