From 8383590266e3f919d8cb544c489028305f0f68be Mon Sep 17 00:00:00 2001 From: luvs01 <27862058+luvs01@users.noreply.github.com> Date: Tue, 13 Oct 2026 10:39:46 +0900 Subject: [PATCH] fix(ci): skip the bun executable cache when a run checks out another ref MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A scheduled ci.yml run resolves needs.changes.outputs.checkout_ref to a dev commit while the run carries the default branch's Actions-cache scope. setup-bun saves the installed executable into that cache in its post step, so code executed from the checked-out ref could write a default-branch cache entry that privileged consumers (release.yml, including the OIDC provenance job) restore later — the actions/cache-poisoning/poisonable-step chain. Every other trigger checks out the run's own ref, where the cache stays branch-scoped, so the cache is only disabled on schedule. Addresses code-scanning alerts #243 and #244. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- .github/actions/setup-project-bun/action.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/actions/setup-project-bun/action.yml b/.github/actions/setup-project-bun/action.yml index 1ab22dd1dc..de1bd34385 100644 --- a/.github/actions/setup-project-bun/action.yml +++ b/.github/actions/setup-project-bun/action.yml @@ -54,3 +54,11 @@ runs: uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 with: bun-version: ${{ steps.resolve.outputs.version }} + # ci.yml resolves needs.changes.outputs.checkout_ref to a dev commit on + # schedule, so a scheduled job runs a different ref's code under the + # default branch's Actions-cache scope. setup-bun saves the installed + # executable into that cache in its post step; letting the checked-out + # code influence a default-branch cache entry is the + # actions/cache-poisoning/poisonable-step chain. Every other trigger + # checks out the run's own ref, where the cache is branch-scoped. + no-cache: ${{ github.event_name == 'schedule' }}