mirror of
https://github.com/electron/electron.git
synced 2026-10-28 11:44:46 +08:00
The workflow_dispatch/schedule release, publish and PGO pipelines default to cache-mode: write, but the build / publish / test / clang-tidy / gn-check / pgo-collect segment jobs they call only ever restore caches (yarn via install-dependencies and setup-node, the per-run SAS token via restore-cache-azcopy). Cap those callers at cache-mode: read so a compromised release job cannot poison the default-branch Actions caches. Checkout jobs (save the SAS-token cache) and build-siso jobs (save the siso binary cache) are left at the default and keep write access. Nothing is set at workflow level. Claude-Session: https://claude.ai/code/session_01MYe3WCXtgiqomNuVQdi4Yd Co-authored-by: Claude <noreply@anthropic.com>