Files
electron/.github
claude[bot]andClaude f6bcc1932f ci: set cache-mode: read on release and publish segment jobs (#53823)
The workflow_dispatch/schedule release, publish and PGO pipelines default
to cache-mode: write, but the build / publish / test / clang-tidy /
gn-check / pgo-collect segment jobs they call only ever restore caches
(yarn via install-dependencies and setup-node, the per-run SAS token via
restore-cache-azcopy). Cap those callers at cache-mode: read so a compromised
release job cannot poison the default-branch Actions caches.

Checkout jobs (save the SAS-token cache) and build-siso jobs (save the siso
binary cache) are left at the default and keep write access. Nothing is
set at workflow level.


Claude-Session: https://claude.ai/code/session_01MYe3WCXtgiqomNuVQdi4Yd

Co-authored-by: Claude <noreply@anthropic.com>
2026-09-14 19:36:04 -07:00
..