Skip to content

feat: adopt @actions/cache 6.2.0 (cache-mode skip + read-denied warning) - #1781

Merged
philip-gai merged 3 commits into
mainfrom
philip-gai/bump-cache-toolkit-6.2.0
Jul 15, 2026
Merged

feat: adopt @actions/cache 6.2.0 (cache-mode skip + read-denied warning)#1781
philip-gai merged 3 commits into
mainfrom
philip-gai/bump-cache-toolkit-6.2.0

Conversation

@philip-gai

Copy link
Copy Markdown
Member

Description

Adopts @actions/cache 6.2.0 and rebuilds the vendored dist/ bundles. The new toolkit version adds two cache-mode security behaviors:

  • ACTIONS_CACHE_MODE skip: when the runner sets ACTIONS_CACHE_MODE, the action skips operations the effective mode does not permit. Restore is skipped for none and write-only; save is skipped for none and read. Each skip emits a single non-fatal info line and returns a cache miss on restore or a no-op on save. It never throws.
  • Read/write denied warnings: when the cache service denies an operation because the token has no readable or writable scopes, the action surfaces a clear warning instead of a generic error, and continues without failing the run.

Motivation and Context

The cache service can restrict what a job's token is allowed to do (read, write, both, or neither). Previously a denied read or write surfaced as an opaque error. These changes make the client honor the mode up front and report policy denials clearly.

Regression safety: when ACTIONS_CACHE_MODE is unset or set to an unrecognized value, behavior is identical to today. The skip logic only triggers on the explicit restrictive values.

Note on activation: the client-side skip depends on the runner exporting ACTIONS_CACHE_MODE, and the denial warnings depend on the cache service returning the corresponding policy responses. Until those roll out, this bump is behavior-preserving.

Toolkit change: actions/toolkit#2447 (published as @actions/cache 6.2.0).

How Has This Been Tested?

  • Full @actions/cache unit suite passing in the toolkit repo (tsc, jest, prettier, eslint clean).
  • End-to-end validation on hosted runners using a test build of this action pinned to the unreleased toolkit code:
    • Env-driven matrix over none, read, write, write-only, unknown, and unset confirmed the expected skip or proceed outcome for both restore and save, with exactly one info line per skip and no failures.
    • With cache-mode enforcement enabled server-side, restore under a read-denied token returned the read-denied policy response and the action degraded to a warning plus cache miss; save under a write-denied token returned the write-denied policy response and degraded to a warning. Allowed and unset modes cached and restored normally.

Types of changes

  • New feature (non-breaking change which adds functionality)

Checklist:

  • My code follows the code style of this project.
  • My change requires a change to the documentation.
  • I have updated the documentation accordingly.
  • I have read the CONTRIBUTING document.
  • I have added tests to cover my changes.
  • All new and existing tests passed.

Bumps @actions/cache to ^6.2.0 and rebuilds the vendored dist bundles.
Note: package-lock.json must be regenerated with a registry install once
@actions/cache 6.2.0 is published to npm, before this is merged.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the action to use @actions/cache 6.2.0 and refreshes the vendored dist/ bundles to pick up new cache-mode enforcement (skip behavior) and clearer policy-denial warnings.

Changes:

  • Bump @actions/cache from ^6.1.0 to ^6.2.0 (and update lockfile + license metadata).
  • Rebuild vendored dist/* bundles to include cache-mode “skip” behavior and read/write denied messaging improvements.
Show a summary per file
File Description
package.json Bumps @actions/cache dependency to ^6.2.0.
package-lock.json Locks @actions/cache to 6.2.0 with updated integrity/resolution metadata.
dist/save/index.js Rebuilt bundle for the save entrypoint including cache-mode / denial logic.
dist/save-only/index.js Rebuilt bundle for the save-only entrypoint including cache-mode / denial logic.
dist/restore/index.js Rebuilt bundle for the restore entrypoint including cache-mode / denial logic.
dist/restore-only/index.js Rebuilt bundle for the restore-only entrypoint including cache-mode / denial logic.
.licenses/npm/@actions/cache.dep.yml Updates recorded dependency version to 6.2.0.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 2/7 changed files
  • Comments generated: 0
  • Review effort level: Low

@philip-gai
philip-gai marked this pull request as ready for review July 13, 2026 20:00
@philip-gai
philip-gai requested a review from a team as a code owner July 13, 2026 20:00

@boxofyellow boxofyellow left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM: :shipit:

@boxofyellow boxofyellow left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM: :shipit:

@philip-gai
philip-gai merged commit 3edfce9 into main Jul 15, 2026
17 checks passed
@philip-gai
philip-gai deleted the philip-gai/bump-cache-toolkit-6.2.0 branch July 15, 2026 18:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants