feat: adopt @actions/cache 6.2.0 (cache-mode skip + read-denied warning) - #1781
Merged
Conversation
Bumps @actions/cache to ^6.2.0 and rebuilds the vendored dist bundles. Note: package-lock.json must be regenerated with a registry install once @actions/cache 6.2.0 is published to npm, before this is merged.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the action to use @actions/cache 6.2.0 and refreshes the vendored dist/ bundles to pick up new cache-mode enforcement (skip behavior) and clearer policy-denial warnings.
Changes:
- Bump
@actions/cachefrom^6.1.0to^6.2.0(and update lockfile + license metadata). - Rebuild vendored
dist/*bundles to include cache-mode “skip” behavior and read/write denied messaging improvements.
Show a summary per file
| File | Description |
|---|---|
| package.json | Bumps @actions/cache dependency to ^6.2.0. |
| package-lock.json | Locks @actions/cache to 6.2.0 with updated integrity/resolution metadata. |
| dist/save/index.js | Rebuilt bundle for the save entrypoint including cache-mode / denial logic. |
| dist/save-only/index.js | Rebuilt bundle for the save-only entrypoint including cache-mode / denial logic. |
| dist/restore/index.js | Rebuilt bundle for the restore entrypoint including cache-mode / denial logic. |
| dist/restore-only/index.js | Rebuilt bundle for the restore-only entrypoint including cache-mode / denial logic. |
| .licenses/npm/@actions/cache.dep.yml | Updates recorded dependency version to 6.2.0. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 2/7 changed files
- Comments generated: 0
- Review effort level: Low
philip-gai
marked this pull request as ready for review
July 13, 2026 20:00
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adopts
@actions/cache6.2.0 and rebuilds the vendoreddist/bundles. The new toolkit version adds two cache-mode security behaviors:ACTIONS_CACHE_MODE, the action skips operations the effective mode does not permit. Restore is skipped fornoneandwrite-only; save is skipped fornoneandread. Each skip emits a single non-fatal info line and returns a cache miss on restore or a no-op on save. It never throws.Motivation and Context
The cache service can restrict what a job's token is allowed to do (read, write, both, or neither). Previously a denied read or write surfaced as an opaque error. These changes make the client honor the mode up front and report policy denials clearly.
Regression safety: when
ACTIONS_CACHE_MODEis unset or set to an unrecognized value, behavior is identical to today. The skip logic only triggers on the explicit restrictive values.Note on activation: the client-side skip depends on the runner exporting
ACTIONS_CACHE_MODE, and the denial warnings depend on the cache service returning the corresponding policy responses. Until those roll out, this bump is behavior-preserving.Toolkit change: actions/toolkit#2447 (published as
@actions/cache6.2.0).How Has This Been Tested?
@actions/cacheunit suite passing in the toolkit repo (tsc, jest, prettier, eslint clean).none,read,write,write-only, unknown, and unset confirmed the expected skip or proceed outcome for both restore and save, with exactly one info line per skip and no failures.Types of changes
Checklist: