Repository navigation
[CI] Add cache-poisoning mitigations for actions/cache #49730
Description
Describe the enhancement
Workflows that use actions/cache and are triggered by both push and pull_request (or schedule) may be susceptible to cache poisoning. The recommended mitigation is to use actions/cache/restore (read-only) in PR-triggered runs and only allow cache writes from trusted branches.
This affects 28 cache steps across:
.github/workflows/cpp.yml.github/workflows/cpp_extra.yml.github/workflows/cuda_extra.yml.github/workflows/dev.yml.github/workflows/docs.yml.github/workflows/integration.yml.github/workflows/matlab.yml.github/workflows/package_linux.yml
Component(s)
Continuous Integration
Activity
thisisnic commentedon Apr 14, 2026
This also seems like a false positive as may be fairly unlikely?
thisisnic commentedon Apr 29, 2026
I'm closing this as "not needed" as the solution (PRs can only read from the cache) would slow down CI on PRs, but the only consequence if someone tried to take advantage of it would be a misleading CI run (false pass) but no effect on released artifacts etc, so it doesn't seem like a reasonable tradeoff.