Skip to content

Repair wp/7.1 branch Actions: Disable npm caching in release workflows - #83400

Open
desrosj wants to merge 2 commits into
fix-actions-7.1/reference-trunk-workflow-lintfrom
fix-actions-7.1/disable-cache-for-release-builds
Open

Repair wp/7.1 branch Actions: Disable npm caching in release workflows#83400
desrosj wants to merge 2 commits into
fix-actions-7.1/reference-trunk-workflow-lintfrom
fix-actions-7.1/disable-cache-for-release-builds

Conversation

@desrosj

@desrosj desrosj commented Sep 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Part of #82781.

What?

Sets package-manager-cache: false explicitly on every actions/setup-node step in the workflows that build and publish release artifacts on this branch (4 steps).

Workflow Job Step
build-plugin-zip.yml build Use desired version of Node.js
build-plugin-zip.yml npm-publish Setup Node.js
publish-npm-packages.yml release Setup Node.js
publish-npm-packages.yml release Setup Node.js (for WP major version)

It also adds the cache input from 9983882 to .github/setup-node/action.yml. The input defaults to true. When it is false, the action skips the node_modules cache step and its post-install step, and turns off the npm cache. This branch has no setup-npm action, so the npm cache is turned off through the cache option of actions/setup-node instead.

Why?

Cache poisoning is an attack in which a release workflow picks up build state cached by an earlier, less-trusted workflow run. A job that produces a published plugin ZIP or npm package should install from the lockfile every time.

actions/setup-node's package-manager-cache input defaults to true. It currently engages only when package.json declares packageManager (or devEngines.packageManager) naming npm — which this branch does not. That means these jobs are uncached by accident, not by intent: adding that field later would silently switch caching back on in the release path with no visible change to any workflow file. Stating it explicitly removes that dependency on unrelated packaging metadata.

How?

Ports WordPress/gutenberg#79835, "Disable caching when publishing built assets", adapted for this branch. Upstream routes these jobs through the composite .github/setup-node action and threads a new cache input through to .github/setup-npm; this branch has no setup-npm composite and its release jobs call actions/setup-node directly, so the equivalent input is set on each step instead.

The composite .github/setup-node on this branch now has the cache input described above, but none of the release workflows use it: they call actions/setup-node directly, so they are covered by package-manager-cache: false instead. The Storybook check opts out of the composite action's cache in #84178.

Use of AI Tools

This PR was created by Claude Code under my supervision. All code should be treated as AI-produced and not yet reviewed by a human until this PR is marked Ready for Review.

🤖 Generated with Claude Code

@desrosj desrosj added the [Type] Build Tooling Issues or PRs related to build tooling label Sep 22, 2026
@coderabbitai

coderabbitai Bot commented Sep 22, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: be1dbbf7-9b94-4763-a9a8-938107c63695

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@desrosj
desrosj added this pull request to stack #83383 September 22, 2026 19:40
@github-actions

github-actions Bot commented Sep 22, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 PR meta 🤖

📦 Bundle size

Size Change: 0 B

Total Size: 7.75 MB

8953a53 Run

@desrosj
desrosj removed this pull request from stack #83383 September 22, 2026 23:50
@desrosj
desrosj changed the base branch from fix-actions-7.1/update-php-test-matrix to wp/7.1 September 22, 2026 23:50
@desrosj
desrosj force-pushed the fix-actions-7.1/disable-cache-for-release-builds branch from b48c47e to e83b8d7 Compare September 22, 2026 23:51
@desrosj
desrosj changed the base branch from wp/7.1 to fix-actions-7.1/reference-trunk-workflow-lint September 22, 2026 23:52
@desrosj
desrosj added this pull request to stack #83417 September 22, 2026 23:52
@desrosj desrosj mentioned this pull request Sep 24, 2026
Open
@desrosj
desrosj marked this pull request as ready for review September 28, 2026 14:39
@github-actions

github-actions Bot commented Sep 28, 2026 •
edited
Loading

Copy link
Copy Markdown

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: desrosj <desrosj@git.wordpress.org>
Co-authored-by: lucatume <lucatume@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

@desrosj
desrosj removed this pull request from stack #83417 September 28, 2026 15:31
@desrosj
desrosj added this pull request to stack #83629 September 28, 2026 15:31
@desrosj
desrosj force-pushed the fix-actions-7.1/disable-cache-for-release-builds branch from e83b8d7 to 8eb0573 Compare October 7, 2026 13:42
@desrosj desrosj mentioned this pull request Oct 7, 2026
Open
@desrosj
desrosj removed this pull request from stack #83629 October 8, 2026 21:07
@desrosj
desrosj changed the base branch from fix-actions-7.1/reference-trunk-workflow-lint to wp/7.1 October 8, 2026 21:07
@desrosj
desrosj force-pushed the fix-actions-7.1/disable-cache-for-release-builds branch from 009fa35 to 9d1726e Compare October 8, 2026 21:08
@desrosj
desrosj changed the base branch from wp/7.1 to fix-actions-7.1/reference-trunk-workflow-lint October 8, 2026 21:09
@desrosj
desrosj added this pull request to stack #84346 October 8, 2026 21:10
@desrosj
desrosj removed this pull request from stack #84346 October 9, 2026 23:21
@desrosj
desrosj changed the base branch from fix-actions-7.1/reference-trunk-workflow-lint to wp/7.1 October 9, 2026 23:21
@desrosj
desrosj force-pushed the fix-actions-7.1/disable-cache-for-release-builds branch from 9d1726e to 8953a53 Compare October 9, 2026 23:22
@desrosj
desrosj changed the base branch from wp/7.1 to fix-actions-7.1/reference-trunk-workflow-lint October 9, 2026 23:23
@desrosj
desrosj added this pull request to stack #84466 October 9, 2026 23:23
@desrosj desrosj mentioned this pull request Oct 15, 2026
Open
@ntsekouras ntsekouras mentioned this pull request Oct 20, 2026
Open
@desrosj
desrosj removed this pull request from stack #84466 October 21, 2026 18:35
@desrosj
desrosj added this pull request to stack #85326 October 21, 2026 18:36
@desrosj
desrosj removed this pull request from stack #85326 October 24, 2026 18:04
@desrosj
desrosj added this pull request to stack #85508 October 24, 2026 18:04

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lucatume lucatume lucatume approved these changes

Assignees

No one assigned

Labels

[Type] Build Tooling Issues or PRs related to build tooling

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@desrosj @lucatume