Skip to content

Repair wp/6.8 branch Actions: Disable npm caching in release workflows - #83403

Open
desrosj wants to merge 1 commit into
fix-actions-6.8/add-job-timeoutsfrom
fix-actions-6.8/disable-cache-for-release-builds
Open

Repair wp/6.8 branch Actions: Disable npm caching in release workflows#83403
desrosj wants to merge 1 commit into
fix-actions-6.8/add-job-timeoutsfrom
fix-actions-6.8/disable-cache-for-release-builds

Conversation

@desrosj

@desrosj desrosj commented Sep 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Part of #82786.

What?

Sets package-manager-cache: false explicitly on every actions/setup-node step in publish-npm-packages.yml (2 steps).

Workflow Job Step
publish-npm-packages.yml release Setup Node.js
publish-npm-packages.yml release Setup Node.js (for WP major version)

Why?

Cache poisoning is an attack in which a release workflow picks up build state cached by an earlier, less-trusted workflow run. A job that produces a published npm package should install from the lockfile every time.

actions/setup-node's package-manager-cache input defaults to true. It currently engages only when package.json declares packageManager (or devEngines.packageManager) naming npm — which this branch does not. That means these jobs are uncached by accident, not by intent: adding that field later would silently switch caching back on in the release path with no visible change to any workflow file. Stating it explicitly removes that dependency on unrelated packaging metadata.

How?

Ports WordPress/gutenberg#79835, "Disable caching when publishing built assets", adapted for this branch. Upstream routes these jobs through the composite .github/setup-node action and threads a new cache input through to .github/setup-npm; this branch has no setup-npm composite and its release jobs call actions/setup-node directly, so the equivalent input is set on each step instead. build-plugin-zip.yml, which #79835 also changes, is removed from this branch in #82881.

This branch's actions/setup-node pin in publish-npm-packages.yml (v4.2.0) predates the package-manager-cache input, so the setting takes effect once #82883 updates it to v7.0.0.

The composite .github/setup-node on this branch is deliberately left alone: it is only ever called by test and automation workflows, none of which publish a release artifact.

Use of AI Tools

This PR was created by Claude Code under my supervision. All code should be treated as AI-produced and not yet reviewed by a human until this PR is marked Ready for Review.

🤖 Generated with Claude Code

@desrosj desrosj added the [Type] Build Tooling Issues or PRs related to build tooling label Sep 22, 2026
@desrosj
desrosj added this pull request to stack #83393 September 22, 2026 19:41
@coderabbitai

coderabbitai Bot commented Sep 22, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 30ffba6a-5b8b-4d51-be2e-4ef4a6978853

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@desrosj
desrosj removed this pull request from stack #83393 September 22, 2026 22:09
@desrosj
desrosj changed the base branch from fix-actions-6.8/ignore-browserslist-old-data to wp/6.8 September 22, 2026 22:09
@desrosj
desrosj force-pushed the fix-actions-6.8/disable-cache-for-release-builds branch from 2106ce2 to 7366abb Compare September 22, 2026 23:27
@desrosj
desrosj changed the base branch from wp/6.8 to fix-actions-6.8/remove-rn-workflows September 22, 2026 23:29
@desrosj
desrosj added this pull request to stack #83414 September 22, 2026 23:29
@desrosj desrosj mentioned this pull request Sep 24, 2026
Open
@desrosj
desrosj marked this pull request as ready for review September 28, 2026 15:19
@github-actions

github-actions Bot commented Sep 28, 2026 •
edited
Loading

Copy link
Copy Markdown

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: desrosj <desrosj@git.wordpress.org>
Co-authored-by: lucatume <lucatume@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

@desrosj
desrosj force-pushed the fix-actions-6.8/disable-cache-for-release-builds branch from 7366abb to 367b65e Compare October 7, 2026 13:44
@desrosj
desrosj removed this pull request from stack #83414 October 7, 2026 18:13
@desrosj
desrosj changed the base branch from fix-actions-6.8/remove-rn-workflows to wp/6.8 October 7, 2026 18:13
@desrosj
desrosj force-pushed the fix-actions-6.8/disable-cache-for-release-builds branch from 367b65e to 5548d84 Compare October 7, 2026 18:16
@desrosj
desrosj changed the base branch from wp/6.8 to fix-actions-6.8/remove-rn-workflows October 7, 2026 18:17
@desrosj
desrosj added this pull request to stack #84189 October 7, 2026 18:18
@desrosj
desrosj removed this pull request from stack #84189 October 8, 2026 21:19
@desrosj
desrosj changed the base branch from fix-actions-6.8/remove-rn-workflows to wp/6.8 October 8, 2026 21:19
@desrosj
desrosj force-pushed the fix-actions-6.8/disable-cache-for-release-builds branch from 5548d84 to d65e449 Compare October 8, 2026 21:21
@desrosj
desrosj changed the base branch from wp/6.8 to fix-actions-6.8/remove-rn-workflows October 8, 2026 21:22
@desrosj
desrosj added this pull request to stack #84349 October 8, 2026 21:23
@desrosj
desrosj removed this pull request from stack #84349 October 9, 2026 23:36
@desrosj
desrosj changed the base branch from fix-actions-6.8/remove-rn-workflows to wp/6.8 October 9, 2026 23:36
@desrosj
desrosj force-pushed the fix-actions-6.8/disable-cache-for-release-builds branch from d65e449 to 63974a9 Compare October 9, 2026 23:38
@desrosj
desrosj changed the base branch from wp/6.8 to fix-actions-6.8/add-job-timeouts October 9, 2026 23:39
@desrosj
desrosj added this pull request to stack #84472 October 9, 2026 23:40
@desrosj desrosj mentioned this pull request Oct 15, 2026
Open
@desrosj
desrosj force-pushed the fix-actions-6.8/disable-cache-for-release-builds branch from 63974a9 to cda7c0f Compare October 19, 2026 17:05
@ntsekouras ntsekouras mentioned this pull request Oct 20, 2026
Open
@desrosj
desrosj removed this pull request from stack #84472 October 21, 2026 18:32
@desrosj
desrosj added this pull request to stack #85322 October 21, 2026 18:33

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lucatume lucatume lucatume approved these changes

Assignees

No one assigned

Labels

[Type] Build Tooling Issues or PRs related to build tooling

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@desrosj @lucatume