Skip to content

Repair wp/6.1 branch Actions: Disable npm caching in release workflows - #84241

Open
desrosj wants to merge 1 commit into
fix-actions-6.1/add-job-timeoutsfrom
fix-actions-6.1/disable-cache-for-release-builds
Open

Repair wp/6.1 branch Actions: Disable npm caching in release workflows#84241
desrosj wants to merge 1 commit into
fix-actions-6.1/add-job-timeoutsfrom
fix-actions-6.1/disable-cache-for-release-builds

Conversation

@desrosj

@desrosj desrosj commented Oct 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Part of #82932.

What?

Sets package-manager-cache: false explicitly on every actions/setup-node step in publish-npm-packages.yml (1 step).

Workflow Job Step
publish-npm-packages.yml release Setup Node (for CLI)

Why?

Cache poisoning is an attack in which a release workflow picks up build state cached by an earlier, less-trusted workflow run. A job that produces a published npm package should install from the lockfile every time.

actions/setup-node's package-manager-cache input defaults to true. It currently engages only when package.json declares packageManager (or devEngines.packageManager) naming npm — which this branch does not. That means these jobs are uncached by accident, not by intent: adding that field later would silently switch caching back on in the release path with no visible change to any workflow file. Stating it explicitly removes that dependency on unrelated packaging metadata.

How?

Ports WordPress/gutenberg#79835, "Disable caching when publishing built assets", adapted for this branch. Upstream routes these jobs through the composite .github/setup-node action and threads a new cache input through to .github/setup-npm; this branch has no setup-npm composite and its release jobs call actions/setup-node directly, so the equivalent input is set on each step instead. build-plugin-zip.yml, which #79835 also changes, is removed from this branch in #84240.

This branch's actions/setup-node pin in publish-npm-packages.yml (v3.1.0) predates the package-manager-cache input, so the setting takes effect once #84242 updates it to v7.0.0.

Use of AI Tools

This PR was created by Claude Code under my supervision. All code should be treated as AI-produced and not yet reviewed by a human until this PR is marked Ready for Review.

🤖 Generated with Claude Code

@desrosj desrosj added the [Type] Build Tooling Issues or PRs related to build tooling label Oct 8, 2026
@desrosj desrosj self-assigned this Oct 8, 2026
@coderabbitai

coderabbitai Bot commented Oct 8, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 1b8a2a23-c3a8-4810-a680-e65959a6fbfb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@desrosj
desrosj added this pull request to stack #84262 October 8, 2026 03:56
This was referenced Oct 8, 2026
Closed
Open
@desrosj
desrosj marked this pull request as ready for review October 8, 2026 15:12
@github-actions

github-actions Bot commented Oct 8, 2026

Copy link
Copy Markdown

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: desrosj <desrosj@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

@desrosj
desrosj removed this pull request from stack #84262 October 8, 2026 21:51
@desrosj
desrosj changed the base branch from fix-actions-6.1/remove-rn-workflows to wp/6.1 October 8, 2026 21:51
@desrosj
desrosj force-pushed the fix-actions-6.1/disable-cache-for-release-builds branch from c3d9e32 to 9420c17 Compare October 8, 2026 21:52
@desrosj
desrosj changed the base branch from wp/6.1 to fix-actions-6.1/remove-rn-workflows October 8, 2026 21:53
@desrosj
desrosj added this pull request to stack #84356 October 8, 2026 21:54
@desrosj
desrosj removed this pull request from stack #84356 October 10, 2026 00:07
@desrosj
desrosj changed the base branch from fix-actions-6.1/remove-rn-workflows to wp/6.1 October 10, 2026 00:07
@desrosj
desrosj force-pushed the fix-actions-6.1/disable-cache-for-release-builds branch from 9420c17 to 6376163 Compare October 10, 2026 00:09
@desrosj
desrosj changed the base branch from wp/6.1 to fix-actions-6.1/add-job-timeouts October 10, 2026 00:10
@desrosj
desrosj added this pull request to stack #84486 October 10, 2026 00:11
@desrosj desrosj mentioned this pull request Oct 15, 2026
Open
@desrosj
desrosj removed this pull request from stack #84486 October 21, 2026 19:45
@desrosj
desrosj added this pull request to stack #85346 October 21, 2026 19:46

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lucatume lucatume lucatume approved these changes

Assignees

@desrosj desrosj

Labels

[Type] Build Tooling Issues or PRs related to build tooling

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@desrosj @lucatume