code-foundry 1.0.2 → 1.0.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.github/actions/cache/action.yml +6 -2
- package/CHANGELOG.md +7 -0
- package/package.json +1 -1
|
@@ -25,9 +25,13 @@ outputs:
|
|
|
25
25
|
runs:
|
|
26
26
|
using: composite
|
|
27
27
|
steps:
|
|
28
|
+
# Caches are restored on every event but saved on push only: scheduled
|
|
29
|
+
# and dispatched runs share the default branch with untrusted
|
|
30
|
+
# runtime-ref checkouts, so letting them save would allow cache
|
|
31
|
+
# poisoning. Push events require write access and stay trusted.
|
|
28
32
|
- name: Restore cache
|
|
29
33
|
id: restore
|
|
30
|
-
if: inputs.save != 'true'
|
|
34
|
+
if: inputs.save != 'true' || github.event_name != 'push'
|
|
31
35
|
uses: actions/cache/restore@v5
|
|
32
36
|
with:
|
|
33
37
|
path: ${{ inputs.path }}
|
|
@@ -35,7 +39,7 @@ runs:
|
|
|
35
39
|
restore-keys: ${{ inputs.restore-keys }}
|
|
36
40
|
- name: Restore and save cache
|
|
37
41
|
id: cache
|
|
38
|
-
if: inputs.save == 'true'
|
|
42
|
+
if: inputs.save == 'true' && github.event_name == 'push'
|
|
39
43
|
uses: actions/cache@v5
|
|
40
44
|
with:
|
|
41
45
|
path: ${{ inputs.path }}
|
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,12 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## [1.0.3](https://github.com/0xPlayerOne/code-foundry/compare/v1.0.2...v1.0.3) (2026-09-06)
|
|
4
|
+
|
|
5
|
+
|
|
6
|
+
### Bug Fixes
|
|
7
|
+
|
|
8
|
+
* **security:** save caches on push events only ([3180b07](https://github.com/0xPlayerOne/code-foundry/commit/3180b07a669b7caa5728be6a07143d60a0c7f6af))
|
|
9
|
+
|
|
3
10
|
## [1.0.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.0.1...v1.0.2) (2026-09-05)
|
|
4
11
|
|
|
5
12
|
|
package/package.json
CHANGED