Add cache-write input for read-only cache mode

[salmanmkc]

When cache is set to maven/gradle/sbt, this action restores and saves the dependency cache. For PR workflows there's no way to get restore-only — a malicious PR can poison the cache and have it picked up by trusted runs on main.

This adds a cache-write input (defaults to true, backward compatible). When false, the cleanup step skips cache saving entirely.

Usage:

- uses: actions/setup-java@v5
  with:
    distribution: temurin
    java-version: 21
    cache: maven
    cache-write: ${{ github.event_name != 'pull_request' }}

What changed:

• action.yml — new cache-write input
• src/cleanup-java.ts — early return in saveCache() when cache-write is false
• dist/ — rebuilt

Same change going into setup-node, setup-python, setup-go, setup-dotnet.

[Copilot]

Pull request overview

This PR adds a new cache-write input to the setup-java action, allowing users to disable cache saving while still restoring the cache. This enables a read-only cache mode that's useful for preventing cache poisoning from untrusted PR builds.

Changes:

• New cache-write input in action.yml with a default of true (backward compatible)
• Early return in saveCache() in src/cleanup-java.ts when cache-write is false
• Rebuilt dist/cleanup/index.js to reflect the source change

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

File	Description
action.yml	Adds new cache-write input definition with default true
src/cleanup-java.ts	Adds guard clause in saveCache() to skip save when cache-write is false
dist/cleanup/index.js	Compiled output reflecting the source change

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[Copilot]

The codebase has an established getBooleanInput() utility in src/util.ts that handles case-insensitive comparison (via .toUpperCase() === 'TRUE'). It's used for all other boolean inputs: check-latest in setup-java.ts:30, overwrite-settings in auth.ts:20 and toolchains.ts:30.

Using raw string comparison === 'false' here is fragile — it won't match 'False' or 'FALSE', which users might reasonably pass. This should use getBooleanInput from src/util.ts instead, with the logic inverted (skip save when the result is false).

Additionally, the input name 'cache-write' is hardcoded as a string literal, whereas the codebase convention is to define input name constants in src/constants.ts (e.g., INPUT_CACHE, INPUT_CACHE_DEPENDENCY_PATH at line 20-21). A constant like INPUT_CACHE_WRITE should be added there and used here.

[Copilot]

The existing test file has tests for cache save behavior (error handling, successful saves), but no test was added for the new cache-write: false code path. A test should verify that when cache-write input is 'false', saveCache returns early without calling cache.saveCache. This is important because this is the core behavior being added by this PR.