Add cache-write input for read-only cache mode

[salmanmkc]

Right now if you use cache: pip (or pipenv/poetry) in a PR workflow, the action restores and saves the cache. There's no way to get read-only mode where you benefit from existing caches without writing back. This matters for cache poisoning — an untrusted PR could plant bad packages in the cache that later get picked up by pushes to main.

This adds a cache-write input (defaults to true, no breaking change). Set it to false to skip the post-step save.

Usage:

- uses: actions/setup-python@v6
  with:
    python-version: "3.12"
    cache: pip
    cache-write: ${{ github.event_name != 'pull_request' }}

What changed:

• action.yml — new cache-write input
• src/cache-save.ts — early return when cache-write is false
• dist/ — rebuilt

Same change going into setup-node, setup-go, setup-java, setup-dotnet.

[Copilot]

Pull request overview

Adds a new action input to support “read-only” cache usage by allowing workflows to restore caches without writing updated caches back, helping mitigate cache poisoning risks for untrusted PRs.

Changes:

• Introduces a new cache-write input (defaulting to enabled) in action.yml.
• Skips the post-step cache save when cache-write is set to false.
• Rebuilds the compiled dist/ output to include the new behavior.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

File	Description
action.yml	Adds the new cache-write input and documents its purpose.
src/cache-save.ts	Implements early return to skip saving cache when cache-write is disabled.
dist/cache-save/index.js	Compiled output reflecting the new cache-write behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[Copilot]

cache-write is treated as a raw string and only disables saving when the value is exactly 'false'. This is inconsistent with other boolean inputs in this repo (e.g., check-latest uses core.getBooleanInput) and will silently save the cache for values like False/FALSE. Prefer core.getBooleanInput('cache-write') (or normalize/lowercase) and branch on the boolean result.

Suggested change

	const cacheWriteEnabled = core.getInput('cache-write');
	if (cacheWriteEnabled === 'false') {
	const cacheWriteInput = core.getInput('cache-write');
	const cacheWriteEnabled =
	cacheWriteInput === ''
	? true
	: core.getBooleanInput('cache-write');
	if (!cacheWriteEnabled) {

[Copilot]

New cache-write behavior is not covered by tests. Add a unit test in __tests__/cache-save.test.ts that sets cache-write to false and asserts cache.saveCache is not called (and optionally that the skip message is logged) when cache is enabled.