Repository navigation
Automatically disable caching on release-shaped triggers? #984
Description
This is an idea I've been bouncing around in my head for a while.
TL;DR: setup-uv could disable caching by default when it detects that it's being run from a release-shaped trigger. In practice that means the release trigger plus tag-push events.
Summary
GitHub Actions caching is unfortunately not very secure, and is very easy to poison across workflows/jobs.
We've seen attackers successfully use this to pivot from a low-privilege/low-risk job (like a build step) to a high-privilege one, since cache write access isn't disabled when the user does permissions: {}.
The solution is to never load from cache in "sensitive" jobs. In practice that means that jobs that publish release artifacts, for example, should always run fully uncached (but should of course use a locked resolution).
Proposed solution
setup-uv could check what trigger it was invoked under, and modify its caching behavior based on that trigger.
This should be straightforward to do: every GHA job gets a GITHUB_EVENT_PATH variable, which points to the full webhook payload, which in turn reveals the trigger. GITHUB_EVENT_NAME also exposes the bare event name itself, which is sufficient for e.g. release events.
Here's a (different) example of those being read from:
Concretely, when the user sets enable-cache: auto, we should disable it under the following new conditions:
- The workflow trigger is
pull_request_targetorworkflow_run(fundamentally insecure) - The workflow trigger is
releaseorpushwith tags (indicates a release flow)
Other context
This would also hush a bunch of findings that come out of zizmor's cache-poisoning audit -- in particular it currently flags most setup-uv invocations since they restore from the cache by default, but if that changes then zizmor can stop emitting those 🙂
Activity
woodruffw commentedon Aug 4, 2026
Also for context: I was recently reminded of this because of astral-sh/uv#20946, which shows how we have to set non-default options to ratchet down setup-uv's caching controls on release workflows 🙂
eifinger commentedon Aug 7, 2026
Thank you for the detailed issue, sounds reasonable and straightforward to implement.
Will be another breaking release though.
IIRC
workflow_runis problematic because a previous workflow without write permissions could poison the cache, trigger another workflow viaworkflow_runand this workflow might be one with write permissions that would now consume the poisoned cache?woodruffw commentedon Aug 7, 2026
Thanks! And yeah, your description of the risk with
workflow_runis correct: it runs on the default branch so the implicit cache token can poison anything "below" the default branch, unlike the implicit cache token for a specific feature branch.Disable automatic caching for sensitive events (astral-sh#992)
ci(github-action)!: Update action astral-sh/setup-uv (v9.0.0 ➔ v10.0.…
Update https://github.com/astral-sh/setup-uv action to v10 (#145)
chore: bump astral-sh/setup-uv to v10.0.1 (#1002)
Merge branch 'renovate/major-all-major' into 'master'
ci(deps): bump astral-sh/setup-uv from v9.0.0 to v10.0.1
ci(deps): bump astral-sh/setup-uv from v9.0.0 to v10.0.1
ci(deps): bump astral-sh/setup-uv from v9.0.0 to v10.0.1
ci(deps): bump astral-sh/setup-uv from v9.0.0 to v10.0.1
ci(deps): bump astral-sh/setup-uv from v9.0.0 to v10.0.1
23 remaining items
ci(deps): bump astral-sh/setup-uv from v9.0.0 to v10.0.1
chore(deps): update astral-sh/setup-uv action to v10 (#31)
chore(deps): update astral-sh/setup-uv action to v10 (#473)
chore(deps): bump CI actions to latest majors (combines #142-#145) (#148
ci(deps): bump astral-sh/setup-uv from v9.0.0 to v10.0.1
Update astral-sh/setup-uv action to v10 (#17)
Update astral-sh/setup-uv action to v10 (#5)
⬆️ Update astral-sh/setup-uv action to v10 (#2114)
The job that builds what we publish restored a cache it did not build
The job that builds what we publish restored a cache it did not build
The job that builds what we publish restored a cache it did not build
The job that builds what we publish restored a cache it did not build
The publish path restored a uv cache, and CI stored whatever the curr…
chore(template): update dependency astral-sh/setup-uv to v10 (#99)
chore(template): update dependency astral-sh/setup-uv to v10 (#99)