Disable caching when publishing built assets by desrosj · Pull Request #79835 · WordPress/gutenberg

desrosj · 2026-07-02T19:55:54Z

What?

This disables caching within workflows that build production assets to harden against potential cache poisoning attacks.

Why?

Though it's difficult to achieve, cache poisoning is an attack where release workflows leverage a build state cached from previous workflow executions.

How?

Popular third-party actions configure caching by default but support inputs that can disable the behavior.

Use of AI Tools

None

Copilot

Pull request overview

This PR hardens release/publishing workflows against cache-poisoning risks by disabling Node/package-manager caching in workflows that build and publish production assets, and by introducing a caching toggle in the repo’s composite Node setup action.

Changes:

Disable actions/setup-node package-manager caching in npm publishing and plugin zip build workflows.
Add an enable-caching input to the local .github/setup-node composite action.
Gate the composite action’s post-install-on-cache-hit behavior behind the new enable-caching input.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/publish-npm-packages.yml	Disables `actions/setup-node` package-manager caching during npm publishing.
.github/workflows/build-plugin-zip.yml	Disables `actions/setup-node` package-manager caching during plugin zip build/publish steps.
.github/setup-node/action.yml	Adds `enable-caching` input and uses it to influence setup-node caching and post-install behavior.

Caching can be used when building a zip file for a pull request but should always be disabled for other scenarios (when building the zip for the GitHub Container Registry or for final release).

github-actions · 2026-07-02T20:02:14Z

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Unlinked Accounts

The following contributors have not linked their GitHub and WordPress.org accounts: @Copilot.

Contributors, please read how to link your accounts to ensure your work is properly credited in WordPress releases.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Unlinked contributors: Copilot.

Co-authored-by: desrosj <desrosj@git.wordpress.org>
Co-authored-by: ciampo <mciampini@git.wordpress.org>
Co-authored-by: tyxla <tyxla@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

github-actions · 2026-07-02T20:36:41Z

Flaky tests detected in d111a36.
Some tests passed with failed attempts. The failures may not be related to this commit but are still reported for visibility. See the documentation for more information.

🔍 Workflow run URL: https://github.com/WordPress/gutenberg/actions/runs/29345238761
📝 Reported issues:

[Flaky Test] Should navigate inner blocks with arrow keys #39607 in /test/e2e/specs/editor/various/writing-flow.spec.js

…://github.com/WordPress/gutenberg into actions/disable-caching-for-production-builds

It's not clear why this was the only workflow that contains the `cache` input, but removing this will allow `package-manager-cache` only to be used without conflict.

ciampo · 2026-07-14T20:46:29Z

          with:
              node-version-file: ${{ inputs.node-version == '' && '.nvmrc' || '' }}
              node-version: ${{ inputs.node-version }}
+              package-manager-cache: ${{ inputs.enable-caching == 'true' && 'true' || 'false' }}


Flagged during ai-assisted review

The new guards correctly make the node_modules cache opt-outable, but removing cache: npm also disables actions/setup-node's npm cache for every default caller.

package-manager-cache: true only enables automatic caching when the root package.json declares npm in devEngines.packageManager or the top-level packageManager field (upstream implementation, detection logic). Gutenberg declares neither, so the default enable-caching: true path no longer restores or saves the npm cache across the action's 13 call sites. That contradicts the new input's contract and creates a broad CI performance regression unrelated to the production hardening.

Could we either remove the currently unused composite-action input, or preserve the explicit cache conditionally?

cache: ${{ inputs.enable-caching == 'true' && 'npm' || '' }} package-manager-cache: false

ciampo · 2026-07-14T20:47:18Z

              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
              with:
                  node-version-file: '.nvmrc'
+                  package-manager-cache: ${{ matrix.IS_GUTENBERG_PLUGIN == 'true' && github.event_name == 'pull_request' && 'true' || 'false' }}


Flagged during ai-assisted review

Keeping npm caching for Gutenberg-plugin PR builds makes sense, but this condition never enables it. matrix.IS_GUTENBERG_PLUGIN comes from the YAML booleans [true, false], while the expression compares it with the string 'true'; under GitHub's loose-equality rules, boolean true is coerced to 1 and the non-numeric string is NaN, so the comparison is false. Even without that mismatch, package-manager-cache: true cannot auto-detect npm because this repository has no packageManager declaration.

Could we make the intended cache input explicit instead, or remove the exception if caching should now stay disabled for all plugin builds?

cache: ${{ matrix.IS_GUTENBERG_PLUGIN && github.event_name == 'pull_request' && 'npm' || '' }} package-manager-cache: false

Yeah, I'd just drop the string comparison ( == 'true') and keep matrix.IS_GUTENBERG_PLUGIN

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

tyxla · 2026-07-15T10:32:09Z

              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
              with:
                  node-version-file: '.nvmrc'
+                  package-manager-cache: ${{ matrix.IS_GUTENBERG_PLUGIN == 'true' && github.event_name == 'pull_request' && 'true' || 'false' }}


Yeah, I'd just drop the string comparison ( == 'true') and keep matrix.IS_GUTENBERG_PLUGIN

tyxla · 2026-07-15T10:33:12Z

+        required: true
+        default: 'true'


Why do we have a default for a required input?

tyxla · 2026-07-15T10:35:22Z


        - name: Install npm dependencies
-          if: ${{ steps.cache-node_modules.outputs.cache-hit != 'true' }}
+          if: ${{ inputs.enable-caching == 'false' || steps.cache-node_modules.outputs.cache-hit != 'true' }}


If caching is disabled the cache step is skipped, so cache-hit != true is already true, no?

Disable caching when publishing built assets.

b665f1c

desrosj requested a review from Copilot July 2, 2026 19:55

desrosj self-assigned this Jul 2, 2026

desrosj added the [Type] Build Tooling Issues or PRs related to build tooling label Jul 2, 2026

Copilot started reviewing on behalf of desrosj July 2, 2026 19:56 View session

Copilot AI reviewed Jul 2, 2026

View reviewed changes

Comment thread .github/setup-node/action.yml

Refine caching logic for building plugin zips.

8feb9ce

Caching can be used when building a zip file for a pull request but should always be disabled for other scenarios (when building the zip for the GitHub Container Registry or for final release).

desrosj requested a review from johnbillion July 6, 2026 14:53

Merge branch 'trunk' into actions/disable-caching-for-production-builds

983b286

desrosj added this to WordPress Project Build Tooling Jul 9, 2026

github-project-automation Bot moved this to Backlog in WordPress Project Build Tooling Jul 9, 2026

desrosj moved this from Backlog to In review in WordPress Project Build Tooling Jul 9, 2026

Merge branch 'trunk' into actions/disable-caching-for-production-builds

d1f5d01

Copilot started work on behalf of desrosj July 14, 2026 14:46 View session

desrosj and others added 2 commits July 14, 2026 10:48

Only manually cache when desired.

03bd071

Disable all cache paths when enable-caching is false

bee5cc9

Copilot finished work on behalf of desrosj July 14, 2026 14:49

desrosj added 4 commits July 14, 2026 10:50

Flip conditional to check for true.

27ae035

Merge branch 'actions/disable-caching-for-production-builds' of https…

d111a36

…://github.com/WordPress/gutenberg into actions/disable-caching-for-production-builds

Remove cache input.

95eabe8

It's not clear why this was the only workflow that contains the `cache` input, but removing this will allow `package-manager-cache` only to be used without conflict.

Merge branch 'trunk' into actions/disable-caching-for-production-builds

d36d9b3

Copilot started work on behalf of desrosj July 14, 2026 17:14 View session

Copilot finished work on behalf of desrosj July 14, 2026 17:15

desrosj requested review from aduth, ciampo, t-hamano and tyxla July 14, 2026 19:54

ciampo reviewed Jul 14, 2026

View reviewed changes

ciampo requested a review from Copilot July 14, 2026 20:47

Copilot started reviewing on behalf of ciampo July 14, 2026 20:48 View session

Copilot AI reviewed Jul 14, 2026

View reviewed changes

Comment thread .github/workflows/build-plugin-zip.yml

tyxla reviewed Jul 15, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Disable caching when publishing built assets#79835

Disable caching when publishing built assets#79835
desrosj wants to merge 10 commits into
trunkfrom
actions/disable-caching-for-production-builds

desrosj commented Jul 2, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

github-actions Bot commented Jul 2, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 2, 2026 •

edited

Loading

Uh oh!

ciampo Jul 14, 2026

Uh oh!

ciampo Jul 14, 2026

Uh oh!

tyxla Jul 15, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

tyxla Jul 15, 2026

Uh oh!

tyxla Jul 15, 2026

Uh oh!

tyxla Jul 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

desrosj commented Jul 2, 2026

What?

Why?

How?

Use of AI Tools

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

github-actions Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Unlinked Accounts

Uh oh!

github-actions Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ciampo Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

ciampo Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

tyxla Jul 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

tyxla Jul 15, 2026

Choose a reason for hiding this comment

Uh oh!

tyxla Jul 15, 2026

Choose a reason for hiding this comment

Uh oh!

tyxla Jul 15, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

github-actions Bot commented Jul 2, 2026 •

edited

Loading

github-actions Bot commented Jul 2, 2026 •

edited

Loading