From fc9d85c6402646eebb8c54362489f17b0ae79bc6 Mon Sep 17 00:00:00 2001 From: rcourtman <8825017+rcourtman@users.noreply.github.com> Date: Fri, 2 Oct 2026 11:30:08 +0100 Subject: [PATCH] Pin setup-node caching off in the dependency advisory watch The scheduled watch reads each release line's lockfile in the default branch's cache scope, so it deliberately writes no dependency cache. It sets no cache input, but the pinned setup-node enables npm caching on its own once package.json names npm as its packageManager. Nothing declares that today; adding it later would silently reopen a default-branch cache write here. Set package-manager-cache: false, as five release workflows already do, assert it in the workflow test, and say how the contract's no-dependency-cache promise is kept. --- .github/workflows/dependency-advisory-watch.yml | 3 +++ .../v6/internal/subsystems/deployment-installability.md | 4 +++- scripts/tests/test_dependency_advisory_watch.py | 5 +++++ 3 files changed, 11 insertions(+), 1 deletion(-) diff --git a/.github/workflows/dependency-advisory-watch.yml b/.github/workflows/dependency-advisory-watch.yml index ca5aed47dd..94bf5aeacf 100644 --- a/.github/workflows/dependency-advisory-watch.yml +++ b/.github/workflows/dependency-advisory-watch.yml @@ -89,6 +89,9 @@ jobs: uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '24' + # setup-node enables npm caching by itself once package.json names + # npm as its packageManager; keep this scheduled job cache-free. + package-manager-cache: false - name: Audit complete frontend dependency graph id: audit diff --git a/docs/release-control/v6/internal/subsystems/deployment-installability.md b/docs/release-control/v6/internal/subsystems/deployment-installability.md index cf42b95974..bd7b24e07c 100644 --- a/docs/release-control/v6/internal/subsystems/deployment-installability.md +++ b/docs/release-control/v6/internal/subsystems/deployment-installability.md @@ -6269,7 +6269,9 @@ The second job is a fail-fast-free matrix over those branches. A scheduled job runs in the default branch's cache and token scope, so it never checks out, installs or runs another branch's code: each entry fetches the audited branch and reads only its `frontend-modern/package.json` and `package-lock.json` as -data with `git show`, uses no dependency cache, and repeats the required +data with `git show`, uses no dependency cache (its `actions/setup-node` step +sets `package-manager-cache: false`, because that pin turns npm caching on by +itself once `package.json` names npm as its `packageManager`), and repeats the required build-and-test audit against that lockfile with the same `actions/setup-node` pin and Node.js 24 and `scripts/npm-audit-retry.sh all` with `NPM_AUDIT_REQUIRE_RESULT=true`. `npm audit` answers from the lockfile, so the diff --git a/scripts/tests/test_dependency_advisory_watch.py b/scripts/tests/test_dependency_advisory_watch.py index 792ab831a8..9019c1818c 100644 --- a/scripts/tests/test_dependency_advisory_watch.py +++ b/scripts/tests/test_dependency_advisory_watch.py @@ -180,6 +180,11 @@ class WorkflowContractTest(unittest.TestCase): self.assertNotIn("npm install", self.text) self.assertNotIn("actions/cache", self.text) self.assertNotRegex(self.text, r"(?m)^\s+cache(-dependency-path)?:") + # setup-node turns npm caching on automatically when package.json + # declares packageManager, so the absence of `cache:` is not enough. + setup_node = [step for step in audit if str(step.get("uses", "")).startswith("actions/setup-node@")] + self.assertEqual(1, len(setup_node)) + self.assertIs(False, setup_node[0].get("with", {}).get("package-manager-cache")) def test_audit_matches_the_required_build_and_test_audit(self) -> None: build = yaml.safe_load(BUILD_AND_TEST.read_text(encoding="utf-8"))