Keep unsigned caches out of privileged workflows

Change-source: pulse-maintainer

.github/workflows/README.md

@@ -42,6 +42,14 @@ be interpolated into the generated shell program. Outputs remain data even
 when an intermediate step parsed or validated them, because later substitution
 would turn their value back into shell source.
 
+Jobs that receive confidential repository secrets or a write-capable
+`GITHUB_TOKEN` do not restore or save caches. This includes setup-action
+dependency caches, direct Actions caches, and external BuildKit cache imports:
+cache contents are unsigned mutable build input, while provenance only records
+what the workflow produced. Read-only jobs may still cache locked dependencies;
+the intentionally public legacy license key is not treated as a confidential
+credential.
+
 Passing data through `env` does not make it safe to append to the runner's
 `GITHUB_OUTPUT`, `GITHUB_ENV`, `GITHUB_PATH`, or `GITHUB_STATE` command files.
 The audit follows workflow data and values read from the event payload through

.github/workflows/backfill-release-assets.yml

@@ -32,7 +32,7 @@ jobs:
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
-          cache: true
+          cache: false
 
       - name: Install Syft
         run: |

.github/workflows/build-release-candidate.yml

@@ -285,7 +285,7 @@ jobs:
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
-          cache: true
+          cache: false
 
       - name: Build, sign, and notarize agent binaries
         shell: bash
@@ -389,7 +389,7 @@ jobs:
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
-          cache: true
+          cache: false
 
       - name: Build unsigned agent binaries
         shell: pwsh
@@ -705,14 +705,13 @@ jobs:
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
-          cache: true
+          cache: false
 
       - name: Set up Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '24'
-          cache: 'npm'
-          cache-dependency-path: 'frontend-modern/package-lock.json'
+          package-manager-cache: false
 
       - name: Install release prerequisites
         run: |

.github/workflows/canonical-private-governance.yml

@@ -62,8 +62,7 @@ jobs:
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: repos/pulse/go.mod
-          cache: true
-          cache-dependency-path: repos/pulse/go.sum
+          cache: false
 
       - name: Stub embedded frontend assets for Go tests
         run: bash scripts/ensure_test_assets.sh

.github/workflows/compile-release-payload.yml

@@ -136,7 +136,7 @@ jobs:
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
-          cache: true
+          cache: false
 
       - name: Build hosted qualification subjects
         env:

.github/workflows/create-release.yml

@@ -1323,7 +1323,7 @@ jobs:
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
-          cache: true
+          cache: false
 
       - name: Install Syft
         run: |

.github/workflows/eval-model-matrix.yml

@@ -43,6 +43,7 @@ jobs:
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
+          cache: false
 
       - name: Verify eval credentials are configured
         env:

.github/workflows/patrol-qualification-live.yml

@@ -59,6 +59,7 @@ jobs:
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
+          cache: false
 
       - name: Validate qualification catalogue
         run: go run ./cmd/patrol-qualify -mode validate

.github/workflows/publish-docker.yml

@@ -149,7 +149,6 @@ jobs:
           push: true
           provenance: mode=max
           sbom: true
-          cache-from: type=registry,ref=ghcr.io/${{ github.repository_owner }}/pulse:buildcache
           tags: |
             rcourtman/pulse:${{ steps.version.outputs.tag }}
             rcourtman/pulse:${{ steps.version.outputs.version }}
@@ -188,7 +187,6 @@ jobs:
           push: true
           provenance: mode=max
           sbom: true
-          cache-from: type=registry,ref=ghcr.io/${{ github.repository_owner }}/pulse-control-plane:buildcache
           tags: |
             rcourtman/pulse-control-plane:${{ steps.version.outputs.tag }}
             rcourtman/pulse-control-plane:${{ steps.version.outputs.version }}

.github/workflows/release-dry-run.yml

@@ -246,8 +246,7 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '24'
-          cache: 'npm'
-          cache-dependency-path: 'frontend-modern/package-lock.json'
+          package-manager-cache: false
 
       - name: Install frontend dependencies
         run: npm --prefix frontend-modern ci
@@ -277,7 +276,7 @@ jobs:
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
-          cache: true
+          cache: false
 
       - name: Run backend tests
         # Serial package execution keeps non-race SLO tests meaningful on

.github/workflows/signpath-test-signing.yml

@@ -34,7 +34,7 @@ jobs:
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
-          cache: true
+          cache: false
 
       - name: Verify isolated test-signing configuration
         shell: pwsh

.github/workflows/test-e2e.yml

@@ -243,8 +243,7 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '24'
-          cache: 'npm'
-          cache-dependency-path: tests/integration/package-lock.json
+          package-manager-cache: false
 
       - name: Install Playwright dependencies
         working-directory: tests/integration

.github/workflows/update-demo-server.yml

@@ -304,6 +304,7 @@ jobs:
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
+          cache: false
 
       - name: Wait for release assets
         if: inputs.verify_only != true