使用 cache-mode 控制 GitHub Actions 缓存访问权限

现在，你可以使用 cache-mode 在工作流或作业级别对 GitHub Actions 缓存实施最小权限访问控制。通过仅向每个工作流或作业授予其所需的缓存访问权限，你可以避免不必要的缓存恢复或保存操作，并有助于保护受信任的工作流免受缓存投毒影响。该功能现已在所有套餐中正式可用。

为每个工作流或作业选择所需的访问权限：

• read：允许恢复缓存，但禁止保存缓存。这是 pull_request_target 等低信任事件的默认设置。
• write：允许恢复和保存缓存。这是 push 等受信任事件的默认设置。
• write-only：允许保存缓存，但禁止恢复缓存。
• none：禁止所有缓存访问。

作业级设置会覆盖工作流级设置。所选模式由缓存服务强制执行，并会延续至可复用工作流：被调用的工作流无法获得超过其调用方所授予的缓存访问权限。

显式声明的 cache-mode 还会覆盖 pull_request_target 等低信任事件默认的只读缓存设置。为这些事件声明 write 或 write-only 会增加缓存投毒风险，因此，当声明的模式授予写入访问权限时，GitHub Actions 会添加警告标注。未设置 cache-mode 的工作流将继续使用现有的安全默认值。

缓存模式现已在 github.com 上向所有 GitHub 套餐正式开放。有关配置详情，请参阅 cache-mode 工作流语法文档。

欢迎在 GitHub Community 中参与讨论。

You can now use cache-mode to apply least-privilege access to the GitHub Actions cache at the workflow or job level. By granting each workflow or job only the cache access it needs, you can prevent unnecessary restores or saves and help protect trusted workflows from cache poisoning. This capability is now generally available on all plans.

Choose the access each workflow or job needs:

• read allows cache restores but prevents cache saves. This is the default for low-trust events such as pull_request_target.
• write allows cache restores and saves. This is the default for trusted events such as push.
• write-only allows cache saves but prevents cache restores.
• none prevents all cache access.

Job-level settings override workflow-level settings. The selected mode is enforced by the cache service and carries through reusable workflows, where a called workflow cannot receive more cache access than its caller granted.

An explicitly declared cache-mode also overrides the read-only cache default for low-trust events such as pull_request_target. Declaring write or write-only for these events can increase the risk of cache poisoning, so GitHub Actions adds a warning annotation when the declared mode grants write access. Workflows that do not set cache-mode continue to use the existing secure defaults.

Cache mode is generally available on github.com for all GitHub plans. For configuration details, see the cache-mode workflow syntax documentation.

Join the discussion within GitHub Community