@@ -41200,7 +41200,7 @@ module.exports = { version: packageJson.version }
4120041200/***/ 4012:
4120141201/***/ ((module) => {
4120241202
41203- module.exports = /*#__PURE__*/JSON.parse('{"name":"@actions/cache","version":"6.1.0","description":"Actions cache lib","keywords":["github","actions","cache"],"homepage":"https://github.com/actions/toolkit/tree/main/packages/cache","license":"MIT","type":"module","main":"lib/cache.js","types":"lib/cache.d.ts","exports":{".":{"types":"./lib/cache.d.ts","import":"./lib/cache.js"}},"directories":{"lib":"lib","test":"__tests__"},"files":["lib","!.DS_Store"],"publishConfig":{"access":"public"},"repository":{"type":"git","url":"git+https://github.com/actions/toolkit.git","directory":"packages/cache"},"scripts":{"audit-moderate":"npm install && npm audit --json --audit-level=moderate > audit.json","test":"echo \\"Error: run tests from root\\" && exit 1","tsc":"tsc && cp src/internal/shared/package-version.cjs lib/internal/shared/"},"bugs":{"url":"https://github.com/actions/toolkit/issues"},"dependencies":{"@actions/core":"^3.0.1","@actions/exec":"^3.0.0","@actions/glob":"^0.6.1","@actions/http-client":"^4.0.1","@actions/io":"^3.0.2","@azure/core-rest-pipeline":"^1.23.0","@azure/storage-blob":"^12.31.0","@protobuf-ts/runtime-rpc":"^2.11.1","semver":"^7.7.4"},"devDependencies":{"@protobuf-ts/plugin":"^2.11.1","@types/node":"^25.6.0","@types/semver":"^7.7.1","typescript":"^5.9.3"},"overrides":{"uri-js":"npm:uri-js-replace@^1.0.1","node-fetch":"^3.3.2"}}');
41203+ module.exports = /*#__PURE__*/JSON.parse('{"name":"@actions/cache","version":"6.2.0","description":"Actions cache lib","keywords":["github","actions","cache"],"homepage":"https://github.com/actions/toolkit/tree/main/packages/cache","license":"MIT","type":"module","main":"lib/cache.js","types":"lib/cache.d.ts","exports":{".":{"types":"./lib/cache.d.ts","import":"./lib/cache.js"}},"directories":{"lib":"lib","test":"__tests__"},"files":["lib","!.DS_Store"],"publishConfig":{"access":"public"},"repository":{"type":"git","url":"git+https://github.com/actions/toolkit.git","directory":"packages/cache"},"scripts":{"audit-moderate":"npm install && npm audit --json --audit-level=moderate > audit.json","test":"echo \\"Error: run tests from root\\" && exit 1","tsc":"tsc && cp src/internal/shared/package-version.cjs lib/internal/shared/"},"bugs":{"url":"https://github.com/actions/toolkit/issues"},"dependencies":{"@actions/core":"^3.0.1","@actions/exec":"^3.0.0","@actions/glob":"^0.6.1","@actions/http-client":"^4.0.1","@actions/io":"^3.0.2","@azure/core-rest-pipeline":"^1.23.0","@azure/storage-blob":"^12.31.0","@protobuf-ts/runtime-rpc":"^2.11.1","semver":"^7.7.4"},"devDependencies":{"@protobuf-ts/plugin":"^2.11.1","@types/node":"^25.6.0","@types/semver":"^7.7.1","typescript":"^5.9.3"},"overrides":{"uri-js":"npm:uri-js-replace@^1.0.1","node-fetch":"^3.3.2"}}');
4120441204
4120541205/***/ })
4120641206
@@ -45451,6 +45451,10 @@ const SystemTarPathOnWindows = `${process.env['SYSTEMDRIVE']}\\Windows\\System32
4545145451const TarFilename = 'cache.tar';
4545245452const ManifestFilename = 'manifest.txt';
4545345453const CacheFileSizeLimit = 10 * Math.pow(1024, 3); // 10GiB per repository
45454+ // Prefix the cache backend embeds in a read-denial message (v2 twirp
45455+ // GetCacheEntryDownloadURL error or the GHES v1 `_apis/artifactcache` 403 body).
45456+ // Shared so cache.ts and cacheHttpClient.ts match the same contract value.
45457+ const constants_CacheReadDeniedMessagePrefix = 'cache read denied:';
4545445458//# sourceMappingURL=constants.js.map
4545545459;// CONCATENATED MODULE: ./node_modules/@actions/cache/lib/internal/cacheUtils.js
4545645460var cacheUtils_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _arguments, P, generator) {
@@ -95156,6 +95160,24 @@ function config_getCacheServiceVersion() {
9515695160 return 'v1';
9515795161 return process.env['ACTIONS_CACHE_SERVICE_V2'] ? 'v2' : 'v1';
9515895162}
95163+ // The cache-mode lattice: readable = {read, write}, writable = {write,
95164+ // write-only}, none = neither.
95165+ const KNOWN_CACHE_MODES = ['none', 'read', 'write', 'write-only'];
95166+ // The effective cache-mode exported by the runner, or '' when not set.
95167+ function config_getCacheMode() {
95168+ return (process.env['ACTIONS_CACHE_MODE'] || '').trim().toLowerCase();
95169+ }
95170+ // Unset or unrecognized modes are permissive so behavior matches today.
95171+ function config_isCacheReadable(mode) {
95172+ if (!KNOWN_CACHE_MODES.includes(mode))
95173+ return true;
95174+ return mode === 'read' || mode === 'write';
95175+ }
95176+ function isCacheWritable(mode) {
95177+ if (!KNOWN_CACHE_MODES.includes(mode))
95178+ return true;
95179+ return mode === 'write' || mode === 'write-only';
95180+ }
9515995181function getCacheServiceURL() {
9516095182 const version = config_getCacheServiceVersion();
9516195183 // Based on the version of the cache service, we will determine which
@@ -95205,6 +95227,7 @@ var cacheHttpClient_awaiter = (undefined && undefined.__awaiter) || function (th
9520595227
9520695228
9520795229
95230+
9520895231function getCacheApiUrl(resource) {
9520995232 const baseUrl = getCacheServiceURL();
9521095233 if (!baseUrl) {
@@ -95232,6 +95255,7 @@ function createHttpClient() {
9523295255}
9523395256function getCacheEntry(keys, paths, options) {
9523495257 return cacheHttpClient_awaiter(this, void 0, void 0, function* () {
95258+ var _a;
9523595259 const httpClient = createHttpClient();
9523695260 const version = utils.getCacheVersion(paths, options === null || options === void 0 ? void 0 : options.compressionMethod, options === null || options === void 0 ? void 0 : options.enableCrossOsArchive);
9523795261 const resource = `cache?keys=${encodeURIComponent(keys.join(','))}&version=${version}`;
@@ -95245,6 +95269,12 @@ function getCacheEntry(keys, paths, options) {
9524595269 return null;
9524695270 }
9524795271 if (!isSuccessStatusCode(response.statusCode)) {
95272+ // Only surface the receiver's body for a `cache read denied:` policy denial
95273+ // so callers can dispatch on it; keep the generic message otherwise.
95274+ const errorMessage = (_a = response.error) === null || _a === void 0 ? void 0 : _a.message;
95275+ if (errorMessage === null || errorMessage === void 0 ? void 0 : errorMessage.includes(CacheReadDeniedMessagePrefix)) {
95276+ throw new Error(errorMessage);
95277+ }
9524895278 throw new Error(`Cache service responded with ${response.statusCode}`);
9524995279 }
9525095280 const cacheResult = response.result;
@@ -96505,6 +96535,7 @@ var cache_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _ar
9650596535
9650696536
9650796537
96538+
9650896539class ValidationError extends Error {
9650996540 constructor(message) {
9651096541 super(message);
@@ -96520,19 +96551,20 @@ class ReserveCacheError extends Error {
9652096551 }
9652196552}
9652296553/**
96523- * Stable prefix the receiver writes into the cache reservation response when
96524- * the issuer downgraded the cache token to read-only (for example, because
96554+ * Stable prefix the cache service writes into the cache reservation response
96555+ * when the issuer downgraded the cache token to read-only (for example, because
9652596556 * the run was triggered by an untrusted event). saveCacheV1 / saveCacheV2
96526- * dispatch on this prefix to re-classify the failure as a
96527- * CacheWriteDeniedError so consumers (and the outer catch arm) can
96528- * distinguish a policy denial from other reservation failures.
96557+ * dispatch on this prefix to re-classify the failure as a CacheWriteDeniedError
96558+ * so consumers and tests can distinguish a policy denial from other reservation
96559+ * failures. Internally it is logged as a non-fatal warning like other
96560+ * best-effort save failures.
9652996561 */
9653096562const CACHE_WRITE_DENIED_PREFIX = 'cache write denied:';
9653196563/**
9653296564 * Raised when the cache backend refuses to reserve a writable cache entry
9653396565 * because the JWT issued for this run was scoped read-only (for example, the
9653496566 * run was triggered by an event the repository administrator classified as
96535- * untrusted). The receiver -supplied detail message always begins with
96567+ * untrusted). The service -supplied detail message always begins with
9653696568 * `cache write denied:` (the full error message includes additional context
9653796569 * like the cache key).
9653896570 *
@@ -96548,6 +96580,19 @@ class CacheWriteDeniedError extends ReserveCacheError {
9654896580 Object.setPrototypeOf(this, CacheWriteDeniedError.prototype);
9654996581 }
9655096582}
96583+ // Re-exported from constants so consumers keep referencing it here; the shared
96584+ // value also drives detection in cacheHttpClient without duplicating the string.
96585+ const CACHE_READ_DENIED_PREFIX = (/* unused pure expression or super */ null && (CacheReadDeniedMessagePrefix));
96586+ // Raised when the cache backend denies a download URL because the run's token
96587+ // has no readable cache scopes. Caching is best-effort, so restoreCache logs a
96588+ // warning and reports a cache miss rather than rethrowing this.
96589+ class CacheReadDeniedError extends Error {
96590+ constructor(message) {
96591+ super(message);
96592+ this.name = 'CacheReadDeniedError';
96593+ Object.setPrototypeOf(this, CacheReadDeniedError.prototype);
96594+ }
96595+ }
9655196596class FinalizeCacheError extends Error {
9655296597 constructor(message) {
9655396598 super(message);
@@ -96602,6 +96647,12 @@ function restoreCache(paths_1, primaryKey_1, restoreKeys_1, options_1) {
9660296647 const cacheServiceVersion = getCacheServiceVersion();
9660396648 core.debug(`Cache service version: ${cacheServiceVersion}`);
9660496649 checkPaths(paths);
96650+ const cacheMode = getCacheMode();
96651+ if (!isCacheReadable(cacheMode)) {
96652+ core.info(`Cache restore skipped: the effective cache-mode '${cacheMode}' does not permit reads.`);
96653+ core.debug(`Skipped restore for paths [${paths.join(', ')}] with primary key '${primaryKey}'.`);
96654+ return undefined;
96655+ }
9660596656 switch (cacheServiceVersion) {
9660696657 case 'v2':
9660796658 return yield restoreCacheV2(paths, primaryKey, restoreKeys, options, enableCrossOsArchive);
@@ -96623,6 +96674,7 @@ function restoreCache(paths_1, primaryKey_1, restoreKeys_1, options_1) {
9662396674 */
9662496675function restoreCacheV1(paths_1, primaryKey_1, restoreKeys_1, options_1) {
9662596676 return cache_awaiter(this, arguments, void 0, function* (paths, primaryKey, restoreKeys, options, enableCrossOsArchive = false) {
96677+ var _a;
9662696678 restoreKeys = restoreKeys || [];
9662796679 const keys = [primaryKey, ...restoreKeys];
9662896680 core.debug('Resolved Keys:');
@@ -96637,10 +96689,26 @@ function restoreCacheV1(paths_1, primaryKey_1, restoreKeys_1, options_1) {
9663796689 let archivePath = '';
9663896690 try {
9663996691 // path are needed to compute version
96640- const cacheEntry = yield cacheHttpClient.getCacheEntry(keys, paths, {
96641- compressionMethod,
96642- enableCrossOsArchive
96643- });
96692+ let cacheEntry;
96693+ try {
96694+ cacheEntry = yield cacheHttpClient.getCacheEntry(keys, paths, {
96695+ compressionMethod,
96696+ enableCrossOsArchive
96697+ });
96698+ }
96699+ catch (error) {
96700+ // The v1 artifact cache service returns HTTP 403 with a
96701+ // `cache read denied:` body when the run's token has no readable cache
96702+ // scopes. getCacheEntry lives in a dependency-free internal module and
96703+ // cannot import CacheReadDeniedError without a circular dependency, so it
96704+ // only surfaces the raw denial message; we classify it into the typed
96705+ // error here so the outer catch and consumers can dispatch on it.
96706+ const errorMessage = (_a = error === null || error === void 0 ? void 0 : error.message) !== null && _a !== void 0 ? _a : '';
96707+ if (errorMessage.includes(CACHE_READ_DENIED_PREFIX)) {
96708+ throw new CacheReadDeniedError(errorMessage);
96709+ }
96710+ throw error;
96711+ }
9664496712 if (!(cacheEntry === null || cacheEntry === void 0 ? void 0 : cacheEntry.archiveLocation)) {
9664596713 // Cache not found
9664696714 return undefined;
@@ -96669,7 +96737,9 @@ function restoreCacheV1(paths_1, primaryKey_1, restoreKeys_1, options_1) {
9666996737 }
9667096738 else {
9667196739 // warn on cache restore failure and continue build
96672- // Log server errors (5xx) as errors, all other errors as warnings
96740+ // Log server errors (5xx) as errors, all other errors as warnings.
96741+ // A read denied by policy (CacheReadDeniedError) is not an HttpClientError
96742+ // so it falls here and is warned, treated as a cache miss.
9667396743 if (typedError instanceof HttpClientError &&
9667496744 typeof typedError.statusCode === 'number' &&
9667596745 typedError.statusCode >= 500) {
@@ -96704,6 +96774,7 @@ function restoreCacheV1(paths_1, primaryKey_1, restoreKeys_1, options_1) {
9670496774 */
9670596775function restoreCacheV2(paths_1, primaryKey_1, restoreKeys_1, options_1) {
9670696776 return cache_awaiter(this, arguments, void 0, function* (paths, primaryKey, restoreKeys, options, enableCrossOsArchive = false) {
96777+ var _a;
9670796778 // Override UploadOptions to force the use of Azure
9670896779 options = Object.assign(Object.assign({}, options), { useAzureSdk: true });
9670996780 restoreKeys = restoreKeys || [];
@@ -96725,7 +96796,20 @@ function restoreCacheV2(paths_1, primaryKey_1, restoreKeys_1, options_1) {
9672596796 restoreKeys,
9672696797 version: utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive)
9672796798 };
96728- const response = yield twirpClient.GetCacheEntryDownloadURL(request);
96799+ let response;
96800+ try {
96801+ response = yield twirpClient.GetCacheEntryDownloadURL(request);
96802+ }
96803+ catch (error) {
96804+ // The receiver returns twirp PermissionDenied (403) when the run's token
96805+ // has no readable cache scopes. The client wraps that 403, so the stable
96806+ // prefix is embedded in the message rather than leading it.
96807+ const errorMessage = (_a = error === null || error === void 0 ? void 0 : error.message) !== null && _a !== void 0 ? _a : '';
96808+ if (errorMessage.includes(CACHE_READ_DENIED_PREFIX)) {
96809+ throw new CacheReadDeniedError(errorMessage);
96810+ }
96811+ throw error;
96812+ }
9672996813 if (!response.ok) {
9673096814 core.debug(`Cache not found for version ${request.version} of keys: ${keys.join(', ')}`);
9673196815 return undefined;
@@ -96760,8 +96844,10 @@ function restoreCacheV2(paths_1, primaryKey_1, restoreKeys_1, options_1) {
9676096844 throw error;
9676196845 }
9676296846 else {
96763- // Supress all non-validation cache related errors because caching should be optional
96764- // Log server errors (5xx) as errors, all other errors as warnings
96847+ // Suppress all non-validation cache related errors because caching should be optional
96848+ // Log server errors (5xx) as errors, all other errors as warnings.
96849+ // A read denied by policy (CacheReadDeniedError) is not an HttpClientError
96850+ // so it falls here and is warned, treated as a cache miss.
9676596851 if (typedError instanceof HttpClientError &&
9676696852 typeof typedError.statusCode === 'number' &&
9676796853 typedError.statusCode >= 500) {
@@ -96800,6 +96886,12 @@ function cache_saveCache(paths_1, key_1, options_1) {
9680096886 core_debug(`Cache service version: ${cacheServiceVersion}`);
9680196887 checkPaths(paths);
9680296888 checkKey(key);
96889+ const cacheMode = config_getCacheMode();
96890+ if (!isCacheWritable(cacheMode)) {
96891+ info(`Cache save skipped: the effective cache-mode '${cacheMode}' does not permit writes.`);
96892+ core_debug(`Skipped save for paths [${paths.join(', ')}] with key '${key}'.`);
96893+ return -1;
96894+ }
9680396895 switch (cacheServiceVersion) {
9680496896 case 'v2':
9680596897 return yield saveCacheV2(paths, key, options, enableCrossOsArchive);
@@ -96877,17 +96969,14 @@ function saveCacheV1(paths_1, key_1, options_1) {
9687796969 if (typedError.name === ValidationError.name) {
9687896970 throw error;
9687996971 }
96880- else if (typedError.name === CacheWriteDeniedError.name) {
96881- // Cache write was denied by policy (read-only token). Surface to the
96882- // customer at warning level so it is visible in the workflow log
96883- // without failing the run.
96884- warning(`Failed to save: ${typedError.message}`);
96885- }
9688696972 else if (typedError.name === ReserveCacheError.name) {
9688796973 info(`Failed to save: ${typedError.message}`);
9688896974 }
9688996975 else {
96890- // Log server errors (5xx) as errors, all other errors as warnings
96976+ // Log server errors (5xx) as errors, all other errors as warnings.
96977+ // A write denied by policy (CacheWriteDeniedError) is not an
96978+ // HttpClientError and its name does not match the ReserveCacheError arm,
96979+ // so it falls here and is warned without failing the run.
9689196980 if (typedError instanceof lib_HttpClientError &&
9689296981 typeof typedError.statusCode === 'number' &&
9689396982 typedError.statusCode >= 500) {
@@ -96998,20 +97087,17 @@ function saveCacheV2(paths_1, key_1, options_1) {
9699897087 if (typedError.name === ValidationError.name) {
9699997088 throw error;
9700097089 }
97001- else if (typedError.name === CacheWriteDeniedError.name) {
97002- // Cache write was denied by policy (read-only token). Surface to the
97003- // customer at warning level so it is visible in the workflow log
97004- // without failing the run.
97005- warning(`Failed to save: ${typedError.message}`);
97006- }
9700797090 else if (typedError.name === ReserveCacheError.name) {
9700897091 info(`Failed to save: ${typedError.message}`);
9700997092 }
9701097093 else if (typedError.name === FinalizeCacheError.name) {
9701197094 warning(typedError.message);
9701297095 }
9701397096 else {
97014- // Log server errors (5xx) as errors, all other errors as warnings
97097+ // Log server errors (5xx) as errors, all other errors as warnings.
97098+ // A write denied by policy (CacheWriteDeniedError) is not an
97099+ // HttpClientError and its name does not match the ReserveCacheError arm,
97100+ // so it falls here and is warned without failing the run.
9701597101 if (typedError instanceof lib_HttpClientError &&
9701697102 typeof typedError.statusCode === 'number' &&
9701797103 typedError.statusCode >= 500) {
0 commit comments