This is big. Allows to safely run untrusted code on any trigger as if it was pull_request.
Cache-mode now controls GitHub Actions cache access by workflow or job with least-privilege settings.
• Modes include read, write, write-only, & none, affecting cache restore/save permissions.
github.blog/changelog/2026…
