🏁 Script executed:

#!/bin/bash
set -euo pipefail

git ls-files .github/workflows/release.yml
echo '---'
cat -n .github/workflows/release.yml | sed -n '1,220p'

Repository: cmm-cmm/ForgeSelect

Length of output: 1699

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Inspect any workflow-level safeguards or related release docs if present.
rg -n "workflow_dispatch|release|publish|NPM_TOKEN|cache" .github/workflows . -g '!**/node_modules/**' -g '!**/dist/**' -g '!**/build/**' | sed -n '1,240p'

Repository: cmm-cmm/ForgeSelect

Length of output: 5288

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Locate any docs or scripts that describe the intended release trigger/ref policy.
fd -a -t f -H 'release*' .
fd -a -t f -H 'publish*' .
fd -a -t f -H '.github/workflows/*.yml' .github/workflows

Repository: cmm-cmm/ForgeSelect

Length of output: 206

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# If the workflow uses checkout or cache actions, inspect those exact lines.
python3 - <<'PY'
from pathlib import Path
p = Path('.github/workflows/release.yml')
for i, line in enumerate(p.read_text().splitlines(), 1):
    if any(k in line for k in ['actions/checkout', 'actions/cache', 'npm', 'workflow_dispatch', 'release', 'publish', 'environment', 'ref']):
        print(f"{i}: {line}")
PY

Repository: cmm-cmm/ForgeSelect

Length of output: 537

🏁 Script executed:

#!/bin/bash
set -euo pipefail

git ls-files .github/workflows/release.yml
echo "----"
cat -n .github/workflows/release.yml

Repository: cmm-cmm/ForgeSelect

Length of output: 1700

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Workflow files:"
git ls-files .github/workflows

echo "---- npm cache usage ----"
rg -n --glob '.github/workflows/*.yml' 'cache:\s*npm|actions/setup-node@v4|registry-url|persist-credentials|id-token' .github/workflows

Repository: cmm-cmm/ForgeSelect

Length of output: 1003

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "---- ci.yml ----"
cat -n .github/workflows/ci.yml

echo "---- pages.yml ----"
cat -n .github/workflows/pages.yml

Repository: cmm-cmm/ForgeSelect

Length of output: 2187

🌐 Web query:

actions/setup-node cache poisoning elevated privileges GitHub recommends disabling package manager caching workflow permissions

💡 Result:

GitHub recommends disabling automatic package manager caching in workflows with elevated privileges or access to sensitive information to mitigate the risk of cache poisoning [1]. In versions of the actions/setup-node action where automatic caching is enabled (specifically for npm when defined in package.json), the action may restore dependencies from a cache that could be influenced by previous, less secure workflow runs [2][1]. In a cache poisoning scenario, an attacker with the ability to trigger a workflow can inject malicious content into the shared cache [3][4]. When a subsequent, privileged workflow (such as a release or publishing pipeline) restores this cache, it may use the compromised artifacts, potentially leading to supply chain attacks or the exfiltration of secrets and credentials [2][3][4]. To prevent this vulnerability, you should explicitly disable automatic caching in these sensitive workflows by setting the package-manager-cache input to false in your workflow file [5][3][1]: - name: Setup Node.js uses: actions/setup-node@v6 with: node-version: '20' package-manager-cache: false This configuration is particularly critical for workflows that handle OIDC tokens, production secrets, or the publishing of release artifacts [5][4]. Additionally, following the principle of least privilege by restricting GITHUB_TOKEN permissions is a key practice for reducing the overall attack surface in GitHub Actions [4].

Citations:

• 1: https://github.com/actions/setup-node/blob/v6/README.md
• 2: Don't cache automatically in privileged workflows actions/setup-node#1358
• 3: Fix cache poisoning vulnerabilities by disabling package-manager-cache in setup-node github/gh-aw#5214
• 4: https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/GitHub_Actions_Security_Cheat_Sheet.md
• 5: docs: Update caching recommendations to mitigate cache poisoning risks actions/setup-node#1567