[claude]

Requested by David Sanders · Slack thread

Before: The Release workflow (push to main) and the Publish documentation workflow (push of a v* tag) have no cache policy of their own. Each actions/setup-node step opts out with package-manager-cache: false, but that is a per-step choice; any step, action, or reusable workflow added later could read from or write to the Actions cache during a release run, and nothing in the workflow would stop it.

After: Both workflows carry a top-level cache-mode: none, so the runner denies every cache read and write for the whole run regardless of per-step settings. Because release.yml calls test.yml via uses:, the none cap also applies to those test jobs during release runs (PR runs of test.yml are unaffected and keep caching). A step that tries to use the cache logs a message and continues: a skipped restore behaves as a cache miss and a skipped save is a no-op, so the run does not fail.

GitHub added the workflow- and job-level cache-mode key to control Actions cache access (changelog, syntax reference), and release paths should never depend on cache contents.

How: Adds cache-mode: none (with a one-line comment) after the top-level permissions: block in .github/workflows/release.yml and .github/workflows/docs.yml. No other lines change; the existing package-manager-cache: false settings stay in place. PR CI does not exercise these workflows, so the first release after merge is the real test. Both files parse cleanly and zizmor 1.30.1 accepts the new key; actionlint 1.7.12 does not yet recognise cache-mode at the workflow level (its schema predates the feature), which is worth knowing if actionlint is ever added to CI here.

🤖 Generated with Claude Code

https://claude.ai/code/session_01MYe3WCXtgiqomNuVQdi4Yd

[claude]

LGTM - a small, self-contained config change.

• Reviewed the identical cache-mode: none + explanatory comment added to docs.yml and release.yml, placed right after each workflow's top-level permissions: block.
• Confirmed no other lines changed and the existing package-manager-cache: false settings on actions/setup-node steps remain untouched.
• Could not independently verify from this offline environment whether cache-mode is currently a recognized top-level workflow key on GitHub's schema; worst case per the PR's own description is a harmless no-op, and the maintainer who requested this change has already approved it.

Extended reasoning...

The diff only adds a two-line block (a comment plus cache-mode: none) to the top level of two workflow files, docs.yml and release.yml, with no other changes; it touches no secrets, auth, or permissions logic directly. The main open question is whether cache-mode is a real GitHub Actions schema key as of the PR's claimed 2026-09-10 changelog, which I cannot verify from this sandboxed environment (no external web access), but even if it were a no-op it would not introduce a security regression, only fail to add the intended protection. A human reviewer (dsanders11, apparently the same person who requested the change per the linked Slack thread) already approved the PR, and the automated bug-hunting system reported no findings, so I'm approving as a low-risk, mechanical config change.