Merge pull request #1775 from jasongin/readonly-cache-v5

Bump @actions/cache to v5.1.0 - handle read-only cache access
2026-08-06 03:12:16 +08:00 · 2026-06-26 15:14:19 -04:00 · 2026-06-26 12:05:30 -07:00 · 2026-04-13 11:36:02 -04:00 · 2026-04-13 11:30:08 -04:00 · 2026-04-13 11:17:26 -04:00
20 changed files with 18499 additions and 15082 deletions
@@ -90,15 +90,86 @@ jobs:
    runs-on: ubuntu-latest
    container:
      image: ubuntu:latest
-      options: --dns 127.0.0.1
+      options: --cap-add=NET_ADMIN
    services:
      squid-proxy:
        image: ubuntu/squid:latest
        ports:
          - 3128:3128
    env:
+      http_proxy: http://squid-proxy:3128
      https_proxy: http://squid-proxy:3128
    steps:
+    - name: Wait for proxy to be ready
+      shell: bash
+      run: |
+        echo "Waiting for squid proxy to be ready..."
+        echo "Resolving squid-proxy hostname:"
+        getent hosts squid-proxy || echo "DNS resolution failed"
+        for i in $(seq 1 30); do
+          if (echo > /dev/tcp/squid-proxy/3128) 2>/dev/null; then
+            echo "Proxy is ready!"
+            exit 0
+          fi
+          echo "Attempt $i: Proxy not ready, waiting..."
+          sleep 2
+        done
+        echo "Proxy failed to become ready"
+        exit 1
+      env:
+        http_proxy: ""
+        https_proxy: ""
+    - name: Install dependencies
+      run: |
+        apt-get update
+        apt-get install -y iptables curl
+    - name: Verify proxy is working
+      run: |
+        echo "Testing proxy connectivity..."
+        curl -s -o /dev/null -w "%{http_code}" --proxy http://squid-proxy:3128 http://github.com || true
+        echo "Proxy verification complete"
+    - name: Block direct traffic (enforce proxy usage)
+      run: |
+        # Get the squid-proxy container IP
+        PROXY_IP=$(getent hosts squid-proxy | awk '{ print $1 }')
+        echo "Proxy IP: $PROXY_IP"
+        
+        # Allow loopback traffic
+        iptables -A OUTPUT -o lo -j ACCEPT
+        
+        # Allow traffic to the proxy container
+        iptables -A OUTPUT -d $PROXY_IP -j ACCEPT
+        
+        # Allow established connections
+        iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+        
+        # Allow DNS (needed for initial resolution)
+        iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
+        iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
+        
+        # Block all other outbound traffic (HTTP/HTTPS)
+        iptables -A OUTPUT -p tcp --dport 80 -j REJECT
+        iptables -A OUTPUT -p tcp --dport 443 -j REJECT
+        
+        # Log the iptables rules for debugging
+        iptables -L -v -n
+    - name: Verify direct HTTPS is blocked
+      run: |
+        echo "Testing that direct HTTPS requests fail..."
+        if curl --noproxy '*' -s --connect-timeout 5 https://github.com > /dev/null 2>&1; then
+          echo "ERROR: Direct HTTPS request succeeded - blocking is not working!"
+          exit 1
+        else
+          echo "SUCCESS: Direct HTTPS request was blocked as expected"
+        fi
+        
+        echo "Testing that HTTPS through proxy succeeds..."
+        if curl --proxy http://squid-proxy:3128 -s --connect-timeout 10 https://github.com > /dev/null 2>&1; then
+          echo "SUCCESS: HTTPS request through proxy succeeded"
+        else
+          echo "ERROR: HTTPS request through proxy failed!"
+          exit 1
+        fi
    - name: Checkout
      uses: actions/checkout@v5
    - name: Generate files
@@ -114,15 +185,86 @@ jobs:
    runs-on: ubuntu-latest
    container:
      image: ubuntu:latest
-      options: --dns 127.0.0.1
+      options: --cap-add=NET_ADMIN
    services:
      squid-proxy:
        image: ubuntu/squid:latest
        ports:
          - 3128:3128
    env:
+      http_proxy: http://squid-proxy:3128
      https_proxy: http://squid-proxy:3128
    steps:
+    - name: Wait for proxy to be ready
+      shell: bash
+      run: |
+        echo "Waiting for squid proxy to be ready..."
+        echo "Resolving squid-proxy hostname:"
+        getent hosts squid-proxy || echo "DNS resolution failed"
+        for i in $(seq 1 30); do
+          if (echo > /dev/tcp/squid-proxy/3128) 2>/dev/null; then
+            echo "Proxy is ready!"
+            exit 0
+          fi
+          echo "Attempt $i: Proxy not ready, waiting..."
+          sleep 2
+        done
+        echo "Proxy failed to become ready"
+        exit 1
+      env:
+        http_proxy: ""
+        https_proxy: ""
+    - name: Install dependencies
+      run: |
+        apt-get update
+        apt-get install -y iptables curl
+    - name: Verify proxy is working
+      run: |
+        echo "Testing proxy connectivity..."
+        curl -s -o /dev/null -w "%{http_code}" --proxy http://squid-proxy:3128 http://github.com || true
+        echo "Proxy verification complete"
+    - name: Block direct traffic (enforce proxy usage)
+      run: |
+        # Get the squid-proxy container IP
+        PROXY_IP=$(getent hosts squid-proxy | awk '{ print $1 }')
+        echo "Proxy IP: $PROXY_IP"
+        
+        # Allow loopback traffic
+        iptables -A OUTPUT -o lo -j ACCEPT
+        
+        # Allow traffic to the proxy container
+        iptables -A OUTPUT -d $PROXY_IP -j ACCEPT
+        
+        # Allow established connections
+        iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+        
+        # Allow DNS (needed for initial resolution)
+        iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
+        iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
+        
+        # Block all other outbound traffic (HTTP/HTTPS)
+        iptables -A OUTPUT -p tcp --dport 80 -j REJECT
+        iptables -A OUTPUT -p tcp --dport 443 -j REJECT
+        
+        # Log the iptables rules for debugging
+        iptables -L -v -n
+    - name: Verify direct HTTPS is blocked
+      run: |
+        echo "Testing that direct HTTPS requests fail..."
+        if curl --noproxy '*' -s --connect-timeout 5 https://github.com > /dev/null 2>&1; then
+          echo "ERROR: Direct HTTPS request succeeded - blocking is not working!"
+          exit 1
+        else
+          echo "SUCCESS: Direct HTTPS request was blocked as expected"
+        fi
+        
+        echo "Testing that HTTPS through proxy succeeds..."
+        if curl --proxy http://squid-proxy:3128 -s --connect-timeout 10 https://github.com > /dev/null 2>&1; then
+          echo "SUCCESS: HTTPS request through proxy succeeded"
+        else
+          echo "ERROR: HTTPS request through proxy failed!"
+          exit 1
+        fi
    - name: Checkout
      uses: actions/checkout@v5
    - name: Restore cache
@@ -1,114 +0,0 @@
-# Pull Request Triage Report for actions/cache
-
-*Generated: 2026-01-29*
-
-| PR Link | Author | Date Opened | Days Open | Category |
-|---------|--------|-------------|-----------|----------|
-| [#1700](https://github.com/actions/cache/pull/1700) | Copilot | 2026-01-29 | 0 | Other |
-| [#1689](https://github.com/actions/cache/pull/1689) | StephenHodgson | 2025-12-13 | 47 | New feature |
-| [#1683](https://github.com/actions/cache/pull/1683) | salmanmkc | 2025-12-11 | 49 | Documentation |
-| [#1672](https://github.com/actions/cache/pull/1672) | alinernunes15-a11y | 2025-11-07 | 83 | Documentation |
-| [#1671](https://github.com/actions/cache/pull/1671) | dulcekarma7u7-netizen | 2025-10-28 | 93 | Documentation |
-| [#1654](https://github.com/actions/cache/pull/1654) | timbaverstock-bmbl | 2025-09-22 | 129 | Documentation |
-| [#1639](https://github.com/actions/cache/pull/1639) | atoulme | 2025-08-08 | 174 | Documentation |
-| [#1638](https://github.com/actions/cache/pull/1638) | TNGBBK | 2025-08-07 | 175 | Documentation |
-| [#1605](https://github.com/actions/cache/pull/1605) | loic-bellinger | 2025-05-14 | 260 | Documentation |
-| [#1604](https://github.com/actions/cache/pull/1604) | stuartleeks | 2025-05-08 | 266 | New feature |
-| [#1587](https://github.com/actions/cache/pull/1587) | Yury-Fridlyand | 2025-04-06 | 298 | Documentation |
-| [#1571](https://github.com/actions/cache/pull/1571) | helly25 | 2025-03-11 | 324 | New feature |
-| [#1567](https://github.com/actions/cache/pull/1567) | KtorZ | 2025-03-07 | 328 | Documentation |
-| [#1536](https://github.com/actions/cache/pull/1536) | KyFaSt | 2025-01-22 | 372 | Security fix |
-| [#1516](https://github.com/actions/cache/pull/1516) | vorburger | 2024-12-12 | 413 | Documentation |
-| [#1514](https://github.com/actions/cache/pull/1514) | lima-limon-inc | 2024-12-11 | 414 | Documentation |
-| [#1493](https://github.com/actions/cache/pull/1493) | EnricoMi | 2024-11-04 | 451 | New feature |
-| [#1472](https://github.com/actions/cache/pull/1472) | mustafacco7 | 2024-10-18 | 468 | Documentation |
-| [#1451](https://github.com/actions/cache/pull/1451) | karlhorky | 2024-08-13 | 534 | Documentation |
-| [#1439](https://github.com/actions/cache/pull/1439) | rusty-key | 2024-07-23 | 555 | Documentation |
-| [#1436](https://github.com/actions/cache/pull/1436) | llakala | 2024-07-19 | 559 | New feature |
-| [#1378](https://github.com/actions/cache/pull/1378) | Olegt0rr | 2024-04-16 | 653 | Other |
-| [#1374](https://github.com/actions/cache/pull/1374) | itchyny | 2024-04-14 | 655 | Other |
-| [#1337](https://github.com/actions/cache/pull/1337) | marco-cpd | 2024-02-23 | 706 | Bug fix |
-| [#1328](https://github.com/actions/cache/pull/1328) | vorburger | 2024-02-16 | 713 | Documentation |
-| [#1312](https://github.com/actions/cache/pull/1312) | Mogyuchi | 2024-01-28 | 732 | Documentation |
-| [#1308](https://github.com/actions/cache/pull/1308) | PrinsFrank | 2024-01-22 | 738 | New feature |
-| [#1290](https://github.com/actions/cache/pull/1290) | joseluisq | 2023-12-01 | 790 | Documentation |
-| [#1283](https://github.com/actions/cache/pull/1283) | IanButterworth | 2023-11-18 | 803 | Documentation |
-| [#1282](https://github.com/actions/cache/pull/1282) | jlanga | 2023-11-17 | 804 | New feature |
-| [#1252](https://github.com/actions/cache/pull/1252) | Magnus167 | 2023-10-01 | 851 | Documentation |
-| [#1248](https://github.com/actions/cache/pull/1248) | Fishrock123 | 2023-09-25 | 857 | Documentation |
-| [#1231](https://github.com/actions/cache/pull/1231) | kbdharun | 2023-09-05 | 877 | Other |
-| [#1222](https://github.com/actions/cache/pull/1222) | dsame | 2023-08-23 | 890 | Documentation |
-| [#1191](https://github.com/actions/cache/pull/1191) | Yakiyo | 2023-06-15 | 959 | Documentation |
-| [#1185](https://github.com/actions/cache/pull/1185) | jorendorff | 2023-06-12 | 962 | Documentation |
-| [#1184](https://github.com/actions/cache/pull/1184) | byrgulle12 | 2023-06-09 | 965 | Spam candidate |
-| [#1183](https://github.com/actions/cache/pull/1183) | pgrange | 2023-06-08 | 966 | Bug fix |
-| [#1167](https://github.com/actions/cache/pull/1167) | tommy-gilligan | 2023-05-04 | 1001 | Documentation |
-| [#1160](https://github.com/actions/cache/pull/1160) | rikhuijzer | 2023-04-24 | 1011 | Documentation |
-| [#1159](https://github.com/actions/cache/pull/1159) | rodrigoalcarazdelaosa | 2023-04-23 | 1012 | Documentation |
-| [#1096](https://github.com/actions/cache/pull/1096) | Lord-Kamina | 2023-01-31 | 1094 | New feature |
-| [#876](https://github.com/actions/cache/pull/876) | bchen1029 | 2022-07-26 | 1283 | Bug fix |
-| [#726](https://github.com/actions/cache/pull/726) | robinp | 2022-02-05 | 1454 | Documentation |
-| [#717](https://github.com/actions/cache/pull/717) | jsoref | 2022-01-23 | 1467 | New feature |
-| [#677](https://github.com/actions/cache/pull/677) | planetmarshall | 2021-11-14 | 1537 | Documentation |
-| [#673](https://github.com/actions/cache/pull/673) | TimoRoth | 2021-11-08 | 1543 | New feature |
-| [#557](https://github.com/actions/cache/pull/557) | melvyn-apryl | 2021-03-27 | 1769 | Documentation |
-| [#498](https://github.com/actions/cache/pull/498) | eyal0 | 2021-01-04 | 1851 | New feature |
-| [#402](https://github.com/actions/cache/pull/402) | vlsi | 2020-08-19 | 1989 | Documentation |
-| [#325](https://github.com/actions/cache/pull/325) | mzabaluev | 2020-05-24 | 2076 | Documentation |
-| [#268](https://github.com/actions/cache/pull/268) | FinalDes | 2020-04-21 | 2109 | Documentation |
-| [#234](https://github.com/actions/cache/pull/234) | evandrocoan | 2020-03-27 | 2134 | Documentation |
-
-## Summary by Category
-
-| Category | Count |
-|----------|-------|
-| Documentation | 31 |
-| New feature | 11 |
-| Bug fix | 3 |
-| Other | 4 |
-| Security fix | 1 |
-| Spam candidate | 1 |
-| **Total** | **51** |
-
-## Category Definitions
-
- **New feature**: PRs that add new functionality or capabilities to the cache action
- **Bug fix**: PRs that fix issues or incorrect behavior in the existing code
- **Security fix**: PRs that address security concerns or add security-related documentation
- **Documentation**: PRs that add/update README, examples, or other documentation
- **Spam candidate**: PRs with unclear purpose, incomplete/garbled content, or no meaningful changes
- **Other**: PRs that don't fit into the above categories (e.g., refactoring, dependency updates)
-
-## Detailed Analysis Notes
-
-### Documentation PRs (31)
-Most open PRs are documentation improvements, including:
- New caching examples (pnpm, opam, Docker, ASDF, Bazel, Hugo, Dart, etc.)
- Clarifications on existing behavior (path matching, cache-hit output, key rendering)
- Updated links and references
- README improvements
-
-### New Feature PRs (11)
-Feature requests include:
- Conditional save options (`save-on-success`, `save` input)
- Force-overwrite capability for existing caches
- New outputs (cachePath, cache-primary-key)
- Compression level control
- Cache refresh/update mechanisms
-
-### Bug Fix PRs (3)
- #1337: Adjusts storage warning message with incorrect limit
- #1183: Fixes cabal store path for Ubuntu
- #876: Fixes cache-hit value when cache not found
-
-### Security Fix PRs (1)
- #1536: Adds recommended minimum permissions to README (by GitHub staff member)
-
-### Spam Candidate PRs (1)
- #1184: Unclear PR with garbled Turkish text in title, renames file with no meaningful changes
-
-### Other PRs (4)
- #1700: This current WIP triage PR
- #1378: Bumps action versions in examples
- #1374: Code refactoring (avoids re-evaluation of key input)
- #1231: Updates actions/checkout to v4 in workflows
@@ -33,7 +33,7 @@ If you do not upgrade, all workflow runs using any of the deprecated [actions/ca

 Upgrading to the recommended versions will not break your workflows.

-> **Additionally, if you are managing your own GitHub runners, you must update your runner version to `2.231.0` or newer to ensure compatibility with the new cache service.**  
+> **Additionally, if you are managing your own GitHub runners, you must update your runner version to `2.231.0` or newer to ensure compatibility with the new cache service.**
 > Failure to update both the action version and your runner version may result in workflow failures after the migration date.

 Read more about the change & access the migration guide: [reference to the announcement](https://github.com/actions/cache/discussions/1510).
@@ -109,6 +109,14 @@ The cache is scoped to the key, [version](#cache-version), and branch. The defau

 See [Matching a cache key](https://help.github.com/en/actions/configuring-and-managing-workflows/caching-dependencies-to-speed-up-workflows#matching-a-cache-key) for more info.

+### Read-only access
+
+Some workflow runs only have read-only access to the cache. A common case is a workflow triggered by a pull request from a fork: such runs can **restore** existing caches but may not be permitted to **save** new ones.
+
+When the cache token is read-only, the save step does not fail the job. Instead, `@actions/cache` reports the denial once as a warning (for example, `Failed to save: ... cache write denied: ...`) and the step completes successfully without writing a cache entry. Restores in the same run continue to work as usual.
+
+> **Note** This applies to the action's normal save path as well as the standalone [Save action](./save/README.md). If you intentionally want a restore-only setup, see [Make cache read only / Reuse cache from centralized job](./caching-strategies.md#make-cache-read-only--reuse-cache-from-centralized-job).
+
 ### Example cache workflow

 #### Restoring and saving cache using a single action
@@ -351,7 +359,7 @@ Please note that Windows environment variables (like `%LocalAppData%`) will NOT

 ## Note

-Thank you for your interest in this GitHub repo, however, right now we are not taking contributions. 
+Thank you for your interest in this GitHub repo, however, right now we are not taking contributions.

 We continue to focus our resources on strategic areas that help our customers be successful while making developers' lives easier. While GitHub Actions remains a key part of this vision, we are allocating resources towards other areas of Actions and are not taking contributions to this repository at this time. The GitHub public roadmap is the best place to follow along for any updates on features we’re working on and what stage they’re in.

@@ -369,4 +377,4 @@ You are welcome to still raise bugs in this repo.

 ## License

-The scripts and documentation in this project are released under the [MIT License](LICENSE)
+The scripts and documentation in this project are released under the [MIT License](LICENSE)
@@ -2,7 +2,7 @@

 ## How to prepare a release

-> [!NOTE]  
+> [!NOTE]
 > Relevant for maintainers with write access only.

 1. Switch to a new branch from `main`.
@@ -21,10 +21,21 @@
    1. Publish the release.
 1. Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
    1. There should be a workflow run queued with the same version number.
-    1. Approve the run to publish the new version and update the major tags for this action. 
+    1. Approve the run to publish the new version and update the major tags for this action.

 ## Changelog

+### 5.1.0
+
+- Bump `@actions/cache` to v5.1.0 to pick up [actions/toolkit#2435 Handle cache write error due to read-only token](https://github.com/actions/toolkit/pull/2435)
+- Switch redundant "Cache save failed" warning to debug log in save-only
+
+### 5.0.4
+
+- Bump `minimatch` to v3.1.5 (fixes ReDoS via globstar patterns)
+- Bump `undici` to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
+- Bump `fast-xml-parser` to v5.5.6
+
 ### 5.0.3

 - Bump `@actions/cache` to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)
@@ -105,8 +105,10 @@ test("save with valid inputs uploads a cache", async () => {
    expect(failedMock).toHaveBeenCalledTimes(0);
 });

-test("save failing logs the warning message", async () => {
+test("save failing logs the debug message", async () => {
+    const debugMock = jest.spyOn(core, "debug");
    const warningMock = jest.spyOn(core, "warning");
+    const failedMock = jest.spyOn(core, "setFailed");

    const primaryKey = "Linux-node-bb828da54c148048dd17899ba9fda624811cfb43";

@@ -115,6 +117,9 @@ test("save failing logs the warning message", async () => {
    testUtils.setInput(Inputs.Path, inputPath);
    testUtils.setInput(Inputs.UploadChunkSize, "4000000");

+    // A read-only / write-denied save surfaces to the action as saveCache resolving
+    // to -1; the toolkit has already logged the underlying reason. The action
+    // must not fail the job or emit its own warning.
    const cacheId = -1;
    const saveCacheMock = jest
        .spyOn(cache, "saveCache")
@@ -134,6 +139,7 @@ test("save failing logs the warning message", async () => {
        false
    );

-    expect(warningMock).toHaveBeenCalledTimes(1);
-    expect(warningMock).toHaveBeenCalledWith("Cache save failed.");
+    expect(debugMock).toHaveBeenCalledWith("Cache was not saved.");
+    expect(warningMock).not.toHaveBeenCalled();
+    expect(failedMock).not.toHaveBeenCalled();
 });
@@ -49,7 +49,7 @@
  with:
    path: |
      ~/.bun/install/cache
-    key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lockb') }}
+    key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
 ```

 ### Windows
@@ -59,7 +59,7 @@
  with:
    path: |
      ~\.bun
-    key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lockb') }}
+    key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
 ```

 ## C# - NuGet
@@ -1,15 +1,15 @@
 {
  "name": "cache",
-  "version": "5.0.2",
+  "version": "5.1.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "cache",
-      "version": "5.0.2",
+      "version": "5.1.0",
      "license": "MIT",
      "dependencies": {
-        "@actions/cache": "^5.0.5",
+        "@actions/cache": "^5.1.0",
        "@actions/core": "^2.0.3",
        "@actions/exec": "^2.0.0",
        "@actions/io": "^2.0.0"
@@ -39,9 +39,9 @@
      }
    },
    "node_modules/@actions/cache": {
-      "version": "5.0.5",
-      "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-5.0.5.tgz",
-      "integrity": "sha512-jiQSg0gfd+C2KPgcmdCOq7dCuCIQQWQ4b1YfGIRaaA9w7PJbRwTOcCz4LiFEUnqZGf0ha/8OKL3BeNwetHzYsQ==",
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-5.1.0.tgz",
+      "integrity": "sha512-kTIj4YPrjjRPKSGlj7f8eq+Pijoy/SKBEbJcAwNsQTFGEF29NGqj1mqD02/PmhV6r4bRAixycexAWpmUJ2aCwg==",
      "license": "MIT",
      "dependencies": {
        "@actions/core": "^2.0.0",
@@ -1875,13 +1875,13 @@
      }
    },
    "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": {
-      "version": "9.0.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
-      "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
+      "version": "9.0.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
+      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
      "dev": true,
      "license": "ISC",
      "dependencies": {
-        "brace-expansion": "^2.0.1"
+        "brace-expansion": "^2.0.2"
      },
      "engines": {
        "node": ">=16 || 14 >=14.17"
@@ -1945,9 +1945,9 @@
      }
    },
    "node_modules/@typespec/ts-http-runtime": {
-      "version": "0.3.2",
-      "resolved": "https://registry.npmjs.org/@typespec/ts-http-runtime/-/ts-http-runtime-0.3.2.tgz",
-      "integrity": "sha512-IlqQ/Gv22xUC1r/WQm4StLkYQmaaTsXAhUVsNE0+xiyf0yRFiH5++q78U3bw6bLKDCTmh0uqKB9eG9+Bt75Dkg==",
+      "version": "0.3.5",
+      "resolved": "https://registry.npmjs.org/@typespec/ts-http-runtime/-/ts-http-runtime-0.3.5.tgz",
+      "integrity": "sha512-yURCknZhvywvQItHMMmFSo+fq5arCUIyz/CVk7jD89MSai7dkaX8ufjCWp3NttLojoTVbcE72ri+be/TnEbMHw==",
      "license": "MIT",
      "dependencies": {
        "http-proxy-agent": "^7.0.0",
@@ -2008,9 +2008,9 @@
      }
    },
    "node_modules/ajv": {
-      "version": "6.12.6",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
-      "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
+      "version": "6.14.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.14.0.tgz",
+      "integrity": "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -3741,10 +3741,10 @@
      "dev": true,
      "license": "MIT"
    },
-    "node_modules/fast-xml-parser": {
-      "version": "5.3.3",
-      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.3.3.tgz",
-      "integrity": "sha512-2O3dkPAAC6JavuMm8+4+pgTk+5hoAs+CjZ+sWcQLkX9+/tHRuTkQh/Oaifr8qDmZ8iEHb771Ea6G8CdwkrgvYA==",
+    "node_modules/fast-xml-builder": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.1.4.tgz",
+      "integrity": "sha512-f2jhpN4Eccy0/Uz9csxh3Nu6q4ErKxf0XIsasomfOihuSUa3/xw6w8dnOtCDgEItQFJG8KyXPzQXzcODDrrbOg==",
      "funding": [
        {
          "type": "github",
@@ -3753,7 +3753,24 @@
      ],
      "license": "MIT",
      "dependencies": {
-        "strnum": "^2.1.0"
+        "path-expression-matcher": "^1.1.3"
+      }
+    },
+    "node_modules/fast-xml-parser": {
+      "version": "5.5.6",
+      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.5.6.tgz",
+      "integrity": "sha512-3+fdZyBRVg29n4rXP0joHthhcHdPUHaIC16cuyyd1iLsuaO6Vea36MPrxgAzbZna8lhvZeRL8Bc9GP56/J9xEw==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "fast-xml-builder": "^1.1.4",
+        "path-expression-matcher": "^1.1.3",
+        "strnum": "^2.1.2"
      },
      "bin": {
        "fxparser": "src/cli/cli.js"
@@ -3838,9 +3855,9 @@
      }
    },
    "node_modules/flatted": {
-      "version": "3.3.3",
-      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.3.3.tgz",
-      "integrity": "sha512-GX+ysw4PBCz0PzosHDepZGANEuFCMLrnRTiEy9McGjmkCQYwRq4A/X786G/fjM/+OjsWSU1ZrY5qyARZmO/uwg==",
+      "version": "3.4.2",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.2.tgz",
+      "integrity": "sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==",
      "dev": true,
      "license": "ISC"
    },
@@ -5805,9 +5822,9 @@
      }
    },
    "node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
      "license": "ISC",
      "dependencies": {
        "brace-expansion": "^1.1.7"
@@ -6141,6 +6158,21 @@
        "node": ">=8"
      }
    },
+    "node_modules/path-expression-matcher": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/path-expression-matcher/-/path-expression-matcher-1.1.3.tgz",
+      "integrity": "sha512-qdVgY8KXmVdJZRSS1JdEPOKPdTiEK/pi0RkcT2sw1RhXxohdujUlJFPuS1TSkevZ9vzd3ZlL7ULl1MHGTApKzQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
    "node_modules/path-is-absolute": {
      "version": "1.0.1",
      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
@@ -7462,9 +7494,9 @@
      }
    },
    "node_modules/undici": {
-      "version": "6.23.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.23.0.tgz",
-      "integrity": "sha512-VfQPToRA5FZs/qJxLIinmU59u0r7LXqoJkCzinq3ckNJp3vKEh7jTWN589YQ5+aoAC/TGRLyJLCPKcLQbM8r9g==",
+      "version": "6.24.1",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.24.1.tgz",
+      "integrity": "sha512-sC+b0tB1whOCzbtlx20fx3WgCXwkW627p4EA9uM+/tNNPkSS+eSEld6pAs9nDv7WbY1UUljBMYPtu9BCOrCWKA==",
      "license": "MIT",
      "engines": {
        "node": ">=18.17"
@@ -1,6 +1,6 @@
 {
  "name": "cache",
-  "version": "5.0.3",
+  "version": "5.1.0",
  "private": true,
  "description": "Cache dependencies and build outputs",
  "main": "dist/restore/index.js",
@@ -23,7 +23,7 @@
  "author": "GitHub",
  "license": "MIT",
  "dependencies": {
-    "@actions/cache": "^5.0.5",
+    "@actions/cache": "^5.1.0",
    "@actions/core": "^2.0.3",
    "@actions/exec": "^2.0.0",
    "@actions/io": "^2.0.0"
@@ -51,4 +51,4 @@
  "engines": {
    "node": ">=24"
  }
-}
+}
@@ -84,7 +84,11 @@ export async function saveOnlyRun(
    try {
        const cacheId = await saveImpl(new NullStateProvider());
        if (cacheId === -1) {
-            core.warning(`Cache save failed.`);
+            // The toolkit's saveCache already logs the underlying reason at
+            // the appropriate severity (warning for most failures, info for
+            // benign concurrency races, error for 5xx). Avoid emitting a
+            // generic warning here that would duplicate or mask that signal.
+            core.debug(`Cache was not saved.`);
        }
    } catch (err) {
        console.error(err);
Author	SHA1	Message	Date
Daniel Kennedy	caa2961268	Merge pull request #1775 from jasongin/readonly-cache-v5 Bump @actions/cache to v5.1.0 - handle read-only cache access	2026-06-26 15:14:19 -04:00
Jason Ginchereau	00c2da95da	Bump @actions/cache to v5.1.0 - handle read-only cache access	2026-06-26 12:05:30 -07:00
Yang Cao	27d5ce7f10	Merge pull request #1747 from actions/yacaovsnc/update-dependency Update ts-http-runtime dependency	2026-04-13 11:36:02 -04:00
Yang Cao	f280785d7b	licensed changes	2026-04-13 11:30:08 -04:00
Yang Cao	619aeb1606	npm run build generated dist files	2026-04-13 11:17:26 -04:00
Yang Cao	bcf16c2893	Update ts-http-runtime to 0.3.5	2026-04-13 11:14:40 -04:00
Bassem Dghaidi	668228422a	Merge pull request #1738 from actions/prepare-v5.0.4 Update dependencies & patch security vulnerabilities	2026-03-18 16:03:49 +01:00
Bassem Dghaidi	e34039626f	Update RELEASES	2026-03-18 07:03:52 -07:00
Bassem Dghaidi	8a67110529	Add licenses	2026-03-18 06:34:30 -07:00
Bassem Dghaidi	1865903e1b	Update dependencies & patch security vulnerabilities	2026-03-18 06:29:24 -07:00
Ryan Ghadimi	5656298164	Merge pull request #1722 from RyPeck/patch-1 Fix cache key in examples.md for bun.lock	2026-02-24 14:21:04 +00:00
Ryan Peck	4e380d19e1	Fix cache key in examples.md for bun.lock Updated cache key to use 'bun.lock' instead of 'bun.lockb' for consistency.	2026-02-24 09:11:36 -05:00
Bassem Dghaidi	b7e8d49f17	Merge pull request #1701 from actions/Link-/fix-proxy-integration-tests Fix proxy integration tests	2026-01-30 16:37:01 +01:00
Bassem Dghaidi	984a21b1cb	Add traffic sanity check step	2026-01-30 02:05:51 -08:00
Bassem Dghaidi	acf2f1f76a	Fix resolution	2026-01-30 02:03:12 -08:00
Bassem Dghaidi	95a07c5132	Add wait for proxy	2026-01-30 02:00:09 -08:00
Bassem Dghaidi	90e4fae240	Rewrite and simplify	2026-01-30 01:56:07 -08:00