From 9ab0dd592310bea1e835b5d08a99dda893a92ff0 Mon Sep 17 00:00:00 2001 From: Benoit Tigeot Date: Wed, 29 Jul 2026 16:49:11 +0200 Subject: [PATCH] ci: prevent cache poisoning in release-signed setup-go's cache restores from a key derived on go.sum contents, which a malicious PR could poison to smuggle tampered dependencies into a release build. Release jobs run rarely enough that the cache isn't worth the exposure. Signed-off-by: Benoit Tigeot --- .github/workflows/release-signed.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release-signed.yml b/.github/workflows/release-signed.yml index caf952a56..c08600ede 100644 --- a/.github/workflows/release-signed.yml +++ b/.github/workflows/release-signed.yml @@ -1,5 +1,5 @@ # -# PoC: signed release with SBOMs and build provenance. +# Signed release with SBOMs and build provenance. # Modeled on https://github.com/goreleaser/example-secure # name: release-signed @@ -32,6 +32,7 @@ jobs: with: go-version: '${{ env.GOLANG_VERSION }}' check-latest: true + cache: false - name: Install Cosign uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1