GitHub Actions cache-mode is GA, giving per-job read, write, write-only or none access to caches
GitHub Changelog·medium signal
GitHub made `cache-mode` generally available on all GitHub.com plans on 2026-09-10, with values `read`, `write`, `write-only` and `none`. Low-trust events default to read and trusted events to write, job-level settings override workflow-level ones, and reusable workflows can't exceed the caller's grant. GitHub warns when write access is granted to risky events like `pull_request_target`, the usual route for cache poisoning.