GitHub Actions adds cache-mode to limit cache poisoning

GitHub Actions jobs can now set a cache-mode of read, write, write-only, or none, per GitHub's changelog post.

The setting targets pull_request_target workflows. Those run with access to secrets and a writable cache even when the triggering pull request comes from a fork. A malicious PR could poison a cache entry that a later, trusted run pulls from.

Low-trust events, the kind triggered by an external contributor's pull request, default to read-only access under the new setting.

Reusable workflows can't exceed whatever access the caller granted them.

GitHub now warns when a pull_request_target workflow has write access to the cache. A warning isn't a block, though. A workflow can still ship with write access wide open.

Maintainers of workflows that forks can trigger should set cache-mode: read on them. Fork PRs rarely need write access to the cache, and turning it off is about the cheapest defense against cache poisoning available right now. Check reusable workflows next. One that used to assume write access may need an explicit read setting now, or it keeps whatever access the caller already had.