cipherstash · tobyhede · Aug 6, 2026
@@ -0,0 +1,18 @@
+---
+'stash': patch
+---
+
+Correct the release-workflow section of the bundled `stash-supply-chain-security`
+skill. It described the no-Actions-cache rule as a property of one file — "no
+`cache:`, `package-manager-cache: false`, `pnpm/action-setup` with
+`cache: false`" — which is no longer the whole rule.
+
+The gate now follows any local composite action or reusable workflow the job
+reaches, so the constraint is on the whole call tree rather than the workflow
+file. And every published `uses:` must appear in the script's `AUDITED_ACTIONS`
+allowlist: the check cannot open a published action to prove it does not cache,
+and caching actions are not reliably named — a `setup-<tool>` action that caches
+by default has no `cache:` input and nothing in its name to match. The list is
+therefore what is permitted, not what is forbidden, and adding a step to
+`release.yml` or `tests-supply-chain.yml` means auditing the action and adding
+it there in the same PR.
@@ -20,7 +20,7 @@ runs:
     - name: Checkout Repo
       uses: actions/checkout@v6
 
-    - uses: pnpm/action-setup@v6.0.8
+    - uses: pnpm/action-setup@v6.0.9
       name: Install pnpm
       with:
         run_install: false

@@ -0,0 +1,27 @@
+# Over-trigger guard. Every `uses:` here is on the allowlist and none of them
+# caches, so the gate must stay silent — including on `changesets/action`,
+# which is real (release.yml's publish step), third-party, and has nothing to
+# do with caching. A rule that fired here would fire on the live release
+# workflow.
+name: Audited Actions
+on:
+  push:
+    tags: ['v*']
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v6
+        with:
+          run_install: false
+          cache: false
+      - name: Install Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          package-manager-cache: false
+      - name: Publish to npm
+        uses: changesets/action@v1.9.0
+        with:
+          publish: pnpm run release
@@ -0,0 +1,17 @@
+# Three more vendors, none of them first-party, none with a `cache:` input.
+# The point is that no rule keyed on a list of known cache actions would have
+# had these on it — the list is open-ended and grows without this repo hearing
+# about it.
+name: Cache Family
+on:
+  push:
+    tags: ['v*']
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: buildjet/cache@v4
+      - uses: runs-on/cache@v4
+      - uses: tespkg/actions-cache@v1
+      - run: pnpm changeset:publish
@@ -0,0 +1,10 @@
+name: Cachey Restore
+description: Restore-only half of the GitHub Actions cache.
+runs:
+  using: composite
+  steps:
+    - name: Restore the compiled binding
+      uses: actions/cache/restore@v4
+      with:
+        path: index.node
+        key: binding-${{ runner.os }}
@@ -0,0 +1,10 @@
+name: Cachey Save
+description: Save-only half of the GitHub Actions cache.
+runs:
+  using: composite
+  steps:
+    - name: Save the compiled binding
+      uses: actions/cache/save@v4
+      with:
+        path: index.node
+        key: binding-${{ runner.os }}
@@ -0,0 +1,13 @@
+name: Cachey
+description: Restores a build artifact from the GitHub Actions cache.
+runs:
+  using: composite
+  steps:
+    - name: Restore the compiled binding
+      uses: actions/cache@v4
+      with:
+        path: index.node
+        key: binding-${{ runner.os }}
+    - name: Build the binding
+      shell: bash
+      run: echo build
@@ -0,0 +1,16 @@
+name: Clean Composite
+description: Sets up the toolchain with every cache explicitly disabled.
+runs:
+  using: composite
+  steps:
+    - uses: pnpm/action-setup@v6
+      with:
+        run_install: false
+        cache: false
+    - name: Install Node.js
+      uses: actions/setup-node@v6
+      with:
+        node-version: 22
+        package-manager-cache: false
+    - shell: bash
+      run: pnpm install --frozen-lockfile
@@ -0,0 +1,7 @@
+name: Loop A
+description: Half of a cyclic composite reference.
+runs:
+  using: composite
+  steps:
+    - name: Hand off to B
+      uses: ./.github/actions/loop-b
@@ -0,0 +1,12 @@
+name: Loop B
+description: Half of a cyclic composite reference, and it caches.
+runs:
+  using: composite
+  steps:
+    - name: Restore the compiled binding
+      uses: actions/cache@v4
+      with:
+        path: index.node
+        key: binding-${{ runner.os }}
+    - name: Hand back to A
+      uses: ./.github/actions/loop-a
@@ -0,0 +1,12 @@
+name: Missing Explicit False
+description: Sets up the toolchain but never says what it wants from the cache.
+runs:
+  using: composite
+  steps:
+    - uses: pnpm/action-setup@v6
+      with:
+        run_install: false
+    - name: Install Node.js
+      uses: actions/setup-node@v6
+      with:
+        node-version: 22
@@ -0,0 +1,7 @@
+name: Outer
+description: A composite whose only job is to call another composite.
+runs:
+  using: composite
+  steps:
+    - name: Delegate to the inner composite
+      uses: ./.github/actions/cachey
@@ -0,0 +1,10 @@
+name: Setup Node With Cache
+description: Sets up Node with the package-manager cache switched on.
+runs:
+  using: composite
+  steps:
+    - name: Install Node.js
+      uses: actions/setup-node@v6
+      with:
+        node-version: 22
+        cache: 'pnpm'
@@ -0,0 +1,12 @@
+name: Third Party Cache
+description: Restores caches through actions that are not actions/cache.
+runs:
+  using: composite
+  steps:
+    - name: Restore the compiled binding
+      uses: useblacksmith/cache@v5
+      with:
+        path: index.node
+        key: binding-${{ runner.os }}
+    - name: Restore the Cargo build
+      uses: Swatinem/rust-cache@v2
@@ -0,0 +1,10 @@
+name: Yaml Ext
+description: Spelled `action.yaml`, which GitHub accepts alongside `action.yml`.
+runs:
+  using: composite
+  steps:
+    - name: Restore the compiled binding
+      uses: actions/cache@v4
+      with:
+        path: index.node
+        key: binding-${{ runner.os }}
@@ -0,0 +1,12 @@
+name: Composite Cache Restore
+on:
+  push:
+    branches: [main]
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Build the protect-ffi binding
+        uses: ./.github/actions/cachey-restore
+      - run: pnpm publish --no-git-checks
@@ -0,0 +1,12 @@
+name: Composite Cache Save
+on:
+  push:
+    branches: [main]
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Build the protect-ffi binding
+        uses: ./.github/actions/cachey-save
+      - run: pnpm publish --no-git-checks
@@ -0,0 +1,12 @@
+name: Composite Cache
+on:
+  push:
+    branches: [main]
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Build the protect-ffi binding
+        uses: ./.github/actions/cachey
+      - run: pnpm publish --no-git-checks
@@ -0,0 +1,12 @@
+name: Composite Clean
+on:
+  push:
+    branches: [main]
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Build the protect-ffi binding
+        uses: ./.github/actions/clean-composite
+      - run: pnpm publish --no-git-checks
@@ -0,0 +1,12 @@
+name: Composite Cyclic
+on:
+  push:
+    branches: [main]
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Build the protect-ffi binding
+        uses: ./.github/actions/loop-a
+      - run: pnpm publish --no-git-checks
@@ -0,0 +1,16 @@
+# A quoted `uses:` with a leading space. GitHub trims it and resolves the
+# composite; an untrimmed match against `^\.{1,2}/` does not, so the composite
+# is never opened. Contrived on its own — but it was the one unfollowable local
+# reference that exited 0 rather than 2, and silent-pass is the wrong direction
+# for this gate.
+name: Composite Leading Space
+on:
+  push:
+    tags: ['v*']
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Build the protect-ffi binding
+        uses: ' ./.github/actions/cachey'
+      - run: pnpm changeset:publish
@@ -0,0 +1,12 @@
+name: Composite Missing Explicit False
+on:
+  push:
+    branches: [main]
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Build the protect-ffi binding
+        uses: ./.github/actions/missing-explicit-false
+      - run: pnpm publish --no-git-checks
@@ -0,0 +1,12 @@
+name: Composite Nested
+on:
+  push:
+    branches: [main]
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Build the protect-ffi binding
+        uses: ./.github/actions/outer
+      - run: pnpm publish --no-git-checks
@@ -0,0 +1,12 @@
+name: Composite Setup Node Cache
+on:
+  push:
+    branches: [main]
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Build the protect-ffi binding
+        uses: ./.github/actions/setup-node-cache
+      - run: pnpm publish --no-git-checks
@@ -0,0 +1,11 @@
+name: Composite Third Party Cache
+on:
+  push:
+    tags: ['v*']
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Build the protect-ffi binding
+        uses: ./.github/actions/thirdparty-cache
+      - run: pnpm changeset:publish
@@ -0,0 +1,12 @@
+name: Composite Unresolvable
+on:
+  push:
+    branches: [main]
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Build the protect-ffi binding
+        uses: ./.github/actions/no-such-action
+      - run: pnpm publish --no-git-checks
@@ -0,0 +1,12 @@
+name: Composite Yaml Ext
+on:
+  push:
+    branches: [main]
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Build the protect-ffi binding
+        uses: ./.github/actions/yaml-ext
+      - run: pnpm publish --no-git-checks
@@ -0,0 +1,16 @@
+name: Third Party Uses
+on:
+  push:
+    branches: [main]
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      # None of these is a local path, so none of them has an `action.yml` on
+      # this filesystem to open. A traversal that treats every `uses:` as a
+      # path fails here rather than on the composite fixtures.
+      - uses: actions/checkout@v6
+      - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
+      - uses: cipherstash/some-action/nested/path@v1
+      - uses: docker://alpine:3.19
+      - run: pnpm publish --no-git-checks
@@ -0,0 +1,10 @@
+name: Cachey
+description: Restores a build artifact from the GitHub Actions cache.
+runs:
+  using: composite
+  steps:
+    - name: Restore the compiled binding
+      uses: actions/cache@v4
+      with:
+        path: index.node
+        key: binding-${{ runner.os }}