From 8e16c0f39e3544bb3207c096e5d39fdeb7bfffc2 Mon Sep 17 00:00:00 2001
From: Wojciech Maj <kontakt@wojtekmaj.pl>
Date: Tue, 12 May 2026 12:20:02 +0200
Subject: [PATCH] Remove dependency cache from publish workflow

See: https://bsky.app/profile/sebastienlorber.com/post/3mlnddggv6c2f
---
 .github/workflows/publish.yml | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 4521e99..55adba0 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -19,15 +19,8 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
 
-      - name: Cache Yarn cache
-        uses: actions/cache@v5
-        env:
-          cache-name: yarn-cache
-        with:
-          path: ~/.yarn/berry/cache
-          key: ${{ runner.os }}-${{ env.cache-name }}-${{ hashFiles('**/yarn.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-${{ env.cache-name }}
+      # ⚠️ Do not cache dependencies in publish workflows
+      # Restoring package-manager cache here increases the risk of a compromised release
 
       - name: Use Node.js
         uses: actions/setup-node@v6
-- 
2.51.2