ci: set cache-mode on release workflows

[claude]

Requested by David Sanders · Slack thread

Before: Whether a release run touched the GitHub Actions cache depended on per-step configuration. The Release workflow (push to main / 3-x-y) has no explicit cache opt-out on its setup-node step, and the test job it calls via uses: ./.github/workflows/test.yml runs with whatever cache settings test.yml has. Nothing enforced a "no cache on release" intent at the workflow level, so a step or action that restored a cache entry during a publish would silently be allowed.

After: The Release workflow declares cache-mode: none at the top level, so every job in a release run — including the test jobs pulled in from test.yml via uses: — is denied cache access by the runner regardless of what individual steps or actions ask for. A denied cache restore logs a message and continues as a cache miss; a denied cache save logs and becomes a no-op, so the release does not fail because of this setting. PR CI (test.yml on its own triggers) is untouched and keeps caching as before.

GitHub's new workflow-level cache-mode key makes this a declarative, enforced setting rather than a convention (see changelog and workflow syntax reference), which closes the cache-poisoning avenue on the path that publishes to npm.

How: Adds cache-mode: none (with a one-line comment) directly after the top-level permissions: {} block in .github/workflows/release.yml. No other lines changed. The file parses as YAML and zizmor 1.30.1 accepts the new key with no new findings. Note that PR CI does not exercise the release workflow, so the first push to main that triggers a semantic release after merge is the real test of this change.

🤖 Generated with Claude Code

https://claude.ai/code/session_01MYe3WCXtgiqomNuVQdi4Yd

---

Generated by Claude Code

[electron-npm-package-publisher]

🎉 This PR is included in version 4.37.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀