GitHub Actions Adds cache-mode: An Audit Plan for Proxy Test Pipelines

GitHub announced on September 10, 2026 that Actions now supports cache-mode at workflow and job level. The control is generally available on all GitHub plans and lets operators choose whether a workflow may restore cache entries, save them, do both, or access no cache.

This is a GitHub capability, not a new 98IP product feature. It matters to proxy-enabled test systems because browser binaries, package stores, compiled clients and test fixtures are often cached to shorten global CI runs. If low-trust events can write reusable cache state, a later trusted job may consume artifacts it did not intend to trust.

Public source note: GitHub, “Control GitHub Actions cache access with cache-mode,” September 10, 2026.

What GitHub changed

GitHub documents four access modes:

GitHub says read is the default for low-trust events such as pull_request_target, while write is the default for trusted events such as push. Job-level settings override workflow-level settings. The permission also carries through reusable workflows: a called workflow cannot receive more cache access than its caller granted.

An explicit setting can override defaults. GitHub warns when write or write-only is explicitly granted to a low-trust event because doing so can increase cache-poisoning risk. Existing workflows without cache-mode continue to use the existing secure defaults.

Why proxy test pipelines need a cache boundary

An authorized proxy test workflow may cache:

• package-manager downloads and compiled dependencies;
• browser engines, drivers and fonts;
• network-test clients and certificate bundles;
• sanitized test fixtures;
• build outputs used by multiple regions;
• connection or performance baselines.

It should never cache live proxy credentials, cookies, session tokens, captured authorization headers, raw customer payloads or residential exit addresses. A cache is optimized for reuse, so it is the wrong place for secrets and mutable identity state.

The security question is not only “who can run this job?” It is also “can this event save an artifact that a more trusted job will later restore?”

Inventory event trust before choosing a mode

List every trigger and reusable workflow edge:

workflow_name
event_name
source_repository
source_ref
permissions
cache_mode
cache_key_inputs
restore_key_scope
reusable_workflow_chain
secret_access
deployment_access

Pay special attention to fork-originated pull requests, pull_request_target, manual dispatch with user-controlled inputs, scheduled jobs that restore broad keys, and reusable workflows called from repositories with different trust levels.

Do not infer safety from a friendly branch name. Base decisions on the event context, repository relationship, protected environment rules and exact cache permissions.

Map modes to proxy CI jobs

Dependency validation from an untrusted contribution

Use read only when the job needs a known cache and must not change it. Keep secrets unavailable, avoid proxy production credentials and ensure the cache key cannot select unrelated trusted artifacts through overly broad restore prefixes.

Trusted default-branch build

write may be appropriate when protected branch controls, reviewed code and scoped credentials are in place. The job should own a narrowly namespaced cache and publish only reproducible dependencies or build outputs.

Regional artifact producer

write-only can help when a job generates a fresh benchmark bundle but must not consume older state. Validate the output before another job is allowed to restore it.

Live network or credential test

Use none when isolation is more important than speed. A job that exercises authentication, cookie boundaries, certificate changes or one-time incident fixtures should start clean and write no reusable state.

Pair these choices with the proxy credential rotation guide so long-lived caches cannot outlast authentication changes.

Design narrow cache keys

Least-privilege mode does not repair an unsafe key. Include the dimensions that change artifact trust or compatibility:

repository / workflow / operating_system / architecture /
runtime_version / lockfile_digest / artifact_purpose

Do not include secrets in cache keys. Do not use raw proxy usernames, passwords, tokens, cookies or exit IPs as key material. Avoid broad restore prefixes that let unrelated workflows fall back to a shared entry.

Treat browser and proxy-client versions as meaningful boundaries. An old client can behave differently in DNS resolution, TLS validation, connection reuse or HTTP/2 multiplexing. The curl 8.22 multiplexed connection-age review illustrates why client version and connection behavior belong in validation evidence.

Separate fixtures from observations

Static, reviewed fixtures may be cacheable. Runtime observations usually are not.

Cacheable examples include a public test-page snapshot created for deterministic parsing, a pinned browser archive checksum list or a compiled test harness. Non-cacheable examples include live responses, customer URLs, session cookies, exit mappings, temporary allowlists and incident packet captures.

Store live observations in a retention-controlled evidence system with access logging. Sanitize identifiers and use keyed fingerprints where correlation is necessary.

Audit reusable workflows

GitHub states that a called reusable workflow cannot gain more cache access than its caller. Verify the full call chain anyway:

1. identify the initiating event and repository;
2. record the caller’s workflow-level mode;
3. record every job-level override;
4. follow reusable-workflow calls;
5. confirm the effective mode at each job;
6. test a low-trust caller and prove it cannot save;
7. test a none job and prove it cannot restore or save.

Also review action versions. Pin third-party actions according to your supply-chain policy, minimize token permissions and avoid exposing proxy credentials to jobs that do not require them.

Build a safe regression test

Use a disposable repository and synthetic, non-secret artifacts.

1. A trusted job saves a marker under a narrow cache key.
2. A low-trust test with read restores the marker.
3. That test attempts to replace the marker and must fail to save.
4. A write-only job proves it cannot restore the old marker, then saves a new isolated entry.
5. A none job proves both restore and save are unavailable.
6. A reusable workflow proves its effective access never exceeds the caller.
7. A later trusted job confirms the approved entry was not modified by the low-trust run.

Do not run the regression with real secrets or production proxy accounts. A cache-permission test should remain useful even if every artifact becomes public.

Rollout and monitoring

Start by declaring cache-mode explicitly on the highest-risk workflows. Monitor cache hit rate, build duration, download volume, save failures, warning annotations and test-result consistency. Performance may change when isolation removes broad restores; measure the cost rather than weakening the boundary without review.

For geographically distributed workers, compare results by region and address family but keep cache trust separate from proxy route health. A build cache miss is not a proxy failure. The proxy pool quarantine and recovery guide provides a separate state model for unhealthy exits.

Review checklist

• [ ] Every trigger has an explicit trust classification.
• [ ] Low-trust events cannot save reusable cache entries.
• [ ] Sensitive network tests use none where appropriate.
• [ ] Cache keys are narrow and contain no secrets.
• [ ] Broad restore prefixes have been removed or justified.
• [ ] Reusable workflow chains preserve the caller ceiling.
• [ ] Live credentials, cookies and responses are never cached.
• [ ] Action and runtime versions are pinned or controlled.
• [ ] Synthetic tests prove each mode’s effective behavior.
• [ ] Build-performance changes are measured after rollout.

FAQ

Does read make an untrusted job fully safe?

No. It prevents cache saves but does not replace secret isolation, minimal token permissions, action pinning, input validation and protected environments.

Should every proxy test disable caching?

No. Reviewed dependencies and deterministic artifacts can benefit from caching. Use none for jobs where reusable state conflicts with authentication, privacy or incident-isolation requirements.

Can cache-mode protect secrets stored inside a cache?

It reduces access paths but does not make caching secrets acceptable. Credentials, cookies and tokens should not be placed in cache entries.

Does a cache miss prove the proxy failed?

No. Cache service access, dependency downloads, proxy transport and destination behavior are separate stages and require separate telemetry.

Compliance note

Run proxy and data-collection tests only against resources and destinations you are authorized to use. Respect repository policies, software licenses, destination terms, privacy rules and rate limits. Keep credentials out of caches and logs, and never use proxy routing to evade an access decision.