---
title: "Build releases without a shared cache · Agent Wranglers"
url: https://agentwranglers.se/playbook/engineering/ci-and-supply-chain/no-cache-in-release-builds
id: ENG-57
level: Recommended
updated: 2026-10-27
build: a2a6bdfed830
tokens: 836
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Build releases without a shared cache

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [CI and supply chain](https://agentwranglers.se/playbook/engineering/ci-and-supply-chain.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: ENG-57
- Level: Recommended
- Chapter: [CI and supply chain](https://agentwranglers.se/playbook/engineering/ci-and-supply-chain.md)
- Rule: Build every release from a clean install from the lock file. Never restore a cache in a release job that other workflows can write.
- Check: A search of the release workflow finds no `actions/cache` step and no `cache:` key. The release log shows a full install from the lock file.
- How: CI caches are shared by key across the workflows of a branch. A job that runs fork code with write rights, such as one on `pull_request_target`, can save a poisoned cache entry. GitHub's docs note that such jobs "share the same cache of the main branch with other privileged workflow triggers". The release job then restores the entry and ships the attacker's files. Remove every cache step and cache option from the release workflow. Keep caches in check jobs, where speed matters and nothing ships. Build releases only in CI, as [Build releases only in CI and verify them before deploy](https://agentwranglers.se/playbook/engineering/ci-and-supply-chain/build-in-ci-and-verify.md) says, and repeatably, as [Make builds repeatable](https://agentwranglers.se/playbook/engineering/ci-and-supply-chain/reproducible-builds.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Shell example

```sh
# CI gate: the release workflow restores no cache
if grep -nE 'actions/cache|^\s*cache(-dependency-path)?:' .github/workflows/release.yml .gitlab-ci.yml 2>/dev/null; then
  echo "FAIL: release build restores a cache"; exit 1
fi
```

## Sources

- [GitHub: Secure use reference](https://docs.github.com/en/actions/reference/security/secure-use)

## Related rules

- ENG-11 [Build releases only in CI and verify them before deploy](https://agentwranglers.se/playbook/engineering/ci-and-supply-chain/build-in-ci-and-verify.md) in Engineering
- ENG-21 [Pin every version so builds repeat](https://agentwranglers.se/playbook/engineering/ci-and-supply-chain/reproducible-builds.md) in Engineering

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/engineering/ci-and-supply-chain/no-cache-in-release-builds">Agent Wranglers engineering playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Make release tags and files immutable](https://agentwranglers.se/playbook/engineering/ci-and-supply-chain/immutable-releases.md)
- Next: [Lock every CI action and its dependencies to a reviewed commit](https://agentwranglers.se/playbook/engineering/ci-and-supply-chain/ci-dependency-lock.md)
- [CI and supply chain](https://agentwranglers.se/playbook/engineering/ci-and-supply-chain.md)