github GitHub Changelog ·

Control GitHub Actions Cache Access with cache-mode

securitygaengineer
feature

GitHub Actions now supports `cache-mode`, allowing granular control over cache access at the workflow or job level. This feature enables applying least-privilege access, preventing unnecessary restores or saves, and protecting against cache poisoning. It introduces `read`, `write`, `write-only`, and `none` modes, with job-level settings overriding workflow-level configurations. This capability is generally available on all GitHub plans.

Features (1)
  • Granular Cache Access Control with cache-mode

    The new `cache-mode` feature for GitHub Actions allows users to specify `read`, `write`, `write-only`, or `none` cache access at the workflow or job level. This enables least-privilege access, mitigates cache poisoning risks, and helps optimize build times by preventing unnecessary cache operations. The selected mode is enforced by the cache service and propagates through reusable workflows.

Read the original announcement →

https://github.blog/changelog/2026-09-10-control-github-actions-cache-access-with-cache-mode

Related releases