You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+19-5Lines changed: 19 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,6 +12,16 @@ This action provides the following functionality for GitHub Actions users:
12
12
- Registering problem matchers for error output
13
13
- Configuring authentication for GPR or npm
14
14
15
+
## Breaking changes in V5
16
+
17
+
- Enabled caching by default with package manager detection if no cache input is provided.
18
+
> For workflows with elevated privileges or access to sensitive information, we recommend disabling automatic caching by setting `package-manager-cache: false` when caching is not needed for secure operation.
19
+
20
+
- Upgraded action from node20 to node24.
21
+
> Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. [See Release Notes](https://github.com/actions/runner/releases/tag/v2.327.1)
22
+
23
+
For more details, see the full release notes on the [releases page](https://github.com/actions/setup-node/releases/v5.0.0)
24
+
15
25
## Usage
16
26
17
27
See [action.yml](action.yml)
@@ -57,6 +67,10 @@ See [action.yml](action.yml)
57
67
# Default: ''
58
68
cache: ''
59
69
70
+
# Used to disable automatic caching based on the package manager field in package.json. By default, caching is enabled if the package manager field is present and no cache input is provided'
71
+
# default: true
72
+
package-manager-cache: true
73
+
60
74
# Used to specify the path to a dependency file: package-lock.json, yarn.lock, etc.
61
75
# It will generate hash from the target file for primary key. It works only If cache is specified.
62
76
# Supports wildcards or a list of file names for caching multiple dependencies.
@@ -137,17 +151,17 @@ It's **always** recommended to commit the lockfile of your package manager for s
137
151
138
152
The action has a built-in functionality for caching and restoring dependencies. It uses [actions/cache](https://github.com/actions/cache) under the hood for caching global packages data but requires less configuration settings. Supported package managers are `npm`, `yarn`, `pnpm` (v6.10+). The `cache` input is optional.
139
153
140
-
Caching is turned on by default when a `packageManager` field is detected in the `package.json` file. The `package-manager-cache` input provides control over this automatic caching behavior. By default, `package-manager-cache` is set to `true`, which enables caching when a valid package manager field is detected in the `package.json` file. To disable this automatic caching, set the `package-manager-cache` input to `false`.
154
+
Caching is turned on by default when a `packageManager` field is detected in the `package.json` file and no `cache` input is provided. The `package-manager-cache` input provides control over this automatic caching behavior. By default, `package-manager-cache` is set to `true`, which enables caching when a valid package manager field is detected in the `package.json` file. To disable this automatic caching, set the `package-manager-cache` input to `false`.
141
155
142
156
```yaml
143
157
steps:
144
-
- uses: actions/checkout@v4
145
-
- uses: actions/setup-node@v4
158
+
- uses: actions/checkout@v5
159
+
- uses: actions/setup-node@v5
146
160
with:
147
161
package-manager-cache: false
148
162
- run: npm ci
149
163
```
150
-
> If no valid `packageManager` field is detected in the `package.json` file, caching will remain disabled unless explicitly configured.
164
+
> If no valid `packageManager` field is detected in the `package.json` file, caching will remain disabled unless explicitly configured. For workflows with elevated privileges or access to sensitive information, we recommend disabling automatic caching by setting `package-manager-cache: false` when caching is not needed for secure operation.
151
165
152
166
The action defaults to search for the dependency file (`package-lock.json`, `npm-shrinkwrap.json` or `yarn.lock`) in the repository root, and uses its hash as a part of the cache key. Use `cache-dependency-path` for cases when multiple dependency files are used, or they are located in different subdirectories.
153
167
@@ -250,4 +264,4 @@ Contributions are welcome! See [Contributor's Guide](docs/contributors.md)
250
264
251
265
## Code of Conduct
252
266
253
-
:wave: Be nice. See [our code of conduct](CODE_OF_CONDUCT.md)
267
+
:wave: Be nice. See [our code of conduct](CODE_OF_CONDUCT.md)
0 commit comments