GitHub Actions 9月10日：引入 cache-mode 控制缓存访问权限
Control GitHub Actions cache access with cache-mode
涉及 CI/CD 核心依赖的安全能力跃迁，建议读者检查并配置 cache-mode 以防范缓存投毒风险。
You can now use cache-mode to apply least-privilege access to the GitHub Actions cache at the workflow or job level. By granting each workflow or job only the cache access it needs, you can prevent unnecessary restores or saves and help protect trusted workflows from cache poisoning. This capability is now generally available on all plans.
您现在可以使用 cache-mode 在 workflow 或 job 级别对 GitHub Actions 缓存应用最小权限访问。通过仅授予每个 workflow 或 job 所需的缓存访问权限，您可以防止不必要的恢复或保存操作，并帮助保护受信任的 workflow 免受缓存投毒攻击。此功能现已在所有计划中全面可用。
Choose the access each workflow or job needs:
选择每个 workflow 或 job 所需的访问权限：
- read allows cache restores but prevents cache saves. This is the default for low-trust events such as pull_request_target.
- write allows cache restores and saves. This is the default for trusted events such as push.
- write-only allows cache saves but prevents cache restores.
- none prevents all cache access.
- read 允许缓存恢复但禁止缓存保存。这是针对低信任度事件（如 pull_request_target）的默认设置。
- write 允许缓存恢复和保存。这是针对受信任事件（如 push）的默认设置。
- write-only 允许缓存保存但禁止缓存恢复。
- none 禁止所有缓存访问。
Job-level settings override workflow-level settings. The selected mode is enforced by the cache service and carries through reusable workflows, where a called workflow cannot receive more cache access than its caller granted.
Job 级别的设置会覆盖 workflow 级别的设置。所选模式由缓存服务强制执行，并在可重用 workflow 中生效，其中被调用的 workflow 获得的缓存访问权限不能超过其调用者所授予的权限。
An explicitly declared cache-mode also overrides the read-only cache default for low-trust events such as pull_request_target. Declaring write or write-only for these events can increase the risk of cache poisoning, so GitHub Actions adds a warning annotation when the declared mode grants write access. Workflows that do not set cache-mode continue to use the existing secure defaults.
显式声明的 cache-mode 也会覆盖针对低信任度事件（如 pull_request_target）的只读缓存默认值。对于这些事件声明 write 或 write-only 可能会增加缓存投毒的风险，因此当声明的模式授予写入权限时，GitHub Actions 会添加警告注释。未设置 cache-mode 的 workflow 将继续使用现有的安全默认值。
Cache mode is generally available on github.com for all GitHub plans. For configuration details, see the cache-mode workflow syntax documentation.
Cache mode 已在 github.com 上对所有 GitHub 计划全面可用。有关配置详细信息，请参阅 cache-mode workflow 语法文档。
Join the discussion within GitHub Community
加入 GitHub Community 中的讨论
The post Control GitHub Actions cache access with cache-mode appeared first on The GitHub Blog.
本文《使用 cache-mode 控制 GitHub Actions 缓存访问》最初发布于 The GitHub Blog。
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力