kevinveenbirkenbachandClaude Opus 5 079ca89c00 ci(validation): no pip cache on the PR-head job ...

The validation job checks out the pull request head and runs make install from it, then setup-python saves the pip cache in its post-step, after that code has run with write access to the cache directory. The workflow is reachable through workflow_dispatch, where the cache key resolves in the default-branch scope, so a poisoned entry written there is restored by every later trusted run. CodeQL flags each run step after the checkout as poisonable.

Removing the cache removes the sink. The checkout stays as it is: read-only token, no persisted credentials, excluded under pull_request_target. Nine other setup-python steps keep their cache; this is the one job that executes untrusted code, and the comment says so where the next tidy-up would put the cache back.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-09-03 16:29:15 +02:00

..

ISSUE_TEMPLATE

feat: Add issue templates for bugs and features

2026-03-23 23:59:21 +01:00

PULL_REQUEST_TEMPLATE

refactor(roles): name the credential file meta/secrets.yml

2026-08-12 12:08:06 +02:00

workflows

ci(validation): no pip cache on the PR-head job

2026-09-03 16:29:15 +02:00

CODEOWNERS

Add CODEOWNERS file

2026-03-26 19:33:08 +01:00

dependabot.yml

fix(dependabot): scan every ecosystem recursively including the repo root

2026-07-23 20:01:31 +02:00

FUNDING.yml

Added Funding

2025-03-12 20:52:48 +01:00

pull_request_template.md

test(tooling): integrate markdownlint-cli2, ansible-lint, galaxy-importer + fix the resulting baseline

2026-05-08 23:46:37 +02:00