Merge pull request #1775 from jasongin/readonly-cache-v5

Bump @actions/cache to v5.1.0 - handle read-only cache access

.licenses/npm/@actions/cache.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/cache"
-version: 5.0.5
+version: 5.1.0
 type: npm
 summary: Actions cache lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/cache

.licenses/npm/@typespec/ts-http-runtime.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@typespec/ts-http-runtime"
-version: 0.3.2
+version: 0.3.5
 type: npm
 summary: Isomorphic client library for making HTTP requests in node.js and browser.
 homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/core/ts-http-runtime/

PR_TRIAGE_REPORT.md

@@ -1,114 +0,0 @@
-# Pull Request Triage Report for actions/cache
-
-*Generated: 2026-01-29*
-
-| PR Link | Author | Date Opened | Days Open | Category |
-|---------|--------|-------------|-----------|----------|
-| [#1700](https://github.com/actions/cache/pull/1700) | Copilot | 2026-01-29 | 0 | Other |
-| [#1689](https://github.com/actions/cache/pull/1689) | StephenHodgson | 2025-12-13 | 47 | New feature |
-| [#1683](https://github.com/actions/cache/pull/1683) | salmanmkc | 2025-12-11 | 49 | Documentation |
-| [#1672](https://github.com/actions/cache/pull/1672) | alinernunes15-a11y | 2025-11-07 | 83 | Documentation |
-| [#1671](https://github.com/actions/cache/pull/1671) | dulcekarma7u7-netizen | 2025-10-28 | 93 | Documentation |
-| [#1654](https://github.com/actions/cache/pull/1654) | timbaverstock-bmbl | 2025-09-22 | 129 | Documentation |
-| [#1639](https://github.com/actions/cache/pull/1639) | atoulme | 2025-08-08 | 174 | Documentation |
-| [#1638](https://github.com/actions/cache/pull/1638) | TNGBBK | 2025-08-07 | 175 | Documentation |
-| [#1605](https://github.com/actions/cache/pull/1605) | loic-bellinger | 2025-05-14 | 260 | Documentation |
-| [#1604](https://github.com/actions/cache/pull/1604) | stuartleeks | 2025-05-08 | 266 | New feature |
-| [#1587](https://github.com/actions/cache/pull/1587) | Yury-Fridlyand | 2025-04-06 | 298 | Documentation |
-| [#1571](https://github.com/actions/cache/pull/1571) | helly25 | 2025-03-11 | 324 | New feature |
-| [#1567](https://github.com/actions/cache/pull/1567) | KtorZ | 2025-03-07 | 328 | Documentation |
-| [#1536](https://github.com/actions/cache/pull/1536) | KyFaSt | 2025-01-22 | 372 | Security fix |
-| [#1516](https://github.com/actions/cache/pull/1516) | vorburger | 2024-12-12 | 413 | Documentation |
-| [#1514](https://github.com/actions/cache/pull/1514) | lima-limon-inc | 2024-12-11 | 414 | Documentation |
-| [#1493](https://github.com/actions/cache/pull/1493) | EnricoMi | 2024-11-04 | 451 | New feature |
-| [#1472](https://github.com/actions/cache/pull/1472) | mustafacco7 | 2024-10-18 | 468 | Documentation |
-| [#1451](https://github.com/actions/cache/pull/1451) | karlhorky | 2024-08-13 | 534 | Documentation |
-| [#1439](https://github.com/actions/cache/pull/1439) | rusty-key | 2024-07-23 | 555 | Documentation |
-| [#1436](https://github.com/actions/cache/pull/1436) | llakala | 2024-07-19 | 559 | New feature |
-| [#1378](https://github.com/actions/cache/pull/1378) | Olegt0rr | 2024-04-16 | 653 | Other |
-| [#1374](https://github.com/actions/cache/pull/1374) | itchyny | 2024-04-14 | 655 | Other |
-| [#1337](https://github.com/actions/cache/pull/1337) | marco-cpd | 2024-02-23 | 706 | Bug fix |
-| [#1328](https://github.com/actions/cache/pull/1328) | vorburger | 2024-02-16 | 713 | Documentation |
-| [#1312](https://github.com/actions/cache/pull/1312) | Mogyuchi | 2024-01-28 | 732 | Documentation |
-| [#1308](https://github.com/actions/cache/pull/1308) | PrinsFrank | 2024-01-22 | 738 | New feature |
-| [#1290](https://github.com/actions/cache/pull/1290) | joseluisq | 2023-12-01 | 790 | Documentation |
-| [#1283](https://github.com/actions/cache/pull/1283) | IanButterworth | 2023-11-18 | 803 | Documentation |
-| [#1282](https://github.com/actions/cache/pull/1282) | jlanga | 2023-11-17 | 804 | New feature |
-| [#1252](https://github.com/actions/cache/pull/1252) | Magnus167 | 2023-10-01 | 851 | Documentation |
-| [#1248](https://github.com/actions/cache/pull/1248) | Fishrock123 | 2023-09-25 | 857 | Documentation |
-| [#1231](https://github.com/actions/cache/pull/1231) | kbdharun | 2023-09-05 | 877 | Other |
-| [#1222](https://github.com/actions/cache/pull/1222) | dsame | 2023-08-23 | 890 | Documentation |
-| [#1191](https://github.com/actions/cache/pull/1191) | Yakiyo | 2023-06-15 | 959 | Documentation |
-| [#1185](https://github.com/actions/cache/pull/1185) | jorendorff | 2023-06-12 | 962 | Documentation |
-| [#1184](https://github.com/actions/cache/pull/1184) | byrgulle12 | 2023-06-09 | 965 | Spam candidate |
-| [#1183](https://github.com/actions/cache/pull/1183) | pgrange | 2023-06-08 | 966 | Bug fix |
-| [#1167](https://github.com/actions/cache/pull/1167) | tommy-gilligan | 2023-05-04 | 1001 | Documentation |
-| [#1160](https://github.com/actions/cache/pull/1160) | rikhuijzer | 2023-04-24 | 1011 | Documentation |
-| [#1159](https://github.com/actions/cache/pull/1159) | rodrigoalcarazdelaosa | 2023-04-23 | 1012 | Documentation |
-| [#1096](https://github.com/actions/cache/pull/1096) | Lord-Kamina | 2023-01-31 | 1094 | New feature |
-| [#876](https://github.com/actions/cache/pull/876) | bchen1029 | 2022-07-26 | 1283 | Bug fix |
-| [#726](https://github.com/actions/cache/pull/726) | robinp | 2022-02-05 | 1454 | Documentation |
-| [#717](https://github.com/actions/cache/pull/717) | jsoref | 2022-01-23 | 1467 | New feature |
-| [#677](https://github.com/actions/cache/pull/677) | planetmarshall | 2021-11-14 | 1537 | Documentation |
-| [#673](https://github.com/actions/cache/pull/673) | TimoRoth | 2021-11-08 | 1543 | New feature |
-| [#557](https://github.com/actions/cache/pull/557) | melvyn-apryl | 2021-03-27 | 1769 | Documentation |
-| [#498](https://github.com/actions/cache/pull/498) | eyal0 | 2021-01-04 | 1851 | New feature |
-| [#402](https://github.com/actions/cache/pull/402) | vlsi | 2020-08-19 | 1989 | Documentation |
-| [#325](https://github.com/actions/cache/pull/325) | mzabaluev | 2020-05-24 | 2076 | Documentation |
-| [#268](https://github.com/actions/cache/pull/268) | FinalDes | 2020-04-21 | 2109 | Documentation |
-| [#234](https://github.com/actions/cache/pull/234) | evandrocoan | 2020-03-27 | 2134 | Documentation |
-
-## Summary by Category
-
-| Category | Count |
-|----------|-------|
-| Documentation | 31 |
-| New feature | 11 |
-| Bug fix | 3 |
-| Other | 4 |
-| Security fix | 1 |
-| Spam candidate | 1 |
-| **Total** | **51** |
-
-## Category Definitions
-
-- **New feature**: PRs that add new functionality or capabilities to the cache action
-- **Bug fix**: PRs that fix issues or incorrect behavior in the existing code
-- **Security fix**: PRs that address security concerns or add security-related documentation
-- **Documentation**: PRs that add/update README, examples, or other documentation
-- **Spam candidate**: PRs with unclear purpose, incomplete/garbled content, or no meaningful changes
-- **Other**: PRs that don't fit into the above categories (e.g., refactoring, dependency updates)
-
-## Detailed Analysis Notes
-
-### Documentation PRs (31)
-Most open PRs are documentation improvements, including:
-- New caching examples (pnpm, opam, Docker, ASDF, Bazel, Hugo, Dart, etc.)
-- Clarifications on existing behavior (path matching, cache-hit output, key rendering)
-- Updated links and references
-- README improvements
-
-### New Feature PRs (11)
-Feature requests include:
-- Conditional save options (`save-on-success`, `save` input)
-- Force-overwrite capability for existing caches
-- New outputs (cachePath, cache-primary-key)
-- Compression level control
-- Cache refresh/update mechanisms
-
-### Bug Fix PRs (3)
-- #1337: Adjusts storage warning message with incorrect limit
-- #1183: Fixes cabal store path for Ubuntu
-- #876: Fixes cache-hit value when cache not found
-
-### Security Fix PRs (1)
-- #1536: Adds recommended minimum permissions to README (by GitHub staff member)
-
-### Spam Candidate PRs (1)
-- #1184: Unclear PR with garbled Turkish text in title, renames file with no meaningful changes
-
-### Other PRs (4)
-- #1700: This current WIP triage PR
-- #1378: Bumps action versions in examples
-- #1374: Code refactoring (avoids re-evaluation of key input)
-- #1231: Updates actions/checkout to v4 in workflows

README.md

@@ -109,6 +109,14 @@ The cache is scoped to the key, [version](#cache-version), and branch. The defau
 
 See [Matching a cache key](https://help.github.com/en/actions/configuring-and-managing-workflows/caching-dependencies-to-speed-up-workflows#matching-a-cache-key) for more info.
 
+### Read-only access
+
+Some workflow runs only have read-only access to the cache. A common case is a workflow triggered by a pull request from a fork: such runs can **restore** existing caches but may not be permitted to **save** new ones.
+
+When the cache token is read-only, the save step does not fail the job. Instead, `@actions/cache` reports the denial once as a warning (for example, `Failed to save: ... cache write denied: ...`) and the step completes successfully without writing a cache entry. Restores in the same run continue to work as usual.
+
+> **Note** This applies to the action's normal save path as well as the standalone [Save action](./save/README.md). If you intentionally want a restore-only setup, see [Make cache read only / Reuse cache from centralized job](./caching-strategies.md#make-cache-read-only--reuse-cache-from-centralized-job).
+
 ### Example cache workflow
 
 #### Restoring and saving cache using a single action

RELEASES.md

@@ -25,6 +25,11 @@
 
 ## Changelog
 
+### 5.1.0
+
+- Bump `@actions/cache` to v5.1.0 to pick up [actions/toolkit#2435 Handle cache write error due to read-only token](https://github.com/actions/toolkit/pull/2435)
+- Switch redundant "Cache save failed" warning to debug log in save-only
+
 ### 5.0.4
 
 - Bump `minimatch` to v3.1.5 (fixes ReDoS via globstar patterns)

__tests__/saveOnly.test.ts

@@ -105,8 +105,10 @@ test("save with valid inputs uploads a cache", async () => {
     expect(failedMock).toHaveBeenCalledTimes(0);
 });
 
-test("save failing logs the warning message", async () => {
+test("save failing logs the debug message", async () => {
+    const debugMock = jest.spyOn(core, "debug");
     const warningMock = jest.spyOn(core, "warning");
+    const failedMock = jest.spyOn(core, "setFailed");
 
     const primaryKey = "Linux-node-bb828da54c148048dd17899ba9fda624811cfb43";
 
@@ -115,6 +117,9 @@ test("save failing logs the warning message", async () => {
     testUtils.setInput(Inputs.Path, inputPath);
     testUtils.setInput(Inputs.UploadChunkSize, "4000000");
 
+    // A read-only / write-denied save surfaces to the action as saveCache resolving
+    // to -1; the toolkit has already logged the underlying reason. The action
+    // must not fail the job or emit its own warning.
     const cacheId = -1;
     const saveCacheMock = jest
         .spyOn(cache, "saveCache")
@@ -134,6 +139,7 @@ test("save failing logs the warning message", async () => {
         false
     );
 
-    expect(warningMock).toHaveBeenCalledTimes(1);
+    expect(debugMock).toHaveBeenCalledWith("Cache was not saved.");
-    expect(warningMock).toHaveBeenCalledWith("Cache save failed.");
+    expect(warningMock).not.toHaveBeenCalled();
+    expect(failedMock).not.toHaveBeenCalled();
 });

package-lock.json

@@ -1,15 +1,15 @@
 {
   "name": "cache",
-  "version": "5.0.4",
+  "version": "5.1.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "cache",
-      "version": "5.0.4",
+      "version": "5.1.0",
       "license": "MIT",
       "dependencies": {
-        "@actions/cache": "^5.0.5",
+        "@actions/cache": "^5.1.0",
         "@actions/core": "^2.0.3",
         "@actions/exec": "^2.0.0",
         "@actions/io": "^2.0.0"
@@ -39,9 +39,9 @@
       }
     },
     "node_modules/@actions/cache": {
-      "version": "5.0.5",
+      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-5.0.5.tgz",
+      "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-5.1.0.tgz",
-      "integrity": "sha512-jiQSg0gfd+C2KPgcmdCOq7dCuCIQQWQ4b1YfGIRaaA9w7PJbRwTOcCz4LiFEUnqZGf0ha/8OKL3BeNwetHzYsQ==",
+      "integrity": "sha512-kTIj4YPrjjRPKSGlj7f8eq+Pijoy/SKBEbJcAwNsQTFGEF29NGqj1mqD02/PmhV6r4bRAixycexAWpmUJ2aCwg==",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^2.0.0",
@@ -1945,9 +1945,9 @@
       }
     },
     "node_modules/@typespec/ts-http-runtime": {
-      "version": "0.3.2",
+      "version": "0.3.5",
-      "resolved": "https://registry.npmjs.org/@typespec/ts-http-runtime/-/ts-http-runtime-0.3.2.tgz",
+      "resolved": "https://registry.npmjs.org/@typespec/ts-http-runtime/-/ts-http-runtime-0.3.5.tgz",
-      "integrity": "sha512-IlqQ/Gv22xUC1r/WQm4StLkYQmaaTsXAhUVsNE0+xiyf0yRFiH5++q78U3bw6bLKDCTmh0uqKB9eG9+Bt75Dkg==",
+      "integrity": "sha512-yURCknZhvywvQItHMMmFSo+fq5arCUIyz/CVk7jD89MSai7dkaX8ufjCWp3NttLojoTVbcE72ri+be/TnEbMHw==",
       "license": "MIT",
       "dependencies": {
         "http-proxy-agent": "^7.0.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "cache",
-  "version": "5.0.4",
+  "version": "5.1.0",
   "private": true,
   "description": "Cache dependencies and build outputs",
   "main": "dist/restore/index.js",
@@ -23,7 +23,7 @@
   "author": "GitHub",
   "license": "MIT",
   "dependencies": {
-    "@actions/cache": "^5.0.5",
+    "@actions/cache": "^5.1.0",
     "@actions/core": "^2.0.3",
     "@actions/exec": "^2.0.0",
     "@actions/io": "^2.0.0"

src/saveImpl.ts

@@ -84,7 +84,11 @@ export async function saveOnlyRun(
     try {
         const cacheId = await saveImpl(new NullStateProvider());
         if (cacheId === -1) {
-            core.warning(`Cache save failed.`);
+            // The toolkit's saveCache already logs the underlying reason at
+            // the appropriate severity (warning for most failures, info for
+            // benign concurrency races, error for 5xx). Avoid emitting a
+            // generic warning here that would duplicate or mask that signal.
+            core.debug(`Cache was not saved.`);
         }
     } catch (err) {
         console.error(err);