From c9058d8dbf66c3515d7b551a6b1b2f311dc159c2 Mon Sep 17 00:00:00 2001
From: Denis Kasak <dkasak@termina.org.uk>
Date: Tue, 7 Jul 2026 11:44:26 +0000
Subject: [PATCH] Skip the docker layer cache when building debs from a tag

---
 .github/workflows/release-artifacts.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/release-artifacts.yml b/.github/workflows/release-artifacts.yml
index c3d1a25c77..d70a7740da 100644
--- a/.github/workflows/release-artifacts.yml
+++ b/.github/workflows/release-artifacts.yml
@@ -73,6 +73,11 @@ jobs:
         uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Set up docker layer caching
+        # Skip the cache when building from a tag so that the released debs
+        # cannot be influenced by a poisoned cache. The lint cannot see the
+        # `if` condition, hence the ignore.
+        # zizmor: ignore[cache-poisoning]
+        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: /tmp/.buildx-cache