Skip the docker layer cache when building debs from a tag

2026-08-24 12:00:04 +00:00 · 2026-07-14 17:04:25 +02:00
parent 7e28b289a9
commit c9058d8dbf
1 changed files with 5 additions and 0 deletions
@@ -73,6 +73,11 @@ jobs:
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: Set up docker layer caching
+        # Skip the cache when building from a tag so that the released debs
+        # cannot be influenced by a poisoned cache. The lint cannot see the
+        # `if` condition, hence the ignore.
+        # zizmor: ignore[cache-poisoning]
+        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: /tmp/.buildx-cache