The new cache ratchet can be bypassed by moving an unsafe cache into a checked-in composite action. The test then claims to enumerate every quality-job cache while executable Bun or Playwright state can return unnoticed.
Evidence
The helper checks only direct quality-job steps whose uses value begins with actions/cache. In a disposable post-fix worktree, a quality step invoked ./.github/actions/cache-wrapper, whose composite action cached the Bun store with actions/cache@v4. All three focused cache tests still passed. The same ratchet gap exists on the pre-fix SHA and is therefore deferred by the bounded verification contract.
Concrete failure
A later workflow cleanup hides an executable cache behind a local wrapper. A pull-request revision publishes altered package or browser state, another revision restores it, and the central approved-cache test remains green.
Suggested verification
Add a mutation fixture with a local composite cache wrapper and require rejection. Recursively inspect checked-in composite actions or pin the complete allowed local-action set reachable from the quality job.
Found while verifying #251.
The new cache ratchet can be bypassed by moving an unsafe cache into a checked-in composite action. The test then claims to enumerate every quality-job cache while executable Bun or Playwright state can return unnoticed.
Evidence
The helper checks only direct quality-job steps whose
usesvalue begins withactions/cache. In a disposable post-fix worktree, a quality step invoked./.github/actions/cache-wrapper, whose composite action cached the Bun store withactions/cache@v4. All three focused cache tests still passed. The same ratchet gap exists on the pre-fix SHA and is therefore deferred by the bounded verification contract.Concrete failure
A later workflow cleanup hides an executable cache behind a local wrapper. A pull-request revision publishes altered package or browser state, another revision restores it, and the central approved-cache test remains green.
Suggested verification
Add a mutation fixture with a local composite cache wrapper and require rejection. Recursively inspect checked-in composite actions or pin the complete allowed local-action set reachable from the quality job.
Found while verifying #251.