ci: set cache-mode on release workflows

[claude]

Requested by David Sanders · Slack thread

Before: A release run (push to main) could read from and write to the GitHub Actions cache. The release job already opts out of setup-node's package-manager cache via package-manager-cache: false, but that is a per-step setting, and the test job that release.yml calls via uses: ./.github/workflows/test.yml still restores and saves a yarn cache on every release run.

After: The Release workflow declares cache-mode: none at the top level, so no job in a release run can read or write the Actions cache, including the reusable test job it calls (the caller's none caps the called workflow's cache access during release runs). Any step that tries to use the cache logs a message and continues: a skipped restore behaves like a cache miss and a skipped save is a no-op, so nothing fails. Pull request and scheduled runs of test.yml are unchanged and keep caching.

This uses GitHub's new cache-mode workflow key (changelog, syntax reference) to enforce that release paths never touch the cache, regardless of per-step settings.

How: Adds a one-line comment and cache-mode: none to .github/workflows/release.yml, directly after the top-level permissions: block. The existing package-manager-cache: false line is left in place. No other files are touched.

Note that PR CI does not exercise the Release workflow, so the first release after this merges is the real test. Because a denied cache step logs and continues rather than failing, the expected outcome is a normal release with cache restore/save steps reported as skipped. For reference, actionlint v1.7.12 does not yet know the cache-mode key and flags it as an unexpected workflow key; zizmor 1.30.1 parses the file without complaint (this repo does not run either tool in CI).

🤖 Generated with Claude Code

https://claude.ai/code/session_01MYe3WCXtgiqomNuVQdi4Yd

---

Generated by Claude Code