{"id":31654793,"url":"https://github.com/step-security/cirruslabs-cache","last_synced_at":"2025-10-07T12:16:58.926Z","repository":{"id":297375431,"uuid":"995619503","full_name":"step-security/cirruslabs-cache","owner":"step-security","description":"Cache dependencies and build outputs in GitHub Actions. Secure drop-in replacement for cirruslabs/cache.","archived":false,"fork":false,"pushed_at":"2025-10-07T05:23:09.000Z","size":1302,"stargazers_count":0,"open_issues_count":12,"forks_count":1,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-10-07T07:17:17.895Z","etag":null,"topics":["step-security-maintained-actions"],"latest_commit_sha":null,"homepage":"https://docs.stepsecurity.io/actions/stepsecurity-maintained-actions","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/step-security.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-06-03T19:05:15.000Z","updated_at":"2025-09-29T05:11:40.000Z","dependencies_parsed_at":"2025-10-07T07:09:16.645Z","dependency_job_id":"1d32e2f0-240f-4266-a59a-9d3ab0049d02","html_url":"https://github.com/step-security/cirruslabs-cache","commit_stats":null,"previous_names":["step-security/cirruslabs-cache"],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/step-security/cirruslabs-cache","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/step-security%2Fcirruslabs-cache","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/step-security%2Fcirruslabs-cache/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/step-security%2Fcirruslabs-cache/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/step-security%2Fcirruslabs-cache/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/step-security","download_url":"https://codeload.github.com/step-security/cirruslabs-cache/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/step-security%2Fcirruslabs-cache/sbom","scorecard":{"id":1237658,"data":{"date":"2025-09-09T07:26:54Z","repo":{"name":"github.com/step-security/cirruslabs-cache","commit":"a2a5b3aff76c9aa265b3953453979a9597d0ec43"},"scorecard":{"version":"v5.0.0","commit":"ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4"},"score":7.8,"checks":[{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#binary-artifacts"}},{"name":"Branch-Protection","score":8,"reason":"branch protection is not maximal on development and all release branches","details":["Info: 'allow deletion' disabled on branch 'main'","Info: 'force pushes' disabled on branch 'main'","Warn: required approving review count is 1 on branch 'main'","Warn: codeowners review is required - but no codeowners file found in repo","Info: status check found to merge onto on branch 'main'","Info: PRs are required in order to make changes on branch 'main'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#branch-protection"}},{"name":"CI-Tests","score":10,"reason":"6 out of 6 merged PRs checked by a CI test -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project runs tests before pull requests are merged.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#ci-tests"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#cii-best-practices"}},{"name":"Code-Review","score":7,"reason":"Found 3/4 approved changesets -- score normalized to 7","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#code-review"}},{"name":"Contributors","score":3,"reason":"project has 1 contributing companies or organizations -- score normalized to 3","details":["Info: stepsecurity contributor org/company found, "],"documentation":{"short":"Determines if the project has a set of contributors from multiple organizations (e.g., companies).","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#contributors"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#dangerous-workflow"}},{"name":"Dependency-Update-Tool","score":10,"reason":"update tool detected","details":["Info: detected update tool: Dependabot: .github/dependabot.yml:1"],"documentation":{"short":"Determines if the project uses a dependency update tool.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#dependency-update-tool"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: MIT License: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#license"}},{"name":"Maintained","score":10,"reason":"12 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#maintained"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#packaging"}},{"name":"Pinned-Dependencies","score":10,"reason":"all dependencies are pinned","details":["Info:   9 out of   9 GitHub-owned GitHubAction dependencies pinned","Info:   4 out of   4 third-party GitHubAction dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#pinned-dependencies"}},{"name":"SAST","score":7,"reason":"SAST tool detected but not run on all commits","details":["Info: SAST configuration detected: CodeQL","Warn: 4 commits out of 23 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#sast"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Info: Found linked content: SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#security-policy"}},{"name":"Signed-Releases","score":10,"reason":"1 out of the last 1 releases have a total of 1 signed artifacts.","details":["Info: provenance for release artifact: multiple.intoto.jsonl: https://api.github.com/repos/step-security/cirruslabs-cache/releases/assets/261239899"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#signed-releases"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Info: jobLevel 'actions' permission set to 'read': .github/workflows/actions_release.yml:16","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/actions_release.yml:18","Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql.yml:31","Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:32","Info: jobLevel 'checks' permission set to 'read': .github/workflows/scorecards.yml:35","Info: jobLevel 'contents' permission set to 'read': .github/workflows/scorecards.yml:29","Info: jobLevel 'actions' permission set to 'read': .github/workflows/scorecards.yml:30","Info: jobLevel 'issues' permission set to 'read': .github/workflows/scorecards.yml:32","Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/scorecards.yml:33","Info: topLevel 'contents' permission set to 'read': .github/workflows/actions_release.yml:11","Warn: topLevel 'contents' permission set to 'write': .github/workflows/audit_package.yml:25","Info: topLevel 'packages' permission set to 'read': .github/workflows/audit_package.yml:27","Warn: topLevel 'contents' permission set to 'write': .github/workflows/auto_cherry_pick.yml:12","Info: topLevel 'packages' permission set to 'read': .github/workflows/auto_cherry_pick.yml:14","Info: topLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:24","Info: topLevel 'contents' permission set to 'read': .github/workflows/dependency-review.yml:13","Info: topLevel 'contents' permission set to 'read': .github/workflows/guarddog.yml:10","Info: topLevel permissions set to 'read-all': .github/workflows/scorecards.yml:18"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#token-permissions"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-09-15T02:30:15.714Z","repository_id":297375431,"created_at":"2025-09-15T02:30:15.715Z","updated_at":"2025-09-15T02:30:15.715Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":278773002,"owners_count":26043291,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-07T02:00:06.786Z","response_time":59,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["step-security-maintained-actions"],"created_at":"2025-10-07T12:16:56.932Z","updated_at":"2025-10-07T12:16:58.918Z","avatar_url":"https://github.com/step-security.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Cirrus Runners Cache action\n\nThis utility repository periodically runs a GitHub Action that pulls the latest [actions/cache](https://github.com/actions/cache) repository and applies a rather simple patch to all of its actions:\n\n```ts\nconst httpCacheHost = process.env[\"CIRRUS_HTTP_CACHE_HOST\"];\n\nif (httpCacheHost != null) {\n    const newActionsCacheURL = `http://${httpCacheHost}/`;\n\n    console.log(\n        `Redefining the ACTIONS_CACHE_URL to ${newActionsCacheURL} to make the cache faster...`\n    );\n\n    process.env[\"ACTIONS_CACHE_URL\"] = newActionsCacheURL;\n}\n```\n\nThis allows the tasks running on [Cirrus Runners](https://cirrus-runners.app/) to take advantage of a faster and more local cache provided by Cirrus Runners and exposed in `CIRRUS_HTTP_CACHE_HOST` environment variable.\n\nThese modifications are then re-pushed to the corresponding major tags (e.g. `v4`), making the changes in your CI workflows as simple as:\n\n```diff\n-- uses: actions/cache@v4\n+- uses: step-security/cirruslabs-cache@v4\n   with:\n     path: node_modules\n     key: node_modules\n```\n\n## Running with your own implementation of GitHub Actions Cache API\n\nIf you have implemented the GitHub Actions Cache API alongside self-hosted runners, you can enable its use by setting the `CIRRUS_HTTP_CACHE_HOST` environment variable when starting your runner:\n\n```bash\nexport CIRRUS_HTTP_CACHE_HOST=cache.internal:8080\n./run.sh\n```\n\n## Why?\n\nBecause the following PRs were closed/not merged yet:\n\n* https://github.com/actions/cache/pull/679\n* https://github.com/actions/toolkit/pull/1695\n\n# Cache action\n\nThis action allows caching dependencies and build outputs to improve workflow execution time.\n\n\u003eTwo other actions are available in addition to the primary `cache` action:\n\u003e\n\u003e* [Restore action](./restore/README.md)\n\u003e* [Save action](./save/README.md)\n\n[![Tests](https://github.com/actions/cache/actions/workflows/workflow.yml/badge.svg)](https://github.com/actions/cache/actions/workflows/workflow.yml)\n\n## Documentation\n\nSee [\"Caching dependencies to speed up workflows\"](https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows).\n\n## What's New\n\n### ⚠️ Important changes\n\nThe cache backend service has been rewritten from the ground up for improved performance and reliability. [actions/cache](https://github.com/actions/cache) now integrates with the new cache service (v2) APIs.\n\nThe new service will gradually roll out as of **February 1st, 2025**. The legacy service will also be sunset on the same date. Changes in these release are **fully backward compatible**.\n\n**We are deprecating some versions of this action**. We recommend upgrading to version `v4` or `v3` as soon as possible before **February 1st, 2025.** (Upgrade instructions below).\n\nIf you are using pinned SHAs, please use the SHAs of versions `v4.2.0` or `v3.4.0`\n\nIf you do not upgrade, all workflow runs using any of the deprecated [actions/cache](https://github.com/actions/cache) will fail.\n\nUpgrading to the recommended versions will not break your workflows.\n\nRead more about the change \u0026 access the migration guide: [reference to the announcement](https://github.com/actions/cache/discussions/1510).\n\n### v4\n\n* Integrated with the new cache service (v2) APIs.\n* Updated to node 20\n\n### v3\n\n* Integrated with the new cache service (v2) APIs.\n* Added support for caching in GHES 3.5+.\n* Fixed download issue for files \u003e 2GB during restore.\n* Updated the minimum runner version support from node 12 -\u003e node 16.\n* Fixed avoiding empty cache save when no files are available for caching.\n* Fixed tar creation error while trying to create tar with path as `~/` home folder on `ubuntu-latest`.\n* Fixed zstd failing on amazon linux 2.0 runners.\n* Fixed cache not working with github workspace directory or current directory.\n* Fixed the download stuck problem by introducing a timeout of 1 hour for cache downloads.\n* Fix zstd not working for windows on gnu tar in issues.\n* Allowing users to provide a custom timeout as input for aborting download of a cache segment using an environment variable `SEGMENT_DOWNLOAD_TIMEOUT_MINS`. Default is 10 minutes.\n* New actions are available for granular control over caches - [restore](restore/action.yml) and [save](save/action.yml).\n* Support cross-os caching as an opt-in feature. See [Cross OS caching](./tips-and-workarounds.md#cross-os-cache) for more info.\n* Added option to fail job on cache miss. See [Exit workflow on cache miss](./restore/README.md#exit-workflow-on-cache-miss) for more info.\n* Fix zstd not being used after zstd version upgrade to 1.5.4 on hosted runners\n* Added option to lookup cache without downloading it.\n* Reduced segment size to 128MB and segment timeout to 10 minutes to fail fast in case the cache download is stuck.\n\nSee the [v2 README.md](https://github.com/actions/cache/blob/v2/README.md) for older updates.\n\n## Usage\n\n### Pre-requisites\n\nCreate a workflow `.yml` file in your repository's `.github/workflows` directory. An [example workflow](#example-cache-workflow) is available below. For more information, see the GitHub Help Documentation for [Creating a workflow file](https://help.github.com/en/articles/configuring-a-workflow#creating-a-workflow-file).\n\nIf you are using this inside a container, a POSIX-compliant `tar` needs to be included and accessible from the execution path.\n\nIf you are using a `self-hosted` Windows runner, `GNU tar` and `zstd` are required for [Cross-OS caching](https://github.com/actions/cache/blob/main/tips-and-workarounds.md#cross-os-cache) to work. They are also recommended to be installed in general so the performance is on par with `hosted` Windows runners.\n\n### Inputs\n\n* `key` - An explicit key for a cache entry. See [creating a cache key](#creating-a-cache-key).\n* `path` - A list of files, directories, and wildcard patterns to cache and restore. See [`@actions/glob`](https://github.com/actions/toolkit/tree/main/packages/glob) for supported patterns.\n* `restore-keys` - An ordered multiline string listing the prefix-matched keys, that are used for restoring stale cache if no cache hit occurred for key.\n* `enableCrossOsArchive` - An optional boolean when enabled, allows Windows runners to save or restore caches that can be restored or saved respectively on other platforms. Default: `false`\n* `fail-on-cache-miss` - Fail the workflow if cache entry is not found. Default: `false`\n* `lookup-only` - If true, only checks if cache entry exists and skips download. Does not change save cache behavior. Default: `false`\n\n#### Environment Variables\n\n* `SEGMENT_DOWNLOAD_TIMEOUT_MINS` - Segment download timeout (in minutes, default `10`) to abort download of the segment if not completed in the defined number of minutes. [Read more](https://github.com/actions/cache/blob/main/tips-and-workarounds.md#cache-segment-restore-timeout)\n\n### Outputs\n\n* `cache-hit` - A string value to indicate an exact match was found for the key.\n  * If there's a cache hit, this will be 'true' or 'false' to indicate if there's an exact match for `key`.\n  * If there's a cache miss, this will be an empty string.\n\nSee [Skipping steps based on cache-hit](#skipping-steps-based-on-cache-hit) for info on using this output\n\n### Cache scopes\n\nThe cache is scoped to the key, [version](#cache-version), and branch. The default branch cache is available to other branches.\n\nSee [Matching a cache key](https://help.github.com/en/actions/configuring-and-managing-workflows/caching-dependencies-to-speed-up-workflows#matching-a-cache-key) for more info.\n\n### Example cache workflow\n\n#### Restoring and saving cache using a single action\n\n```yaml\nname: Caching Primes\n\non: push\n\njobs:\n  build:\n    runs-on: ubuntu-latest\n\n    steps:\n    - uses: actions/checkout@v4\n\n    - name: Cache Primes\n      id: cache-primes\n      uses: actions/cache@v4\n      with:\n        path: prime-numbers\n        key: ${{ runner.os }}-primes\n\n    - name: Generate Prime Numbers\n      if: steps.cache-primes.outputs.cache-hit != 'true'\n      run: /generate-primes.sh -d prime-numbers\n\n    - name: Use Prime Numbers\n      run: /primes.sh -d prime-numbers\n```\n\nThe `cache` action provides a `cache-hit` output which is set to `true` when the cache is restored using the primary `key` and `false` when the cache is restored using `restore-keys` or no cache is restored.\n\n#### Using a combination of restore and save actions\n\n```yaml\nname: Caching Primes\n\non: push\n\njobs:\n  build:\n    runs-on: ubuntu-latest\n\n    steps:\n    - uses: actions/checkout@v4\n\n    - name: Restore cached Primes\n      id: cache-primes-restore\n      uses: actions/cache/restore@v4\n      with:\n        path: |\n          path/to/dependencies\n          some/other/dependencies\n        key: ${{ runner.os }}-primes\n    .\n    . //intermediate workflow steps\n    .\n    - name: Save Primes\n      id: cache-primes-save\n      uses: actions/cache/save@v4\n      with:\n        path: |\n          path/to/dependencies\n          some/other/dependencies\n        key: ${{ steps.cache-primes-restore.outputs.cache-primary-key }}\n```\n\n\u003e **Note**\n\u003e You must use the `cache` or `restore` action in your workflow before you need to use the files that might be restored from the cache. If the provided `key` matches an existing cache, a new cache is not created and if the provided `key` doesn't match an existing cache, a new cache is automatically created provided the job completes successfully.\n\n## Caching Strategies\n\nWith the introduction of the `restore` and `save` actions, a lot of caching use cases can now be achieved. Please see the [caching strategies](./caching-strategies.md) document for understanding how you can use the actions strategically to achieve the desired goal.\n\n## Implementation Examples\n\nEvery programming language and framework has its own way of caching.\n\nSee [Examples](examples.md) for a list of `actions/cache` implementations for use with:\n\n* [Bun](./examples.md#bun)\n* [C# - NuGet](./examples.md#c---nuget)\n* [Clojure - Lein Deps](./examples.md#clojure---lein-deps)\n* [D - DUB](./examples.md#d---dub)\n* [Deno](./examples.md#deno)\n* [Elixir - Mix](./examples.md#elixir---mix)\n* [Go - Modules](./examples.md#go---modules)\n* [Haskell - Cabal](./examples.md#haskell---cabal)\n* [Haskell - Stack](./examples.md#haskell---stack)\n* [Java - Gradle](./examples.md#java---gradle)\n* [Java - Maven](./examples.md#java---maven)\n* [Node - npm](./examples.md#node---npm)\n* [Node - Lerna](./examples.md#node---lerna)\n* [Node - Yarn](./examples.md#node---yarn)\n* [OCaml/Reason - esy](./examples.md#ocamlreason---esy)\n* [PHP - Composer](./examples.md#php---composer)\n* [Python - pip](./examples.md#python---pip)\n* [Python - pipenv](./examples.md#python---pipenv)\n* [R - renv](./examples.md#r---renv)\n* [Ruby - Bundler](./examples.md#ruby---bundler)\n* [Rust - Cargo](./examples.md#rust---cargo)\n* [Scala - SBT](./examples.md#scala---sbt)\n* [Swift, Objective-C - Carthage](./examples.md#swift-objective-c---carthage)\n* [Swift, Objective-C - CocoaPods](./examples.md#swift-objective-c---cocoapods)\n* [Swift - Swift Package Manager](./examples.md#swift---swift-package-manager)\n* [Swift - Mint](./examples.md#swift---mint)\n\n## Creating a cache key\n\nA cache key can include any of the contexts, functions, literals, and operators supported by GitHub Actions.\n\nFor example, using the [`hashFiles`](https://docs.github.com/en/actions/learn-github-actions/expressions#hashfiles) function allows you to create a new cache when dependencies change.\n\n```yaml\n  - uses: actions/cache@v4\n    with:\n      path: |\n        path/to/dependencies\n        some/other/dependencies\n      key: ${{ runner.os }}-${{ hashFiles('**/lockfiles') }}\n```\n\nAdditionally, you can use arbitrary command output in a cache key, such as a date or software version:\n\n```yaml\n  # http://man7.org/linux/man-pages/man1/date.1.html\n  - name: Get Date\n    id: get-date\n    run: |\n      echo \"date=$(/bin/date -u \"+%Y%m%d\")\" \u003e\u003e $GITHUB_OUTPUT\n    shell: bash\n\n  - uses: actions/cache@v4\n    with:\n      path: path/to/dependencies\n      key: ${{ runner.os }}-${{ steps.get-date.outputs.date }}-${{ hashFiles('**/lockfiles') }}\n```\n\nSee [Using contexts to create cache keys](https://help.github.com/en/actions/configuring-and-managing-workflows/caching-dependencies-to-speed-up-workflows#using-contexts-to-create-cache-keys)\n\n## Cache Limits\n\nA repository can have up to 10GB of caches. Once the 10GB limit is reached, older caches will be evicted based on when the cache was last accessed.  Caches that are not accessed within the last week will also be evicted.\n\n## Skipping steps based on cache-hit\n\nUsing the `cache-hit` output, subsequent steps (such as install or build) can be skipped when a cache hit occurs on the key.  It is recommended to install missing/updated dependencies in case of a partial key match when the key is dependent on the `hash` of the package file.\n\nExample:\n\n```yaml\nsteps:\n  - uses: actions/checkout@v4\n\n  - uses: actions/cache@v4\n    id: cache\n    with:\n      path: path/to/dependencies\n      key: ${{ runner.os }}-${{ hashFiles('**/lockfiles') }}\n\n  - name: Install Dependencies\n    if: steps.cache.outputs.cache-hit != 'true'\n    run: /install.sh\n```\n\n\u003e **Note** The `id` defined in `actions/cache` must match the `id` in the `if` statement (i.e. `steps.[ID].outputs.cache-hit`)\n\n## Cache Version\n\nCache version is a hash [generated](https://github.com/actions/toolkit/blob/500d0b42fee2552ae9eeb5933091fe2fbf14e72d/packages/cache/src/internal/cacheHttpClient.ts#L73-L90) for a combination of compression tool used (Gzip, Zstd, etc. based on the runner OS) and the `path` of directories being cached. If two caches have different versions, they are identified as unique caches while matching. This, for example, means that a cache created on a `windows-latest` runner can't be restored on `ubuntu-latest` as cache `Version`s are different.\n\n\u003e Pro tip: The [list caches](https://docs.github.com/en/rest/actions/cache#list-github-actions-caches-for-a-repository) API can be used to get the version of a cache. This can be helpful to troubleshoot cache miss due to version.\n\n\u003cdetails\u003e\n  \u003csummary\u003eExample\u003c/summary\u003e\nThe workflow will create 3 unique caches with same keys. Ubuntu and windows runners will use different compression technique and hence create two different caches. And `build-linux` will create two different caches as the `paths` are different.\n\n```yaml\njobs:\n  build-linux:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n\n      - name: Cache Primes\n        id: cache-primes\n        uses: actions/cache@v4\n        with:\n          path: prime-numbers\n          key: primes\n\n      - name: Generate Prime Numbers\n        if: steps.cache-primes.outputs.cache-hit != 'true'\n        run: ./generate-primes.sh -d prime-numbers\n\n      - name: Cache Numbers\n        id: cache-numbers\n        uses: actions/cache@v4\n        with:\n          path: numbers\n          key: primes\n\n      - name: Generate Numbers\n        if: steps.cache-numbers.outputs.cache-hit != 'true'\n        run: ./generate-primes.sh -d numbers\n\n  build-windows:\n    runs-on: windows-latest\n    steps:\n      - uses: actions/checkout@v4\n\n      - name: Cache Primes\n        id: cache-primes\n        uses: actions/cache@v4\n        with:\n          path: prime-numbers\n          key: primes\n\n      - name: Generate Prime Numbers\n        if: steps.cache-primes.outputs.cache-hit != 'true'\n        run: ./generate-primes -d prime-numbers\n```\n\n\u003c/details\u003e\n\n## Known practices and workarounds\n\nThere are a number of community practices/workarounds to fulfill specific requirements. You may choose to use them if they suit your use case. Note these are not necessarily the only solution or even a recommended solution.\n\n* [Cache segment restore timeout](./tips-and-workarounds.md#cache-segment-restore-timeout)\n* [Update a cache](./tips-and-workarounds.md#update-a-cache)\n* [Use cache across feature branches](./tips-and-workarounds.md#use-cache-across-feature-branches)\n* [Cross OS cache](./tips-and-workarounds.md#cross-os-cache)\n* [Force deletion of caches overriding default cache eviction policy](./tips-and-workarounds.md#force-deletion-of-caches-overriding-default-cache-eviction-policy)\n\n### Windows environment variables\n\nPlease note that Windows environment variables (like `%LocalAppData%`) will NOT be expanded by this action. Instead, prefer using `~` in your paths which will expand to the HOME directory. For example, instead of `%LocalAppData%`, use `~\\AppData\\Local`. For a list of supported default environment variables, see the [Learn GitHub Actions: Variables](https://docs.github.com/en/actions/learn-github-actions/variables#default-environment-variables) page.\n\n## Contributing\n\nWe would love for you to contribute to `actions/cache`. Pull requests are welcome! Please see the [CONTRIBUTING.md](CONTRIBUTING.md) for more information.\n\n## License\n\nThe scripts and documentation in this project are released under the [MIT License](LICENSE)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstep-security%2Fcirruslabs-cache","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fstep-security%2Fcirruslabs-cache","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstep-security%2Fcirruslabs-cache/lists"}