fix(ci): prevent cache poisoning (#798)

Author: Proximyst

.github/workflows/build-plugin.yaml

@@ -33,9 +33,11 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version-file: .nvmrc
+          # Releases should be isolated. PRs can poison the cache.
+          package-manager-cache: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }} # zizmor: ignore[cache-poisoning] # zizmor is wrong now
       - run: yarn install --frozen-lockfile
       - run: yarn run build