do not cache in build workflow when running on release (#311)

Author: joshuadavidthomas

.github/workflows/build.yml

@@ -92,6 +92,7 @@ jobs:
           echo "ARCH=${arch:-'unknown'}" >> $GITHUB_ENV
 
       - name: Cache rustup toolchain
+        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
         uses: actions/cache@v4
         with:
           path: |
@@ -101,7 +102,7 @@ jobs:
             ${{ runner.os }}-${{ runner.arch }}-rustup-
 
       - name: Cache Homebrew packages (macOS)
-        if: ${{ runner.os == 'macOS' }}
+        if: ${{ !startsWith(github.ref, 'refs/tags/') && runner.os == 'macOS' }}
         uses: actions/cache@v4
         with:
           path: |
@@ -116,7 +117,7 @@ jobs:
           target: ${{ env.TARGET }}
 
       - name: Cache Zig toolchain
-        if: ${{ runner.os == 'Linux' && matrix.platform.target == 'aarch64' }}
+        if: ${{ !startsWith(github.ref, 'refs/tags/') && runner.os == 'Linux' && matrix.platform.target == 'aarch64' }}
         id: cache-zig
         uses: actions/cache@v4
         with:
@@ -294,6 +295,7 @@ jobs:
           python-version: 3.x
 
       - name: Cache rustup toolchain
+        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
         uses: actions/cache@v4
         with:
           path: |
@@ -303,6 +305,7 @@ jobs:
             ${{ runner.os }}-${{ runner.arch }}-rustup-
 
       - name: Cache Cargo registry
+        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
         uses: actions/cache@v4
         with:
           path: |
@@ -345,6 +348,7 @@ jobs:
           python-version: 3.x
 
       - name: Cache rustup toolchain
+        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
         uses: actions/cache@v4
         with:
           path: |
@@ -354,6 +358,7 @@ jobs:
             ${{ runner.os }}-${{ runner.arch }}-rustup-
 
       - name: Cache Cargo registry
+        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
         uses: actions/cache@v4
         with:
           path: |

.github/zizmor.yml

@@ -0,0 +1,18 @@
+rules:
+  cache-poisoning:
+    ignore:
+      # test workflow does not produce artifacts to poison
+      - test.yml
+      # all caching is disabled when a tag is pushed
+      - build.yml:96:9
+      - build.yml:106:9
+      - build.yml:115:9
+      - build.yml:122:9
+      - build.yml:236:9
+      - build.yml:268:9
+      - build.yml:299:9
+      - build.yml:309:9
+      - build.yml:321:9
+      - build.yml:352:9
+      - build.yml:362:9
+      - build.yml:374:9