ci: disable pnpm cache when publishing

Author: sapphi-red

.github/workflows/publish.yml

@@ -24,6 +24,8 @@ jobs:
         with:
           node-version: 22
           registry-url: https://registry.npmjs.org/
+          # disable cache, to avoid cache poisoning (https://docs.zizmor.sh/audits/#cache-poisoning)
+          package-manager-cache: false
 
       - name: Install deps
         run: pnpm install

.github/workflows/release-continuous.yml

@@ -26,6 +26,8 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: lts/*
+          # disable cache, to avoid cache poisoning (https://docs.zizmor.sh/audits/#cache-poisoning)
+          package-manager-cache: false
 
       - name: Install dependencies
         run: pnpm install