Control GitHub Actions cache access with cache-mode - GitHub Changelog

You can now use cache-mode to apply least-privilege access to the GitHub Actions cache at the workflow or job level. By granting each workflow or job only the cache access it needs, you can prevent unnecessary restores or saves and help protect trusted workflows from cache poisoning. This capability is now generally available on all plans. Choose the access each workflow or job needs: read allows

[nguyen-oi]

cache-modeで権限管理できるの助かる。プルリク起点のキャッシュ毒入れ対策に必須になりそう