ci: set cache-mode on release workflows

[claude]

Requested by David Sanders · Slack thread

• I have read the contribution documentation for this project.
• I agree to follow the code of conduct that this project follows, as appropriate.
• The changes are appropriately documented (if applicable). — CI-only change; a one-line comment in each workflow explains the intent.
• The changes have sufficient test coverage (if applicable). — not applicable; PR CI does not exercise the release workflows.
• The testsuite passes successfully on my local machine (if applicable). — not applicable; no source changes.

Summarize your changes:

Before: Whether a release or docs-deploy run touched the GitHub Actions cache depended on per-step configuration. Publish (Forge 7) (push to main) and API Documentation (tag push v7.** / dispatch, which commits to the gh-pages site) both opt out step by step with package-manager-cache: false on setup-node, but nothing enforced that intent at the workflow level, so any future step or third-party action that restored a cache entry during a publish would silently be allowed.

After: Both workflows declare cache-mode: none at the top level, so every job in a release or docs-deploy run is denied cache access by the runner regardless of what individual steps or actions ask for. A denied cache restore logs a message and continues as a cache miss; a denied cache save logs and becomes a no-op, so neither workflow fails because of this setting. PR CI (ci.yml) is untouched and keeps caching as before.

GitHub's new workflow-level cache-mode key makes this a declarative, enforced setting rather than a convention (see changelog and workflow syntax reference), which closes the cache-poisoning avenue on the paths that publish to npm and to js.electronforge.io.

How: Adds cache-mode: none (with a one-line comment) directly after the top-level permissions: {} block in .github/workflows/release.yml and .github/workflows/gh-pages.yml. No other lines changed; the existing package-manager-cache: false lines are kept. Both files parse as YAML and zizmor 1.30.1 accepts the new key with no new findings. Note that PR CI does not exercise these workflows, so the first version-bump release (and the resulting v7.* tag push) after merge is the real test of this change.

🤖 Generated with Claude Code

https://claude.ai/code/session_01MYe3WCXtgiqomNuVQdi4Yd

---

Generated by Claude Code