Don't use cache in CI.

[dcampbell24]

No description provided.

[sylvestre]

I'm sorry, but it requires further explanation of the reasons why.

[dcampbell24]

The update of zizmor has a new error: error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack.

See https://woodruffw.github.io/zizmor/audits/#cache-poisoning and https://woodruffw.github.io/zizmor/audits/#remediation_13 for the details. It suggests removing all caching.

[sylvestre]

yeah, but I think it is unlikely + they recommend disabling it for release workflows.
I think you removed it everywhere, no?

[dcampbell24]

I removed it everywhere zizmor was complaining about it. I think that was everywhere in CICD.yml. It says you ought to remove it everywhere you intend to publish build artifacts.

[sylvestre]

yeah, but i am not convinced we should follow the tool blindly :)