From ac84a3741fde82f9b4056b924fd10d98fb347fe9 Mon Sep 17 00:00:00 2001
From: Philip Gai <philip-gai@github.com>
Date: Tue, 18 Aug 2026 09:36:12 -0500
Subject: [PATCH] chore: constrain benchmark cache access

---
 .github/workflows/cache-key-stability.yml | 1 +
 .github/workflows/cache-save.yml          | 1 +
 .github/workflows/cache-value.yml         | 2 ++
 .github/workflows/jdk-cache.yml           | 2 ++
 4 files changed, 6 insertions(+)

diff --git a/.github/workflows/cache-key-stability.yml b/.github/workflows/cache-key-stability.yml
index 03428c7..30f1463 100644
--- a/.github/workflows/cache-key-stability.yml
+++ b/.github/workflows/cache-key-stability.yml
@@ -47,6 +47,7 @@ jobs:
   probe:
     name: ${{ matrix.platform }} / replica ${{ matrix.replica }}
     runs-on: ${{ matrix.os }}
+    cache-mode: none
     timeout-minutes: 20
     strategy:
       fail-fast: false
diff --git a/.github/workflows/cache-save.yml b/.github/workflows/cache-save.yml
index f3d0f10..c289614 100644
--- a/.github/workflows/cache-save.yml
+++ b/.github/workflows/cache-save.yml
@@ -76,6 +76,7 @@ jobs:
   measure:
     name: paired / ${{ matrix.sample }}
     runs-on: ubuntu-24.04
+    cache-mode: write-only
     # At this fixture size a normal save is seconds, not minutes. A slot that has
     # not returned after three minutes is a cache-service stall; the report can
     # discard the incomplete runner instead of letting the workflow wait for the
diff --git a/.github/workflows/cache-value.yml b/.github/workflows/cache-value.yml
index 20e663d..84a490a 100644
--- a/.github/workflows/cache-value.yml
+++ b/.github/workflows/cache-value.yml
@@ -69,6 +69,7 @@ jobs:
   seed:
     name: Seed cache
     runs-on: ubuntu-24.04
+    cache-mode: write-only
     steps:
       - name: Check out benchmark repository
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
@@ -108,6 +109,7 @@ jobs:
     name: paired / ${{ matrix.sample }}
     needs: seed
     runs-on: ubuntu-24.04
+    cache-mode: read
     # The uncached arm downloads PetClinic's whole dependency tree from Maven
     # Central twice per runner, which is the slowest thing this repository does.
     timeout-minutes: 40
diff --git a/.github/workflows/jdk-cache.yml b/.github/workflows/jdk-cache.yml
index 7423181..c1cebef 100644
--- a/.github/workflows/jdk-cache.yml
+++ b/.github/workflows/jdk-cache.yml
@@ -114,6 +114,7 @@ jobs:
     name: Seed caches
     needs: prepare
     runs-on: ubuntu-24.04
+    cache-mode: write-only
     steps:
       - name: Check out benchmark repository
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
@@ -161,6 +162,7 @@ jobs:
     name: paired / ${{ matrix.sample }}
     needs: seed
     runs-on: ubuntu-24.04
+    cache-mode: read
     # A measurement job is a couple of minutes of work. Anything far beyond that
     # is a stalled cache download or JDK fetch rather than a slow measurement,
     # and the run should not wait six hours for the default timeout to notice.