From 8dc052475b8d09441d6303a78c7a1699d865f685 Mon Sep 17 00:00:00 2001
From: ISSOtm <me@eldred.fr>
Date: Tue, 7 Apr 2026 22:22:11 +0200
Subject: [PATCH] Avoid caching in our release workflow

This is a malware distrib vector,
and we run this workflow sporadically enough
that we can afford to do so uncached.
---
 .github/workflows/create-release-artifacts.yml | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/create-release-artifacts.yml b/.github/workflows/create-release-artifacts.yml
index 6a71ecfb..c35ce343 100644
--- a/.github/workflows/create-release-artifacts.yml
+++ b/.github/workflows/create-release-artifacts.yml
@@ -15,8 +15,8 @@ env:
   CMAKE_CONFIG_TYPE: Release # `cmake --build` now implies `--config Release`.
 
   # We instruct CMake to download and build third-party projects in the same place as in `testing.yml`
-  # for the sources cache to remain valid.
-  DEPS_ROOT_DIR: ~/_deps # Note that this needs to be used in a position where Bash will trigger tilde expansion!
+  # to prevent divergence between testing and release workflows.
+  DEPS_ROOT_DIR: ~/_deps
 
 jobs:
   windows:
@@ -41,12 +41,6 @@ jobs:
       - name: Install deps
         run: |
           bash .github/scripts/install_deps.sh windows
-      - name: Cache library deps
-        uses: actions/cache@v5
-        with:
-          path: ${{ env.DEPS_ROOT_DIR }}/*-tmp/
-          key: dep-srcs-${{ hashFiles('cmake/deps.cmake') }}
-          enableCrossOsArchive: true
       - name: Build Windows binaries
         shell: bash
         run: |