From 9af93d67864dc963de417bfe6d429476ca499e22 Mon Sep 17 00:00:00 2001
From: Derek Tamsen <828329+derektamsen@users.noreply.github.com>
Date: Tue, 28 Jul 2026 01:04:41 -0700
Subject: [PATCH] fix(ci): disable setup-go cache for tags

Disable setup go caching for tags. This will help
prevent using a poisoned cache on tagged releases.

Fixes #6
---
 .github/workflows/codeql.yaml  | 2 ++
 .github/workflows/release.yaml | 2 ++
 .github/workflows/test.yaml    | 2 ++
 3 files changed, 6 insertions(+)

diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
index e52374a..418df44 100644
--- a/.github/workflows/codeql.yaml
+++ b/.github/workflows/codeql.yaml
@@ -48,6 +48,8 @@ jobs:
 
     - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
       with:
+        # only enable the cache if the ref is not a tag
+        cache: ${{ !startsWith(github.ref, 'refs/tags/') }}
         go-version-file: 'go.mod'
 
     # Initializes the CodeQL tools for scanning.
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index c580b38..82565ab 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -33,6 +33,8 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
         with:
+          # only enable the cache if the ref is not a tag
+          cache: ${{ !startsWith(github.ref, 'refs/tags/') }}
           go-version: 'stable'
 
       - name: Install dependencies
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 46e10a0..7c37f55 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -20,6 +20,8 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
       with:
+        # only enable the cache if the ref is not a tag
+        cache: ${{ !startsWith(github.ref, 'refs/tags/') }}
         go-version: ${{ matrix.go-version }}
 
     - name: Install dependencies