fix: drop the GitHub Actions cache layer, keep the tool cache lookup

Review found that the GitHub Actions cache layer cost more than it saved. Measured on ubuntu-latest, same job, same version: cold: download + checksum + cosign + extract 0.93 s cache hit: restore the 24 MB entry 1.28 s first run also pays a save +2.26 s It is slower than a download in every configuration measured, because a GitHub-hosted runner reaches the release CDN in about 0.4 s for a 15 MB archive, and the cached entry is the larger extracted directory. It also skipped the sha256 and cosign verification on a hit, which is the control it was supposed to protect, and the only case where it wins on time is when cosign is installed, which is exactly the case where skipping is wrong. It cost 875 KB (+120%) of dist/index.js for every user and 24 MB of repository cache quota per version and platform. The restore and save wrappers were also dead code: @actions/cache catches everything except ValidationError internally, so the try/catch and the ReserveCacheError classification could never run. What remains is the runner tool cache lookup, which is what #476 asked for, and the distribution-keyed tool name that stops a Pro binary being returned for an OSS install. The tool cache test asserted that two installs return the same path, but that path is a pure function of the tool, version and architecture: it passed even with the tool cache wiped between the calls. It now asserts that the second install reports a tool cache hit and does not download, and it was verified to fail when the lookup is removed. Co-authored-by: timbretimber <105982513+timbretimber@users.noreply.github.com> Co-authored-by: Akkuman <akkumans@qq.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4eaf86fa-a85b-41f6-8763-612acc1ccc39 Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>
2026-09-02 10:58:27 +00:00 · 2026-08-29 17:56:44 -03:00
parent df0896bb77
commit 7c44e618e7
12 changed files with 52 additions and 1770 deletions
@@ -100,28 +100,6 @@ jobs:
        run: |
          goreleaser check --verbose

-  cache-binary:
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os:
-          - ubuntu-latest
-          - macos-latest
-          - windows-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      # The first workflow run saves the binary, later runs restore it.
-      - name: GoReleaser
-        uses: ./
-        with:
-          version: '~> v2'
-          install-only: true
-          cache-binary: true
-      - name: Check
-        run: goreleaser --version
-
  signing:
    runs-on: ${{ matrix.os }}
    if: github.event_name != 'pull_request'
@@ -220,33 +220,24 @@ steps:

 ### Cache the binary

-The action always looks for GoReleaser in the [runner tool cache][toolcache]
-first. That cache is kept between jobs on self-hosted runners only, so on
-GitHub-hosted runners every job downloads and verifies the release again.
+The action looks for GoReleaser in the [runner tool cache][toolcache] before it
+downloads. A second use of the action in the same job, or any job on a
+self-hosted runner that already has the version, installs immediately.

-Set `cache-binary` to store the binary in the [GitHub Actions cache][ghcache]
-as well. Later jobs then restore it instead of downloading the release archive,
-the checksums and the signature bundle again:
+A binary taken from the tool cache is not verified again, because the checksum
+and the cosign signature were verified when it was first written. On a
+self-hosted runner the tool cache is kept between jobs, so it must be trusted
+like the runner itself. GitHub-hosted runners start with an empty tool cache in
+every job, so they always download and verify.

-```yaml
-steps:
-  -
-    name: Install GoReleaser
-    uses: goreleaser/goreleaser-action@v7
-    with:
-      version: '~> v2'
-      install-only: true
-      cache-binary: true
-```
-
-The cache entry is written per distribution, version, operating system and
-architecture, and it counts against the [cache size limit][ghcachelimit] of your
-repository. Cache errors are not fatal: the action logs a warning and falls back
-to a download.
+The action does not use the [GitHub Actions cache][ghcache]. It was measured and
+it is slower than a download: restoring the 24 MB entry takes about 1.3 s, while
+downloading, verifying the checksum, verifying the cosign signature and
+extracting the release takes about 0.9 s on a GitHub-hosted runner. It would
+also skip the verification it is supposed to protect.

 [toolcache]: https://github.com/actions/toolkit/tree/main/packages/tool-cache
 [ghcache]: https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/cache-dependencies
-[ghcachelimit]: https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching#usage-limits-and-eviction-policy

 ## Customizing

@@ -262,7 +253,6 @@ Following inputs can be used as `step.with` keys
 | `args`           | String  |              | Arguments to pass to GoReleaser                                  |
 | `workdir`        | String  | `.`          | Working directory (below repository root)                        |
 | `install-only`   | Bool    | `false`      | Just install GoReleaser                                          |
-| `cache-binary`   | Bool    | `false`      | Cache the GoReleaser binary in the GitHub Actions cache (see below) |

 > **¹** Can be a fixed version like `v0.117.0` or a max satisfying semver one like `~> 0.132`. In this case this will return `v0.132.1`.
 >
@@ -58,9 +58,27 @@ describe('install', () => {
    expect(fs.existsSync(bin)).toBe(true);
  }, 100000);

-  it('reuses the runner tool cache on a second install', async () => {
+  it('reuses the runner tool cache instead of downloading again', async () => {
    const first = await goreleaser.install('goreleaser', 'v2.15.3');
-    const second = await goreleaser.install('goreleaser', 'v2.15.3');
+
+    const written: string[] = [];
+    const stdout = process.stdout.write.bind(process.stdout);
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    process.stdout.write = ((chunk: any, ...rest: any[]): boolean => {
+      written.push(chunk.toString());
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      return (stdout as any)(chunk, ...rest);
+    }) as typeof process.stdout.write;
+    let second: string;
+    try {
+      second = await goreleaser.install('goreleaser', 'v2.15.3');
+    } finally {
+      process.stdout.write = stdout;
+    }
+
+    const logs = written.join('');
+    expect(logs).toContain('found in the runner tool cache');
+    expect(logs).not.toContain('Downloading https://github.com/goreleaser');
    expect(second).toEqual(first);
    expect(fs.existsSync(second)).toBe(true);
  }, 100000);
@@ -12,7 +12,6 @@ const baseInputs = (overrides: Partial<Inputs>): Inputs => ({
  args: '',
  workdir: '.',
  installOnly: false,
-  cacheBinary: false,
  ...overrides
 });

@@ -32,10 +32,6 @@ inputs:
    description: 'Just install GoReleaser'
    default: 'false'
    required: false
-  cache-binary:
-    description: 'Cache the GoReleaser binary in the GitHub Actions cache'
-    default: 'false'
-    required: false

 outputs:
  artifacts:
@@ -7,7 +7,6 @@
      "name": "goreleaser-action",
      "license": "MIT",
      "dependencies": {
-        "@actions/cache": "^6.2.0",
        "@actions/core": "^3.0.1",
        "@actions/exec": "^3.0.0",
        "@actions/http-client": "^4.0.1",
@@ -34,23 +33,6 @@
        "typescript": "^5.2.2"
      }
    },
-    "node_modules/@actions/cache": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-6.2.0.tgz",
-      "integrity": "sha512-Nv0xWRmbxfDbAn/70flO/F6tj2Nv4XTYMAsQHiDFSojCDfso/Zni+fRKa14ToI9hnmOW/rQcY1WYb6wsM7Pgwg==",
-      "license": "MIT",
-      "dependencies": {
-        "@actions/core": "^3.0.1",
-        "@actions/exec": "^3.0.0",
-        "@actions/glob": "^0.6.1",
-        "@actions/http-client": "^4.0.1",
-        "@actions/io": "^3.0.2",
-        "@azure/core-rest-pipeline": "^1.23.0",
-        "@azure/storage-blob": "^12.31.0",
-        "@protobuf-ts/runtime-rpc": "^2.11.1",
-        "semver": "^7.7.4"
-      }
-    },
    "node_modules/@actions/core": {
      "version": "3.0.1",
      "resolved": "https://registry.npmjs.org/@actions/core/-/core-3.0.1.tgz",
@@ -70,38 +52,6 @@
        "@actions/io": "^3.0.2"
      }
    },
-    "node_modules/@actions/glob": {
-      "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/@actions/glob/-/glob-0.6.1.tgz",
-      "integrity": "sha512-K4+2Ac5ILcf2ySdJCha+Pop9NcKjxqCL4xL4zI50dgB2PbXgC0+AcP011xfH4Of6b4QEJJg8dyZYv7zl4byTsw==",
-      "license": "MIT",
-      "dependencies": {
-        "@actions/core": "^3.0.0",
-        "minimatch": "^3.0.4"
-      }
-    },
-    "node_modules/@actions/glob/node_modules/brace-expansion": {
-      "version": "1.1.18",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
-      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
-      "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^1.0.0",
-        "concat-map": "0.0.1"
-      }
-    },
-    "node_modules/@actions/glob/node_modules/minimatch": {
-      "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
-      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
-      "license": "ISC",
-      "dependencies": {
-        "brace-expansion": "^1.1.7"
-      },
-      "engines": {
-        "node": "*"
-      }
-    },
    "node_modules/@actions/http-client": {
      "version": "4.0.1",
      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-4.0.1.tgz",
@@ -131,280 +81,6 @@
        "semver": "^7.7.3"
      }
    },
-    "node_modules/@azure/abort-controller": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.2.0.tgz",
-      "integrity": "sha512-fNAjWnA/nZ2jz31kxR/AqRaUT8ewHBw/WuBIosK0moMy1C9e5ValbDfFdIxJzVOOYaYkV/b2F1S4H/aHiqfVQg==",
-      "license": "MIT",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=22.0.0"
-      }
-    },
-    "node_modules/@azure/abort-controller/node_modules/tslib": {
-      "version": "2.8.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
-      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
-      "license": "0BSD"
-    },
-    "node_modules/@azure/core-auth": {
-      "version": "1.11.0",
-      "resolved": "https://registry.npmjs.org/@azure/core-auth/-/core-auth-1.11.0.tgz",
-      "integrity": "sha512-IUZydyTUkDnYdstOW9pFOOUQlBjAepK5teihDE3x6yxsPJs/hsAaaYpeGxdxrgtOiJbBKSjKW7MDk7AEhb4LRg==",
-      "license": "MIT",
-      "dependencies": {
-        "@azure/abort-controller": "^2.1.2",
-        "@azure/core-util": "^1.13.0",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=22.0.0"
-      }
-    },
-    "node_modules/@azure/core-auth/node_modules/tslib": {
-      "version": "2.8.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
-      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
-      "license": "0BSD"
-    },
-    "node_modules/@azure/core-client": {
-      "version": "1.11.0",
-      "resolved": "https://registry.npmjs.org/@azure/core-client/-/core-client-1.11.0.tgz",
-      "integrity": "sha512-JjQWO6akOck45PH/XBrxzsQGAiKrfFl4m5iggJ0ItMIz5omRufOXWpqCPpdjKN3vKDzlSUvFjaMb7Zwf0gvAdA==",
-      "license": "MIT",
-      "dependencies": {
-        "@azure/abort-controller": "^2.1.2",
-        "@azure/core-auth": "^1.10.0",
-        "@azure/core-rest-pipeline": "^1.22.0",
-        "@azure/core-tracing": "^1.3.0",
-        "@azure/core-util": "^1.13.0",
-        "@azure/logger": "^1.3.0",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=22.0.0"
-      }
-    },
-    "node_modules/@azure/core-client/node_modules/tslib": {
-      "version": "2.8.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
-      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
-      "license": "0BSD"
-    },
-    "node_modules/@azure/core-http-compat": {
-      "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/@azure/core-http-compat/-/core-http-compat-2.5.0.tgz",
-      "integrity": "sha512-BoSmXPx2er1Ai+wKlDvj29jIQespCNBwEmKyZVHO2kEFsWbGjAjwMCGzug3DJM5/QYIV3vej0S1zcU5bq9fa8w==",
-      "license": "MIT",
-      "dependencies": {
-        "@azure/abort-controller": "^2.1.2"
-      },
-      "engines": {
-        "node": ">=22.0.0"
-      },
-      "peerDependencies": {
-        "@azure/core-client": "^1.10.0",
-        "@azure/core-rest-pipeline": "^1.22.0"
-      }
-    },
-    "node_modules/@azure/core-lro": {
-      "version": "2.7.2",
-      "resolved": "https://registry.npmjs.org/@azure/core-lro/-/core-lro-2.7.2.tgz",
-      "integrity": "sha512-0YIpccoX8m/k00O7mDDMdJpbr6mf1yWo2dfmxt5A8XVZVVMz2SSKaEbMCeJRvgQ0IaSlqhjT47p4hVIRRy90xw==",
-      "license": "MIT",
-      "dependencies": {
-        "@azure/abort-controller": "^2.0.0",
-        "@azure/core-util": "^1.2.0",
-        "@azure/logger": "^1.0.0",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@azure/core-lro/node_modules/tslib": {
-      "version": "2.8.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
-      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
-      "license": "0BSD"
-    },
-    "node_modules/@azure/core-paging": {
-      "version": "1.7.0",
-      "resolved": "https://registry.npmjs.org/@azure/core-paging/-/core-paging-1.7.0.tgz",
-      "integrity": "sha512-7GEAoIsaoBr6KELNRb8nypowCqvk8dnCHFCYg4XD4lOQGY2GqjQg5IhkRjyBFRO18CGSMq05PaNqSOE9GQro3g==",
-      "license": "MIT",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=22.0.0"
-      }
-    },
-    "node_modules/@azure/core-paging/node_modules/tslib": {
-      "version": "2.8.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
-      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
-      "license": "0BSD"
-    },
-    "node_modules/@azure/core-rest-pipeline": {
-      "version": "1.25.0",
-      "resolved": "https://registry.npmjs.org/@azure/core-rest-pipeline/-/core-rest-pipeline-1.25.0.tgz",
-      "integrity": "sha512-bMs8ekJLjX8wPV+9IPBges1SLPyuDtE9g5gLDWOpxzKcoOFQnpLGkbcT1tdw3FaAmDS1gnPmMmJ6y/T5B96kIA==",
-      "license": "MIT",
-      "dependencies": {
-        "@azure/abort-controller": "^2.1.2",
-        "@azure/core-auth": "^1.10.0",
-        "@azure/core-tracing": "^1.3.0",
-        "@azure/core-util": "^1.13.0",
-        "@azure/logger": "^1.3.0",
-        "@typespec/ts-http-runtime": "^0.3.4",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=22.0.0"
-      }
-    },
-    "node_modules/@azure/core-rest-pipeline/node_modules/tslib": {
-      "version": "2.8.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
-      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
-      "license": "0BSD"
-    },
-    "node_modules/@azure/core-tracing": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/@azure/core-tracing/-/core-tracing-1.4.0.tgz",
-      "integrity": "sha512-eGwxD0AtncrxeBM4tG8R55Pc3rdX1hNW2WibJAgYpCVA6E93mvvVH+LcssoVjOBrSKWS55yEIHsk0X8ctHmfOQ==",
-      "license": "MIT",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=22.0.0"
-      }
-    },
-    "node_modules/@azure/core-tracing/node_modules/tslib": {
-      "version": "2.8.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
-      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
-      "license": "0BSD"
-    },
-    "node_modules/@azure/core-util": {
-      "version": "1.14.0",
-      "resolved": "https://registry.npmjs.org/@azure/core-util/-/core-util-1.14.0.tgz",
-      "integrity": "sha512-9n2pWK61veAuN0V20t9lOuoV4CFMdyAZ1ygZzvBGk/pBBJRib/PjL9PLXa/aI2CcPpyHfqVsxxqLCYl6uZlfDw==",
-      "license": "MIT",
-      "dependencies": {
-        "@azure/abort-controller": "^2.1.2",
-        "@typespec/ts-http-runtime": "^0.3.0",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=22.0.0"
-      }
-    },
-    "node_modules/@azure/core-util/node_modules/tslib": {
-      "version": "2.8.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
-      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
-      "license": "0BSD"
-    },
-    "node_modules/@azure/core-xml": {
-      "version": "1.6.0",
-      "resolved": "https://registry.npmjs.org/@azure/core-xml/-/core-xml-1.6.0.tgz",
-      "integrity": "sha512-e7lX/dk//F6Qf7BB6PTY4+p2yuOQtyOeHGyapYHNwqSp2OnYpwQt49A/Nin2XmKBQ69pwagR4k/lQBq8lbHQkA==",
-      "license": "MIT",
-      "dependencies": {
-        "fast-xml-parser": "^5.5.9",
-        "tslib": "^2.8.1"
-      },
-      "engines": {
-        "node": ">=22.0.0"
-      }
-    },
-    "node_modules/@azure/core-xml/node_modules/tslib": {
-      "version": "2.8.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
-      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
-      "license": "0BSD"
-    },
-    "node_modules/@azure/logger": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/@azure/logger/-/logger-1.4.0.tgz",
-      "integrity": "sha512-rbAE25KUfjU/s3XHUdJgceoCP5dEOpMx85J04kF+QMdta73XkuG9JGHHinch+XIoKpBdqljin+KqURpJriSzLA==",
-      "license": "MIT",
-      "dependencies": {
-        "@typespec/ts-http-runtime": "^0.3.0",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=22.0.0"
-      }
-    },
-    "node_modules/@azure/logger/node_modules/tslib": {
-      "version": "2.8.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
-      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
-      "license": "0BSD"
-    },
-    "node_modules/@azure/storage-blob": {
-      "version": "12.33.0",
-      "resolved": "https://registry.npmjs.org/@azure/storage-blob/-/storage-blob-12.33.0.tgz",
-      "integrity": "sha512-2SX8oP8PyblUcAFZSg39c8Ls+tFjavM6sBeV+qpw33mRzRhI/5hrFJmJ/x0H9xx5l6ECPvgSP8uPxqTeVbHNIA==",
-      "license": "MIT",
-      "dependencies": {
-        "@azure/abort-controller": "^2.1.2",
-        "@azure/core-auth": "^1.9.0",
-        "@azure/core-client": "^1.9.3",
-        "@azure/core-http-compat": "^2.2.0",
-        "@azure/core-lro": "^2.2.0",
-        "@azure/core-paging": "^1.6.2",
-        "@azure/core-rest-pipeline": "^1.19.1",
-        "@azure/core-tracing": "^1.2.0",
-        "@azure/core-util": "^1.11.0",
-        "@azure/core-xml": "^1.4.5",
-        "@azure/logger": "^1.1.4",
-        "@azure/storage-common": "^12.4.1",
-        "events": "^3.0.0",
-        "tslib": "^2.8.1"
-      },
-      "engines": {
-        "node": ">=22.0.0"
-      }
-    },
-    "node_modules/@azure/storage-blob/node_modules/tslib": {
-      "version": "2.8.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
-      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
-      "license": "0BSD"
-    },
-    "node_modules/@azure/storage-common": {
-      "version": "12.5.0",
-      "resolved": "https://registry.npmjs.org/@azure/storage-common/-/storage-common-12.5.0.tgz",
-      "integrity": "sha512-bttzuhQiCIwrkzjPDA+AtAR7dg19L/CC6ztcqJ5LfvWpXuys9mHp0UQ0udYnoUvv9SCT9KTR5kqFvFr0e6k0lQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@azure/abort-controller": "^2.1.2",
-        "@azure/core-auth": "^1.9.0",
-        "@azure/core-http-compat": "^2.4.0",
-        "@azure/core-rest-pipeline": "^1.24.0",
-        "@azure/core-tracing": "^1.2.0",
-        "@azure/core-util": "^1.11.0",
-        "@azure/logger": "^1.1.4",
-        "events": "^3.3.0",
-        "tslib": "^2.8.1"
-      },
-      "engines": {
-        "node": ">=22.0.0"
-      }
-    },
-    "node_modules/@azure/storage-common/node_modules/tslib": {
-      "version": "2.8.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
-      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
-      "license": "0BSD"
-    },
    "node_modules/@babel/code-frame": {
      "version": "7.28.6",
      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.28.6.tgz",
@@ -1576,18 +1252,6 @@
        "@jridgewell/sourcemap-codec": "^1.4.14"
      }
    },
-    "node_modules/@nodable/entities": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/@nodable/entities/-/entities-3.0.0.tgz",
-      "integrity": "sha512-8L9xFeTYKhm49xfIypoe2W5wV1m/3Z58kT+7kR9A8OyFxcPduI4VmxaUMQyKYrRjUoLLSXv6EKKID5Tvj9cUVw==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/nodable"
-        }
-      ],
-      "license": "MIT"
-    },
    "node_modules/@nodelib/fs.scandir": {
      "version": "2.1.5",
      "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz",
@@ -1639,21 +1303,6 @@
        "url": "https://opencollective.com/pkgr"
      }
    },
-    "node_modules/@protobuf-ts/runtime": {
-      "version": "2.11.1",
-      "resolved": "https://registry.npmjs.org/@protobuf-ts/runtime/-/runtime-2.11.1.tgz",
-      "integrity": "sha512-KuDaT1IfHkugM2pyz+FwiY80ejWrkH1pAtOBOZFuR6SXEFTsnb/jiQWQ1rCIrcKx2BtyxnxW6BWwsVSA/Ie+WQ==",
-      "license": "(Apache-2.0 AND BSD-3-Clause)"
-    },
-    "node_modules/@protobuf-ts/runtime-rpc": {
-      "version": "2.11.1",
-      "resolved": "https://registry.npmjs.org/@protobuf-ts/runtime-rpc/-/runtime-rpc-2.11.1.tgz",
-      "integrity": "sha512-4CqqUmNA+/uMz00+d3CYKgElXO9VrEbucjnBFEjqI4GuDrEQ32MaI3q+9qPBvIGOlL4PmHXrzM32vBPWRhQKWQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@protobuf-ts/runtime": "^2.11.1"
-      }
-    },
    "node_modules/@sinclair/typebox": {
      "version": "0.27.8",
      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.27.8.tgz",
@@ -2037,26 +1686,6 @@
        "url": "https://opencollective.com/typescript-eslint"
      }
    },
-    "node_modules/@typespec/ts-http-runtime": {
-      "version": "0.3.8",
-      "resolved": "https://registry.npmjs.org/@typespec/ts-http-runtime/-/ts-http-runtime-0.3.8.tgz",
-      "integrity": "sha512-bLMpVcWZNzq6lYOybwFwOAR1IXKcHnhUNqYeHjl1bET/qE3jFPFH+p8Wrh3rU4xwdnifPxmKNESBYnvnmc75aA==",
-      "license": "MIT",
-      "dependencies": {
-        "http-proxy-agent": "^7.0.0",
-        "https-proxy-agent": "^7.0.0",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=22.0.0"
-      }
-    },
-    "node_modules/@typespec/ts-http-runtime/node_modules/tslib": {
-      "version": "2.8.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
-      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
-      "license": "0BSD"
-    },
    "node_modules/@ungap/structured-clone": {
      "version": "1.3.0",
      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.0.tgz",
@@ -2110,15 +1739,6 @@
        "node": ">=0.4.0"
      }
    },
-    "node_modules/agent-base": {
-      "version": "7.1.4",
-      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
-      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 14"
-      }
-    },
    "node_modules/ajv": {
      "version": "6.12.6",
      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
@@ -2205,18 +1825,6 @@
        "node": ">= 8"
      }
    },
-    "node_modules/anynum": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/anynum/-/anynum-1.0.1.tgz",
-      "integrity": "sha512-N6//FLET/tXYNM/F6ABca1oH6fWB+KlTt909Le28WMDBk8oaT4vY17DCrwg2MvmuqUKt3Ni4N5dGJ/EoBgcO6A==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/NaturalIntelligence"
-        }
-      ],
-      "license": "MIT"
-    },
    "node_modules/arg": {
      "version": "4.1.3",
      "resolved": "https://registry.npmjs.org/arg/-/arg-4.1.3.tgz",
@@ -2370,6 +1978,7 @@
      "version": "1.0.2",
      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
      "license": "MIT"
    },
    "node_modules/baseline-browser-mapping": {
@@ -2643,6 +2252,7 @@
      "version": "0.0.1",
      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==",
+      "dev": true,
      "license": "MIT"
    },
    "node_modules/convert-source-map": {
@@ -2700,6 +2310,7 @@
      "version": "4.4.3",
      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "dev": true,
      "license": "MIT",
      "dependencies": {
        "ms": "^2.1.3"
@@ -3283,15 +2894,6 @@
        "node": ">=0.10.0"
      }
    },
-    "node_modules/events": {
-      "version": "3.3.0",
-      "resolved": "https://registry.npmjs.org/events/-/events-3.3.0.tgz",
-      "integrity": "sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.8.x"
-      }
-    },
    "node_modules/execa": {
      "version": "5.1.1",
      "resolved": "https://registry.npmjs.org/execa/-/execa-5.1.1.tgz",
@@ -3400,45 +3002,6 @@
      "dev": true,
      "license": "MIT"
    },
-    "node_modules/fast-xml-builder": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.3.1.tgz",
-      "integrity": "sha512-pIM/1n3ntFXKYrUZwW7QCK0gAW7XY+wzj1YMIV3tLDvPj/V+zTGJK5e3/4WJfwj0qWw2ElNXiTixda/R+3YSug==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/NaturalIntelligence"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "path-expression-matcher": "^1.6.2",
-        "xml-naming": "^0.3.0"
-      }
-    },
-    "node_modules/fast-xml-parser": {
-      "version": "5.11.1",
-      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.11.1.tgz",
-      "integrity": "sha512-TBw6K/fxoQGGjCmZDw9w/ZwP3uDcnTM4YH/g+PFRWr8sbe5idXtxNN6vITh4+1ruCZaho6uBFurElsA7F0zzgw==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/NaturalIntelligence"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "@nodable/entities": "^3.0.0",
-        "fast-xml-builder": "^1.2.0",
-        "is-unsafe": "^2.0.0",
-        "path-expression-matcher": "^1.6.2",
-        "strnum": "^2.4.2",
-        "xml-naming": "^0.3.0"
-      },
-      "bin": {
-        "fxparser": "src/cli/cli.js"
-      }
-    },
    "node_modules/fastq": {
      "version": "1.20.1",
      "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.20.1.tgz",
@@ -3772,32 +3335,6 @@
      "dev": true,
      "license": "MIT"
    },
-    "node_modules/http-proxy-agent": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz",
-      "integrity": "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==",
-      "license": "MIT",
-      "dependencies": {
-        "agent-base": "^7.1.0",
-        "debug": "^4.3.4"
-      },
-      "engines": {
-        "node": ">= 14"
-      }
-    },
-    "node_modules/https-proxy-agent": {
-      "version": "7.0.6",
-      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
-      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
-      "license": "MIT",
-      "dependencies": {
-        "agent-base": "^7.1.2",
-        "debug": "4"
-      },
-      "engines": {
-        "node": ">= 14"
-      }
-    },
    "node_modules/human-signals": {
      "version": "2.1.0",
      "resolved": "https://registry.npmjs.org/human-signals/-/human-signals-2.1.0.tgz",
@@ -3983,18 +3520,6 @@
        "url": "https://github.com/sponsors/sindresorhus"
      }
    },
-    "node_modules/is-unsafe": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/is-unsafe/-/is-unsafe-2.0.2.tgz",
-      "integrity": "sha512-HgbIHPBH0KHHCcjLfGsCvhtPTVxjaAZlXjwdz7/GQC40SjSe4sfQsar8J5VFo8JOSbarkpV0OLG95bbaNd9aAQ==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/NaturalIntelligence"
-        }
-      ],
-      "license": "MIT"
-    },
    "node_modules/isexe": {
      "version": "2.0.0",
      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
@@ -5008,6 +4533,7 @@
      "version": "2.1.3",
      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "dev": true,
      "license": "MIT"
    },
    "node_modules/natural-compare": {
@@ -5189,21 +4715,6 @@
        "node": ">=8"
      }
    },
-    "node_modules/path-expression-matcher": {
-      "version": "1.6.2",
-      "resolved": "https://registry.npmjs.org/path-expression-matcher/-/path-expression-matcher-1.6.2.tgz",
-      "integrity": "sha512-enSlaiat05iasnzmgNxRj8reFdj3puY2QpNgP1aPIaVfT6nn9ICuPoFlKHk8EN22HcwewshO+mN2DGbkCEOtqQ==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/NaturalIntelligence"
-        }
-      ],
-      "license": "MIT",
-      "engines": {
-        "node": ">=14.0.0"
-      }
-    },
    "node_modules/path-is-absolute": {
      "version": "1.0.1",
      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
@@ -5816,21 +5327,6 @@
        "url": "https://github.com/sponsors/sindresorhus"
      }
    },
-    "node_modules/strnum": {
-      "version": "2.4.2",
-      "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.4.2.tgz",
-      "integrity": "sha512-rDG3Ah4TV0k1hWvLSzkZtMmLN9+eS+h3knq4MP6A42Y3Yh5qGNnOUs1jJkoSr8FG5dsL28c7KgkIBzSEykqtuw==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/NaturalIntelligence"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "anynum": "^1.0.1"
-      }
-    },
    "node_modules/supports-color": {
      "version": "7.2.0",
      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
@@ -6367,21 +5863,6 @@
        "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
      }
    },
-    "node_modules/xml-naming": {
-      "version": "0.3.0",
-      "resolved": "https://registry.npmjs.org/xml-naming/-/xml-naming-0.3.0.tgz",
-      "integrity": "sha512-ghig2TBE/H11aOVgmahA3MhimvkBr6JIYknH/Dhdk10nXwdbIqBJsbfMxpvFPG8bAw77gN29aQWvKpmVoPlvPQ==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/NaturalIntelligence"
-        }
-      ],
-      "license": "MIT",
-      "engines": {
-        "node": ">=16.0.0"
-      }
-    },
    "node_modules/y18n": {
      "version": "5.0.8",
      "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz",
@@ -24,7 +24,6 @@
  "author": "CrazyMax",
  "license": "MIT",
  "dependencies": {
-    "@actions/cache": "^6.2.0",
    "@actions/core": "^3.0.1",
    "@actions/exec": "^3.0.0",
    "@actions/http-client": "^4.0.1",
@@ -11,7 +11,6 @@ export interface Inputs {
  args: string;
  workdir: string;
  installOnly: boolean;
-  cacheBinary: boolean;
 }

 export async function getInputs(): Promise<Inputs> {
@@ -21,7 +20,6 @@ export async function getInputs(): Promise<Inputs> {
    versionFile: core.getInput('version-file'),
    args: core.getInput('args'),
    workdir: core.getInput('workdir') || '.',
-    installOnly: core.getBooleanInput('install-only'),
-    cacheBinary: core.getBooleanInput('cache-binary')
+    installOnly: core.getBooleanInput('install-only')
  };
 }
@@ -1,17 +1,15 @@
 import * as crypto from 'crypto';
 import * as fs from 'fs';
-import * as os from 'os';
 import * as path from 'path';
 import * as yaml from 'js-yaml';
 import * as context from './context';
 import * as github from './github';
-import * as cache from '@actions/cache';
 import * as core from '@actions/core';
 import * as exec from '@actions/exec';
 import * as io from '@actions/io';
 import * as tc from '@actions/tool-cache';

-export async function install(distribution: string, version: string, cacheBinary = false): Promise<string> {
+export async function install(distribution: string, version: string): Promise<string> {
  const release: github.GitHubRelease = await github.getRelease(distribution, version);
  const tag = release.tag_name;
  const toolVersion = tag.replace(/^v/, '');
@@ -23,17 +21,6 @@ export async function install(distribution: string, version: string, cacheBinary
  }

  const filename = getFilename(distribution);
-  const extPath = path.join(process.env.RUNNER_TEMP || os.tmpdir(), 'goreleaser-action', distribution, toolVersion);
-  const useCache = cacheBinary && cache.isFeatureAvailable();
-  // The GitHub Actions cache is shared by every runner of a repository, so the
-  // key must pin the distribution, platform and architecture. The release
-  // filename already encodes all three.
-  const cacheKey = `goreleaser-action-${tag}-${filename}`;
-
-  if (useCache && (await restoreCache(cacheKey, extPath))) {
-    return getExePath(await tc.cacheDir(extPath, distribution, toolVersion));
-  }
-
  const baseUrl = `https://github.com/goreleaser/${distribution}/releases/download/${tag}`;
  const downloadUrl = `${baseUrl}/${filename}`;

@@ -44,23 +31,19 @@ export async function install(distribution: string, version: string, cacheBinary
  await verifyChecksum(distribution, tag, downloadPath, filename);

  core.info('Extracting GoReleaser');
-  await io.rmRF(extPath);
+  let extPath: string;
  if (context.osPlat == 'win32') {
    let zipPath = downloadPath;
    if (!zipPath.endsWith('.zip')) {
      zipPath = `${downloadPath}.zip`;
      fs.renameSync(downloadPath, zipPath);
    }
-    await tc.extractZip(zipPath, extPath);
+    extPath = await tc.extractZip(zipPath);
  } else {
-    await tc.extractTar(downloadPath, extPath);
+    extPath = await tc.extractTar(downloadPath);
  }
  core.debug(`Extracted to ${extPath}`);

-  if (useCache) {
-    await saveCache(cacheKey, extPath);
-  }
-
  const cachePath: string = await tc.cacheDir(extPath, distribution, toolVersion);
  core.debug(`Cached to ${cachePath}`);

@@ -71,42 +54,6 @@ const getExePath = (dir: string): string => {
  return path.join(dir, context.osPlat == 'win32' ? 'goreleaser.exe' : 'goreleaser');
 };

-async function restoreCache(key: string, dest: string): Promise<boolean> {
-  try {
-    const hit = await cache.restoreCache([dest], key);
-    if (!hit) {
-      core.info(`No GitHub Actions cache entry for ${key}`);
-      return false;
-    }
-    if (!fs.existsSync(getExePath(dest))) {
-      core.warning(`Ignoring incomplete GitHub Actions cache entry ${hit}`);
-      await io.rmRF(dest);
-      return false;
-    }
-    core.info(`Restored ${hit} from the GitHub Actions cache`);
-    return true;
-  } catch (e) {
-    logCacheError(`Unable to restore ${key} from the GitHub Actions cache`, e);
-    return false;
-  }
-}
-
-async function saveCache(key: string, src: string): Promise<void> {
-  try {
-    await cache.saveCache([src], key);
-    core.info(`Saved ${key} to the GitHub Actions cache`);
-  } catch (e) {
-    logCacheError(`Unable to save ${key} to the GitHub Actions cache`, e);
-  }
-}
-
-// A read-only cache token (fork pull requests) and a key already reserved by a
-// concurrent job are expected, so they must not raise a warning annotation.
-const logCacheError = (message: string, e: Error): void => {
-  const expected = e instanceof cache.ReserveCacheError || e instanceof cache.CacheReadDeniedError;
-  (expected ? core.info : core.warning)(`${message}: ${e.message}`);
-};
-
 export async function verifyChecksum(
  distribution: string,
  tag: string,
@@ -12,7 +12,7 @@ async function run(): Promise<void> {
  try {
    const inputs: context.Inputs = await context.getInputs();
    const version = getRequestedVersion(inputs);
-    const bin = await goreleaser.install(inputs.distribution, version, inputs.cacheBinary);
+    const bin = await goreleaser.install(inputs.distribution, version);
    core.info(`GoReleaser ${version} installed successfully`);

    if (inputs.installOnly) {