fix(#6178): bump actions/cache to v6.1.0, add actions:write to harness-dispatch

[rh-hemartin]

Summary

• Bump actions/cache/restore and actions/cache/save from v4.3.0 to v6.1.0 in the harness-dispatch job, removing the Node.js 20 deprecation warning.
• Add actions: write permission to harness-dispatch so the GitHub Actions cache API can save entries (fixes "cache write denied: token has no writable scopes").

Fixes #6178

🤖 Generated with Claude Code

[qodo-code-review]

PR Summary by Qodo

Fix Harness dispatch cache writes by bumping actions/cache and granting actions:write

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Upgrade actions/cache restore/save in harness-dispatch to v6.1.0 to avoid Node.js 20 deprecation
 warnings.
• Grant harness-dispatch actions: write permission so cache saves succeed with least privilege.

Diagram

graph TD
  WF["reusable-dispatch.yml"] --> JOB["harness-dispatch job"] --> RESTORE["actions/cache/restore v6.1.0"] --> API[("GitHub Cache API")]
  JOB["harness-dispatch job"] --> SAVE["actions/cache/save v6.1.0"] --> API[("GitHub Cache API")]
  JOB["harness-dispatch job"] --> PERMS["permissions: actions=write"] --> API[("GitHub Cache API")]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Set workflow-wide permissions instead of job-scoped

• ➕ Simplifies permission management if multiple jobs need cache writes
• ➖ Broader token scope than necessary for jobs that don't need actions:write
• ➖ Harder to reason about least-privilege at the job level

2. Use broader `write-all` (or `contents: write`) permissions

• ➕ Quick way to unblock cache writes without pinpointing the needed scope
• ➖ Over-privileged token compared to actions: write
• ➖ Increases blast radius if a job is compromised

Recommendation: Keep the current approach: job-scoped actions: write is the least-privilege fix for cache save failures, and bumping actions/cache to v6.1.0 removes Node runtime deprecation warnings while remaining pinned to an immutable commit SHA.

Files changed (1) +3 / -2

Other (1) +3 / -2

reusable-dispatch.ymlGrant actions:write and bump actions/cache to v6.1.0 for harness-dispatch +3/-2

Grant actions:write and bump actions/cache to v6.1.0 for harness-dispatch

• Adds 'actions: write' permission to the harness-dispatch job so cache save requests are authorized. Updates 'actions/cache/restore' and 'actions/cache/save' from v4.3.0 to v6.1.0 (pinned SHAs) to eliminate Node.js 20 deprecation warnings and use the current cache action implementation.

.github/workflows/reusable-dispatch.yml

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:54 AM UTC · Completed 10:04 AM UTC

Commit: 87848b4 · View workflow run →

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can route each action level your way: inline, summary, both, or drop

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] .github/workflows/reusable-dispatch.yml — This PR modifies a file under the .github/ protected path. The change is linked to issue Dispatch warning, cache running on Node 24 #6178 and the PR description explains the rationale (bumping actions/cache to v6.1.0 and adding actions: write permission for cache API access). Human approval is always required for changes to governance and infrastructure files under protected paths.

Previous run

Review

Findings

Medium

• [protected-path] .github/workflows/reusable-dispatch.yml — This PR modifies a file under .github/, which is a protected path requiring human approval. The PR links to issue Dispatch warning, cache running on Node 24 #6178 and provides clear justification for both changes (bumping actions/cache to resolve the Node.js 20 deprecation warning, and adding actions: write permission to fix "cache write denied: token has no writable scopes" errors). Human approval is always required for protected-path changes, regardless of context.

Low

• [supply-chain] .github/workflows/reusable-dispatch.yml:1437 — actions/cache/restore and actions/cache/save are bumped from v4.3.0 (0057852b...) to v6.1.0 (55cc8345...). Both pins use full commit SHAs, which is correct supply-chain practice. The commit hash should be verified against the official actions/cache repository to confirm it corresponds to the claimed v6.1.0 tag.

---

Labels: PR modifies the dispatch workflow (.github/workflows/reusable-dispatch.yml) to fix cache action deprecation and permission issues

[rh-hemartin]

/fs-review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:59 AM UTC · Completed 7:10 AM UTC

Commit: 87848b4 · View workflow run →

[waynesun09]

Validated at head 87848b41 — both changes are correct and needed.

SHA pin verified: 55cc8345863c7cc4c66a329aec7e433d2d1c52a9 is exactly the v6.1.0 tag (and current floating v6) on actions/cache — resolves the bot's supply-chain question. v6 targets Node 24, killing the deprecation warning; v6.1.0 specifically adds graceful read-only-cache handling (actions/cache#1768), which downgrades the issue's "Cache save failed" error noise to a single warning when writes are denied.

actions: write — confirmed needed, with one nuance worth knowing:

• Needed: the job's permissions block is all-read (contents: read, pull-requests: read), so the derived cache token has no writable scopes — that is precisely the cache write denied: token has no writable scopes error in #6178. No write scope, no save, ever.
• Safe to request: per the workflow_call intersection rule, every caller must already grant it or the run would fail — and they do: the per-repo shim template grants actions: write (it always had to, since harness-run in this same workflow already requests it), and fullsend's own fullsend.yaml shim does too. No shim-rollout hazard, no new trust exposure: harness-dispatch executes only trusted code (base-SHA checkout, persist-credentials: false), and the cached artifact is the CLI from vendored/pinned-upstream sources.
• Nuance: since GitHub's 2026-06-26 change (read-only Actions cache for untrusted triggers), pull_request_target / issue_comment runs get a read-only cache token at the event level regardless of permissions — so saves will still be skipped on those triggers even after this merges (quietly, thanks to v6.1.0). Saves will succeed on trusted triggers (schedule polling dispatch, push, workflow_dispatch), and those entries serve restores for the untrusted-trigger runs — exactly GitHub's recommended pattern, and the cache key (fullsend-cli-<mode>-<workflow_sha>) is shared across events, so this works end-to-end. Worth a one-line comment in the workflow so nobody files a "cache still not saving on PR events" bug later; non-blocking.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 5:08 PM UTC · Completed 5:24 PM UTC

Commit: 87848b4 · View workflow run →

[fullsend-ai-retro]

Retro: PR #6279 — bump actions/cache to v6.1.0, add actions:write

Workflow went well overall. This was a human-authored, single-file fix (3 additions, 2 deletions in reusable-dispatch.yml) for issue #6178. The triage agent correctly identified both root causes (Node.js 20 deprecation from pinned v4.3.0 and missing actions: write). The review agent ran once on PR open, correctly flagged the protected-path concern (medium) and the supply-chain SHA verification need (low). Human reviewer waynesun09 delivered an exceptionally thorough approval that verified the SHA pin, analyzed workflow_call permission intersection rules, and identified a nuance about GitHub's 2026-06-26 read-only cache policy for untrusted triggers.

Timeline

1. Aug 13 12:48 — Issue #6178 filed by deboer-tim
2. Aug 13 12:49–12:53 — Triage agent (run 31701771960) correctly diagnosed both root causes and noted that workflow file changes require human intervention
3. Aug 17 09:53 — rh-hemartin opened PR fix(#6178): bump actions/cache to v6.1.0, add actions:write to harness-dispatch #6279 (co-authored with Claude Code)
4. Aug 17 09:54–10:05 — Review agent (run 32017487774) posted findings: protected-path (medium) and supply-chain SHA verification (low)
5. Aug 20 06:57 — PR author triggered second /fs-review on the same commit 87848b4 (run 32341810256)
6. Aug 20 16:53 — waynesun09 approved with detailed verification of SHA pin, permission safety, and cache behavior nuances
7. Aug 20 17:07 — PR merged

Improvement areas (all covered by existing issues)

SHA-to-tag verification (#2624): The review agent flagged the SHA bump as a supply-chain concern but stopped at "the hash should be verified" rather than performing the verification itself. The human reviewer explicitly confirmed 55cc8345 maps to the v6.1.0 tag. This PR is additional evidence that the agent's supply-chain finding creates verification work for humans that the agent could complete autonomously.

Permission inheritance analysis (fullsend-ai/agents#142): The review agent didn't analyze whether adding actions: write to the reusable workflow's harness-dispatch job would propagate safely to all callers via the workflow_call intersection rule. The human reviewer verified this end-to-end (callers already grant actions: write). This is evidence for the existing proposal to add workflow_call permission inheritance checks to the security sub-agent.

Same-commit re-review (#4681, fullsend-ai/agents#323): The second /fs-review ran on the same commit SHA (87848b4) as the first review. The PRIOR_REVIEW_PROVENANCE was none on the first run. This is additional evidence that same-commit dedup would save tokens.

What went well

• Triage agent correctly diagnosed both root causes and proactively noted the workflow-file limitation
• Review agent identified the right concerns at appropriate severity levels
• Human review was thorough and additive — verifying the SHA pin, analyzing permission propagation, and surfacing a platform behavior nuance (GitHub's read-only cache on untrusted triggers) that would be difficult for the agent to know without specialized platform knowledge
• No rework needed — the code was correct on the first attempt, and the PR merged without changes