From 59cd2ea0d03beaa038a7d60d78eee6036bd3ac9c Mon Sep 17 00:00:00 2001
From: qwen-code-ci-bot <qwen-code-ci-bot@users.noreply.github.com>
Date: Tue, 28 Jul 2026 15:31:51 +0000
Subject: [PATCH] test(ci): pin actions/cache/restore as restore-only invariant
 in both lanes (#7885)

---
 scripts/tests/qwen-triage-workflow.test.js | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/scripts/tests/qwen-triage-workflow.test.js b/scripts/tests/qwen-triage-workflow.test.js
index ba7cd32efe..71c339656b 100644
--- a/scripts/tests/qwen-triage-workflow.test.js
+++ b/scripts/tests/qwen-triage-workflow.test.js
@@ -2925,4 +2925,16 @@ describe('qwen-triage tmux lane parity', () => {
     const envelope = 4096; // verdict header, description, markers, signature
     expect(reportCap + transcriptCap + envelope).toBeLessThan(65536);
   });
+
+  // The cache step must be restore-only: `actions/cache/restore` has no
+  // post-save hook, so PR lifecycle scripts cannot write to the shared
+  // cache. Swapping to `actions/cache` would re-enable the save path and
+  // let a PR poison subsequent runs.
+  it('pins the npm cache step to restore-only in both lanes', () => {
+    for (const jobName of ['verify', 'tmux-testing']) {
+      const cacheStep = stepIn(jobName, 'Restore npm cache');
+      expect(cacheStep).toContain('actions/cache/restore@');
+      expect(cacheStep).not.toMatch(/uses:\s*'actions\/cache@/);
+    }
+  });
 });