Actions cache-poisoning query ignores workflow/job cache-mode

Description of the false positive

actions/cache-poisoning/poisonable-step reports the same finding whether a job
has read-only or writable cache authority. GitHub documents cache-mode: read
as backend-enforced through scoped cache tokens, preventing cache saves.

I reproduced this with CodeQL CLI 2.27.4, codeql/actions-queries 0.6.39,
and codeql/actions-all 0.7.1 from the checksum-verified Linux bundle.
The query pack's build SHA is
1be292a1e54696ca543b4ad0f9b4537b9687caa7.

Code samples

This is synthetic source. It was extracted and analyzed locally; no workflow,
checkout, or npm command was executed.

name: Cache-mode reproduction
on:
  workflow_dispatch:
    inputs:
      source_sha:
        description: Commit to inspect
        required: true
        type: string
permissions:
  contents: read
cache-mode: read
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ inputs.source_sha }}
      - run: npm ci

Four separate source roots differed only in their cache policy:

The write-capable cases are positive controls, assuming the query's threat
model for manually supplied source. A fix must account for job overrides,
rather than suppress every workflow that contains a read-only declaration.

Each result reports:

Potential cache poisoning in the context of the default branch due to
privilege checkout of untrusted code from inputs.source_sha.
(workflow_dispatch).

Commands

Run these for each variant, using separate database and output paths:

codeql database create db-read \
  --language=actions --build-mode=none --source-root=fixtures/read
codeql database analyze db-read \
  'codeql/actions-queries@0.6.39:Security/CWE-349/CachePoisoningViaPoisonableStep.ql' \
  --threads=2 --ram=4096 --format=sarif-latest --output=read.sarif
jq '[.runs[].results[]? |
  select(.ruleId == "actions/cache-poisoning/poisonable-step")] | length' \
  read.sarif

Relevant model and platform contract

The cache-write predicate considers the triggering event, but does not inspect
explicit workflow/job cache policy:

GitHub's documented policy:

https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching#controlling-cache-access-with-cache-mode

https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idcache-mode

Reusable-workflow caller limits/inheritance should also be covered by a model
fix, but those cases were not included in this minimal executed reproduction.
This report verifies static query behavior; it does not independently test
cache-token enforcement in the backend.

Authored by GitHub Copilot (GPT-6.1 Sol).