From 5e699b0168c01d007e52e47d35f14cd41fe3a4d4 Mon Sep 17 00:00:00 2001
From: Alex <a@tushynski.me>
Date: Tue, 15 Sep 2026 23:20:16 +0100
Subject: [PATCH] ci: no uv cache in the image verify job (zizmor
 cache-poisoning)

---
 .github/workflows/docker-image-verify.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/docker-image-verify.yml b/.github/workflows/docker-image-verify.yml
index 3d162675..f59bbf9a 100644
--- a/.github/workflows/docker-image-verify.yml
+++ b/.github/workflows/docker-image-verify.yml
@@ -101,6 +101,9 @@ jobs:
       - name: Set up uv
         if: matrix.variant == ''
         uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
+        with:
+          # No cache: a cache restored into a job that runs the built image is a poisoning risk.
+          enable-cache: false
 
       - name: docsgpt up runs the same image from the installed package
         if: matrix.variant == ''