Disable npm caching in release workflow

[horgh]

zizmor reports cache-poisoning findings for release.yml (it has a release: published trigger and publishes to npm): a poisoned cache entry restored during a release run could taint the published package. This disables setup-node's package-manager cache in both jobs of that workflow.

This also closes the open zizmor code-scanning alerts on release.yml, which would otherwise fail the code-scanning check on any future PR touching those lines.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated CI/CD configuration to optimize build process performance.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ac5d0ac9-a98b-4158-acf5-14ac8ba2dd92

📥 Commits

Reviewing files that changed from the base of the PR and between 7886d23 and 843db97.

📒 Files selected for processing (1)

• .github/workflows/release.yml

---

📝 Walkthrough

Walkthrough

The release workflow now disables package-manager caching in both the build and publish job's Node.js setup steps by adding package-manager-cache: false to their respective actions/setup-node configurations.

Changes

CI Cache Configuration

Layer / File(s)	Summary
Disable package-manager cache in Node.js setup .github/workflows/release.yml	Both the build and publish jobs' actions/setup-node steps now disable package-manager caching by setting package-manager-cache: false.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

🐰 A cache no more, we say with glee,
Two workflows freed from memory!
The build and publish now run clean and clear,
Fresh packages fetched, no stale cache here.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: disabling npm caching in the release workflow by setting package-manager-cache to false in setup-node steps.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch wstorey/fix-zizmor

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}