From 019ff406f0f83ef1d48a35a18fdf25f4141e1bd3 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Wed, 21 Oct 2026 22:20:30 -0700
Subject: [PATCH] ci: deny cache writes from benchmark candidate code (#31838)

---
 .github/workflows/windows-native-preparation-benchmark.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/windows-native-preparation-benchmark.yml b/.github/workflows/windows-native-preparation-benchmark.yml
index 709c1dbd4f6..8b98ae9f737 100644
--- a/.github/workflows/windows-native-preparation-benchmark.yml
+++ b/.github/workflows/windows-native-preparation-benchmark.yml
@@ -16,6 +16,9 @@ on:
 permissions:
   contents: read
 
+# Candidate source must not write caches in the dispatch branch's scope.
+cache-mode: read
+
 concurrency:
   group: windows-native-preparation-comparison-${{ github.ref }}
   cancel-in-progress: false