From 3d1b8e396e8f12381f643e9d50377d5bfca560c4 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Thu, 22 Oct 2026 00:19:38 -0700
Subject: [PATCH] fix(ci): restrict manual candidate test workflows to
 read-only caches (#31887)

---
 .github/workflows/packaged-browser-e2e.yml | 3 +++
 .github/workflows/terminal-perf.yml        | 3 +++
 .github/workflows/windows-wsl-e2e.yml      | 3 +++
 3 files changed, 9 insertions(+)

diff --git a/.github/workflows/packaged-browser-e2e.yml b/.github/workflows/packaged-browser-e2e.yml
index 4967cdde400..de37e67ec23 100644
--- a/.github/workflows/packaged-browser-e2e.yml
+++ b/.github/workflows/packaged-browser-e2e.yml
@@ -18,6 +18,9 @@ on:
         required: false
 permissions:
   contents: read
+
+# Candidate source must not write caches in the dispatch branch's scope.
+cache-mode: read
 jobs:
   compatibility:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/terminal-perf.yml b/.github/workflows/terminal-perf.yml
index dfc0f917d88..bc727e34a10 100644
--- a/.github/workflows/terminal-perf.yml
+++ b/.github/workflows/terminal-perf.yml
@@ -51,6 +51,9 @@ on:
 permissions:
   contents: read
 
+# Candidate source must not write caches in the dispatch branch's scope.
+cache-mode: read
+
 jobs:
   terminal-perf:
     name: terminal scale perf
diff --git a/.github/workflows/windows-wsl-e2e.yml b/.github/workflows/windows-wsl-e2e.yml
index b4382ac0a5a..9f9b36eb21d 100644
--- a/.github/workflows/windows-wsl-e2e.yml
+++ b/.github/workflows/windows-wsl-e2e.yml
@@ -16,6 +16,9 @@ on:
 permissions:
   contents: read
 
+# Candidate source must not write caches in the dispatch branch's scope.
+cache-mode: read
+
 concurrency:
   group: windows-wsl-e2e-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true