👷 Drop dependency cache from plugin doc deploys

Deploy workflows must not restore a cache that other workflows can
write to. The pnpm store cache is removed from the api-doc and
styles-doc deploys; installs are slower but deploys are infrequent.

Also install with --frozen-lockfile in the three plugin deploys, as CI
already does by default, so a deploy never resolves dependencies that
differ from the lockfile.

Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net>

.github/workflows/plugins-deploy-api-doc.yml

@@ -45,7 +45,8 @@ jobs:
           fetch-depth: 0
           ref: ${{ steps.vars.outputs.gh_ref }}
 
-      # START: Setup Node and PNPM enabling cache
+      # No dependency cache here: a deploy must not restore a cache that
+      # other workflows can write to.
       - name: Setup pnpm + Node.js
         uses: pnpm/setup@84cb39b217b10273981911c288cd62326dc7c6d2 # v2.0.2
         with:
@@ -53,26 +54,11 @@ jobs:
           runtime: node@24.21.0
           install: false
 
-      - name: Get pnpm store path
-        id: pnpm-store
-        working-directory: ./plugins
-        shell: bash
-        run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_OUTPUT
-
-      - name: Cache pnpm store
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
-        with:
-          path: ${{ steps.pnpm-store.outputs.STORE_PATH }}
-          key: ${{ runner.os }}-pnpm-${{ hashFiles('plugins/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-
-      # END: Setup Node and PNPM enabling cache
-
       - name: Install deps
         working-directory: ./plugins
         shell: bash
         run: |
-          pnpm install --no-frozen-lockfile;
+          pnpm install --frozen-lockfile;
           pnpm add -D -w wrangler@latest;
 
       - name: Build docs

.github/workflows/plugins-deploy-package.yml

@@ -75,7 +75,7 @@ jobs:
         working-directory: ./plugins
         shell: bash
         run: |
-          pnpm install --no-frozen-lockfile;
+          pnpm install --frozen-lockfile;
           pnpm add -D -w wrangler@latest;
 
       - name: "Build package for ${{ inputs.plugin_name }}-plugin"

.github/workflows/plugins-deploy-styles-doc.yml

@@ -43,7 +43,8 @@ jobs:
           fetch-depth: 0
           ref: ${{ steps.vars.outputs.gh_ref }}
 
-      # START: Setup Node and PNPM enabling cache
+      # No dependency cache here: a deploy must not restore a cache that
+      # other workflows can write to.
       - name: Setup pnpm + Node.js
         uses: pnpm/setup@84cb39b217b10273981911c288cd62326dc7c6d2 # v2.0.2
         with:
@@ -51,26 +52,11 @@ jobs:
           runtime: node@24.21.0
           install: false
 
-      - name: Get pnpm store path
-        id: pnpm-store
-        working-directory: ./plugins
-        shell: bash
-        run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_OUTPUT
-
-      - name: Cache pnpm store
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
-        with:
-          path: ${{ steps.pnpm-store.outputs.STORE_PATH }}
-          key: ${{ runner.os }}-pnpm-${{ hashFiles('plugins/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-
-      # END: Setup Node and PNPM enabling cache
-
       - name: Install deps
         working-directory: ./plugins
         shell: bash
         run: |
-          pnpm install --no-frozen-lockfile;
+          pnpm install --frozen-lockfile;
           pnpm add -D -w wrangler@latest;
 
       - name: Build styles

.github/zizmor.yml

@@ -12,11 +12,6 @@ rules:
       - plugins-deploy-api-doc.yml
       - plugins-deploy-package.yml
       - plugins-deploy-styles-doc.yml
-  # Avoid restoring caches in release/publish workflows.
-  cache-poisoning:
-    ignore:
-      - plugins-deploy-api-doc.yml
-      - plugins-deploy-styles-doc.yml
   # Review `pull_request_target` usage.
   dangerous-triggers:
     ignore: