chore(deps): update actions/cache action to v5.0.3

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/cache	action	patch	v5.0.1 → v5.0.3

---

Release Notes

actions/cache (actions/cache)

v5.0.3

Compare Source

What's Changed

• Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)
• Bump @actions/core to v2.0.3

Full Changelog: actions/cache@v5...v5.0.3

v5.0.2

Compare Source

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

Version Change: actions/cache v5.0.1 → v5.0.3 (patch updates)

v5.0.2 Changes (Jan 16, 2025):

• Modified cache service behavior: HTTP 429 (rate-limiting) responses are no longer retried during cache entry creation
• Improves reliability by avoiding unnecessary retry loops when cache service is under load

v5.0.3 Changes (Jan 29, 2025):

• Security Fix: Updated @actions/cache to v5.0.5 to resolve security vulnerability (dependabot/33)
• Updated @actions/core to v2.0.3
• Build artifacts and license records refreshed

Breaking Changes: None identified. These are patch-level updates within the v5.x line that maintain backward compatibility.

Security Fixes: Yes - v5.0.3 specifically addresses a security vulnerability in the underlying cache dependency.

🎯 Impact Scope Investigation

Usage Location:

• Single usage found in .github/actions/setup/action.yml:10
• Used as a composite action step for caching Go build artifacts and modules
• No other direct usages of actions/cache found in the codebase

Current Configuration:

- uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
  with:
    path: |
      ~/.cache/go-build
      ~/go/pkg/mod
    key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
    restore-keys: |
      ${{ runner.os }}-go-

Workflows Using This Setup Action:

• CI workflow (test, build, lint jobs)
• Other workflows that reference ./.github/actions/setup

Impact on Dependencies:

• No impact on application code (this is a GitHub Actions workflow dependency)
• No changes to the cache action's API or configuration schema
• Existing cache keys and configuration remain fully compatible

Runtime Requirements:

• Already using v5.0.1, which requires Node.js 24 runtime and Actions Runner version 2.327.1+
• No additional runtime requirements introduced by v5.0.3

💡 Recommended Actions

Immediate Action:

• ✅ Merge this PR immediately - This is a security patch update with no breaking changes

Benefits of Merging:

1. Security: Resolves security vulnerability in cache dependency
2. Reliability: Includes improved rate-limit handling (from v5.0.2)
3. Stability: Updated to latest stable dependencies (@actions/core v2.0.3)

No Migration Required:

• No code changes needed
• No configuration changes needed
• No workflow modifications required
• Cache behavior remains compatible

Post-Merge Verification:

• Monitor CI workflow runs to ensure cache operations continue working normally
• No manual intervention expected

🔗 Reference Links

• v5.0.3 Release Notes
• v5.0.2 Release Notes
• Comparison v5.0.1...v5.0.3
• actions/cache Repository

Generated by koki-develop/claude-renovate-review