Set cache-mode: read on reusable workflow calls from low-trust triggers

[roryabraham]

Details

kjanat/actionlint (the fork we are switching our workflow lint to, Expensify/Expensify#678960) adds a cache-call-unrestricted check that the rhysd/actionlint v1.7.11 we run today does not have. It flags a reusable workflow call triggered by pull_request_target, issue_comment, or issues that sets no cache-mode, because the callee can then request cache writes despite the trigger's read-only default.

This sets cache-mode: read on those calls. The workflows involved only read the cache, so capping them at read loses nothing.

Merge order

Do not merge this before the actionlint bump in Expensify/GitHub-Actions. cache-mode is not in the schema of the actionlint version the org ruleset runs today, so the current check fails this PR with unexpected key "cache-mode". It passes under the fork. Merge it immediately after that PR lands.

Related Issues

https://github.com/Expensify/Expensify/issues/678960

Manual Tests

Ran kjanat/actionlint v1.17.0 against the changed workflow(s); the cache-call-unrestricted finding is gone and no new findings were introduced.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[roryabraham]

Holding for Expensify/GitHub-Actions#113. cache-mode is not in the schema of the actionlint version the org ruleset runs today, so this fails the check until that bump merges. Please merge this immediately after it lands.

[roryabraham]

I have read the CLA Document and I hereby sign the CLA