feat: cache the lockfile verification log regardless of cache

The log is under a kilobyte and pnpm writes it on every install, not only
where supply-chain policies are configured: the integrity and tarball-URL
checks are unconditional. A job that starts without it re-checks every
lockfile entry against the registry — on a ~2000-entry lockfile with a warm
store, 13.5s vs 1.5s with `minimumReleaseAge` and `trustPolicy` configured,
and still 6.7s vs 1.6s with no policies at all.

Tying that to the `cache` input made the common case slow for no saving worth
counting, so the log is now restored and saved on its own key whether or not
the store is cached. `cache` goes back to meaning what its name says.

.github/workflows/test.yaml

@@ -334,14 +334,24 @@ jobs:
     # The action caches pnpm's lockfile verification log, which lives in
     # `cacheDir` — a directory pnpm resolves per platform and does not print.
     # Guard the action's copy of that default against pnpm's own.
-    name: 'Lockfile verification cache (${{ matrix.os }})'
+    name: 'Lockfile verification cache (${{ matrix.os }}, cache=${{ matrix.cache }})'
 
     runs-on: ${{ matrix.os }}
 
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        include:
+          # The log is cached independently of the store, so the store-less
+          # configuration has to reach it too.
+          - os: ubuntu-latest
+            cache: false
+          - os: ubuntu-latest
+            cache: true
+          - os: macos-latest
+            cache: true
+          - os: windows-latest
+            cache: true
 
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
@@ -357,7 +367,7 @@ jobs:
       - uses: ./
         with:
           version: '12.0.0-rc.4'
-          cache: true
+          cache: ${{ matrix.cache }}
           run_install: |
             - args: [--no-frozen-lockfile]
 

README.md

@@ -94,7 +94,7 @@ If `run_install` is a YAML string representation of either an object or an array
 
 ### `cache`
 
-**Optional** (_type:_ `boolean`, _default:_ `false`) Whether to cache the pnpm store directory and, on pnpm v11 and newer, the results of pnpm's lockfile verification against the configured supply-chain policies. Both are keyed on the lockfile's content hash.
+**Optional** (_type:_ `boolean`, _default:_ `false`) Whether to cache the pnpm store directory, keyed on the lockfile's content hash. On pnpm v11 and newer, the results of pnpm's lockfile verification are cached regardless of this input — see [Lockfile verification cache](#lockfile-verification-cache).
 
 ### `cache_dependency_path`
 
@@ -208,7 +208,18 @@ jobs:
 
 **Note:** You don't need to run `pnpm store prune` at the end; post-action has already taken care of that.
 
-Besides the store, this also caches pnpm's lockfile verification results (pnpm v11 and newer). Repositories that configure supply-chain policies such as `minimumReleaseAge` or `trustPolicy` make pnpm check every lockfile entry against the registry on each install; that check depends only on the lockfile and the policies, so its result is cached and reused until the lockfile changes.
+### Lockfile verification cache
+
+pnpm v11 and newer check every lockfile entry before installing it — that each entry pins an integrity hash, that a pinned tarball URL matches the registry's own metadata, and, where configured, your `minimumReleaseAge` and `trustPolicy` policies. The verdict is memoized in a sub-kilobyte file, so an unchanged lockfile is not re-checked against the registry.
+
+The action restores and saves that file on every run, independently of the `cache` input, because a job that starts without it pays for the check every time. On a repository with ~2000 lockfile entries and a warm store:
+
+| | without the log | with it |
+| --- | --- | --- |
+| `minimumReleaseAge` + `trustPolicy` | 13.5s | 1.5s |
+| no policies configured | 6.7s | 1.6s |
+
+Reusing a verdict is not a weaker check: pnpm re-verifies whenever the lockfile content changes, and whenever the recorded policy is looser than the one now configured.
 
 ### Cache dependencies from multiple lockfiles
 

action.yml

@@ -17,9 +17,9 @@ inputs:
     default: 'null'
   cache:
     description: |
-      Whether to cache the pnpm store directory and, on pnpm v11 and newer,
-      the results of pnpm's lockfile verification against the configured
-      supply-chain policies. Both are keyed on the lockfile's content hash.
+      Whether to cache the pnpm store directory, keyed on the lockfile's
+      content hash. On pnpm v11 and newer, the results of pnpm's lockfile
+      verification are cached either way — see the README.
     required: false
     default: 'false'
   cache_dependency_path:

dist/index.js

@@ -260,7 +260,7 @@ ${r.comment}`:r.comment}this.doc.range[2]=r.offset;break}default:this.errors.pus
 `)+1;for(;r!==0;)this.onNewLine(this.offset+r),r=this.source.indexOf(`
 `,r)+1}yield*this.pop();break;default:yield*this.pop(),yield*this.step()}}*blockMap(e){let r=e.items[e.items.length-1];switch(this.type){case"newline":if(this.onKeyLine=!1,r.value){let n="end"in r.value?r.value.end:void 0;(Array.isArray(n)?n[n.length-1]:void 0)?.type==="comment"?n?.push(this.sourceToken):e.items.push({start:[this.sourceToken]})}else r.sep?r.sep.push(this.sourceToken):r.start.push(this.sourceToken);return;case"space":case"comment":if(r.value)e.items.push({start:[this.sourceToken]});else if(r.sep)r.sep.push(this.sourceToken);else{if(this.atIndentedComment(r.start,e.indent)){let i=e.items[e.items.length-2]?.value?.end;if(Array.isArray(i)){Array.prototype.push.apply(i,r.start),i.push(this.sourceToken),e.items.pop();return}}r.start.push(this.sourceToken)}return}if(this.indent>=e.indent){let n=!this.onKeyLine&&this.indent===e.indent,i=n&&(r.sep||r.explicitKey)&&this.type!=="seq-item-ind",s=[];if(i&&r.sep&&!r.value){let o=[];for(let a=0;a<r.sep.length;++a){let A=r.sep[a];switch(A.type){case"newline":o.push(a);break;case"space":break;case"comment":A.indent>e.indent&&(o.length=0);break;default:o.length=0}}o.length>=2&&(s=r.sep.splice(o[1]))}switch(this.type){case"anchor":case"tag":i||r.value?(s.push(this.sourceToken),e.items.push({start:s}),this.onKeyLine=!0):r.sep?r.sep.push(this.sourceToken):r.start.push(this.sourceToken);return;case"explicit-key-ind":!r.sep&&!r.explicitKey?(r.start.push(this.sourceToken),r.explicitKey=!0):i||r.value?(s.push(this.sourceToken),e.items.push({start:s,explicitKey:!0})):this.stack.push({type:"block-map",offset:this.offset,indent:this.indent,items:[{start:[this.sourceToken],explicitKey:!0}]}),this.onKeyLine=!0;return;case"map-value-ind":if(r.explicitKey)if(r.sep)if(r.value)e.items.push({start:[],key:null,sep:[this.sourceToken]});else if(SA(r.sep,"map-value-ind"))this.stack.push({type:"block-map",offset:this.offset,indent:this.indent,items:[{start:s,key:null,sep:[this.sourceToken]}]});else if(E9(r.key)&&!SA(r.sep,"newline")){let o=sd(r.start),a=r.key,A=r.sep;A.push(this.sourceToken),delete r.key,delete r.sep,this.stack.push({type:"block-map",offset:this.offset,indent:this.indent,items:[{start:o,key:a,sep:A}]})}else s.length>0?r.sep=r.sep.concat(s,this.sourceToken):r.sep.push(this.sourceToken);else if(SA(r.start,"newline"))Object.assign(r,{key:null,sep:[this.sourceToken]});else{let o=sd(r.start);this.stack.push({type:"block-map",offset:this.offset,indent:this.indent,items:[{start:o,key:null,sep:[this.sourceToken]}]})}else r.sep?r.value||i?e.items.push({start:s,key:null,sep:[this.sourceToken]}):SA(r.sep,"map-value-ind")?this.stack.push({type:"block-map",offset:this.offset,indent:this.indent,items:[{start:[],key:null,sep:[this.sourceToken]}]}):r.sep.push(this.sourceToken):Object.assign(r,{key:null,sep:[this.sourceToken]});this.onKeyLine=!0;return;case"alias":case"scalar":case"single-quoted-scalar":case"double-quoted-scalar":{let o=this.flowScalar(this.type);i||r.value?(e.items.push({start:s,key:o,sep:[]}),this.onKeyLine=!0):r.sep?this.stack.push(o):(Object.assign(r,{key:o,sep:[]}),this.onKeyLine=!0);return}default:{let o=this.startBlockValue(e);if(o){n&&o.type!=="block-seq"&&e.items.push({start:s}),this.stack.push(o);return}}}}yield*this.pop(),yield*this.step()}*blockSequence(e){let r=e.items[e.items.length-1];switch(this.type){case"newline":if(r.value){let n="end"in r.value?r.value.end:void 0;(Array.isArray(n)?n[n.length-1]:void 0)?.type==="comment"?n?.push(this.sourceToken):e.items.push({start:[this.sourceToken]})}else r.start.push(this.sourceToken);return;case"space":case"comment":if(r.value)e.items.push({start:[this.sourceToken]});else{if(this.atIndentedComment(r.start,e.indent)){let i=e.items[e.items.length-2]?.value?.end;if(Array.isArray(i)){Array.prototype.push.apply(i,r.start),i.push(this.sourceToken),e.items.pop();return}}r.start.push(this.sourceToken)}return;case"anchor":case"tag":if(r.value||this.indent<=e.indent)break;r.start.push(this.sourceToken);return;case"seq-item-ind":if(this.indent!==e.indent)break;r.value||SA(r.start,"seq-item-ind")?e.items.push({start:[this.sourceToken]}):r.start.push(this.sourceToken);return}if(this.indent>e.indent){let n=this.startBlockValue(e);if(n){this.stack.push(n);return}}yield*this.pop(),yield*this.step()}*flowCollection(e){let r=e.items[e.items.length-1];if(this.type==="flow-error-end"){let n;do yield*this.pop(),n=this.peek(1);while(n&&n.type==="flow-collection")}else if(e.end.length===0){switch(this.type){case"comma":case"explicit-key-ind":!r||r.sep?e.items.push({start:[this.sourceToken]}):r.start.push(this.sourceToken);return;case"map-value-ind":!r||r.value?e.items.push({start:[],key:null,sep:[this.sourceToken]}):r.sep?r.sep.push(this.sourceToken):Object.assign(r,{key:null,sep:[this.sourceToken]});return;case"space":case"comment":case"newline":case"anchor":case"tag":!r||r.value?e.items.push({start:[this.sourceToken]}):r.sep?r.sep.push(this.sourceToken):r.start.push(this.sourceToken);return;case"alias":case"scalar":case"singl
Line truncated
 `)+1;for(;r!==0;)this.onNewLine(this.offset+r),r=this.source.indexOf(`
-`,r)+1}return{type:e,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(e){switch(this.type){case"alias":case"scalar":case"single-quoted-scalar":case"double-quoted-scalar":return this.flowScalar(this.type);case"block-scalar-header":return{type:"block-scalar",offset:this.offset,indent:this.indent,props:[this.sourceToken],source:""};case"flow-map-start":case"flow-seq-start":return{type:"flow-collection",offset:this.offset,indent:this.indent,start:this.sourceToken,items:[],end:[]};case"seq-item-ind":return{type:"block-seq",offset:this.offset,indent:this.indent,items:[{start:[this.sourceToken]}]};case"explicit-key-ind":{this.onKeyLine=!0;let r=oB(e),n=sd(r);return n.push(this.sourceToken),{type:"block-map",offset:this.offset,indent:this.indent,items:[{start:n,explicitKey:!0}]}}case"map-value-ind":{this.onKeyLine=!0;let r=oB(e),n=sd(r);return{type:"block-map",offset:this.offset,indent:this.indent,items:[{start:n,key:null,sep:[this.sourceToken]}]}}}return null}atIndentedComment(e,r){return this.type!=="comment"||this.indent<=r?!1:e.every(n=>n.type==="newline"||n.type==="space")}*documentEnd(e){this.type!=="doc-mode"&&(e.end?e.end.push(this.sourceToken):e.end=[this.sourceToken],this.type==="newline"&&(yield*this.pop()))}*lineEnd(e){switch(this.type){case"comma":case"doc-start":case"doc-end":case"flow-seq-end":case"flow-map-end":case"map-value-ind":yield*this.pop(),yield*this.step();break;case"newline":this.onKeyLine=!1;default:e.end?e.end.push(this.sourceToken):e.end=[this.sourceToken],this.type==="newline"&&(yield*this.pop())}}};C9.Parser=E_});var N9=h(_g=>{"use strict";var I9=o_(),NRe=Qg(),Dg=wg(),wRe=iD(),xRe=qe(),SRe=y_(),B9=C_();function Q9(t){let e=t.prettyErrors!==!1;return{lineCounter:t.lineCounter||e&&new SRe.LineCounter||null,prettyErrors:e}}function vRe(t,e={}){let{lineCounter:r,prettyErrors:n}=Q9(e),i=new B9.Parser(r?.addNewLine),s=new I9.Composer(e),o=Array.from(s.compose(i.parse(t)));if(n&&r)for(let a of o)a.errors.forEach(Dg.prettifyError(t,r)),a.warnings.forEach(Dg.prettifyError(t,r));return o.length>0?o:Object.assign([],{empty:!0},s.streamInfo())}function b9(t,e={}){let{lineCounter:r,prettyErrors:n}=Q9(e),i=new B9.Parser(r?.addNewLine),s=new I9.Composer(e),o=null;for(let a of s.compose(i.parse(t),!0,t.length))if(!o)o=a;else if(o.options.logLevel!=="silent"){o.errors.push(new Dg.YAMLParseError(a.range.slice(0,2),"MULTIPLE_DOCS","Source contains multiple documents; please use YAML.parseAllDocuments()"));break}return n&&r&&(o.errors.forEach(Dg.prettifyError(t,r)),o.warnings.forEach(Dg.prettifyError(t,r))),o}function RRe(t,e,r){let n;typeof e=="function"?n=e:r===void 0&&e&&typeof e=="object"&&(r=e);let i=b9(t,r);if(!i)return null;if(i.warnings.forEach(s=>wRe.warn(i.options.logLevel,s)),i.errors.length>0){if(i.options.logLevel!=="silent")throw i.errors[0];i.errors=[]}return i.toJS(Object.assign({reviver:n},r))}function DRe(t,e,r){let n=null;if(typeof e=="function"||Array.isArray(e)?n=e:r===void 0&&e&&(r=e),typeof r=="string"&&(r=r.length),typeof r=="number"){let i=Math.round(r);r=i<1?void 0:i>8?{indent:8}:{indent:i}}if(t===void 0){let{keepUndefined:i}=r??e??{};if(!i)return}return xRe.isDocument(t)&&!n?t.toString(r):new NRe.Document(t,n,r).toString(r)}_g.parse=RRe;_g.parseAllDocuments=vRe;_g.parseDocument=b9;_g.stringify=DRe});var B_=h(et=>{"use strict";var _Re=o_(),kRe=Qg(),PRe=UD(),I_=wg(),TRe=og(),ga=qe(),ORe=ua(),MRe=er(),LRe=fa(),FRe=ha(),URe=iB(),qRe=m_(),HRe=y_(),zRe=C_(),aB=N9(),w9=rg();et.Composer=_Re.Composer;et.Document=kRe.Document;et.Schema=PRe.Schema;et.YAMLError=I_.YAMLError;et.YAMLParseError=I_.YAMLParseError;et.YAMLWarning=I_.YAMLWarning;et.Alias=TRe.Alias;et.isAlias=ga.isAlias;et.isCollection=ga.isCollection;et.isDocument=ga.isDocument;et.isMap=ga.isMap;et.isNode=ga.isNode;et.isPair=ga.isPair;et.isScalar=ga.isScalar;et.isSeq=ga.isSeq;et.Pair=ORe.Pair;et.Scalar=MRe.Scalar;et.YAMLMap=LRe.YAMLMap;et.YAMLSeq=FRe.YAMLSeq;et.CST=URe;et.Lexer=qRe.Lexer;et.LineCounter=HRe.LineCounter;et.Parser=zRe.Parser;et.parse=aB.parse;et.parseAllDocuments=aB.parseAllDocuments;et.parseDocument=aB.parseDocument;et.stringify=aB.stringify;et.visit=w9.visit;et.visitAsync=w9.visitAsync});var Ea=ot(it());var b4=ot(Vh()),Wu=ot(it());var C4=ot(Vh()),Ii=ot(it()),I4=ot(qc()),B4=ot(d4()),UR=ot(require("os"));var lI=ot(Vh()),Sr=ot(it()),f4=ot(qc()),h4=require("fs"),FR=ot(require("os")),CA=ot(require("path"));function cI(t){let e="\\\\?\\";if(!t.startsWith(e))return t;let r=t.slice(e.length),n="UNC\\";return r.toUpperCase().startsWith(n)?`\\\\${r.slice(n.length)}`:r}var nwe="lockfile-verified.jsonl",g4="lockfile_verification_cache_path",m4="lockfile_verification_cache_key",p4="lockfile_verification_cache_restored";async function y4(t){try{let e=CA.default.join(await iwe(),nwe),r=`pnpm-lockfile-verified-${process.env.RUNNER_OS}-${FR.default.arch()}-${t}`;(0,Sr.saveState)(g4,e),(0,Sr.saveState)(m4,r),(0,Sr.debug)(`Lockfile verification cache path is ${e}, key is ${r}`);let n=await(0,lI.restoreCache
Line truncated
+`,r)+1}return{type:e,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(e){switch(this.type){case"alias":case"scalar":case"single-quoted-scalar":case"double-quoted-scalar":return this.flowScalar(this.type);case"block-scalar-header":return{type:"block-scalar",offset:this.offset,indent:this.indent,props:[this.sourceToken],source:""};case"flow-map-start":case"flow-seq-start":return{type:"flow-collection",offset:this.offset,indent:this.indent,start:this.sourceToken,items:[],end:[]};case"seq-item-ind":return{type:"block-seq",offset:this.offset,indent:this.indent,items:[{start:[this.sourceToken]}]};case"explicit-key-ind":{this.onKeyLine=!0;let r=oB(e),n=sd(r);return n.push(this.sourceToken),{type:"block-map",offset:this.offset,indent:this.indent,items:[{start:n,explicitKey:!0}]}}case"map-value-ind":{this.onKeyLine=!0;let r=oB(e),n=sd(r);return{type:"block-map",offset:this.offset,indent:this.indent,items:[{start:n,key:null,sep:[this.sourceToken]}]}}}return null}atIndentedComment(e,r){return this.type!=="comment"||this.indent<=r?!1:e.every(n=>n.type==="newline"||n.type==="space")}*documentEnd(e){this.type!=="doc-mode"&&(e.end?e.end.push(this.sourceToken):e.end=[this.sourceToken],this.type==="newline"&&(yield*this.pop()))}*lineEnd(e){switch(this.type){case"comma":case"doc-start":case"doc-end":case"flow-seq-end":case"flow-map-end":case"map-value-ind":yield*this.pop(),yield*this.step();break;case"newline":this.onKeyLine=!1;default:e.end?e.end.push(this.sourceToken):e.end=[this.sourceToken],this.type==="newline"&&(yield*this.pop())}}};C9.Parser=E_});var N9=h(_g=>{"use strict";var I9=o_(),NRe=Qg(),Dg=wg(),wRe=iD(),xRe=qe(),SRe=y_(),B9=C_();function Q9(t){let e=t.prettyErrors!==!1;return{lineCounter:t.lineCounter||e&&new SRe.LineCounter||null,prettyErrors:e}}function vRe(t,e={}){let{lineCounter:r,prettyErrors:n}=Q9(e),i=new B9.Parser(r?.addNewLine),s=new I9.Composer(e),o=Array.from(s.compose(i.parse(t)));if(n&&r)for(let a of o)a.errors.forEach(Dg.prettifyError(t,r)),a.warnings.forEach(Dg.prettifyError(t,r));return o.length>0?o:Object.assign([],{empty:!0},s.streamInfo())}function b9(t,e={}){let{lineCounter:r,prettyErrors:n}=Q9(e),i=new B9.Parser(r?.addNewLine),s=new I9.Composer(e),o=null;for(let a of s.compose(i.parse(t),!0,t.length))if(!o)o=a;else if(o.options.logLevel!=="silent"){o.errors.push(new Dg.YAMLParseError(a.range.slice(0,2),"MULTIPLE_DOCS","Source contains multiple documents; please use YAML.parseAllDocuments()"));break}return n&&r&&(o.errors.forEach(Dg.prettifyError(t,r)),o.warnings.forEach(Dg.prettifyError(t,r))),o}function RRe(t,e,r){let n;typeof e=="function"?n=e:r===void 0&&e&&typeof e=="object"&&(r=e);let i=b9(t,r);if(!i)return null;if(i.warnings.forEach(s=>wRe.warn(i.options.logLevel,s)),i.errors.length>0){if(i.options.logLevel!=="silent")throw i.errors[0];i.errors=[]}return i.toJS(Object.assign({reviver:n},r))}function DRe(t,e,r){let n=null;if(typeof e=="function"||Array.isArray(e)?n=e:r===void 0&&e&&(r=e),typeof r=="string"&&(r=r.length),typeof r=="number"){let i=Math.round(r);r=i<1?void 0:i>8?{indent:8}:{indent:i}}if(t===void 0){let{keepUndefined:i}=r??e??{};if(!i)return}return xRe.isDocument(t)&&!n?t.toString(r):new NRe.Document(t,n,r).toString(r)}_g.parse=RRe;_g.parseAllDocuments=vRe;_g.parseDocument=b9;_g.stringify=DRe});var B_=h(et=>{"use strict";var _Re=o_(),kRe=Qg(),PRe=UD(),I_=wg(),TRe=og(),ga=qe(),ORe=ua(),MRe=er(),LRe=fa(),FRe=ha(),URe=iB(),qRe=m_(),HRe=y_(),zRe=C_(),aB=N9(),w9=rg();et.Composer=_Re.Composer;et.Document=kRe.Document;et.Schema=PRe.Schema;et.YAMLError=I_.YAMLError;et.YAMLParseError=I_.YAMLParseError;et.YAMLWarning=I_.YAMLWarning;et.Alias=TRe.Alias;et.isAlias=ga.isAlias;et.isCollection=ga.isCollection;et.isDocument=ga.isDocument;et.isMap=ga.isMap;et.isNode=ga.isNode;et.isPair=ga.isPair;et.isScalar=ga.isScalar;et.isSeq=ga.isSeq;et.Pair=ORe.Pair;et.Scalar=MRe.Scalar;et.YAMLMap=LRe.YAMLMap;et.YAMLSeq=FRe.YAMLSeq;et.CST=URe;et.Lexer=qRe.Lexer;et.LineCounter=HRe.LineCounter;et.Parser=zRe.Parser;et.parse=aB.parse;et.parseAllDocuments=aB.parseAllDocuments;et.parseDocument=aB.parseDocument;et.stringify=aB.stringify;et.visit=w9.visit;et.visitAsync=w9.visitAsync});var Ea=ot(it());var b4=ot(Vh()),Wu=ot(it());var C4=ot(Vh()),Ii=ot(it()),I4=ot(qc()),B4=ot(d4()),UR=ot(require("os"));var lI=ot(Vh()),Sr=ot(it()),f4=ot(qc()),h4=require("fs"),FR=ot(require("os")),CA=ot(require("path"));function cI(t){let e="\\\\?\\";if(!t.startsWith(e))return t;let r=t.slice(e.length),n="UNC\\";return r.toUpperCase().startsWith(n)?`\\\\${r.slice(n.length)}`:r}var nwe="lockfile-verified.jsonl",g4="lockfile_verification_cache_path",m4="lockfile_verification_cache_key",p4="lockfile_verification_cache_restored";async function y4(t){try{let e=CA.default.join(await iwe(),nwe),r=`pnpm-lockfile-verified-${process.env.RUNNER_OS}-${FR.default.arch()}-${t}`;(0,Sr.saveState)(g4,e),(0,Sr.saveState)(m4,r),(0,Sr.debug)(`Lockfile verification cache path is ${e}, key is ${r}`);let n=await(0,lI.restoreCache
Line truncated
   - version ${e} in the GitHub Action config with the key "version"
   - version ${i} in the package.json with the key "packageManager"
 Remove one of these versions to avoid version mismatch errors like ERR_PNPM_BAD_PM_VERSION`);return e}if(s?.packageManager?.name==="pnpm"&&s.packageManager.version)return s.packageManager.version;if(o)return o;throw n?new Error(`No pnpm version is specified.

src/cache-restore/index.ts

@@ -4,10 +4,10 @@ import { Inputs } from '../inputs'
 import { runRestoreCache } from './run'
 
 export async function restoreCache(inputs: Inputs) {
-  if (!inputs.cache) return
-
   if (!isFeatureAvailable()) {
-    warning('Cache is not available, skipping cache restoration')
+    if (inputs.cache) {
+      warning('Cache is not available, skipping cache restoration')
+    }
     return
   }
 

src/cache-restore/run.ts

@@ -10,11 +10,23 @@ import { removeWindowsExtendedPathPrefix } from '../windows-path'
 export async function runRestoreCache(inputs: Inputs) {
   const fileHash = await hashFiles(inputs.cacheDependencyPath)
   if (!fileHash) {
-    throw new Error('Some specified paths were not resolved, unable to cache dependencies.')
+    // Both caches are keyed on the lockfile, so neither can be restored
+    // without one. Only the store cache was asked for by name.
+    if (inputs.cache) {
+      throw new Error('Some specified paths were not resolved, unable to cache dependencies.')
+    }
+    return
   }
 
-  await runRestoreStoreCache(fileHash)
+  // Restored whether or not the store is cached: the log is a fraction of a
+  // kilobyte, and without it pnpm re-checks every lockfile entry against the
+  // registry on each run — seconds even on a repository that configures no
+  // supply-chain policies.
   await restoreVerificationCache(fileHash)
+
+  if (inputs.cache) {
+    await runRestoreStoreCache(fileHash)
+  }
 }
 
 async function runRestoreStoreCache(fileHash: string) {