Add cache-save: false option

[akx]

Description

This PR adds a new cache-save: false option to opt out of saving the cache. As described in the documentation:

For some scenarios, it may be useful to only save a given subset of dependencies,
but restore more of them for other workflows. For instance, there may be a heavy
extras dependency that you do not need your entire test matrix to download, but
you want to download and test it separately without it being saved in the cache
archive for all runs.

To achieve this, you can use cache-save: false on the run that uses the heavy
dependency.

Related issue

I only found the related issue after implementing this: #751.

Check list

• Mark if documentation changes are required.
• Mark if tests were added or updated to cover the changes.

[akx]

Rebased on v5.

@dmitry-shibanov Could you review this, please?

[ozancaglayan]

Could someone please take an action for this PR and release a new version? 🙏

[ozancaglayan]

@akx can you request review from the maintainers here? @priya-kinthali @aparnajyothi-y @HarithaVattikuti

[akx]

@ozancaglayan As an external, I have no option to request a reviewer. GitHub does say "actions/setup-actions-team was requested for review"...

[aparnajyothi-y]

Hello Everyone, Thank you for your contribution with this PR.
While we appreciate the idea, we’re concerned that it may introduce additional complexity and could potentially limit caching benefits. Furthermore, it would require ongoing maintenance and updates to documentation. Given these factors, we’ve decided to not move forward with this change at this time.

We truly appreciate your understanding and patience, and we encourage you to continue sharing any further thoughts or suggestions you may have.

[aparnajyothi-y]

Hello @akx, Please let us know if you still need any more clarifications/concerns on the above.

[akx]

[...] we’re concerned that it may introduce additional complexity

It's opt-in, for corner cases as described in the PR description.

and could potentially limit caching benefits.

Yes, perfectly on purpose, as described in the PR description.

Furthermore, it would require ongoing maintenance and updates to documentation.

Any change or improvement does that, really. Do note that this PR does have tests and documentation included.

@aparnajyothi-y Feel free to close this if you still believe it's not welcome.

[medmunds]

This would also allow using the cache while avoiding cache poisoning vulnerabilities from PRs:

    - uses: actions/setup-python@v5
      with:
        python-version: "3.13"
        cache: "pip"
        # For anything PR-related, treat the cache as restore-only:
        cache-save: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}

Without this option, workflow security audits currently recommend removing cache: from actions/setup-python (which does in fact "limit caching benefits") and/or manually coding separate actions/cache/save and actions/cache/restore with appropriate conditions (which does in fact "introduce additional complexity").

[akx]

For people following at home, actions/setup-uv just added this in tag 6.7.0.