SLSA-BUILD-L3 — Cache key in pull_request_target derived from PR input

on: pull_request_target
jobs:
  cache-deps:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/cache@<sha>
        with:
          path: ~/.npm
          key: ${{ runner.os }}-${{ github.head_ref }}     # ← PR-controlled

# Option 1: derive the key from trusted state only.
- uses: actions/cache@<sha>
  with:
    path: ~/.npm
    key: ${{ runner.os }}-${{ hashFiles('**/package-lock.json') }}

# Option 2: move PR-specific caching to a non-elevated pull_request workflow.
on: pull_request                    # ← no secrets, no write permissions