[Mokto]

Summary

On *.ghe.com tenants, anonymous github.com API lookups can hit the anonymous rate limit and fail a run. Setting GH_ACTIONS_LOCK_CACHE_DIR now saves successful anonymous public GET responses to disk, so later processes and CI runners reuse them and a failed run still keeps its progress. The cache is opt-in, entries expire after 24h by default (GH_ACTIONS_LOCK_CACHE_TTL), and authenticated requests, tenant requests, and error responses are never cached.

Live evidence: a GHE.com workflow verifying 10 workflows with 21 locked dependencies ran without public github.com credentials. The cold first attempt saved its successful responses but could not verify 19 pins because of the anonymous limit. The second attempt restored the cache and only 8 pins remained unverified. The third attempt verified all 10 workflows, and a fourth warm attempt succeeded again with the verification step under 1 second. This shows that failed runs persist partial progress and that later processes and runners reuse it, beyond in-memory caching. The compressed cache grew from about 73KB to 148KB to 150KB across the attempts. A cold cache does not bypass rate limits; it only accumulates progress across attempts.

Changes

• Add a disk-backed transport for anonymous GET /repos/... requests to api.github.com, keyed by URL, Accept, and API version.
• Write entries atomically, and fall back to online requests on cache read or write failure.
• Reject a non-positive or invalid GH_ACTIONS_LOCK_CACHE_TTL.
• Document the CI restore/save pattern and the trust boundary: restore only caches from trusted workflows and never share a writable cache across trust boundaries.

Review focus

Check the cache key and the skip conditions in internal/ghapi/diskcache.go. Unit tests, vet, and build checks cover the cache. The existing full suite has a known nilHTTPError.RequestURL-related timeout limitation, which this PR does not change.