ci: make release build with read-only cache

The setup-nx-remote-cache action chose between read-write and read-only
connection strings based solely on event-name, making it impossible to
opt into read-only mode on a push event (e.g. a tag-triggered release
calling build.yml via workflow_call). Add cache-mode to the condition so
read-only is used whenever cache-mode is 'read-only', regardless of
event type.

Author: damienwebdev

.github/actions/setup-nx-remote-cache/action.yml

@@ -26,14 +26,14 @@ runs:
     if: ${{ inputs.cache-mode }}
 
     ## Set the AZURE_STORAGE_CONNECTION_STRING.
-    ##  - For `pull_request`, this comes from the passed secret.
-    ##  - For `push` this is `AZURE_NX_CACHE_READWRITE_CONNECTION_STRING``.
+    ##  - For `push` without `cache-mode: read-only`, this is the read-write string.
+    ##  - Otherwise (pull_request, workflow_call, or explicit read-only opt-in), this is the read-only string.
   - run: echo AZURE_STORAGE_CONNECTION_STRING='${{ inputs.read-write-azure-connection-string }}' >> $GITHUB_ENV
     shell: bash
     name: Set AZURE_STORAGE_CONNECTION_STRING
-    if: ${{ inputs.event-name == 'push' }}
+    if: ${{ inputs.event-name == 'push' && inputs.cache-mode != 'read-write' }}
 
   - run: echo AZURE_STORAGE_CONNECTION_STRING='${{ inputs.read-only-azure-connection-string }}' >> $GITHUB_ENV
     shell: bash
     name: Set AZURE_STORAGE_CONNECTION_STRING
-    if: ${{ inputs.event-name != 'push' }}
+    if: ${{ inputs.event-name != 'push' || inputs.cache-mode == 'read-only' }}

.github/workflows/build_release.yml

@@ -14,4 +14,4 @@ jobs:
       ref: ${{ github.sha }}
     secrets:
       NX_KEY: ${{ secrets.NX_KEY }}
-      AZURE_STORAGE_CONNECTION_STRING: ${{ secrets.AZURE_NX_CACHE_READWRITE_CONNECTION_STRING }}
+      AZURE_STORAGE_CONNECTION_STRING: ${{ secrets.AZURE_NX_CACHE_READONLY_CONNECTION_STRING }}