I put 50% of the blame on GitHub, and 50% of the blame on postinstall. A cache is expected to have no observable effects other than increased storage usage and decreased download time. A package cache must not be able to inject malware.
GitHub could
1. Call the Actions Cache the "Actions key-value database that can be written to by any workflow and breaks the idempotence of your builds" (unlikely)
2. Disable install scripts (unlikely)
3. Make an individually configured package cache unnecessary by caching HTTP requests to package repositories [^1]
4. Make the actions cache versioned as if it were a folder in the repo itself. This way, it can still be an arbitrary build + package cache, but modifications from one branch can't change the behavior of workflows on another branch.
[1]: Assuming most of the work saved is downloading the packages.
GitHub could
1. Call the Actions Cache the "Actions key-value database that can be written to by any workflow and breaks the idempotence of your builds" (unlikely)
2. Disable install scripts (unlikely)
3. Make an individually configured package cache unnecessary by caching HTTP requests to package repositories [^1]
4. Make the actions cache versioned as if it were a folder in the repo itself. This way, it can still be an arbitrary build + package cache, but modifications from one branch can't change the behavior of workflows on another branch.
[1]: Assuming most of the work saved is downloading the packages.