A dependency graph file downloaded from another workflow run may come from an untrusted fork. Passing the parsed file whole to octokit.request() let keys such as 'url' override the request destination and leak the token.
gradle-actions-caching