diff --git a/.github/actions/ctcOpen/action.yml b/.github/actions/ctcOpen/action.yml
index 2c918bf8..51cd9743 100644
--- a/.github/actions/ctcOpen/action.yml
+++ b/.github/actions/ctcOpen/action.yml
@@ -56,6 +56,12 @@ runs:
         cache: ${{ inputs.package-manager }}
         cache-dependency-path: ${{ inputs.cache-dependency-path }}
 
+    - name: Ensure package-manager cache exists
+      uses: salesforcecli/github-workflows/.github/actions/ensurePackageManagerCache@main
+      with:
+        package-manager: ${{ inputs.package-manager }}
+        cache-dependency-path: ${{ inputs.cache-dependency-path }}
+
     - run: npm install -g @salesforce/change-case-management --omit=dev
       shell: bash
 
diff --git a/.github/actions/ensurePackageManagerCache/action.yml b/.github/actions/ensurePackageManagerCache/action.yml
new file mode 100644
index 00000000..69cc7265
--- /dev/null
+++ b/.github/actions/ensurePackageManagerCache/action.yml
@@ -0,0 +1,32 @@
+name: Ensure package-manager cache
+description: Creates the npm, pnpm, or Yarn cache directory before setup-node saves it.
+inputs:
+  package-manager:
+    description: Package manager whose cache directory should exist.
+    required: true
+  cache-dependency-path:
+    description: Path to the package manager lockfile.
+    required: false
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      env:
+        PACKAGE_MANAGER: ${{ inputs.package-manager }}
+        CACHE_DEPENDENCY_PATH: ${{ inputs.cache-dependency-path }}
+      run: |
+        case "$PACKAGE_MANAGER" in
+          npm) cache_path="$(npm config get cache)" ;;
+          pnpm) cache_path="$(pnpm store path --silent)" ;;
+          yarn)
+            cache_directory="$(dirname "$CACHE_DEPENDENCY_PATH")"
+            yarn_version="$(cd "$cache_directory" && yarn --version)"
+            if [ "$(printf '%s' "$yarn_version" | cut -d. -f1)" -lt 2 ]; then
+              cache_path="$(cd "$cache_directory" && yarn cache dir)"
+            else
+              cache_path="$(cd "$cache_directory" && yarn config get cacheFolder)"
+            fi
+            ;;
+          *) echo "Unsupported package manager: $PACKAGE_MANAGER"; exit 1 ;;
+        esac
+        mkdir -p "$cache_path"
diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml
index 48c2a67c..a396a29b 100644
--- a/.github/workflows/automerge.yml
+++ b/.github/workflows/automerge.yml
@@ -94,6 +94,12 @@ jobs:
           cache: ${{ steps.detect.outputs.package-manager }}
           cache-dependency-path: ${{ steps.detect.outputs.cache-dependency-path }}
 
+      - name: Ensure package-manager cache exists
+        uses: salesforcecli/github-workflows/.github/actions/ensurePackageManagerCache@main
+        with:
+          package-manager: ${{ steps.detect.outputs.package-manager }}
+          cache-dependency-path: ${{ steps.detect.outputs.cache-dependency-path }}
+
       - run: npm install -g @salesforce/plugin-release-management --omit=dev
 
       - name: run automerge command
diff --git a/sfdc_metadata/sast_scan_triage/triage.yaml b/sfdc_metadata/sast_scan_triage/triage.yaml
new file mode 100644
index 00000000..79c82a31
--- /dev/null
+++ b/sfdc_metadata/sast_scan_triage/triage.yaml
@@ -0,0 +1,6 @@
+false_positive:
+  - id: .github/actions/ctcOpen/action.yml:6d2f59ad38437368cc1daa3e3bf88db529650c7832c0989857f96b050a280283
+    justification: Same-repo action reference (salesforcecli/github-workflows), not a third-party action. The full owner/repo ref is required because callers run these as reusable workflows, so ./ paths would resolve to the caller's repo.
+  - id: .github/workflows/automerge.yml:6d2f59ad38437368cc1daa3e3bf88db529650c7832c0989857f96b050a280283
+    justification: Same-repo action reference (salesforcecli/github-workflows), not a third-party action. The full owner/repo ref is required because callers run these as reusable workflows, so ./ paths would resolve to the caller's repo.
+not_exploitable: []