Stanislas Nanchen

(the benchmark job fails because it cannot upload benchmark results)

_Can someone explain to me the security risk? I strictly only cache dependencies and the key is computed from the dependency information. All is deterministic. So I do not understand...

Thank you for the feedback. Yes, I know the `unzip` function, but it does not allow to extract a sub tree from the zip/jar file. A possibility for sub-tree extraction...

nice. should I give a try at a PR?