diff --git a/.github/workflows/go-ossf-slsa3-publish.yml b/.github/workflows/go-ossf-slsa3-publish.yml
new file mode 100644
index 00000000000..79ea193f754
--- /dev/null
+++ b/.github/workflows/go-ossf-slsa3-publish.yml
@@ -0,0 +1,38 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+# This workflow lets you compile your Go project using a SLSA3 compliant builder.
+# This workflow will generate a so-called "provenance" file describing the steps
+# that were performed to generate the final binary.
+# The project is an initiative of the OpenSSF (openssf.org) and is developed at
+# https://github.com/slsa-framework/slsa-github-generator.
+# The provenance file can be verified using https://github.com/slsa-framework/slsa-verifier.
+# For more information about SLSA and how it improves the supply-chain, visit slsa.dev.
+
+name: SLSA Go releaser
+on:
+  workflow_dispatch:
+  release:
+    types: [created]
+
+permissions: read-all
+
+jobs:
+  # ========================================================================================================================================
+  #     Prerequesite: Create a .slsa-goreleaser.yml in the root directory of your project.
+  #       See format in https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/go/README.md#configuration-file
+  #=========================================================================================================================================
+  build:
+    permissions:
+      id-token: write # To sign.
+      contents: write # To upload release assets.
+      actions: read   # To read workflow path.
+    uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.4.0
+    with:
+      go-version: 1.17
+      # =============================================================================================================
+      #     Optional: For more options, see https://github.com/slsa-framework/slsa-github-generator#golang-projects
+      # =============================================================================================================
+
diff --git a/cache/filecache/filecache.go b/cache/filecache/filecache.go
index 05d9379b49b..2db580b9566 100644
--- a/cache/filecache/filecache.go
+++ b/cache/filecache/filecache.go
@@ -51,6 +51,8 @@ type Cache struct {
 	pruneAllRootDir string
 
 	nlocker *lockTracker
+
+	initOnce sync.Once
 }
 
 type lockTracker struct {
@@ -103,9 +105,24 @@ func (l *lockedFile) Close() error {
 	return l.File.Close()
 }
 
+func (c *Cache) init() error {
+	var initErr error
+	c.initOnce.Do(func() {
+		// Create the base dir if it does not exist.
+		if err := c.Fs.MkdirAll("", 0777); err != nil && !os.IsExist(err) {
+			initErr = err
+		}
+	})
+	return initErr
+}
+
 // WriteCloser returns a transactional writer into the cache.
 // It's important that it's closed when done.
 func (c *Cache) WriteCloser(id string) (ItemInfo, io.WriteCloser, error) {
+	if err := c.init(); err != nil {
+		return ItemInfo{}, nil, err
+	}
+
 	id = cleanID(id)
 	c.nlocker.Lock(id)
 
@@ -130,6 +147,10 @@ func (c *Cache) WriteCloser(id string) (ItemInfo, io.WriteCloser, error) {
 func (c *Cache) ReadOrCreate(id string,
 	read func(info ItemInfo, r io.ReadSeeker) error,
 	create func(info ItemInfo, w io.WriteCloser) error) (info ItemInfo, err error) {
+	if err := c.init(); err != nil {
+		return ItemInfo{}, err
+	}
+
 	id = cleanID(id)
 
 	c.nlocker.Lock(id)
@@ -163,6 +184,9 @@ func (c *Cache) ReadOrCreate(id string,
 // be invoked and the result cached.
 // This method is protected by a named lock using the given id as identifier.
 func (c *Cache) GetOrCreate(id string, create func() (io.ReadCloser, error)) (ItemInfo, io.ReadCloser, error) {
+	if err := c.init(); err != nil {
+		return ItemInfo{}, nil, err
+	}
 	id = cleanID(id)
 
 	c.nlocker.Lock(id)
@@ -197,6 +221,9 @@ func (c *Cache) GetOrCreate(id string, create func() (io.ReadCloser, error)) (It
 
 // GetOrCreateBytes is the same as GetOrCreate, but produces a byte slice.
 func (c *Cache) GetOrCreateBytes(id string, create func() ([]byte, error)) (ItemInfo, []byte, error) {
+	if err := c.init(); err != nil {
+		return ItemInfo{}, nil, err
+	}
 	id = cleanID(id)
 
 	c.nlocker.Lock(id)
@@ -232,6 +259,9 @@ func (c *Cache) GetOrCreateBytes(id string, create func() ([]byte, error)) (Item
 
 // GetBytes gets the file content with the given id from the cache, nil if none found.
 func (c *Cache) GetBytes(id string) (ItemInfo, []byte, error) {
+	if err := c.init(); err != nil {
+		return ItemInfo{}, nil, err
+	}
 	id = cleanID(id)
 
 	c.nlocker.Lock(id)
@@ -250,6 +280,9 @@ func (c *Cache) GetBytes(id string) (ItemInfo, []byte, error) {
 
 // Get gets the file with the given id from the cache, nil if none found.
 func (c *Cache) Get(id string) (ItemInfo, io.ReadCloser, error) {
+	if err := c.init(); err != nil {
+		return ItemInfo{}, nil, err
+	}
 	id = cleanID(id)
 
 	c.nlocker.Lock(id)
@@ -347,10 +380,6 @@ func NewCaches(p *helpers.PathSpec) (Caches, error) {
 
 		baseDir := v.DirCompiled
 
-		if err := cfs.MkdirAll(baseDir, 0777); err != nil && !os.IsExist(err) {
-			return nil, err
-		}
-
 		bfs := afero.NewBasePathFs(cfs, baseDir)
 
 		var pruneAllRootDir string
diff --git a/cache/filecache/filecache_pruner.go b/cache/filecache/filecache_pruner.go
index e1b7f1947e1..2ad6c0bb7e0 100644
--- a/cache/filecache/filecache_pruner.go
+++ b/cache/filecache/filecache_pruner.go
@@ -53,6 +53,9 @@ func (c *Cache) Prune(force bool) (int, error) {
 	if c.pruneAllRootDir != "" {
 		return c.pruneRootDir(force)
 	}
+	if err := c.init(); err != nil {
+		return 0, err
+	}
 
 	counter := 0
 
@@ -117,6 +120,9 @@ func (c *Cache) Prune(force bool) (int, error) {
 }
 
 func (c *Cache) pruneRootDir(force bool) (int, error) {
+	if err := c.init(); err != nil {
+		return 0, err
+	}
 	info, err := c.Fs.Stat(c.pruneAllRootDir)
 	if err != nil {
 		if herrors.IsNotExist(err) {
diff --git a/testscripts/unfinished/new_content.txt b/testscripts/unfinished/new_content.txt
new file mode 100644
index 00000000000..21705835334
--- /dev/null
+++ b/testscripts/unfinished/new_content.txt
@@ -0,0 +1,7 @@
+hugo new site myblog
+cd myblog
+hugo new content --kind post post/first-post.md
+! exists resources
+grep 'draft = true' content/post/first-post.md
+
+