Skip to content

fix(ci): bump the cache-key salt so #9596's widened path list actually takes effect - #9597

Merged
JSONbored merged 1 commit into
mainfrom
fix/ci-cache-key-salt
Jul 28, 2026
Merged

fix(ci): bump the cache-key salt so #9596's widened path list actually takes effect#9597
JSONbored merged 1 commit into
mainfrom
fix/ci-cache-key-salt

Conversation

@JSONbored

Copy link
Copy Markdown
Owner

Why this is needed on top of #9596

#9596 widened the node_modules cache to every workspace, but the salt commit that made it work raced the gate's auto-merge and did not land — the merged action has the widened path list and the original key.

That combination is a no-op. The key is computed from the manifests only, so a branch with an unchanged lockfile keeps hitting the entry archived under the narrow list. That entry contains no apps/loopover-miner-ui/node_modules, and because it's a hit, npm ci is skipped — so the tree stays exactly as incomplete and UI lint keeps failing on Cannot find module '@eslint/js'.

The fix

Add an explicit npm-v2- generation salt to the key, forcing one clean miss so a complete tree is archived under the current path list. The comment states the rule for next time: bumping the salt is required whenever the path list changes, since widening a path list never invalidates entries archived under the old one.

Verified lint:composite-actions clean; the real proof is the first run here installing fresh and every later PR restoring a complete tree.

…y takes effect

#9596 widened the node_modules cache to every workspace but left the key
untouched, so nothing changed for a branch with an unchanged lockfile: it
keeps HITTING the entry archived under the narrow list, which restores no
apps/loopover-miner-ui/node_modules, and a hit skips npm ci -- leaving the
tree exactly as broken and UI lint still failing on 'Cannot find module
@eslint/js'.

Add an explicit npm-v2- generation salt so one clean miss re-archives a
complete tree under the current path list, and document that the salt must
be bumped whenever that list changes.
@JSONbored JSONbored self-assigned this Jul 28, 2026
@JSONbored
JSONbored merged commit 4a5d7b0 into main Jul 28, 2026
2 checks passed
@JSONbored
JSONbored deleted the fix/ci-cache-key-salt branch July 28, 2026 21:29
@superagent-security

Copy link
Copy Markdown
Contributor

Superagent did not find any vulnerabilities or security issues in this PR.

@loopover-orb

loopover-orb Bot commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

Important

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏳ LoopOver is waiting…

LoopOver has seen this pull request and is waiting on CI checks to finish before reviewing it. This comment will update once the review runs.

🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed · 🟨 Waiting

@codecov

codecov Bot commented Jul 28, 2026

Copy link
Copy Markdown

❌ 1 Tests Failed:

Tests completed Failed Passed Skipped
23614 1 23613 21
View the top 1 failed test(s) by shortest run time
test/unit/ci-composite-setup-workspace.test.ts > setup-workspace composite action > skips npm ci only on an exact node_modules cache hit, and saves the cache only after a successful install
Stack Traces | 0.0272s run time
AssertionError: expected 'node_modules\napps/*/node_modules\npa…' to contain 'apps/loopover-ui/node_modules'

- Expected
+ Received

- apps/loopover-ui/node_modules
+ node_modules
+ apps/*/node_modules
+ packages/*/node_modules
+

 ❯ test/unit/ci-composite-setup-workspace.test.ts:56:38

To view more test analytics, go to the Test Analytics Dashboard
📋 Got 3 mins? Take this short survey to help us improve Test Analytics.

JSONbored added a commit that referenced this pull request Jul 28, 2026
…ath list (#9603)

#9596/#9597 changed the node_modules cache to glob every workspace and
added a generation salt to the key, but the composite-action test still
asserted the old literal `apps/loopover-ui/node_modules`, so it has been
failing on main and on every branch since.

Assert the contract that now holds, and tighten it in two places the old
test left open:
- both workspace globs, matching what package.json declares;
- the `npm-v2-` salt, asserted beside the paths, because widening the
  paths without bumping the salt is a no-op and the two must move
  together;
- the SAVE step's path list equals the RESTORE step's -- the save list
  decides what a future run can restore, so a narrowing there would stay
  invisible until some later job failed on a missing workspace.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant