From f207e5d4371ec6709c9a8824a355ce7d52293d57 Mon Sep 17 00:00:00 2001
From: kingoftech-v01 <victorstephanearthur@gmail.com>
Date: Fri, 10 Apr 2026 04:48:19 +0000
Subject: [PATCH] fix(ci): scope pip cache per ref to prevent cross-PR
 pollution

Seven workflows (quality-checks, ci-static-analysis, migrations-check,
pylint-checks, static-assets-check, lint-imports, js-tests) shared a
single pip download cache via the bare restore-keys prefix
"${{ runner.os }}-pip-". When a branch added a git+https dependency
via requirements/edx/github.in, the resulting wheel was cached and
then leaked into unrelated branches on cache miss, producing
misleading test successes or failures.

Scope both the primary key and restore-keys to the current ref so
caches no longer cross branch boundaries, and include github.in in
the hash so intra-branch changes to git-sourced dependencies force
a fresh install.

Closes #31838
---
 .github/workflows/ci-static-analysis.yml  | 4 ++--
 .github/workflows/js-tests.yml            | 4 ++--
 .github/workflows/lint-imports.yml        | 4 ++--
 .github/workflows/migrations-check.yml    | 4 ++--
 .github/workflows/pylint-checks.yml       | 4 ++--
 .github/workflows/quality-checks.yml      | 4 ++--
 .github/workflows/static-assets-check.yml | 4 ++--
 7 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/ci-static-analysis.yml b/.github/workflows/ci-static-analysis.yml
index 94fb9e863d87..a2a5c82d2162 100644
--- a/.github/workflows/ci-static-analysis.yml
+++ b/.github/workflows/ci-static-analysis.yml
@@ -36,8 +36,8 @@ jobs:
         uses: actions/cache@v5
         with:
           path: ${{ steps.pip-cache-dir.outputs.dir }}
-          key: ${{ runner.os }}-pip-${{ hashFiles('requirements/edx/development.txt') }}
-          restore-keys: ${{ runner.os }}-pip-
+          key: ${{ runner.os }}-pip-${{ github.head_ref || github.ref }}-${{ hashFiles('requirements/edx/development.txt', 'requirements/edx/github.in') }}
+          restore-keys: ${{ runner.os }}-pip-${{ github.head_ref || github.ref }}-
 
       - name: Install python dependencies
         run: make dev-requirements
diff --git a/.github/workflows/js-tests.yml b/.github/workflows/js-tests.yml
index dd21d12e3d25..f94f177a4abb 100644
--- a/.github/workflows/js-tests.yml
+++ b/.github/workflows/js-tests.yml
@@ -58,8 +58,8 @@ jobs:
         uses: actions/cache@v5
         with:
           path: ${{ steps.pip-cache-dir.outputs.dir }}
-          key: ${{ runner.os }}-pip-${{ hashFiles('requirements/edx/base.txt') }}
-          restore-keys: ${{ runner.os }}-pip-
+          key: ${{ runner.os }}-pip-${{ github.head_ref || github.ref }}-${{ hashFiles('requirements/edx/base.txt', 'requirements/edx/github.in') }}
+          restore-keys: ${{ runner.os }}-pip-${{ github.head_ref || github.ref }}-
 
       - name: Install Required Python Dependencies
         run: |
diff --git a/.github/workflows/lint-imports.yml b/.github/workflows/lint-imports.yml
index 8b119d31e6b5..8a654788cf21 100644
--- a/.github/workflows/lint-imports.yml
+++ b/.github/workflows/lint-imports.yml
@@ -36,8 +36,8 @@ jobs:
         uses: actions/cache@v5
         with:
           path: ${{ steps.pip-cache-dir.outputs.dir }}
-          key: ${{ runner.os }}-pip-${{ hashFiles('requirements/edx/development.txt') }}
-          restore-keys: ${{ runner.os }}-pip-
+          key: ${{ runner.os }}-pip-${{ github.head_ref || github.ref }}-${{ hashFiles('requirements/edx/development.txt', 'requirements/edx/github.in') }}
+          restore-keys: ${{ runner.os }}-pip-${{ github.head_ref || github.ref }}-
 
       - name: Install python dependencies
         run: make dev-requirements
diff --git a/.github/workflows/migrations-check.yml b/.github/workflows/migrations-check.yml
index 20540fb43906..a7fda5bffb5a 100644
--- a/.github/workflows/migrations-check.yml
+++ b/.github/workflows/migrations-check.yml
@@ -93,8 +93,8 @@ jobs:
         uses: actions/cache@v5
         with:
           path: ${{ steps.pip-cache-dir.outputs.dir }}
-          key: ${{ runner.os }}-pip-${{ hashFiles('requirements/edx/development.txt') }}
-          restore-keys: ${{ runner.os }}-pip-
+          key: ${{ runner.os }}-pip-${{ github.head_ref || github.ref }}-${{ hashFiles('requirements/edx/development.txt', 'requirements/edx/github.in') }}
+          restore-keys: ${{ runner.os }}-pip-${{ github.head_ref || github.ref }}-
 
       - name: Install Python dependencies
         run: |
diff --git a/.github/workflows/pylint-checks.yml b/.github/workflows/pylint-checks.yml
index 91141c0c29ed..8ceae4665c63 100644
--- a/.github/workflows/pylint-checks.yml
+++ b/.github/workflows/pylint-checks.yml
@@ -52,8 +52,8 @@ jobs:
         uses: actions/cache@v5
         with:
           path: ${{ steps.pip-cache-dir.outputs.dir }}
-          key: ${{ runner.os }}-pip-${{ hashFiles('requirements/edx/development.txt') }}
-          restore-keys: ${{ runner.os }}-pip-
+          key: ${{ runner.os }}-pip-${{ github.head_ref || github.ref }}-${{ hashFiles('requirements/edx/development.txt', 'requirements/edx/github.in') }}
+          restore-keys: ${{ runner.os }}-pip-${{ github.head_ref || github.ref }}-
 
       - name: Install required Python dependencies
         run: |
diff --git a/.github/workflows/quality-checks.yml b/.github/workflows/quality-checks.yml
index b57b713eb93a..c173fcb95bf5 100644
--- a/.github/workflows/quality-checks.yml
+++ b/.github/workflows/quality-checks.yml
@@ -53,8 +53,8 @@ jobs:
         uses: actions/cache@v5
         with:
           path: ${{ steps.pip-cache-dir.outputs.dir }}
-          key: ${{ runner.os }}-pip-${{ hashFiles('requirements/edx/testing.txt') }}
-          restore-keys: ${{ runner.os }}-pip-
+          key: ${{ runner.os }}-pip-${{ github.head_ref || github.ref }}-${{ hashFiles('requirements/edx/testing.txt', 'requirements/edx/github.in') }}
+          restore-keys: ${{ runner.os }}-pip-${{ github.head_ref || github.ref }}-
 
       - name: Install Required Python Dependencies
         env:
diff --git a/.github/workflows/static-assets-check.yml b/.github/workflows/static-assets-check.yml
index 41159e3526c5..66b8d1246f59 100644
--- a/.github/workflows/static-assets-check.yml
+++ b/.github/workflows/static-assets-check.yml
@@ -66,8 +66,8 @@ jobs:
         uses: actions/cache@v5
         with:
           path: ${{ steps.pip-cache-dir.outputs.dir }}
-          key: ${{ runner.os }}-pip-${{ hashFiles('requirements/edx/development.txt') }}
-          restore-keys: ${{ runner.os }}-pip-
+          key: ${{ runner.os }}-pip-${{ github.head_ref || github.ref }}-${{ hashFiles('requirements/edx/development.txt', 'requirements/edx/github.in') }}
+          restore-keys: ${{ runner.os }}-pip-${{ github.head_ref || github.ref }}-
 
       - name: Install Limited Python Deps for Build
         run: |