Function computeIntegrityCacheKey

pkg/workflow/cache_integrity.go:188–205

computeIntegrityCacheKey returns the effective cache key for a cache entry, incorporating the integrity level and policy hash prefix. The key always starts with "memory-{integrityLevel}-{policyHash}-" to ensure cache isolation across integrity levels and guard policies, even when the user has specif

(cache CacheMemoryEntry, githubConfig *GitHubToolConfig)

// githubConfig may be nil for workflows without a GitHub guard policy, in which case the
// sentinel value "nopolicy" and the default integrity level "none" are used.
func computeIntegrityCacheKey(cache CacheMemoryEntry, githubConfig *GitHubToolConfig) string {
	integrityLevel := cacheIntegrityLevel(githubConfig)
	policyHash := computePolicyHash(githubConfig)
	integrityPrefix := fmt.Sprintf("memory-%s-%s-", integrityLevel, policyHash)

	// If a custom key was explicitly set, prefix it with the integrity/policy namespace
	// to prevent cross-integrity or cross-policy cache sharing.
	if cache.Key != "" && cache.Key != generateDefaultCacheKey(cache.ID) {
		customKey := cache.Key
		runIdSuffix := "-${{ github.run_id }}"
		if !strings.HasSuffix(customKey, runIdSuffix) {
			customKey = customKey + runIdSuffix
		}
		return integrityPrefix + customKey
	}

	return generateIntegrityAwareCacheKey(cache.ID, integrityLevel, policyHash)
}

// generateIntegrityAwareCacheKey generates the new-format cache key that includes
// the integrity level and policy hash as prefixes.