From 1a94a790bfcc3e2c4c5fa487b8d0410a89f8e4ea Mon Sep 17 00:00:00 2001
From: Vikrant Puppala <vikrant.puppala@databricks.com>
Date: Wed, 8 Jul 2026 16:29:24 +0000
Subject: [PATCH] ci(warm-deps): key cache on pristine lock hash so fork
 restores hit (#831)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The warmer computed its cache key with hashFiles('**/poetry.lock') AFTER
setup-poetry ran `poetry lock`, which rewrites poetry.lock in place. The PR
jobs' restore-deps hashes the PRISTINE committed poetry.lock (it runs before
setup-poetry). The two hashes therefore never matched — a fork PR looked up
e.g. forkvenv-...-46e4852b... while the warmer had saved forkvenv-...-143cf261...
so every fork restore missed and fell back to the JFrog path (which forks
can't auth to), failing all jobs.

Capture the pristine lock hash in a step BEFORE setup-poetry and use that for
the cache key, matching what restore-deps computes. Found via the fork
verification PR #849 (all Unit Tests legs missed the cache).

Refs #831

Co-authored-by: Isaac
Signed-off-by: Vikrant Puppala <vikrant.puppala@databricks.com>
---
 .github/workflows/warm-deps-cache.yml | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/warm-deps-cache.yml b/.github/workflows/warm-deps-cache.yml
index f6fa60998..8c36b1c91 100644
--- a/.github/workflows/warm-deps-cache.yml
+++ b/.github/workflows/warm-deps-cache.yml
@@ -129,6 +129,18 @@ jobs:
           git checkout FETCH_HEAD -- poetry.lock pyproject.toml
           echo "Overlaid poetry.lock / pyproject.toml from the fork branch."
 
+      # Capture the lock hash from the PRISTINE, committed poetry.lock BEFORE
+      # setup-poetry runs (it calls `poetry lock`, which rewrites poetry.lock
+      # in place and changes hashFiles's result). restore-deps in the PR jobs
+      # hashes the pristine lock, so the warmer MUST hash it at the same point
+      # or the keys never match and every fork restore misses.
+      - name: Capture pristine lock hash
+        id: lockhash
+        run: |
+          set -euo pipefail
+          echo "value=${{ hashFiles('**/poetry.lock') }}" >> "$GITHUB_OUTPUT"
+          echo "Pristine poetry.lock hash: ${{ hashFiles('**/poetry.lock') }}"
+
       - name: Install Kerberos system dependencies
         if: matrix.extras == 'pyarrow' || matrix.extras == 'kernel'
         run: |
@@ -186,7 +198,9 @@ jobs:
         run: |
           set -euo pipefail
           TIMESTAMP=$(date -u +%Y%m%d%H%M%S)
-          LOCK_HASH="${{ hashFiles('**/poetry.lock') }}"
+          # Pristine hash captured BEFORE setup-poetry's `poetry lock` mutated
+          # the file — matches what restore-deps computes in the PR jobs.
+          LOCK_HASH="${{ steps.lockhash.outputs.value }}"
           PY="${{ matrix.python-version }}"
           DEP="${{ matrix.dependency-version }}"
           EXTRAS="${{ matrix.extras || 'base' }}"