fix(ci): key node_modules sticky disk on the lockfile hash

Author: waleedlatif1

.github/workflows/test-build.yml

@@ -31,6 +31,22 @@ jobs:
       # namespace on top: untrusted fork runs must never share a cache with
       # push runs (whose caches feed production image builds) or with trusted
       # internal-PR runs.
+      #
+      # node_modules ALSO keys on the lockfile hash, the other two deliberately
+      # do not. A sticky disk is a persistent mutable volume, so every branch
+      # sharing one key shares one node_modules tree, and `bun install
+      # --frozen-lockfile` installs what the lockfile needs without pruning what
+      # it no longer references. Branches cut before a dependency bump therefore
+      # wrote their older copies onto the shared disk and every other branch
+      # inherited them — that is how builds on next 16.2.11 ended up loading a
+      # stale @next/swc 16.2.6 that appears nowhere in bun.lock. Hashing the
+      # lockfile gives each distinct dependency set its own disk, so a tree can
+      # never mix versions from two different lockfiles.
+      #
+      # The bun download cache is content-addressed by package+version and the
+      # Turbo cache is keyed by task hash, so both are safe to share across
+      # lockfiles — and sharing them is what keeps a fresh node_modules disk
+      # cheap to populate.
       - name: Mount Bun cache
         uses: ./.github/actions/cache-mount
         with:
@@ -42,7 +58,7 @@ jobs:
         uses: ./.github/actions/cache-mount
         with:
           provider: ${{ vars.CI_PROVIDER }}
-          key: ${{ github.repository }}-node-modules-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
+          key: ${{ github.repository }}-node-modules-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}-${{ hashFiles('bun.lock') }}
           path: ./node_modules
 
       - name: Mount Turbo cache
@@ -193,8 +209,10 @@ jobs:
   # Next.js production build, in parallel with lint + tests. Sticky disks are
   # cloned from the last committed snapshot per job and committed last-writer-
   # wins, so concurrent mounts are safe. The bun/node_modules disks are shared
-  # with test-build (identical content from the same lockfile — LWW loss is
-  # harmless), but the Turbo cache gets its own key: with a shared key, only
+  # with test-build — and because the node_modules key now includes the lockfile
+  # hash, the two jobs only ever share a disk when they really do resolve the
+  # same dependency tree, so the LWW loss really is harmless. The Turbo cache
+  # gets its own key: with a shared key, only
   # the last committer's new entries survive each run, so the test and build
   # Turbo entries would evict each other nondeterministically.
   # Same next build as the app image, so it needs a large runner. Peak RSS
@@ -236,7 +254,7 @@ jobs:
         uses: ./.github/actions/cache-mount
         with:
           provider: ${{ vars.CI_PROVIDER }}
-          key: ${{ github.repository }}-node-modules-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
+          key: ${{ github.repository }}-node-modules-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}-${{ hashFiles('bun.lock') }}
           path: ./node_modules
 
       - name: Mount Turbo cache