Actions cache that actually caches

The cache step was green on every run and the install step still took the full six minutes. The action was fine. The key was wrong.

The broken key

- uses: actions/cache@v4
  with:
    path: ~/.npm
    key: npm-cache

A static key never changes, so the first run writes the cache and every run after that restores a snapshot that is already stale — but never gets updated, because the key it would write to already exists.

The fix

Key the cache on the lockfile hash, and add a restore-keys fallback so a near-miss still gives you most of the cache:

- uses: actions/cache@v4
  with:
    path: ~/.npm
    key: npm-${{ hashFiles('package-lock.json') }}
    restore-keys: |
      npm-

Now the key changes whenever dependencies change, the cache is rewritten when it should be, and a lockfile bump falls back to the previous cache instead of starting cold.

If your cache is always a hit and your build is always slow, the key is the first thing to look at — not the action.