From c94d7f479ed66daa2a5c7ee1b7f30933e56bd7ce Mon Sep 17 00:00:00 2001
From: Mike Solar <iam@mikesolar.cn>
Date: Fri, 25 Sep 2026 22:00:36 +0800
Subject: [PATCH] ci: key the FFmpeg cache on install-deps.sh too, drop bare
 restore-key

The macOS job failed to link with '-lopenh264 not found': the bare
ffmpeg-<os>-<arch>- restore-key brought back an FFmpeg built before
openh264 was dropped (982593aa2), and the always() save re-saved that
stale tree under the new key, poisoning every later run. The cache key
now hashes both configure inputs (build-ffmpeg.sh AND install-deps.sh,
whose package set decides the enable_if_pkg probes), and the bare
fallback is gone: a changed configure input costs a rebuild instead of
restoring a mismatched tree. The poisoned macOS cache entries were
deleted.
---
 .github/workflows/ci.yml | 25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d0b2bf275..6e9bb24f6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -285,10 +285,17 @@ jobs:
         shell: bash
         run: tooling/install-deps.sh
 
-      # The built FFmpeg is cached as a whole (keyed on the script, distro
-      # and arch): a cache hit skips the ~10 minute build. The
-      # `.build-complete` marker distinguishes a finished build from a
-      # partial cache save; without it the tree is rebuilt.
+      # The built FFmpeg is cached as a whole, keyed on distro, arch and
+      # BOTH configure inputs — build-ffmpeg.sh and install-deps.sh (the
+      # enable_if_pkg probes depend on which packages that script
+      # installed). There is deliberately no bare distro/arch restore-key:
+      # it once restored an openh264-linked FFmpeg after the codec was
+      # dropped, and the `always()` save re-saved that stale tree under
+      # the new key, breaking every later macOS link (`-lopenh264` not
+      # found). A changed configure input must cost a ~10 minute rebuild,
+      # never a mismatched cache. The `.build-complete` marker
+      # distinguishes a finished build from a partial cache save; without
+      # it the tree is rebuilt.
       - name: Restore FFmpeg (WarpCache)
         if: matrix.platform == 'linux'
         id: ffmpeg-cache
@@ -300,10 +307,9 @@ jobs:
           WARPBUILD_RUNNER_VERIFICATION_TOKEN: ${{ env.WARPBUILD_RUNNER_VERIFICATION_TOKEN }}
         with:
           path: .cache/ffmpeg
-          key: ffmpeg-${{ matrix.distro }}-${{ matrix.arch }}-${{ hashFiles('tooling/ffmpeg/build-ffmpeg.sh') }}-${{ github.run_id }}-${{ github.run_attempt }}
+          key: ffmpeg-${{ matrix.distro }}-${{ matrix.arch }}-${{ hashFiles('tooling/ffmpeg/build-ffmpeg.sh', 'tooling/install-deps.sh') }}-${{ github.run_id }}-${{ github.run_attempt }}
           restore-keys: |
-            ffmpeg-${{ matrix.distro }}-${{ matrix.arch }}-${{ hashFiles('tooling/ffmpeg/build-ffmpeg.sh') }}-
-            ffmpeg-${{ matrix.distro }}-${{ matrix.arch }}-
+            ffmpeg-${{ matrix.distro }}-${{ matrix.arch }}-${{ hashFiles('tooling/ffmpeg/build-ffmpeg.sh', 'tooling/install-deps.sh') }}-
 
       - name: Restore FFmpeg (GitHub)
         if: matrix.platform == 'macos'
@@ -311,10 +317,9 @@ jobs:
         uses: actions/cache/restore@v6
         with:
           path: .cache/ffmpeg
-          key: ffmpeg-${{ runner.os }}-${{ matrix.arch }}-${{ hashFiles('tooling/ffmpeg/build-ffmpeg.sh') }}-${{ github.run_id }}-${{ github.run_attempt }}
+          key: ffmpeg-${{ runner.os }}-${{ matrix.arch }}-${{ hashFiles('tooling/ffmpeg/build-ffmpeg.sh', 'tooling/install-deps.sh') }}-${{ github.run_id }}-${{ github.run_attempt }}
           restore-keys: |
-            ffmpeg-${{ runner.os }}-${{ matrix.arch }}-${{ hashFiles('tooling/ffmpeg/build-ffmpeg.sh') }}-
-            ffmpeg-${{ runner.os }}-${{ matrix.arch }}-
+            ffmpeg-${{ runner.os }}-${{ matrix.arch }}-${{ hashFiles('tooling/ffmpeg/build-ffmpeg.sh', 'tooling/install-deps.sh') }}-
 
       - name: Build FFmpeg
         if: matrix.platform != 'windows'