ci: scope turbo cache by dependency graph to fix stale snapshot replay

.github/workflows/workflow-bench.yml

@@ -28,8 +28,9 @@ jobs:
         uses: lynx-infra/cache@5c6160a6a4c7fca80a2f3057bb9dfc9513fcb732
         with:
           path: .turbo
-          # We have to be strict here to make sure getting the cache of build-all
-          key: turbo-v4-${{ runner.os }}-${{ hashFiles('**/packages/**/src/**/*.rs') }}-${{ github.sha }}
+          # We have to be strict here to make sure getting the cache of build-all.
+          # Must stay byte-for-byte identical to the key in workflow-build.yml.
+          key: turbo-v5-${{ runner.os }}-${{ hashFiles('packages/**/src/**/*.rs') }}-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.sha }}
           fail-on-cache-miss: true
       - name: Install
         run: |

.github/workflows/workflow-build.yml

@@ -95,15 +95,19 @@ jobs:
         uses: lynx-infra/cache@5c6160a6a4c7fca80a2f3057bb9dfc9513fcb732
         with:
           path: .turbo
-          key: turbo-v4-${{ runner.os }}-${{ hashFiles('packages/**/src/**/*.rs') }}-${{ github.sha }}
-          # We can restore caches from:
+          # The key is scoped by both the Rust transform sources (*.rs) and the
+          # dependency graph (pnpm-lock.yaml). Turbo's per-task hash does not
+          # fully capture the compiled snapshot output, so a cache built against
+          # a different dependency graph must NOT be replayed here.
+          key: turbo-v5-${{ runner.os }}-${{ hashFiles('packages/**/src/**/*.rs') }}-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.sha }}
+          # We can only restore caches that share the same Rust transform sources
+          # AND the same dependency graph (same *.rs hash and pnpm-lock.yaml hash):
           #   1. Previous commit from base branch (merge base or base SHA)
-          #   2. Any cache
+          #   2. Any cache with a matching *.rs + lockfile hash
           restore-keys: |
-            turbo-v4-${{ runner.os }}-${{ hashFiles('packages/**/src/**/*.rs') }}-${{ needs.get-merge-base.outputs.merge-base }}
-            turbo-v4-${{ runner.os }}-${{ hashFiles('packages/**/src/**/*.rs') }}-${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha || github.event.push.before }}
-            turbo-v4-${{ runner.os }}-${{ hashFiles('packages/**/src/**/*.rs') }}-
-            turbo-v4-${{ runner.os }}-
+            turbo-v5-${{ runner.os }}-${{ hashFiles('packages/**/src/**/*.rs') }}-${{ hashFiles('pnpm-lock.yaml') }}-${{ needs.get-merge-base.outputs.merge-base }}
+            turbo-v5-${{ runner.os }}-${{ hashFiles('packages/**/src/**/*.rs') }}-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha || github.event.push.before }}
+            turbo-v5-${{ runner.os }}-${{ hashFiles('packages/**/src/**/*.rs') }}-${{ hashFiles('pnpm-lock.yaml') }}-
       - name: Install
         run: |
           npm install -g corepack@latest

.github/workflows/workflow-bundle-analysis.yml

@@ -42,8 +42,9 @@ jobs:
         uses: lynx-infra/cache@5c6160a6a4c7fca80a2f3057bb9dfc9513fcb732
         with:
           path: .turbo
-          # We have to be strict here to make sure getting the cache of build-all
-          key: turbo-v4-${{ runner.os }}-${{ hashFiles('**/packages/**/src/**/*.rs') }}-${{ github.sha }}
+          # We have to be strict here to make sure getting the cache of build-all.
+          # Must stay byte-for-byte identical to the key in workflow-build.yml.
+          key: turbo-v5-${{ runner.os }}-${{ hashFiles('packages/**/src/**/*.rs') }}-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.sha }}
           fail-on-cache-miss: true
       - name: Install
         run: |

.github/workflows/workflow-test.yml

@@ -87,8 +87,11 @@ jobs:
         uses: lynx-infra/cache@5c6160a6a4c7fca80a2f3057bb9dfc9513fcb732
         with:
           path: .turbo
-          # We have to be strict here to make sure getting the cache of build-all
-          key: turbo-v4-${{ runner.os }}-${{ hashFiles('**/packages/**/src/**/*.rs') }}-${{ github.sha }}
+          # We have to be strict here to make sure getting the cache of build-all.
+          # This key MUST stay byte-for-byte identical to the one in
+          # workflow-build.yml (same globs, same hash inputs) so that
+          # fail-on-cache-miss reliably restores that commit's build-all .turbo.
+          key: turbo-v5-${{ runner.os }}-${{ hashFiles('packages/**/src/**/*.rs') }}-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.sha }}
           fail-on-cache-miss: true
       - name: Install
         run: |

.github/workflows/workflow-website.yml

@@ -23,7 +23,9 @@ jobs:
         uses: lynx-infra/cache@5c6160a6a4c7fca80a2f3057bb9dfc9513fcb732
         with:
           path: .turbo
-          key: turbo-v4-${{ runner.os }}-${{ hashFiles('**/packages/**/src/**/*.rs') }}-${{ github.sha }}
+          # Must stay byte-for-byte identical to the key in workflow-build.yml
+          # so fail-on-cache-miss restores that commit's build-all .turbo.
+          key: turbo-v5-${{ runner.os }}-${{ hashFiles('packages/**/src/**/*.rs') }}-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.sha }}
           fail-on-cache-miss: true
       - name: Setup Pages
         id: pages