What changed, and why it matters
This is a routine fix for an Android CI build workflow. The GitHub Actions cache key was failing because it tried to hash files in a directory that could not be read. The patch explicitly excludes the problematic directory from the hash. There is no security issue here.
No security action needed. Treat as normal CI maintenance.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit modifies .github/workflows/builds.yml to exclude contrib/android/.cache from hashFiles() inputs used in GitHub Actions cache keys. The prior glob pattern ‘contrib/android/**’ apparently included the .cache directory, causing hashFiles to fail on GitHub-hosted runners. The change is purely a CI reliability fix.
Changed components
.github/workflows/builds.ymlInspect captured patch +2 / −3
diff --git a/.github/workflows/builds.yml b/.github/workflows/builds.yml
index e20a9a0..41d73a8 100644
--- a/.github/workflows/builds.yml
+++ b/.github/workflows/builds.yml
@@ -101,7 +101,7 @@ jobs:
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
with:
path: packages
- key: android-packages-${{ env.APK_ARCH }}-${{ hashFiles('contrib/deterministic-build/requirements.txt', 'contrib/make_packages.sh', 'contrib/android/**') }}
+ key: android-packages-${{ env.APK_ARCH }}-${{ hashFiles('contrib/deterministic-build/**', 'contrib/make_packages.sh', 'contrib/android/**', '!contrib/android/.cache') }}
- name: Cache buildozer (p4a)
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
@@ -109,8 +109,7 @@ jobs:
path: |
.buildozer_qml/android/platform/build-${{ env.APK_ARCH }}/packages
.buildozer_qml/android/platform/build-${{ env.APK_ARCH }}/build
- # note: should *at least* depend on Dockerfile and p4a_recipes/, but contrib/android/ is simplest
- key: android-buildozer-${{ env.APK_ARCH }}-${{ hashFiles('contrib/android/**') }}
+ key: android-buildozer-${{ env.APK_ARCH }}-${{ hashFiles('contrib/android/**', '!contrib/android/.cache') }}
- name: Build APK (debug)
run: ./contrib/android/build.sh qml "$APK_ARCH" debug
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.