ci: Generated Java same-base cache keyed on generation-input content (Part of #5137, #5142)

.github/workflows/java-compile.yml

@@ -23,7 +23,7 @@ name: Generated Java Compiles
 # porting tickets, worklists or audits needs no compile. Any build-input difference,
 # or a side that fails to generate, builds -- from the projects the check already
 # generated, so the corpus is not refactored (or scanned) a third time. The four
-# generations run side by side, and the base's are cached per base commit, so a
+# generations run side by side, and the base's are cached per content hash of the generation inputs, so a
 # second push to the same PR generates only the head. Pushes, the weekly run and
 # manual runs always build from scratch.
 
@@ -181,7 +181,10 @@ jobs:
         uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ runner.temp }}/java_base_cache
-          key: java-same-base-${{ matrix.corpus }}-${{ github.event.pull_request.base.sha || github.sha }}
+          # #5142: keyed on the CONTENT of the files that decide the generation (the paths: list above), of the base checkout on a PR
+          # and of main's own checkout on a push. The old key was the base COMMIT, which has an entry only for the ~43 pct of
+          # main commits that touch those paths (the push run is path-filtered), so most PRs missed and regenerated both sides.
+          key: java-same-base-${{ matrix.corpus }}-${{ github.event_name == 'pull_request' && hashFiles('base/gitgalaxy/cobol_to_java_controller.py', 'base/gitgalaxy/cobol_refractor_controller.py', 'base/gitgalaxy/tools/cobol_to_java/**', 'base/gitgalaxy/tools/cobol_to_cobol/**', 'base/gitgalaxy/standards/yaml_reader.py', 'base/gitgalaxy/standards/fact_channel_confidence.json', 'base/tests/tools/java_target_matrix.py', 'base/tests/cobol_mainframe/corpora.json', 'base/tests/tools/mainframe_corpus.py') || hashFiles('gitgalaxy/gitgalaxy/cobol_to_java_controller.py', 'gitgalaxy/gitgalaxy/cobol_refractor_controller.py', 'gitgalaxy/gitgalaxy/tools/cobol_to_java/**', 'gitgalaxy/gitgalaxy/tools/cobol_to_cobol/**', 'gitgalaxy/gitgalaxy/standards/yaml_reader.py', 'gitgalaxy/gitgalaxy/standards/fact_channel_confidence.json', 'gitgalaxy/tests/tools/java_target_matrix.py', 'gitgalaxy/tests/cobol_mainframe/corpora.json', 'gitgalaxy/tests/tools/mainframe_corpus.py') }}
 
       - name: Keep this commit's generation for the pull requests based on it (main)
         id: keep-gen
@@ -207,7 +210,7 @@ jobs:
         uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ runner.temp }}/java_base_cache
-          key: java-same-base-${{ matrix.corpus }}-${{ github.sha }}
+          key: java-same-base-${{ matrix.corpus }}-${{ hashFiles('gitgalaxy/gitgalaxy/cobol_to_java_controller.py', 'gitgalaxy/gitgalaxy/cobol_refractor_controller.py', 'gitgalaxy/gitgalaxy/tools/cobol_to_java/**', 'gitgalaxy/gitgalaxy/tools/cobol_to_cobol/**', 'gitgalaxy/gitgalaxy/standards/yaml_reader.py', 'gitgalaxy/gitgalaxy/standards/fact_channel_confidence.json', 'gitgalaxy/tests/tools/java_target_matrix.py', 'gitgalaxy/tests/cobol_mainframe/corpora.json', 'gitgalaxy/tests/tools/mainframe_corpus.py') }}
 
       - name: Is the generated Java unchanged? (pull requests)
         id: same

.github/workflows/mainframe-ground-truth.yml

@@ -11,8 +11,7 @@ name: Mainframe Ground Truth
 #
 # Runs on every PR that changes a ground-truth input (#5164: the plan job skips the rest, still reporting `ground-truth`): the scores depend on the whole engine
 # (detection, the COBOL/JCL/BMS/CSD registries, the resolver, the DB writer),
-# and the full fetch + scan + score of all three corpora takes well under a
-# minute. The same job also runs tests/cobol_mainframe/ with the corpora
+# and the fetch + scan + score of all three corpora takes 2-4 min on a cold scan (#5142: the "Gate against" step, measured 2026-10-15). The same job also runs tests/cobol_mainframe/ with the corpora
 # fetched, so the full-corpus refraction differential and the excerpt
 # byte-identity checks -- skipped in every other workflow -- run here too.
 #

tests/tools/test_cache_keys.py

@@ -135,14 +135,10 @@ def test_same_base_cache_is_restore_only_on_pull_requests():
     assert sorted(k for k, _ in steps) == ["restore", "save"], steps
     restore = next(s for k, s in steps if k == "restore")
     save = next(s for k, s in steps if k == "save")
-    assert "pull_request.base.sha" in _key(restore) and "github.sha" in _key(restore)
-    assert _key(save).strip() == _key(restore).replace("github.event.pull_request.base.sha || ", "").strip().replace(
-        "${{ matrix.corpus }}", "${{ matrix.corpus }}"
-    ), "the save key is the restore key at main's own sha"
+    # #5142: content-keyed (the generation inputs of the PR's base checkout / main's own), not the base commit's sha
+    assert "base/gitgalaxy/" in _key(restore) and "gitgalaxy/gitgalaxy/" in _key(restore)
+    assert "gitgalaxy/gitgalaxy/" in _key(save) and "base/" not in _key(save), "the save key hashes main's own checkout"
     assert "github.event_name != 'pull_request'" in save, "the same-base save must not run on a pull request"
-    assert "hashFiles" not in _key(restore) + _key(save), (
-        "no head-file hash in the same-base key (a PR editing it forked the key)"
-    )
 
 
 def test_every_java_compile_cache_save_skips_pull_requests():