--- title: "Keep unrelated environment changes out of cache keys" description: "Include inputs that can change the output while excluding branch identity and unrelated environment churn." url: https://starsling.dev/ci-playbooks/techniques/content-based-cache-keys canonicalUrl: https://starsling.dev/ci-playbooks/techniques/content-based-cache-keys --- # Keep unrelated environment changes out of cache keys Include inputs that can change the output while excluding branch identity and unrelated environment churn. ## How to choose an approach Compare the examples by repository setup, prerequisites, and risks before adopting one. Each company implemented this in its own environment; measure each change against your own baseline. - **[Mastra](https://starsling.dev/ci-playbooks/mastra#task-cache-env)**: Use it when Task hashes change with secrets that are consumed only when the application runs. Check before adopting: Keep credentials used by build-time code generation or embedded configuration. Review secret availability separately from cache hashing. - **[Mastra](https://starsling.dev/ci-playbooks/mastra#global-cache-env)**: Use it when Identical source and tool inputs miss cache when jobs see different GitHub event environments. Check before adopting: Only remove variables proven irrelevant to output. Cache correctness still requires all output-affecting configuration and secure write permissions. - **[OpenAI](https://starsling.dev/ci-playbooks/openai#stabilize-cache-environment)**: Use it when Identical source trees miss remote build caches after a runner image update. Check before adopting: A PATH allow-list can hide a required tool. Keep real tool versions in the cache inputs so a toolchain change still invalidates results. ## Apply this technique ````text Evaluate and apply this CI technique to my repository: Keep unrelated environment changes out of cache keys. Include inputs that can change the output while excluding branch identity and unrelated environment churn. Read the technique and its source-backed company examples: https://starsling.dev/ci-playbooks/techniques/content-based-cache-keys.md Inspect this repository’s CI workflows, build and test commands, dependencies, and recent run timings. Identify where this technique applies and explain the expected benefit using this repository’s evidence. Measure a baseline from recent comparable runs: elapsed time, queue time, runner minutes and failures where available. If data is unavailable, say what cannot be measured. Compare relevant company approaches, checking prerequisites, platform differences and tradeoffs. Rank applicable options by evidence, fit and measurable opportunity; do not present company results as predictions for this repo. Recommend the smallest safe change, show what checks and fallback paths remain, and ASK ME WHICH CHANGE TO APPROVE BEFORE EDITING ANY FILES. Only after approval, work on a new feature branch, make one reversible change, and open a reviewable pull request. Never merge or push to a default or protected branch. Keep required checks, test coverage, deployment and release behavior intact. Validate the change and compare equivalent runs where possible; report limitations and what should be monitored after merge. ```` ## How companies used this technique Read what each company changed and follow the original sources. ### Mastra: Keep runtime API keys out of unrelated build hashes The build task stopped hashing RAPID_API_KEY and ANTHROPIC_API_KEY, two task-level env entries. The transferable step is proving that the build reads no runtime-only credentials. Evidence: Source PR/commit evidence Use it when: Task hashes change with secrets that are consumed only when the application runs. Before applying it: Keep credentials used by build-time code generation or embedded configuration. Review secret availability separately from cache hashing. [Read more in the Mastra playbook](https://starsling.dev/ci-playbooks/mastra#task-cache-env) [Primary source](https://github.com/mastra-ai/mastra/pull/14432) ### Mastra: Remove branch identity from content cache keys A branch-name global environment variable caused different keys between Prebuild and workflow_run consumers. Mastra removed this artificial cache scope. Evidence: Source PR/commit evidence Use it when: Identical source and tool inputs miss cache when jobs see different GitHub event environments. Before applying it: Only remove variables proven irrelevant to output. Cache correctness still requires all output-affecting configuration and secure write permissions. [Read more in the Mastra playbook](https://starsling.dev/ci-playbooks/mastra#global-cache-env) [Primary source](https://github.com/mastra-ai/mastra/pull/12720) ### OpenAI: Remove unrelated environment churn from cache inputs Codex traced different remote cache keys for the same source tree to an unrelated tool version in the hosted Windows PATH. It now computes an explicit PATH in PowerShell and passes it to all three Bazel environments, keeping the tools the build uses. Evidence: Source PR/commit evidence Bazel actions see one explicit PATH across all three environments ([Source](https://github.com/openai/codex/pull/19161)) Use it when: Identical source trees miss remote build caches after a runner image update. Before applying it: A PATH allow-list can hide a required tool. Keep real tool versions in the cache inputs so a toolchain change still invalidates results. [Read more in the OpenAI playbook](https://starsling.dev/ci-playbooks/openai#stabilize-cache-environment) [Primary source](https://github.com/openai/codex/pull/19161) ## CI optimization is continuous work. Apply this technique yourself, or use StarSling Runners for faster GitHub Actions and optional agent-driven optimization PRs, which teams on eligible paid plans can turn on. [Get self-improving CI](https://starsling.dev/products/runners) ## Related techniques ### [Remove caches that cost more than they save](https://starsling.dev/ci-playbooks/techniques/remove-expensive-caches) Measure cache restore and upload time against the work avoided. Remove caches whose transfer cost outweighs their benefit. 2 implementations · 2 companies (Linear, OpenAI) ### [Bake stable dependencies into runner images](https://starsling.dev/ci-playbooks/techniques/prebuild-runner-images) Prepare versioned system dependencies and build downloads once in the runner image instead of installing them on every job. 2 implementations · 2 companies (Anthropic, Linear) ### [Cache package downloads and dependency stores](https://starsling.dev/ci-playbooks/techniques/reuse-package-downloads) Restore package-manager downloads or dependency stores while keeping a locked install that validates the requested dependency graph. 7 implementations · 6 companies (DoorDash, Linear, Shopify, Spotify, Stripe, Uber) ## Company Playbooks ### [Anthropic](https://starsling.dev/ci-playbooks/anthropic) Run only affected tests ### [DoorDash](https://starsling.dev/ci-playbooks/doordash) Run build and test in parallel, sharded across CI agents ### [Linear](https://starsling.dev/ci-playbooks/linear) Benchmark the same job on faster hardware ### [Mastra](https://starsling.dev/ci-playbooks/mastra) StarSling runners for the slowest test workflow ### [OpenAI](https://starsling.dev/ci-playbooks/openai) Rank CI fixes by the minutes they save ### [Ramp](https://starsling.dev/ci-playbooks/ramp) Move a CPU-bound test suite to a faster CPU ### [Shopify](https://starsling.dev/ci-playbooks/shopify) Let an agent iterate against one CI metric ### [Spotify](https://starsling.dev/ci-playbooks/spotify) Build arm64 on native arm64 runners ### [Stripe](https://starsling.dev/ci-playbooks/stripe) Run only the tests a change can reach ### [Uber](https://starsling.dev/ci-playbooks/uber) Build the merge-queue speculations most likely to be needed ## Related guides Implementation guides for this technique. ### [Cache workflow dependencies](https://starsling.dev/best-practices/github-actions/cache-dependencies) Choose dependency cache paths and keys for your package manager. ### [Cut repeated test setup](https://starsling.dev/best-practices/github-actions/cut-repeated-test-setup) Share expensive setup at the scope your tests need. ### [Share setup steps across jobs](https://starsling.dev/github-actions/optimizations/avoid-duplicated-setup) Centralize repeated setup definitions and remove duplicate or unused steps. ### [Optimize npm installs](https://starsling.dev/github-actions/optimizations/optimize-npm-install) Cache npm dependencies and large downloads and remove unused tool installs. ### [Optimize pnpm installs](https://starsling.dev/github-actions/optimizations/optimize-pnpm-install) Set up the pnpm store cache in the right order and scope recursive commands.