GitHub Actions cache key collision / immutable cache not updating

Cache entries in GitHub Actions are immutable: once a key is saved it cannot be overwritten, so reusing a static key while the underlying content changes leaves you restoring stale data forever.

What this error means

Builds keep restoring outdated dependencies or artifacts even though inputs changed, and the save step reports the key already exists instead of updating it.

Cache hit on key: deps-cache (stale)
Cache already exists, not overwriting immutable entry.

Common causes

Static key that never changes

A constant key (deps-cache) is restored on every run and can never be updated, so the first saved content sticks.

Key not tied to content hash

The key does not include a hash of the inputs (lockfile), so changed inputs map to the same immutable entry.

How to fix it

Make the key content-addressed

1. Include hashFiles of the lockfile or inputs in the primary key.
2. Add restore-keys prefixes for partial reuse across changes.
3. Let a new hash produce a new entry instead of overwriting.

key: ${{ runner.os }}-deps-${{ hashFiles('**/package-lock.json') }}
restore-keys: |
  ${{ runner.os }}-deps-

How to prevent it

• Always derive cache keys from a content hash.
• Never reuse a static key for changing content.
• Use restore-keys for graceful partial hits.

Related guides