Composer Cache Integrity - "zip archive ... corrupted" in CI

Composer reused a cached dist archive ("Loading from cache") that is truncated or corrupt - often from a previous interrupted download or a stale CI cache key - so extraction fails.

What this error means

A package that prints "Loading from cache" then fails to extract, complaining the zip archive is corrupted or the checksum does not match. Clearing the Composer cache and re-downloading fixes it.

composer output

  - Installing acme/widgets (2.1.0): Loading from cache
Failed to extract acme/widgets: (9) ...
  This most likely is due to a corrupted zip archive. It was checked against the
  dist reference and the checksum did not match.

Common causes

A corrupted or truncated cache entry

An earlier interrupted download left a partial archive in ~/.cache/composer. Composer loads it, and extraction or checksum validation fails.

A stale or shared CI cache

A restored CI cache from a different lockfile state can contain archives that no longer match the expected checksum.

How to fix it

Clear the Composer cache and reinstall

Terminal

composer clear-cache
composer install --no-interaction --prefer-dist

Key the CI cache on the lockfile

A precise cache key avoids restoring stale archives across unrelated dependency states.

.github/workflows/ci.yml

- uses: actions/cache@v4
  with:
    path: ~/.cache/composer
    key: composer-${{ hashFiles('composer.lock') }}
    restore-keys: composer-

Ensure unzip tooling is present

Composer needs the zip extension or an unzip/7z binary to extract dist archives reliably.