From 80d595a01cb762498196e172539baeeef363cd65 Mon Sep 17 00:00:00 2001
From: Ignacio Santise <25931366+ignaciosantise@users.noreply.github.com>
Date: Wed, 1 Jul 2026 15:12:14 -0300
Subject: [PATCH] fix(ci): key web Metro cache on .env to stop stale
 EXPO_PUBLIC_* poisoning

Expo inlines EXPO_PUBLIC_* into the web bundle at Babel transform time,
but Metro's transform cache (node_modules/.cache) is not keyed on env
values. Callers that inject per-run ephemeral creds (e.g. a rotating
wallet private key/address) therefore restored a cache built with a
different .env and shipped the previous run's address baked into the
bundle.

Hash the written .env into the cache key and drop restore-keys: the
prefix fallback matched any older cache regardless of .env, so an
exact-key miss re-poisoned from a stale entry. Exact-match-only makes it
safe. Stable-creds callers keep a full cache hit (identical .env =>
identical key); per-run-creds callers cold-build each run, as intended.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .../actions/walletkit-build-and-maestro/action.yml  | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/.github/actions/walletkit-build-and-maestro/action.yml b/.github/actions/walletkit-build-and-maestro/action.yml
index c541368a..70a707ee 100644
--- a/.github/actions/walletkit-build-and-maestro/action.yml
+++ b/.github/actions/walletkit-build-and-maestro/action.yml
@@ -480,10 +480,17 @@ runs:
       with:
         # find-cache-dir default (babel-loader / metro transform cache). Warming
         # this across runs cuts most of the `expo export` transform time.
+        #
+        # The key hashes the written .env too: Expo inlines EXPO_PUBLIC_* into
+        # the bundle at Babel transform time, and Metro's transform cache is NOT
+        # keyed on env values — so reusing a cache built with different
+        # EXPO_PUBLIC_* (e.g. a caller injecting per-run ephemeral creds) bakes
+        # stale key/creds into the bundle. No restore-keys: any prefix fallback
+        # would span different .env values and re-introduce that poisoning.
+        # Stable-creds callers still get a full hit (identical .env => identical
+        # key); per-run-creds callers cold-build each run, which is correct.
         path: ${{ steps.paths.outputs.wallet_root }}/node_modules/.cache
-        key: ${{ runner.os }}-web-metro-${{ hashFiles(format('{0}/yarn.lock', steps.paths.outputs.wallet_root)) }}
-        restore-keys: |
-          ${{ runner.os }}-web-metro-
+        key: ${{ runner.os }}-web-metro-${{ hashFiles(format('{0}/yarn.lock', steps.paths.outputs.wallet_root), format('{0}/.env', steps.paths.outputs.wallet_root)) }}
 
     - name: Export web build
       if: inputs.platform == 'web'