From c8dc982eaa3bd1599166841c51940a049bb39ff2 Mon Sep 17 00:00:00 2001
From: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com>
Date: Sat, 29 Aug 2026 15:27:39 -0300
Subject: [PATCH] fix(ci): drop the stale ESLint cache restore-keys fallback
 from ci.yml (#11600) (#11996)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes the blocking Lint job's own ci.yml cache: PR #11963 removed the stale restore-keys fallback from quality.yml but left ci.yml's two "Restore ESLint file cache" steps carrying the same prefix-match fallback that lets a cache from a different lint config report stale per-file verdicts. Byte-level parity with #11963's already-merged fix.

Deliberately half of #11600 — the other half (run-eslint-json.mjs) is covered by PR #11983 from a parallel session, so the two don't collide on the same file.
---
 .github/workflows/ci.yml                           | 14 ++++++++++----
 .../fixes/11600-eslint-gate-cache-suppressions.md  |  5 +++++
 2 files changed, 15 insertions(+), 4 deletions(-)
 create mode 100644 changelog.d/fixes/11600-eslint-gate-cache-suppressions.md

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c15bf1ca12..b30c476e4e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -109,8 +109,11 @@ jobs:
             .eslintcache
             .eslintcache-complexity
           key: eslint-${{ runner.os }}-${{ hashFiles('eslint.config.mjs', 'eslint.complexity-ratchets.config.mjs', 'config/quality/eslint-suppressions.json', 'package-lock.json') }}
-          restore-keys: |
-            eslint-${{ runner.os }}-
+          # No restore-keys fallback on purpose (#11600, P-II.1 of the v3.8.50 postmortem): a
+          # cache built under a different suppressions file / lint config / lockfile reports
+          # stale per-file verdicts, which is exactly how 215 pre-existing errors stayed
+          # invisible for a whole cycle. Exact key or a cold full lint (~13 min) — never a
+          # partial cache from another configuration.
       # Single ESLint inventory (JSON) — quality-gate reuses the artifact instead of
       # a second cold full-tree pass for eslintWarnings ratchet counts.
       - name: ESLint (JSON report)
@@ -209,8 +212,11 @@ jobs:
             .eslintcache
             .eslintcache-complexity
           key: eslint-${{ runner.os }}-${{ hashFiles('eslint.config.mjs', 'eslint.complexity-ratchets.config.mjs', 'config/quality/eslint-suppressions.json', 'package-lock.json') }}
-          restore-keys: |
-            eslint-${{ runner.os }}-
+          # No restore-keys fallback on purpose (#11600, P-II.1 of the v3.8.50 postmortem): a
+          # cache built under a different suppressions file / lint config / lockfile reports
+          # stale per-file verdicts, which is exactly how 215 pre-existing errors stayed
+          # invisible for a whole cycle. Exact key or a cold full lint (~13 min) — never a
+          # partial cache from another configuration.
       # Coverage mergeada (coverage-summary.json) p/ o ratchet de cobertura.
       # continue-on-error: o artifact pode não existir se a job test-coverage foi
       # SKIPPED (shard flaky). Nesse caso collect-metrics pula coverage.* (ausente sem
diff --git a/changelog.d/fixes/11600-eslint-gate-cache-suppressions.md b/changelog.d/fixes/11600-eslint-gate-cache-suppressions.md
new file mode 100644
index 0000000000..858dfa7e91
--- /dev/null
+++ b/changelog.d/fixes/11600-eslint-gate-cache-suppressions.md
@@ -0,0 +1,5 @@
+- Dropped the stale-`.eslintcache` `restore-keys` fallback from both "Restore ESLint file
+  cache" steps in `ci.yml`, so the blocking `Lint` job can no longer be served per-file
+  verdicts computed under a different lint config, suppressions file or lockfile. `quality.yml`
+  had already dropped it in #11963; `ci.yml` — the workflow that actually gates PRs — had not
+  (#11600).