From b4ce3352864e24176b5a5926124bb6adfc45b003 Mon Sep 17 00:00:00 2001
From: Kasper Svendsen <kaspersv@github.com>
Date: Fri, 24 Oct 2025 10:48:01 +0200
Subject: [PATCH] Ensure uniqueness of overlay-base database cache keys

---
 lib/analyze-action.js              |  4 +++-
 src/overlay-database-utils.test.ts |  4 +++-
 src/overlay-database-utils.ts      | 11 +++++++++--
 3 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/lib/analyze-action.js b/lib/analyze-action.js
index 8b936b19d..9efff648c 100644
--- a/lib/analyze-action.js
+++ b/lib/analyze-action.js
@@ -91075,12 +91075,14 @@ async function uploadOverlayBaseDatabaseToCache(codeql, config, logger) {
   return true;
 }
 async function getCacheSaveKey(config, codeQlVersion, checkoutPath) {
+  const runId = getWorkflowRunID();
+  const attemptId = getWorkflowRunAttempt();
   const sha = await getCommitOid(checkoutPath);
   const restoreKeyPrefix = await getCacheRestoreKeyPrefix(
     config,
     codeQlVersion
   );
-  return `${restoreKeyPrefix}${sha}`;
+  return `${restoreKeyPrefix}${runId}-${attemptId}-${sha}`;
 }
 async function getCacheRestoreKeyPrefix(config, codeQlVersion) {
   const languages = [...config.languages].sort().join("_");
diff --git a/src/overlay-database-utils.test.ts b/src/overlay-database-utils.test.ts
index d8a7c05bd..7124d4ece 100644
--- a/src/overlay-database-utils.test.ts
+++ b/src/overlay-database-utils.test.ts
@@ -271,10 +271,12 @@ test("overlay-base database cache keys remain stable", async (t) => {
 
   sinon.stub(apiClient, "getAutomationID").resolves("test-automation-id/");
   sinon.stub(gitUtils, "getCommitOid").resolves(commitOid);
+  sinon.stub(actionsUtil, "getWorkflowRunID").returns(12345);
+  sinon.stub(actionsUtil, "getWorkflowRunAttempt").returns(1);
 
   const saveKey = await getCacheSaveKey(config, codeQlVersion, "checkout-path");
   const expectedSaveKey =
-    "codeql-overlay-base-database-1-c5666c509a2d9895-javascript_python-2.23.0-abc123def456";
+    "codeql-overlay-base-database-1-c5666c509a2d9895-javascript_python-2.23.0-12345-1-abc123def456";
   t.is(
     saveKey,
     expectedSaveKey,
diff --git a/src/overlay-database-utils.ts b/src/overlay-database-utils.ts
index 81d39a990..e3d06866f 100644
--- a/src/overlay-database-utils.ts
+++ b/src/overlay-database-utils.ts
@@ -4,7 +4,12 @@ import * as path from "path";
 
 import * as actionsCache from "@actions/cache";
 
-import { getRequiredInput, getTemporaryDirectory } from "./actions-util";
+import {
+  getRequiredInput,
+  getTemporaryDirectory,
+  getWorkflowRunAttempt,
+  getWorkflowRunID,
+} from "./actions-util";
 import { getAutomationID } from "./api-client";
 import { type CodeQL } from "./codeql";
 import { type Config } from "./config-utils";
@@ -453,12 +458,14 @@ export async function getCacheSaveKey(
   codeQlVersion: string,
   checkoutPath: string,
 ): Promise<string> {
+  const runId = getWorkflowRunID();
+  const attemptId = getWorkflowRunAttempt();
   const sha = await getCommitOid(checkoutPath);
   const restoreKeyPrefix = await getCacheRestoreKeyPrefix(
     config,
     codeQlVersion,
   );
-  return `${restoreKeyPrefix}${sha}`;
+  return `${restoreKeyPrefix}${runId}-${attemptId}-${sha}`;
 }
 
 /**