ci(warm-deps): key cache on pristine lock hash so fork restores hit (#831) (#850)

The warmer computed its cache key with hashFiles('**/poetry.lock') AFTER
setup-poetry ran `poetry lock`, which rewrites poetry.lock in place. The PR
jobs' restore-deps hashes the PRISTINE committed poetry.lock (it runs before
setup-poetry). The two hashes therefore never matched — a fork PR looked up
e.g. forkvenv-...-46e4852b... while the warmer had saved forkvenv-...-143cf261...
so every fork restore missed and fell back to the JFrog path (which forks
can't auth to), failing all jobs.

Capture the pristine lock hash in a step BEFORE setup-poetry and use that for
the cache key, matching what restore-deps computes. Found via the fork
verification PR #849 (all Unit Tests legs missed the cache).

Refs #831

Co-authored-by: Isaac

Signed-off-by: Vikrant Puppala <vikrant.puppala@databricks.com>

Author: vikrantpuppala

.github/workflows/warm-deps-cache.yml

@@ -129,6 +129,18 @@ jobs:
           git checkout FETCH_HEAD -- poetry.lock pyproject.toml
           echo "Overlaid poetry.lock / pyproject.toml from the fork branch."
 
+      # Capture the lock hash from the PRISTINE, committed poetry.lock BEFORE
+      # setup-poetry runs (it calls `poetry lock`, which rewrites poetry.lock
+      # in place and changes hashFiles's result). restore-deps in the PR jobs
+      # hashes the pristine lock, so the warmer MUST hash it at the same point
+      # or the keys never match and every fork restore misses.
+      - name: Capture pristine lock hash
+        id: lockhash
+        run: |
+          set -euo pipefail
+          echo "value=${{ hashFiles('**/poetry.lock') }}" >> "$GITHUB_OUTPUT"
+          echo "Pristine poetry.lock hash: ${{ hashFiles('**/poetry.lock') }}"
+
       - name: Install Kerberos system dependencies
         if: matrix.extras == 'pyarrow' || matrix.extras == 'kernel'
         run: |
@@ -186,7 +198,9 @@ jobs:
         run: |
           set -euo pipefail
           TIMESTAMP=$(date -u +%Y%m%d%H%M%S)
-          LOCK_HASH="${{ hashFiles('**/poetry.lock') }}"
+          # Pristine hash captured BEFORE setup-poetry's `poetry lock` mutated
+          # the file — matches what restore-deps computes in the PR jobs.
+          LOCK_HASH="${{ steps.lockhash.outputs.value }}"
           PY="${{ matrix.python-version }}"
           DEP="${{ matrix.dependency-version }}"
           EXTRAS="${{ matrix.extras || 'base' }}"