From 39097bbef8b02f984c9f4f8bfb7e62e70cc28d77 Mon Sep 17 00:00:00 2001
From: cb-jit-bhuin <jit.bhuin@chargebee.com>
Date: Wed, 5 Aug 2026 12:01:05 +0530
Subject: [PATCH 1/2] chore: use frozen lockfile for CI dependency installs

Replace bare `yarn install` with `yarn install --frozen-lockfile` in the
build and release workflows so CI installs exactly what the committed
yarn.lock specifies.

Also key the node_modules cache off yarn.lock instead of
package-lock.json. The install step is guarded by a cache-hit check, and
the old key hashed a lockfile that yarn never writes to, so dependency
changes did not invalidate the cache and the install step was skipped.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .github/workflows/build.yml   | 4 ++--
 .github/workflows/release.yml | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1bb9a1e..0275da8 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -19,14 +19,14 @@ jobs:
           cache-name: cache-node-modules
         with:
           path: node_modules
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/package-lock.json') }}
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('yarn.lock') }}
           restore-keys: |
             ${{ runner.os }}-build-${{ env.cache-name }}-
             ${{ runner.os }}-build-
             ${{ runner.os }}-
       - name: Install dependencies
         if: steps.cache-nodemodules.outputs.cache-hit != 'true'
-        run: yarn install
+        run: yarn install --frozen-lockfile
       - name: Linter
         run: yarn run eslint
       - name: Yarn Tests
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3220f6b..53a3539 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -30,14 +30,14 @@ jobs:
           cache-name: cache-node-modules
         with:
           path: node_modules
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/package-lock.json') }}
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('yarn.lock') }}
           restore-keys: |
             ${{ runner.os }}-build-${{ env.cache-name }}-
             ${{ runner.os }}-build-
             ${{ runner.os }}-
       - name: Install dependencies
         if: steps.cache-nodemodules.outputs.cache-hit != 'true'
-        run: yarn install
+        run: yarn install --frozen-lockfile
       - name: Initialize NPM config
         run: |
             npm config set registry=https://registry.npmjs.com/

From 1a9177e35e802398268b76e74f4cb83d61db8a7b Mon Sep 17 00:00:00 2001
From: cb-jit-bhuin <jit.bhuin@chargebee.com>
Date: Wed, 5 Aug 2026 12:30:06 +0530
Subject: [PATCH 2/2] ci: bump actions/cache to v4 in build workflow

GitHub auto-fails jobs using actions/cache@v2, so the build job aborted
during setup before reaching the install step. release.yml already uses
v4; this brings build.yml in line so the frozen-lockfile install is
actually exercised.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 0275da8..50fab53 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -14,7 +14,7 @@ jobs:
         run: corepack enable
       - name: Cache node modules
         id: cache-nodemodules
-        uses: actions/cache@v2
+        uses: actions/cache@v4
         env:
           cache-name: cache-node-modules
         with: