The pub package cache step in .github/actions/composite-flutter-setup/action.yml computes its cache key from a hash of pubspec.yaml files under dev/, examples/, and packages/ only, but doesn't include the root workspace pubspec.yaml. The root pubspec pins the versions of all transitive dependencies, so a pub roll that touches only the root pubspec leaves the hash (and thus the cache key) unchanged. The cache then hits and restores a stale pubspec.lock over the freshly checked-out one, which breaks flutter update-packages under --enforce-lockfile on the analyze shard — tree-wide, for every PR — until the cache is manually invalidated.

In [.github/actions/composite-flutter-setup/action.yml](https://github.com/flutter/flutter/blob/543e016abf14cdd39aaf267ba43d9012fd4955ef/.github/actions/composite-flutter-setup/action.yml#L164-L165):

find dev examples packages -name "pubspec.yaml" -print0 | sort -z | xargs -0 cat | sha256sum >> "$RUNNER_TEMP/pub_deps_sha"

Key: ${{ runner.os }}-pub-${{ steps.pub-deps-hash.outputs.revision }}, caching /opt/pub-cache, **/.dart_tool, and **/pubspec.lock (including the root lock).

## Example cache staleness

Example from https://github.com/flutter/flutter/pull/189761:

* Pub roll #189760 bumped `video_player_android` 2.11.0 → 2.12.0, changing only the root `pubspec.yaml` and root `pubspec.lock`
* Because no dev/examples/packages pubspec changed, the cache key was unchanged, so runs kept hitting the pre-roll cache entry (`Linux-pub-65bc4e59…`) and restoring the old pubspec.lock with `video_player_android` 2.11.0.
* The checked-out root `pubspec.yaml` pinned 2.12.0, so flutter update-packages (run by the analyze shard) failed:

video_player_android 2.12.0 (was 2.11.0)
Would change 1 dependency.
Unable to satisfy pubspec.yaml using pubspec.lock.
Failed to update packages.
╔═╡ERROR #1╞═══…
║ Command: bin/flutter update-packages
║ Command exited with exit code 65 but expected zero exit code.

* This reproduced on every re-run. Manually deleting the `Linux-pub-*` cache entries worked around the issue.

We should include the root `pubspec.yaml` in the hash so a root-only roll changes the cache key and forces a fresh resolution.