Is there a chance of adding a CI job or check in the existing validate jobs to make sure this doesn't accidentally happen again?

Yes, we're looking at that; there is a vendor check, but we're looking why it didn't flag this issue. Also, GitHub actions had issues around the time that PR was merged, and it looks like it may have skipped checks; see #51075 (comment)

We may have two add a similar hack as runc added to work around the horrible way of GitHub actions for these.

@cyphar are you able to work around this in your pipeline? FWIW, we are looking into a regression in the BuildKit version included in v28.5.0, and BuildKit will be doing a patch release on Monday (after the weekend); moby/buildkit#6261

I've just applied this patch to our packages for now so it's not really a pressing issue.

Thanks, that's good to hear!

Bringing this in. I'm working on the check so it doesn't happen again in #51093 and will backport it all supported branches.

Ah, yes! I kicked CI because it failed on the cache issue, didn't see it finished 👍