Isolate updates in their own cache dir to avoid cache reuse issues

Author: Seldaek

.env

@@ -29,6 +29,8 @@ CDN_METADATA_PUBLIC_ENDPOINT=
 CDN_METADATA_API_KEY=
 CDN_API_KEY=
 
+UPDATER_WORKER_CACHE_DIR=
+
 #TRUSTED_PROXIES=127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
 #TRUSTED_HOSTS='^(localhost|example\.com)$'
 

config/services.yaml

@@ -46,6 +46,7 @@ services:
             $fallbackGhTokens: "%fallback_gh_tokens%"
             $configDir: '%kernel.project_dir%/config/'
             $internalSecret: '%env(APP_SECRET)%'
+            $updaterWorkerCacheDir: '%env(UPDATER_WORKER_CACHE_DIR)%'
 
     # makes classes in src/ available to be used as services
     # this creates a service per class whose id is the fully-qualified class name

src/Service/UpdaterWorker.php

@@ -80,6 +80,7 @@ public function __construct(
         private StatsDClient $statsd,
         private readonly FallbackGitHubAuthProvider $fallbackGitHubAuthProvider,
         CacheItemPoolInterface $cache,
+        private readonly string $updaterWorkerCacheDir,
     ) {
         $this->cache = new Psr16Cache($cache);
         $this->logger = $logger;
@@ -130,6 +131,14 @@ public function process(Job $job, SignalHandler $signal): array
         $io = new BufferIO('', OutputInterface::VERBOSITY_VERY_VERBOSE, new HtmlOutputFormatter(Factory::createAdditionalStyles()));
         $io->loadConfiguration($config);
 
+        // sandbox into a unique cache dir per package id to avoid potential cache reuse issues
+        if (trim($this->updaterWorkerCacheDir) !== '' && is_dir($this->updaterWorkerCacheDir)) {
+            $subDir = str_pad((string)$package->getId(), 9, '0', STR_PAD_LEFT);
+            $subDir = substr($subDir, 0, 6).'/'.$package->getId();
+            $config->merge(['config' => ['cache-dir' => $this->updaterWorkerCacheDir.'/'.$subDir]]);
+            unset($subDir);
+        }
+
         $usesPackagistToken = false;
         if (Preg::isMatch('{^https://github\.com/(?P<repo>[^/]+/[^/]+?)(?:\.git)?$}i', $package->getRepository(), $matches)) {
             $usesPackagistToken = true;