How does GitHub Actions cache dependencies between workflow runs?

The actions/cache action stores specified directories (like node_modules or a package manager's download cache) keyed by a string you define, typically incorporating the OS and a hash of the lockfile, so the cache only gets reused when the same dependency set is genuinely still valid.

- uses: actions/cache@v4
  with:
    path: ~/.npm
    key: ${{ runner.os }}-npm-${{ hashFiles('package-lock.json') }}
    restore-keys: |
      ${{ runner.os }}-npm-

On a cache hit, the specified path is restored before later steps run, skipping a full reinstall. If the lockfile changes, the hash-based key no longer matches, so the cache misses and a fresh cache is saved under the new key, which is exactly the behavior you want: never silently reuse dependencies from a different lockfile state.

Unlike GitHub Actions artifacts, which are meant to be passed between jobs in the same workflow run and are guaranteed to exist for that run, caches are a best-effort optimization across separate workflow runs and can be evicted under storage pressure, so a workflow should never depend on a cache actually being present to function correctly.