[bitsandfoxes]

The native SDK cache key now hashes only what goes into the native binaries, and a cache miss no longer restores .NET workloads, which on Windows took ~5.4 min of the ~18 min miss.

The native SDK builds are where the run's critical path starts. Over the last 21 days, sdk (Windows) missed its cache in 50 of 119 jobs. A miss delays package-release from ~6.5 to ~22 min, and the green runs that had one ended at a p50 of 55.5 min instead of 42. Most misses are eviction (22 of the 50 on Windows), which #2902 below takes care of. Of the rest, most came from key changes that had nothing to do with native code:

• src/sentry-dotnet is part of submodules-status for every target, so a sentry-dotnet bump rebuilt all 7 native SDKs.
• package/package.json is hashed, but nothing in build/native-sdks.targets or its scripts reads it, so every release bump rebuilt them too.
• Directory.Build.targets only imports native-sdks.targets, which is hashed on its own, plus the Unity and test targets. Editing those also rebuilt every native SDK.

It also missed the other way: the runner label and sdk.yml weren't hashed. The macos-15, ubuntu-24.04 and Java 17 changes kept serving binaries built with the old toolchain.

How it works now:

• The key is sdk=<target>-<runsOn>-hash(submodules-status, native-sdks.targets, sdk-static, the two build scripts, sdk.yml). submodules-status only covers the target's own submodules.
• A miss doesn't check out src/sentry-dotnet. The Build<Target>SDK targets are only cmake, gradle, pwsh, Copy and Exec, and dotnet msbuild runs them without a restore. sentry-dotnet's ProjectReferences are declared but never opened.
• "Restore .NET Workload" is gone. The build step sets MSBuildEnableWorkloadResolver=false instead, because global.json pins a workloadVersion. Without that setting, MSBuild fails with MSB4242 when the workload set isn't installed. No native target needs a workload, since the project is netstandard.

Simulated on the same 21 days, together with #2902 this turns about 70% of the Windows misses into hits, which brings the miss rate from 42% to roughly 11–15%. The p50 run end would drop by about 12 min.

The new key misses once on every target, so this PR's own run builds all 7 native SDKs from scratch, without sentry-dotnet or workloads. That's the proof.

Stacked on #2908.

CI evidence: run 40233069570 is green 56/56 in 42 min. It carried #2907 as a throwaway commit (since dropped). All 7 native SDK jobs missed the new key and built from scratch, without sentry-dotnet or workloads: Windows 11.1 min (the median miss was 18.4: Restore .NET Workload 5.3 min gone, submodules 1.2 → 0.4, Build 9.9), WindowsNative 2, Cocoa 6, Android 6, MacOSNative / Linux / LinuxNative about 1 each. Build Unity SDK finished at 16.6 min. Even with every native cache cold, the run ended at 42 min, against a 55.5 p50 for earlier green runs with a Windows miss.

Rebased onto #2907: run 40302607109 is green on the first attempt in 40.1 min.

🤖 Generated with Claude Code