The documentation of cache key does not correspond to the actual behaviour.

Description

The README.md files states:

ramsey/composer-install will auto-generate a cache key which is composed of
the following elements:

• The OS image name, like ubuntu-latest.
• The exact PHP version, like 8.1.11.
• A hash of the composer.json and/or composer.lock files.

I removed the optional arguments from the actual doc:

Steps to reproduce

Here is a simple project that use this project without option: https://github.com/alexislefebvre/test-ramsey-composer-install/blob/7b2d9b8ebff99fe94b68ae084d93314d2287cae5/.github/workflows/tests.yml

Expected behavior

I expected the cache key to look to something like this: ubuntu-latest-8.4.17-[some-hash]

Screenshots or output

But the cache key is totally different:

Cache restored from key: Linux-php-8.4.17-composer-locked

• ubuntu is missing
• there’s no hash

Logs: https://github.com/alexislefebvre/test-ramsey-composer-install/actions/runs/21416780023/job/61667120730#step:4:76

Caches as seen in the “Actions” tab:

Environment details

• version of this package: 3.1.1
• PHP version: 8.4.17
• OS: Linux

Additional context

The generation of the cache key has an issue, or the documentation should be updated.

Here is the code that generate the cache key:

"${{ hashFiles('**/${{ inputs.composer-filename }}.json', '**/${{ inputs.composer-filename }}.lock') }}" may not work properly.