fix(cli): fold the features lockfile into the cache key

read-configuration --cache-key is documented to hash the committed
features lockfile, but computeCacheKey only used the lockfile when
ReadLockfile's bool was true, and that bool reports the empty marker
file, which comes back with a nil lock. A lockfile with content was
therefore never hashed, so changing the pinned digests kept the key.

Use the lockfile whenever ReadLockfile returns one. Keys for
configurations without a lockfile, or with an empty one, are unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: aledbf

internal/cli/cache_key.go

@@ -54,7 +54,9 @@ func computeCacheKey(result *config.LoadResult, env map[string]string) (string,
 		}
 	}
 
-	if lock, ok, _ := features.ReadLockfile(cfg.ConfigFilePath); ok && lock != nil {
+	// ReadLockfile's bool reports an empty marker file, which pins nothing; a
+	// lockfile with content comes back as a non-nil lock.
+	if lock, _, _ := features.ReadLockfile(cfg.ConfigFilePath); lock != nil {
 		if lockJSON, lerr := json.Marshal(lock); lerr == nil {
 			in.Lockfile = lockJSON
 		}

internal/cli/cache_key_repo_held_test.go

@@ -0,0 +1,62 @@
+package cli
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// A committed features lockfile pins resolved digests, so changing it changes
+// the cache key (docs/go-only-features.md, read-configuration --cache-key); an
+// empty lockfile, which pins nothing, keys like no lockfile at all.
+func TestComputeCacheKeyFoldsInTheLockfile(t *testing.T) {
+	dir := t.TempDir()
+	cfgPath := filepath.Join(dir, "devcontainer.json")
+	lockPath := filepath.Join(dir, "devcontainer-lock.json")
+	key := func() string {
+		t.Helper()
+		k, err := computeCacheKey(imageResult("ubuntu:22.04", cfgPath), nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return k
+	}
+	none := key()
+
+	if err := os.WriteFile(lockPath, []byte(""), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if k := key(); k != none {
+		t.Error("an empty lockfile changed the key")
+	}
+
+	lock := func(digest string) string {
+		return `{"features":{"ghcr.io/o/f:1":{"version":"1.0.0","resolved":"ghcr.io/o/f@` + digest + `","integrity":"` + digest + `"}}}`
+	}
+	if err := os.WriteFile(lockPath, []byte(lock("sha256:aaa")), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	pinnedA := key()
+	if pinnedA == none {
+		t.Error("a lockfile did not change the key")
+	}
+	if err := os.WriteFile(lockPath, []byte(lock("sha256:bbb")), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if key() == pinnedA {
+		t.Error("a lockfile pinning another digest kept the key")
+	}
+}
+
+// A proxy variable that is set but empty configures no proxy, so it keys like
+// an unset one.
+func TestComputeCacheKeyIgnoresEmptyProxy(t *testing.T) {
+	cfgPath := filepath.Join(t.TempDir(), "devcontainer.json")
+	base, err := computeCacheKey(imageResult("ubuntu:22.04", cfgPath), nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if k, _ := computeCacheKey(imageResult("ubuntu:22.04", cfgPath), map[string]string{"HTTPS_PROXY": ""}); k != base {
+		t.Error("an empty proxy variable changed the key")
+	}
+}