fix/batch-changes: ignore per-job env vars in cache key

sourcegraph/sourcegraph#12503 renders codingAgent steps server-side and
declares two per-job env-var forwards on each desugared step's env
(SRC_BATCHES_MODEL_PROVIDER_TOKEN and SRC_BATCHES_JOB_ID). Their values
are different on every dequeue, so including them in cache-key inputs
would bust the cache on every run.

Strip them before hashing so cache keys stay stable across dequeues.
The bare-string declarations still influence the key via the serialized
step.Env. Mirrored on the Sourcegraph side.

Author: taras-yemets

lib/batches/execution/cache/cache.go

@@ -47,6 +47,13 @@ func (key CacheKey) mountsMetadata() ([]MountMetadata, error) {
 	return nil, nil
 }
 
+// perJobEnvVars resolve to per-job values and must be stripped from
+// cache keys. Mirrored in sourcegraph/sourcegraph/lib/batches/execution/cache/cache.go.
+var perJobEnvVars = []string{
+	"SRC_BATCHES_MODEL_PROVIDER_TOKEN",
+	"SRC_BATCHES_JOB_ID",
+}
+
 // resolveStepsEnvironment returns a slice of environments for each of the steps,
 // containing only the env vars that are actually used.
 func resolveStepsEnvironment(globalEnv []string, steps []batches.Step) ([]map[string]string, error) {
@@ -64,6 +71,9 @@ func resolveStepsEnvironment(globalEnv []string, steps []batches.Step) ([]map[st
 		if err != nil {
 			return nil, errors.Wrapf(err, "resolving environment for step %d", i)
 		}
+		for _, name := range perJobEnvVars {
+			delete(env, name)
+		}
 		envs[i] = env
 	}
 	return envs, nil

lib/batches/execution/cache/cache_test.go

@@ -0,0 +1,74 @@
+package cache
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/sourcegraph/sourcegraph/lib/batches"
+	"github.com/sourcegraph/sourcegraph/lib/batches/env"
+)
+
+var repo = batches.Repository{
+	ID:          "my-repo",
+	Name:        "github.com/sourcegraph/src-cli",
+	BaseRef:     "refs/heads/f00b4r",
+	BaseRev:     "c0mmit",
+	FileMatches: []string{"baz.go"},
+}
+
+// TestKeyer_Key_PerJobEnvVarsIgnored verifies that the per-job
+// codingAgent env vars (SRC_BATCHES_MODEL_PROVIDER_TOKEN and
+// SRC_BATCHES_JOB_ID) do not influence the cache key value, even though
+// they are declared as bare-string forwards on the step. Without this,
+// every dequeue would invalidate the cache because the Sourcegraph
+// server resolves those vars to one value (empty) and src-cli resolves
+// them to another (the per-job values exported into the executor
+// container env).
+func TestKeyer_Key_PerJobEnvVarsIgnored(t *testing.T) {
+	var stepEnv env.Environment
+	require.NoError(t, json.Unmarshal(
+		[]byte(`["SRC_BATCHES_MODEL_PROVIDER_TOKEN", "SRC_BATCHES_JOB_ID", "USER_VAR"]`),
+		&stepEnv,
+	))
+
+	step := batches.Step{Run: "foo", Env: stepEnv}
+
+	serverKey := CacheKey{
+		Repository: repo,
+		Steps:      []batches.Step{step},
+		StepIndex:  0,
+		// Server-side: vars unset → empty resolved values.
+		GlobalEnv: []string{"USER_VAR=hello"},
+	}
+	srcCLIKey := CacheKey{
+		Repository: repo,
+		Steps:      []batches.Step{step},
+		StepIndex:  0,
+		// src-cli side: vars present with per-job values.
+		GlobalEnv: []string{
+			"USER_VAR=hello",
+			"SRC_BATCHES_MODEL_PROVIDER_TOKEN=ephemeral-job-token",
+			"SRC_BATCHES_JOB_ID=42",
+		},
+	}
+
+	a, err := serverKey.Key()
+	assert.NoError(t, err)
+	b, err := srcCLIKey.Key()
+	assert.NoError(t, err)
+	assert.Equal(t, a, b, "excluded env vars must not affect the cache key")
+
+	// Changing a non-excluded user var still invalidates the key.
+	userVarChanged := CacheKey{
+		Repository: repo,
+		Steps:      []batches.Step{step},
+		StepIndex:  0,
+		GlobalEnv:  []string{"USER_VAR=world"},
+	}
+	c, err := userVarChanged.Key()
+	assert.NoError(t, err)
+	assert.NotEqual(t, a, c, "non-excluded env vars must still affect the cache key")
+}