From 5c729fc3456ce7014b98c652881a62664570112b Mon Sep 17 00:00:00 2001
From: Martin Zihlmann <martizih@outlook.com>
Date: Wed, 24 Jun 2026 23:09:13 +0100
Subject: [PATCH] mz824: fold heredoc bodies into RUN cache key

---
 pkg/commands/run.go        | 20 ++++++++++++++++++++
 pkg/commands/run_marker.go |  4 ++++
 pkg/commands/run_test.go   | 19 +++++++++++++++++++
 3 files changed, 43 insertions(+)

diff --git a/pkg/commands/run.go b/pkg/commands/run.go
index c73dc21c8..e82089b9e 100644
--- a/pkg/commands/run.go
+++ b/pkg/commands/run.go
@@ -423,6 +423,22 @@ func (r *RunCommand) String() string {
 	return r.cmd.String()
 }
 
+func (r *RunCommand) CacheKey(replacementEnvs []string) (string, error) {
+	return runCacheKey(r.cmd), nil
+}
+
+// runCacheKey appends the raw heredoc bodies to the instruction text
+func runCacheKey(cmd *instructions.RunCommand) string {
+	var key strings.Builder
+	key.WriteString(cmd.String())
+	for _, f := range cmd.Files {
+		key.WriteString("\n")
+		key.WriteString(f.Data)
+		key.WriteString(f.Name)
+	}
+	return key.String()
+}
+
 func (c *RunCommand) FilesUsedFromContext(config *v1.Config, buildArgs *dockerfile.BuildArgs) ([]string, error) {
 	return runCmdFilesUsedFromContext(config, buildArgs, c.cmd, c.fileContext)
 }
@@ -471,6 +487,10 @@ func (cr *CachingRunCommand) IsArgsEnvsRequiredInCache() bool {
 	return true
 }
 
+func (cr *CachingRunCommand) CacheKey(replacementEnvs []string) (string, error) {
+	return runCacheKey(cr.cmd), nil
+}
+
 func (cr *CachingRunCommand) ExecuteCommand(config *v1.Config, buildArgs *dockerfile.BuildArgs) error {
 	logrus.Infof("Found cached layer, extracting to filesystem")
 	var err error
diff --git a/pkg/commands/run_marker.go b/pkg/commands/run_marker.go
index d191015a6..0cd6ec995 100644
--- a/pkg/commands/run_marker.go
+++ b/pkg/commands/run_marker.go
@@ -71,6 +71,10 @@ func (r *RunMarkerCommand) IsArgsEnvsRequiredInCache() bool {
 	return true
 }
 
+func (r *RunMarkerCommand) CacheKey(replacementEnvs []string) (string, error) {
+	return runCacheKey(r.cmd), nil
+}
+
 // CacheCommand returns true since this command should be cached
 func (r *RunMarkerCommand) CacheCommand(img v1.Image) DockerCommand {
 	return &CachingRunCommand{
diff --git a/pkg/commands/run_test.go b/pkg/commands/run_test.go
index bfcf3ce0f..b825e801f 100644
--- a/pkg/commands/run_test.go
+++ b/pkg/commands/run_test.go
@@ -29,10 +29,29 @@ import (
 	"testing"
 
 	v1 "github.com/google/go-containerregistry/pkg/v1"
+	"github.com/moby/buildkit/frontend/dockerfile/instructions"
 	"github.com/osscontainertools/kaniko/pkg/dockerfile"
 	"github.com/osscontainertools/kaniko/testutil"
 )
 
+func Test_RunCommand_CacheKey_IncludesHeredocBody(t *testing.T) {
+	// Two RUN heredocs that differ only in body share the instruction line
+	// "RUN <<EOF", so the body must enter the cache key or a changed script
+	// serves a stale layer.
+	run := func(body string) *RunCommand {
+		cmd := &instructions.RunCommand{}
+		cmd.Files = []instructions.ShellInlineFile{{Name: "EOF", Data: body}}
+		return &RunCommand{cmd: cmd}
+	}
+	hello, err := run("echo hello").CacheKey(nil)
+	testutil.CheckError(t, false, err)
+	world, err := run("echo world").CacheKey(nil)
+	testutil.CheckError(t, false, err)
+	if hello == world {
+		t.Errorf("expected distinct cache keys for differing heredoc bodies, got %q for both", hello)
+	}
+}
+
 func Test_addDefaultHOME(t *testing.T) {
 	tests := []struct {
 		name        string