[RahulGautamSingh]

Changes

Only write release notes to the package cache on a cache miss. Since #24468 the write also ran on every cache hit, which reset the TTL, so a cached compare-only fallback (from a failed or unmatched lookup) that is read at least once per TTL window was never retried. A miss still caches the fallback, so packages without notes are not refetched on every run.

This also applies to real release notes: an entry read at least once per TTL window was never refreshed, so edits to a release body after it was first fetched never showed up.

Reported with a reproduction in #46568 (this implements its suggested fix 2). The shared cache key (fix 3) is a separate problem, tracked in #36939 and #46302.

Context

Please select one of the following:

• This closes an existing Issue, Closes: #
• This doesn't close an Issue, but I accept the risk that this PR may be closed if maintainers disagree with its opening or implementation. Because this does not close an Issue, I will add a minimal reproduction repository as part of this PR.

AI assistance disclosure

Did you use AI tools to create any part of this pull request?

Please select one option and, if yes, briefly describe how AI was used (e.g., code, tests, docs) and which tool(s) you used.

• No — I did not use AI for this contribution.
• Yes — minimal assistance (e.g., IDE autocomplete, small code completions, grammar fixes).
• Yes — substantive assistance (AI-generated non‑trivial portions of code, tests, or documentation).

Code, tests and this description were written by Claude Code (Claude Opus 5.5) and reviewed by @RahulGautamSingh.

• Yes — other (please describe):

Use of AI in replying to PR comments

Who answers review comments:

• @RahulGautamSingh will read and reply directly. Name the account.
• An agent will draft replies and @username will read them before they are posted. Name the account.
• An agent will draft replies and reply autonomously. This is heavily discouraged, and we prefer that there are humans in the loop
• Nobody has explicitly committed to replying.

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified unit tests, or
• No unit tests, but ran on a real repository, or
• Both unit tests + ran on a real repository

The public repository: https://github.com/aslafy-z/renovate-reproduction-stale-cache (from #46568, reproduces the bug on the hosted app)

A reproduction is compulsory for PRs that do not close an Issue: link a public repository above that reproduces the bug or shows the new behavior.
If this PR closes an Issue, confirm the fix against the Issue's reproduction.
If you are not adding a reproduction, state your reason here:

Local reproduction of the fix

The linked repository reproduces the bug on the hosted app. The fix was reproduced locally by calling the real addReleaseNotes() against the rook/rook v1.20.8 GitHub release, with a file package cache and cacheTtlOverride: { "changelog-*": 1 } (1 minute TTL). Each step is a separate process sharing one cacheDir:

1. t=0s, invalid token: the lookup fails and the compare-only fallback is cached (expires at 60s)
2. t=40s, valid token: cache hit
3. t=80s, valid token: on main the hit at 40s rewrote the entry, so it is still served; with the fix it expired at 60s and the notes are fetched

Before

== main (1777a89ee6)
21:02:57 token=bad  -> compare-only
21:03:38 token=good -> compare-only
21:04:18 token=good -> compare-only

After

== fix branch (7548755386)
21:01:11 token=bad  -> compare-only
21:01:52 token=good -> compare-only
21:02:39 token=good -> full release notes (1677 chars, from https://api.github.com/repos/rook/rook/releases)

PRs without a reproduction or a stated reason will not be reviewed and may be closed.

[github-actions]

🎉 This PR is included in version 44.128.2 🎉

The release is available on:

• GitHub release
• 44.128.2

Your semantic-release bot 📦🚀