You want a cache key that changes when either package-lock.json or .npmrc changes. Which hashFiles call is valid?
Select an answer to reveal the explanation.
Short Explanation and Infographic
hashFiles accepts multiple glob patterns as separate string arguments. Comma-separate them inside the function call; do not use ||, JavaScript arrays, or string concatenation of two hashes casually.
Full explanation below image
Full Explanation
hashFiles(path, ...) computes a hash over matching files for all provided glob patterns. Passing '/package-lock.json', '/.npmrc' as two arguments includes both sets of files in a single hash, so a change to either file invalidates caches keyed on that value. Using || inside one string is not how patterns are combined — that would be treated as a weird literal pattern. A JavaScript-style array literal is not valid expression syntax for hashFiles. Adding two hashFiles() results with + is not valid expression arithmetic for strings in the way many expect; if you ever need two hashes, use format() to concatenate them. Typical cache keys look like ${{ runner.os }}-npm-${{ hashFiles('/package-lock.json', '/.npmrc') }}.