Cache by lock-file hash, restore by prefix. The cache key looks like npm-hashFiles('package-lock.json') with restore key npm-.
For matrix builds, include the OS and Node version in the key — caches are not portable across platforms.
Watch the size limit (10GB per repo). Old caches are evicted automatically, but cache thrash on huge artifacts costs minutes per run.