Previous example is somewhat misleading.

When new package is added, old cache is being restored, which may lead to package resolve errors as described here.

Considering this guide:

To ensure the CI workflow’s reliability, make sure it uses the appropriate version of package dependencies.
SwiftPM records the result of dependency resolution in Package.resolved (at the top-level of the package) and it's used when performing dependency resolution (rather than having SwiftPM searching the latest eligible version of each package). Running swift package update updates all dependencies to the latest eligible versions and updates the Package.resolved. You can commit Package.resolved to your Git repository to ensure it’s always up-to-date on the CI environment to prevent the CI from building your project with unexpected versions of package dependencies. Otherwise you can choose to add Package.resolved file to .gitignore file and have swift package resolve command in charge of resolving the dependencies (swift package resolve is invoked by most SwiftPM commands).

We mustn't use restore-keys for spm cache.