Gut check - we're trying to add caching for Pulumi plugins in our Github Actions because we're hitting Github API rate limits when downloading plugins. My thinking is to use the hash of the package-lock.json as the cache key for the plugins. Is this reasonable, or could the plugin versions change without the package-lock.json changing?

That's reasonable. The plugin versions are embedded into the packages, so same package version == same plugin version.

ty!