fix(ci): bootstrap npm from tarball when runner's bundled npm is broken#3010
fix(ci): bootstrap npm from tarball when runner's bundled npm is broken#3010amikofalvy merged 1 commit intomainfrom
Conversation
The GitHub runner image ubuntu24/20260329.72 ships a broken npm 10.9.7 (missing promise-retry module), causing `npm install -g npm@latest` to fail with MODULE_NOT_FOUND. This blocks all releases. Add a fallback that downloads the npm tarball directly from the registry and uses it to self-install, bypassing the broken bundled npm entirely. The normal path is tried first so the fallback is only used when needed. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
🦋 Changeset detectedLatest commit: d221765 The changes in this PR will be included in the next version bump. This PR includes changesets to release 10 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
TL;DR — Adds a fallback mechanism to the release workflow so that npm can be upgraded even when the runner's bundled npm binary is broken. If Key changes
Summary ｜ 2 files ｜ 1 commit ｜ base: Resilient npm upgrade in the release workflow
The fallback uses
|
![pullfrog[bot]](https://avatars.githubusercontent.com/in/1768019?s=60&v=4){kind=small}
There was a problem hiding this comment.
Solid workaround for a real runner breakage. The fallback logic is sound — try the happy path first, bootstrap from tarball if it fails. Two items to address: the changeset shouldn't exist (this is a CI-only change, not a published package change), and the fallback could fail silently if the registry fetch returns empty.
Claude Opus ｜ 𝕏
| "@inkeep/agents-core": patch | ||
| --- | ||
|
|
||
| Fix release workflow npm bootstrap for OIDC publishing |
There was a problem hiding this comment.
This changeset should be removed. The change is to .github/workflows/release.yml — internal CI tooling, not published code in @inkeep/agents-core. Per repo conventions, internal tooling/scripts changes do not get changesets. Merging this would trigger a spurious patch release of agents-core with zero code changes to the package.
If the goal is to trigger a publish run to verify the fix, a workflow_dispatch on the release workflow achieves the same thing without a no-op version bump.
| echo "npm upgraded via bundled npm" | ||
| else | ||
| echo "::warning::Bundled npm broken, bootstrapping from tarball" | ||
| NPM_VER=$(node -e "fetch('https://registry.npmjs.org/npm/latest').then(r=>r.json()).then(d=>console.log(d.version))") |
There was a problem hiding this comment.
If fetch fails (network error, registry outage, non-JSON response), NPM_VER will be empty and the subsequent curl + install commands will silently produce garbage URLs or cryptic errors. Add a guard:
| NPM_VER=$(node -e "fetch('https://registry.npmjs.org/npm/latest').then(r=>r.json()).then(d=>console.log(d.version))") | |
| NPM_VER=$(node -e "fetch('https://registry.npmjs.org/npm/latest').then(r=>r.json()).then(d=>console.log(d.version))") | |
| if [ -z "$NPM_VER" ]; then echo '::error::Failed to resolve npm version from registry'; exit 1; fi |
| NPM_VER=$(node -e "fetch('https://registry.npmjs.org/npm/latest').then(r=>r.json()).then(d=>console.log(d.version))") | |
| NPM_VER=$(node -e "fetch('https://registry.npmjs.org/npm/latest').then(r=>r.json()).then(d=>console.log(d.version))") | |
| if [ -z "$NPM_VER" ]; then echo '::error::Failed to resolve npm version from registry'; exit 1; fi |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
PR Review Summary
(3) Total Issues | Risk: Medium
🟠⚠️ Major (2) 🟠⚠️
Inline Comments:
- 🟠 Major:
.github/workflows/release.yml:49Error suppression via2>/dev/nullhides legitimate failures - 🟠 Major:
.changeset/frightened-white-guineafowl.md:1-5Changeset should not exist for CI-only changes
🟡 Minor (1) 🟡
Inline Comments:
- 🟡 Minor:
.github/workflows/release.yml:53Consider using curl for version lookup instead of Node fetch
🚫 REQUEST CHANGES
Summary: The PR correctly addresses a legitimate CI failure caused by a broken npm in the GitHub runner image. The fallback mechanism is sound in principle, but needs two fixes before merging:
-
Remove the changeset — Per AGENTS.md, "Internal tooling/scripts changes" should NOT have changesets. This workflow fix doesn't change any code in
@inkeep/agents-core. -
Improve error detection — The blanket
2>/dev/nullerror suppression masks legitimate failures. Consider checking for the specificMODULE_NOT_FOUNDerror pattern so genuine network/auth failures are still surfaced.
The curl-based version lookup is a nice-to-have improvement but not blocking.
Discarded (2)
| Location | Issue | Reason Discarded |
|---|---|---|
.github/workflows/release.yml:53-55 |
Tarball download lacks checksum verification | Acceptable for temporary workaround; HTTPS + official registry provides reasonable security, and adding dynamic hash verification from the same registry doesn't add meaningful security. |
.github/workflows/release.yml:53 |
Node fetch() may fail in older runners | Duplicate of the curl suggestion which was placed as Minor |
Reviewers (2)
| Reviewer | Returned | Main Findings | Consider | While You're Here | Inline Comments | Pending Recs | Discarded |
|---|---|---|---|---|---|---|---|
pr-review-devops |
4 | 0 | 0 | 0 | 3 | 0 | 1 |
pr-review-standards |
1 | 0 | 0 | 0 | 0 | 0 | 1 |
| Total | 5 | 0 | 0 | 0 | 3 | 0 | 2 |
Note: Changeset issue was raised by both reviewers; deduplicated in final output.
| - name: Ensure npm 11.5.1+ for OIDC support | ||
| run: npm install -g npm@latest | ||
| run: | | ||
| if npm install -g npm@latest 2>/dev/null; then |
There was a problem hiding this comment.
🟠 MAJOR: Error suppression hides legitimate failures
Issue: The 2>/dev/null redirection discards all stderr output, hiding legitimate errors unrelated to the broken npm issue (network failures, permission issues, registry auth problems).
Why: When the primary upgrade path fails for any reason other than the specific MODULE_NOT_FOUND bug, the workflow silently falls back to the tarball path. This masks real problems and makes debugging harder.
Fix: Consider checking for the specific error pattern instead of blanket suppression:
if npm install -g npm@latest 2>&1 | tee /tmp/npm-upgrade.log; then
echo "npm upgraded via bundled npm"
elif grep -qE 'MODULE_NOT_FOUND|Cannot find module' /tmp/npm-upgrade.log; then
echo "::warning::Bundled npm broken, bootstrapping from tarball"
# ... fallback logic
else
echo "::error::npm upgrade failed for unknown reason"
cat /tmp/npm-upgrade.log
exit 1
fiRefs:
| echo "npm upgraded via bundled npm" | ||
| else | ||
| echo "::warning::Bundled npm broken, bootstrapping from tarball" | ||
| NPM_VER=$(node -e "fetch('https://registry.npmjs.org/npm/latest').then(r=>r.json()).then(d=>console.log(d.version))") |
There was a problem hiding this comment.
🟡 Minor: Consider using curl for version lookup
Issue: The fallback uses node -e "fetch(...)" which requires Node.js 18+ with native fetch. While the workflow specifies Node 22, using curl would be more robust and consistent with the tarball download.
Why: This avoids any Node.js environment dependency in the fallback path. If npm is broken, other aspects of the Node environment might also be affected.
Fix:
| NPM_VER=$(node -e "fetch('https://registry.npmjs.org/npm/latest').then(r=>r.json()).then(d=>console.log(d.version))") | |
| NPM_VER=$(curl -fsSL https://registry.npmjs.org/npm/latest | jq -r .version) |
Refs:
- The runner already has
jqavailable for JSON parsing
| --- | ||
| "@inkeep/agents-core": patch | ||
| --- | ||
|
|
||
| Fix release workflow npm bootstrap for OIDC publishing |
There was a problem hiding this comment.
🟠 MAJOR: Changeset should not exist for CI-only changes
Issue: This changeset attributes a CI workflow fix to @inkeep/agents-core, but per AGENTS.md, changesets should NOT be created for "Internal tooling/scripts changes".
Why: Creating a changeset for this workflow-only change will trigger an unnecessary patch version bump of @inkeep/agents-core. This creates changelog noise and version churn for consumers who see no actual code change in the package.
Fix: Delete this changeset file. The workflow fix does not require a version bump of any package.
From AGENTS.md:
When NOT to create a changeset:
- Documentation-only changes
- Test-only changes
- Internal tooling/scripts changes
- Changes to ignored packages
Preview URLsUse these stable preview aliases for testing this PR:
These point to the same Vercel preview deployment as the bot comment, but they stay stable and easier to find. Raw Vercel deployment URLs
|
1 participant
Summary
ubuntu24/20260329.72ships a broken npm 10.9.7 (missingpromise-retrymodule), causingnpm install -g npm@latestto fail withMODULE_NOT_FOUNDin the release workflowTest plan
🤖 Generated with Claude Code