ci(install): handle release-age races in sandboxes

Bun rejects a young exact pin even when an older release satisfies a latest request, and it age-checks omitted dev dependencies during production installs. Keep latest requests flexible below the cap and remove omitted dependencies from the package-size install manifest.

Mint the package-size token only after PR-controlled packing and installation complete.

Author: BridgeAR

.github/workflows/project.yml

@@ -89,21 +89,29 @@ jobs:
     permissions:
       id-token: write
     steps:
-      - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
-        id: octo-sts
-        with:
-          scope: DataDog/dd-trace-js
-          policy: package-size-report
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/node/latest
       - run: FILENAME=$(npm pack --silent --pack-destination /tmp) && mv /tmp/$FILENAME /tmp/dd-trace.tgz
       - run: cp bunfig.toml /tmp/dd-trace-bunfig.toml && rm -rf *
       - run: tar -zxf /tmp/dd-trace.tgz -C $(pwd) --strip-components=1
       # `--ignore-scripts` skips the `prepare` script (`cd vendor && npm ci --include=dev`):
       # the packed tarball ships pre-built `vendor/dist/**` artifacts but not
       # `vendor/package-lock.json`, so a fresh consumer install can't rebuild vendor.
-      - run: bun --config=/tmp/dd-trace-bunfig.toml install --production --omit=optional --ignore-scripts
+      # Bun 1.3.1 applies the release-age gate while resolving omitted dev dependencies.
+      # Remove them for the consumer install, then restore the shipped manifest for the size report.
+      - run: |
+          cp package.json /tmp/dd-trace-package.json
+          npm pkg delete devDependencies
+          bun --config=/tmp/dd-trace-bunfig.toml install --production --omit=optional --ignore-scripts
+          mv /tmp/dd-trace-package.json package.json
       - run: ls -lisa
+      - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
+        id: octo-sts
+        with:
+          scope: DataDog/dd-trace-js
+          policy: package-size-report
       - name: Compute module size tree and report
         uses: qard/heaviest-objects-in-the-universe@1e02edbdda803a45537a808ede97866db47756d3 # Unreleased
         with:

packages/dd-trace/test/plugins/versions.spec.js

@@ -5,7 +5,7 @@ const assert = require('node:assert/strict')
 const { describe, it } = require('mocha')
 const { coerce, major } = require('semver')
 
-const { getVersionList, resolvePluginVersions, brokenVersionReason } = require('./versions')
+const { getCappedRange, getVersionList, resolvePluginVersions, brokenVersionReason } = require('./versions')
 
 const latests = require('./versions/package.json').dependencies
 
@@ -14,6 +14,17 @@ const keys = (name, versions, nonConsecutive) =>
 
 const latestMajorKey = name => String(major(coerce(latests[name])))
 
+describe('getCappedRange', () => {
+  it('keeps latest requests flexible below the pinned ceiling', () => {
+    assert.equal(getCappedRange('mongodb', 'latest'), `<=${latests.mongodb}`)
+    assert.equal(getCappedRange('mongodb', ''), `<=${latests.mongodb}`)
+  })
+
+  it('keeps exact requests pinned so the release-age gate can reject them', () => {
+    assert.equal(getCappedRange('mongodb', '1.2.3'), '1.2.3')
+  })
+})
+
 describe('getVersionList', () => {
   it('collapses the wildcard to the latest major', () => {
     assert.deepEqual(keys('mongodb', ['*']), [latestMajorKey('mongodb')])

packages/dd-trace/test/plugins/versions/index.js

@@ -55,7 +55,7 @@ function capSubrange (name, subrange) {
     )
   }
 
-  if (!subrange || subrange === 'latest') return latests[name]
+  if (!subrange || subrange === 'latest') return `<=${latests[name]}`
   if (subset(subrange, `<=${latests[name]}`)) return subrange
   if (subrange.includes(' - ')) {
     const minRange = subrange.split(' - ')[0].trim()

scripts/all-green.mjs

@@ -1,9 +1,9 @@
 import { setTimeout } from 'node:timers/promises'
 import { Octokit } from 'octokit'
-import { downloadArtifacts } from './download-artifacts.mjs'
-
 import { summary } from '@actions/core'
 import { context } from '@actions/github'
+// eslint-disable-next-line import/order -- @actions ESM exports resolve differently across supported Node.js versions.
+import { downloadArtifacts } from './download-artifacts.mjs'
 
 /* eslint-disable no-console */