ci(bun): prevent partial-state success

A second Bun invocation is unsafe when the generated workspace state from the first failure remains in place.\n\nAllow one second workflow attempt for transient runner failures, and start both from an empty root node_modules tree.

Author: BridgeAR

.github/actions/install/action.yml

@@ -5,7 +5,11 @@ runs:
   steps:
     - uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
       with:
-        max_attempts: 3
+        max_attempts: 2
         timeout_minutes: 5
         retry_wait_seconds: 30
-        command: bun install --frozen-lockfile --linker=hoisted --network-concurrency 8
+        shell: bash
+        # A retry against Bun's partial install state can skip lifecycle scripts. Start every attempt clean.
+        command: >-
+          node -e "require('node:fs').rmSync('node_modules', { recursive: true, force: true })" &&
+          bun install --frozen-lockfile --linker=hoisted --network-concurrency 8

scripts/helpers/retry.js

@@ -17,7 +17,6 @@ const latests = require('../packages/dd-trace/test/plugins/versions/package.json
 const { isRelativeRequire } = require('../packages/datadog-instrumentations/src/helpers/shared-utils')
 const exec = require('./helpers/exec')
 const mapWithConcurrency = require('./helpers/concurrency')
-const retry = require('./helpers/retry')
 const requirePackageJsonPath = require.resolve('../packages/dd-trace/src/require-package-json')
 const requirePackageJson = require(requirePackageJsonPath)
 
@@ -547,13 +546,6 @@ async function assertWorkspaces () {
   }, null, 2) + '\n')
 }
 
-/**
- * Install the generated versions/ workspaces.
- *
- * Some workspaces download large prebuilt binaries at postinstall time (e.g. Electron pulls one archive per major
- * from GitHub's release CDN), which intermittently fail with 5xx gateway errors. Retry with backoff so a brief CDN
- * outage doesn't fail the whole job.
- */
 function install () {
   try {
     // versions/bunfig.toml pins `linker = "isolated"`, which gives every sandbox
@@ -565,14 +557,10 @@ function install () {
     // (moleculer's runtime `require('bluebird')` fallback, etc.) are wired
     // through `externals.js` `dep: true, forced: true` so they land as a direct
     // dep of the consuming sandbox rather than as a sibling workspace.
-    retry(() => exec('bun install --trust', { cwd: folder() }), {
-      onRetry: (error, attempt, delayMs) => process.stderr.write(
-        `bun install attempt ${attempt} failed, retrying in ${delayMs / 1000}s: ${error.message}\n`
-      ),
-    })
+    exec('bun install --trust', { cwd: folder() })
   } catch (error) {
-    // A failure that outlasts the retries is most often an unresolvable version: a declared range spans a major
-    // version that was never published. Point at the fix instead of leaving a bare bun error.
+    // A failure is most often an unresolvable version: a declared range spans a major version that was never
+    // published. Point at the fix instead of leaving a bare bun error.
     throw new Error(
       'bun failed to install the generated versions/ workspaces. If a plugin declares a version range that spans a ' +
       'major version that was never published (non-consecutive majors), add that package to ' +

scripts/helpers/retry.spec.js

@@ -109,6 +109,21 @@ describe('scripts/install_plugin_modules.js', function () {
     assert.match(result.stderr, /Original error:/)
   })
 
+  it('does not retry a failed install against partial state', () => {
+    const traceFile = path.join(wrapperDirectory, 'failed-install-trace.ndjson')
+    const failureMarker = path.join(wrapperDirectory, 'failed-install')
+    const result = spawnInstall('not-a-plugin', {
+      DD_TEST_FAIL_BUN_INSTALL_ONCE_FILE: failureMarker,
+      DD_TEST_PACKAGE_MANAGER_TRACE_FILE: traceFile,
+    })
+
+    assert.strictEqual(result.status, 1)
+    assert.deepStrictEqual(
+      fs.readFileSync(traceFile, 'utf8').trim().split('\n').map(JSON.parse),
+      [['bun', 'install', '--trust']]
+    )
+  })
+
   it('rejects conflicting declarative overrides', () => {
     const preload = path.join(wrapperDirectory, 'conflicting-overrides.js')
     fs.writeFileSync(preload, `
@@ -331,13 +346,19 @@ function createPackageManagerWrappers () {
 'use strict'
 
 const { spawnSync } = require('node:child_process')
-const { appendFileSync } = require('node:fs')
+const { appendFileSync, existsSync, writeFileSync } = require('node:fs')
 
 const args = process.argv.slice(2)
 if (process.env.DD_TEST_PACKAGE_MANAGER_TRACE_FILE) {
   appendFileSync(process.env.DD_TEST_PACKAGE_MANAGER_TRACE_FILE, JSON.stringify(['bun', ...args]) + '\n')
 }
 if (process.env.DD_TEST_FAIL_BUN_INSTALL === 'true' && args[0] === 'install') process.exit(1)
+if (process.env.DD_TEST_FAIL_BUN_INSTALL_ONCE_FILE &&
+    args[0] === 'install' &&
+    !existsSync(process.env.DD_TEST_FAIL_BUN_INSTALL_ONCE_FILE)) {
+  writeFileSync(process.env.DD_TEST_FAIL_BUN_INSTALL_ONCE_FILE, '')
+  process.exit(1)
+}
 const result = spawnSync(${JSON.stringify(bunBinary)}, args, { stdio: 'inherit' })
 if (result.error) throw result.error
 process.exit(result.status ?? 1)