ci(release): verify bitgo tarball installs on node 20 and node 24

pranavjain97 · pranavjain97 · commit 4a85ca625f7a · 2026-08-11T13:57:51.000-04:00
Adds a post-publish verify-consumer-install job that runs a real `npm install bitgo@<newVersion>` in an isolated tempdir with engine-strict=true on a [20.x, 24.x] node matrix. Catches shrinkwrap engine regressions before they hit customers — the sanitize-html@2.17.6 lockout would have failed here instead of blocking a release train. Retries only on E404/ETARGET registry propagation lag. EBADENGINE and other install failures fail immediately. TICKET: WCN-2091
diff --git a/.github/workflows/npmjs-release.yml b/.github/workflows/npmjs-release.yml
@@ -403,6 +403,71 @@ jobs:
           echo "::error::All retry attempts exhausted creating GitHub release v${{ steps.extract-version.outputs.new-version }}. NPM publish succeeded; manual GitHub release required."
           exit 1
 
+  # WCN-2091: verify the published bitgo tarball actually installs on the minimum
+  # supported Node version with engine-strict. The generated shrinkwrap freezes
+  # whatever transitive versions npm resolved on the release runner (Node 24),
+  # and if any of those pin `engines.node >=22` the release breaks Node 20
+  # consumers post-publish. Matrix so we catch both a min-version regression
+  # (20.x) and a self-consistency check on our nvmrc (24.x).
+  verify-consumer-install:
+    name: Verify consumer install (Node ${{ matrix.node-version }})
+    if: ${{ always() && inputs.dry-run == false && needs.release-bitgojs.result == 'success' }}
+    needs:
+      - release-bitgojs
+    runs-on: ${{ vars.BASE_RUNNER_TYPE || 'ubuntu-latest' }}
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version: ['20.x', '24.x']
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          ref: rel/latest
+          fetch-depth: 1
+
+      - name: Setup Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v6
+        with:
+          node-version: ${{ matrix.node-version }}
+
+      - name: Simulate standalone consumer install with engine-strict
+        run: |
+          version=$(jq -r '.version' modules/bitgo/package.json)
+          bitgo_name=$(jq -r '.name' modules/bitgo/package.json)
+
+          workdir="$(mktemp -d)"
+          cd "$workdir"
+
+          echo "engine-strict=true" > .npmrc
+          cat > package.json <<EOF
+          { "name": "consumer-smoke", "version": "1.0.0", "private": true,
+            "dependencies": { "$bitgo_name": "$version" } }
+          EOF
+
+          echo "Running: npm install $bitgo_name@$version on $(node --version) with engine-strict=true"
+
+          # Registry propagation can lag right after publish. Retry a few times
+          # on E404/ETARGET only; any EBADENGINE or other failure fails immediately.
+          for attempt in 1 2 3 4 5; do
+            if npm install --no-audit --no-fund 2>install.log; then
+              echo "✅ npm install $bitgo_name@$version succeeded on $(node --version)."
+              exit 0
+            fi
+            if grep -qE 'E404|ETARGET' install.log; then
+              echo "Registry propagation lag (attempt $attempt/5) — retrying in 10s."
+              sleep 10
+              continue
+            fi
+            echo "::error::npm install $bitgo_name@$version failed on $(node --version) with engine-strict=true."
+            cat install.log
+            exit 1
+          done
+          echo "::error::npm install $bitgo_name@$version could not resolve after 5 attempts."
+          cat install.log
+          exit 1
+
   get-express-release-context:
     name: Get Express release context
     if: ${{ always() && inputs.dry-run == false && needs.release-bitgojs.result == 'success' }}
