ci: track root causes and restore CI on latest and release/v11 #10027

Purpose

This is the umbrella tracking issue for restoring CI and post-release integration on npm/cli's latest and release/v11 branches. It owns the overall failure inventory, coordinates fixes across npm/cli and upstream fixtures/actions, and tracks verification on both branches.

Track issues by root cause, not by error message, job, runtime, or branch. A child issue can contain multiple failures. Where the initiating cause is not yet established, retain an explicitly scoped investigation rather than presenting an infrastructure hypothesis as fact.

Investigated scope

The inventory below covers all 14 failed jobs in the four completed September 22, 2026 branch-head CI and Release runs:

This is a complete inventory for those runs, not a claim that every historical failure has the same causes. The failed Release workflow status must not be equated with failed package publication: these failures occur in downstream integration.

Root-cause and incident owners

• ci: Node.js nightly integration fails while extracting source archive #10016
• ci: binary-split CITGM source download uses stale repository owner #10020
• ci: release integration selects Node 23 outside npm 12 supported engines #10024
• ci: CITGM Git-dependency fixtures lack npm 12 policy configuration #10026
• ci: CITGM relies on native-build option forwarding rejected by npm 12 #10023
• ci: live-registry smoke test fails on a socket reset with fetch retries disabled #10022
• ci: Cygwin provisioning fails before Windows shim tests run #10025

Complete failed-job inventory

Grouping decisions and important qualifications

The Node 23 warning assertion, npm smoke stderr mismatch, EBADENGINE, subsequent unsatisfied registry mocks, and engine-dependent coverage failure belong under #10024. They should not produce separate tickets per assertion.

The two CITGM policy/configuration failures require different fixes. Allowing Git dependencies does not make --build-from-source a recognized npm CLI flag, and removing that flag does not permit Git dependencies. Both failures occur on supported Node 22, independently of #10024.

#10023 preserves the history from mapbox/node-pre-gyp#58: npm install --build-from-source was a documented and functional way to forward a native installer's configuration through npm. node-pre-gyp still implements source builds; npm 12 now rejects the unknown npm CLI flag before that installer can use it. The migration must verify the actual fixture's installer and preserve any intended source-build coverage, not simply remove the option and assume success.

#10016 and #10020 share the diagnostic weakness of streaming curl -sSL output into tar, but their upstream conditions are distinct. Better HTTP handling does not repair stale repository metadata or guarantee an archive exists. Both nightly jobs selected the same archive, but their logs do not preserve the HTTP response status/body, so a publication race is not a proven fact.

The socket reset in #10022 and the Cygwin setup failure in #10025 are separately owned investigations, not evidence of one shared outage. In particular, the Cygwin downgrade conflict and subsequent installer exit are both observed, but a causal relationship has not been established.

Cross-cutting follow-up owned by this tracker

• Preserve HTTP status and useful failure diagnostics for source downloads without feeding non-success responses directly into extraction.
• Correct FINALEXIT=STEPEXIT in the npm integration result aggregation and its template. It currently assigns a literal string and later emits exit: STEPEXIT: numeric argument required. This masks the intended exit status after earlier test failures; it is not another primary cause of the 14 failed jobs.
• Ensure upstream CITGM fixes reach the published version used by matrix generation. A change merged upstream but not consumed by npm/cli does not close the coverage gap.
• Apply branch-appropriate workflow/template changes to both release lines and document local equivalents for any new diagnostic or validation commands.
• Attach post-fix run evidence for both branches and confirm the affected tests actually execute rather than being skipped, suppressed, or bypassed.

Completion criteria

Close this tracker only when every child issue is resolved or has an explicitly justified disposition, the affected coverage is restored on both branches, and any remaining infrastructure uncertainty is documented with an owner and evidence. A rerun that happens to pass is not by itself proof of root cause, and making one error disappear is not proof that the rest of an integration job succeeded.

npm 12.2.0 follow-up inventory

The npm 12.2.0 Release workflow at c276cadf785c1018d82dd287fe7742567055efb9 reproduced the existing Node 23, JSONStream, binary-split, and thread-sleep failures and exposed two additional root causes:

• ci: nightly npm smoke test rejects expected engine warning #10064
• ci: nightly native CITGM fixtures ignore configured Node headers #10065

Workflow: https://github.com/npm/cli/actions/runs/36746332014

The ordinary branch CI workflow passed: https://github.com/npm/cli/actions/runs/36746330757

npm 12.2.0 failed-job additions

The release/v11 branch CI for npm 11.21.0 also passed. Its separate release-please failure occurred before downstream integration and is tracked in #10066.

npm 11.21.0 release automation failure

• release: GitHub 502 leaves npm 11.21.0 release records incomplete #10066

The npm 11.21.0 Release workflow failed in template-oss-release-please before downstream release integration could run:

Workflow: https://github.com/npm/cli/actions/runs/36756679730

Failing job: https://github.com/npm/cli/actions/runs/36756679730/job/110028585934

The corresponding branch CI workflow passed: https://github.com/npm/cli/actions/runs/36756678607

Both changed packages were published to the npm registry, but their GitHub release records remain incomplete:

The confirmed fatal error was an unhandled GitHub HTTP 502 Bad Gateway response during the release-please step. The 11-of-13 component discovery message and the parser warning for the old non-Conventional Commit Fix typos in some files were not fatal.

The first remediation is to rerun the complete failed workflow so skipped dependent jobs are reevaluated. A successful rerun should create both tags and GitHub Releases and then execute Release Integration. If the 502 recurs, capture the request endpoint class, response status, and retry behavior before manually creating release records.

Upstream CITGM changes

Four npm/cli integration failures have corresponding changes in nodejs/citgm:

The merged binary-split and leveldown changes are included in the pending CITGM 10.0.4 release pull request, nodejs/citgm#1147. None of these changes should be treated as consumed by npm/cli until a CITGM release containing them is published, the npm/cli matrix resolves that version, and the affected package tests execute successfully.