Confirmed across at least 8 unrelated PRs this session (#2988, #2989,
#2991, #2994, #2995, #2996, #2997, and this one): npm ci intermittently
fails during sharp's postinstall with "socket hang up" fetching a
prebuilt libvips binary from GitHub Releases. It's a direct HTTPS
download outside npm's own package cache, so actions/setup-node's
npm cache doesn't help — every occurrence required a manual
`gh run rerun --failed`.
Add a local composite action (.github/actions/npm-ci-retry) that
retries npm ci up to 3 times with a 15s backoff, and switch every
plain `npm ci --legacy-peer-deps` / `npm ci --no-audit --no-fund
--legacy-peer-deps` call site (15 of them, across ci.yml,
integration-tests.yml, verification-pipeline.yml, v3-ci.yml) to use it.
Left untouched: the three rollback-manager.yml invocations (separate,
low-traffic rollback-validation path) and the two existing
Linux/non-Linux --omit=optional fallback blocks in ci.yml and
verification-pipeline.yml, which already have their own resilience
logic for a different failure mode (optional native deps on
macOS/Windows) — not this flake.
Same fix as verification-pipeline.yml — js-yaml 4.x rejects multi-line
flow-style sequences as \"deficient indentation\" because the closing
bracket lines up with the opening key. Converted to plain block style.
Verified: \`node scripts/smoke-workflows-yaml.mjs\` reports
\`ok integration-tests.yml (6 jobs)\`.
Co-Authored-By: RuFlo <ruv@ruv.net>
TypeScript 5.9.2 conflicts with typescript-eslint@8.38.0 which requires <5.9.0.
Using --legacy-peer-deps allows npm to proceed with the installation despite
the peer dependency conflict.
This fixes npm ci failures in all workflows.
rUv