ci(root): use bash retry loop for shrinkwrap verify step

[zahin-mohammad]

Summary

• The Verify bitgo package has shrinkwrap metadata step in npmjs-release.yml calls the retry binary, whose Install retry step was removed in 1c04950 (VL-7134) on the assumption it was only used by improved-yarn-audit. It missed that the shrinkwrap-verify step (added in 23ec271) also depends on it.
• Under bash -e, retry exits 127 (command not found), so ! retry ... is true and the step false-fails with a misleading "missing _hasShrinkwrap metadata" message. The 2026-07-22 release (bitgo@52.3.0) went red here even though the package published correctly (_hasShrinkwrap: true on the registry).
• Replace the retry wrapper with a plain bash loop, matching the adjacent Create GitHub release step, so the check no longer depends on a third-party binary in the post-publish window.

Evidence

Runner log (run 29952850612, job "Release BitGoJS"):

line 4: retry: command not found                                        <- real failure
##[error]Published bitgo@52.3.0 is missing _hasShrinkwrap metadata...   <- misleading

curl -sL https://registry.npmjs.org/bitgo/52.3.0 | jq '._hasShrinkwrap'  # -> true

Test plan

• Release workflow verify step passes on a real publish
• Step still fails correctly when _hasShrinkwrap is genuinely absent

Ticket: WCN-1584

🤖 Generated with Claude Code

[linear-code]

WCN-1584

[zahin-mohammad]

@claude

[github-actions]

Claude finished @zahin-mohammad's task —— View job

---

Code Review for PR #9334

Analyzing the CI workflow changes to fix the shrinkwrap verification step.

Todo List:

• Read and analyze the workflow file changes
• Review the bash loop implementation
• Check solution correctness and consistency
• Provide comprehensive review feedback

Review Summary ✅

Problem Analysis: This PR correctly identifies and fixes a legitimate CI issue where the retry binary dependency was removed in VL-7134 but still used in the shrinkwrap verification step, causing false failures during releases.

Changes Review

File: .github/workflows/npmjs-release.yml (lines 339-354)

✅ Strengths:

1. Root cause fix: Correctly addresses the missing retry binary dependency by replacing it with native bash
2. Consistent pattern: The new bash retry loop matches the exact pattern used in the "Create GitHub release" step (lines 380-395), promoting consistency across the workflow
3. Proper error handling: Maintains the same retry logic (5 attempts, 5s intervals) and preserves the original error message
4. Exit behavior: Correctly exits with 0 on success and 1 on failure, maintaining proper shell semantics
5. Variable scoping: Proper use of local variables within the loop scope

✅ Implementation Quality:

• Retry logic: The for attempt in 1 2 3 4 5 loop with [ "$attempt" -lt 5 ] && sleep 5 correctly implements 5 attempts with delays between failures
• Early exit: exit 0 when _hasShrinkwrap is true provides proper short-circuit behavior
• Final failure: The loop completion with error message and exit 1 maintains the original failure semantics
• String comparison: The [ "$has_shrinkwrap" = 'true' ] comparison is robust and handles the JSON boolean correctly

✅ Consistency Check:
The implementation exactly mirrors the retry pattern in the "Create GitHub release" step, which is a good practice for workflow maintainability.

Minor Observations

• The retry intervals (5 seconds) and attempt count (5) remain unchanged, which is appropriate for registry metadata propagation
• Variable naming (attempt, has_shrinkwrap) is clear and follows shell conventions
• The curl command and jq parsing remain unchanged, preserving the original data fetching logic

Verification

The change should resolve the false failure described in the issue:

• Before: retry: command not found → misleading "_hasShrinkwrap metadata" error
• After: Native bash loop → accurate success/failure reporting

Recommendation: ✅ APPROVE

This is a well-implemented fix that:

1. Solves the immediate CI failure problem
2. Removes an unnecessary external dependency
3. Follows existing workflow patterns
4. Maintains all original functionality and error handling

The implementation is clean, follows best practices, and should reliably fix the release pipeline issue.

---

Job Run | Branch: WCN-1584-fix-release-shrinkwrap-verify