Retry bun install in CI

.github/scripts/bun-install.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# Installs the current directory's dependencies from its lockfile. Retries
+# twice, because bun sometimes fails to extract a large tarball on CI
+# runners ("Fail extracting tarball for next"). The lockfile is frozen, so a
+# retry can only ever produce the same install.
+set -euo pipefail
+
+for attempt in 1 2 3; do
+  if bun install --frozen-lockfile; then
+    exit 0
+  fi
+  if ((attempt < 3)); then
+    echo "::warning::bun install failed in $(pwd) (attempt $attempt of 3); retrying"
+    sleep $((attempt * 5))
+  fi
+done
+echo "::error::bun install failed in $(pwd) after 3 attempts"
+exit 1

.github/workflows/app.yaml

@@ -24,7 +24,7 @@ jobs:
 
       - name: 📥 Download deps
         working-directory: app
-        run: bun install
+        run: bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
 
       - name: 💄 Format check
         working-directory: app

.github/workflows/brand.yaml

@@ -9,13 +9,15 @@ on:
       - "package.json"
       - "bun.lock"
       - ".github/workflows/brand.yaml"
+      - ".github/scripts/bun-install.sh"
   pull_request:
     paths:
       - "brand/**"
       - "app/public/brand/**"
       - "package.json"
       - "bun.lock"
       - ".github/workflows/brand.yaml"
+      - ".github/scripts/bun-install.sh"
 
 permissions:
   contents: read
@@ -41,7 +43,7 @@ jobs:
           bun-version: 1.3.14
 
       - name: 📥 Download deps
-        run: bun install --frozen-lockfile
+        run: bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
 
       - name: 💄 Format check
         working-directory: brand

.github/workflows/cli-release.yaml

@@ -32,7 +32,7 @@ jobs:
                   fi
 
             - name: 📥 Download deps
-              run: bun install --frozen-lockfile
+              run: bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
               working-directory: atw-cli
 
             - name: 🔨 Compiling the different versions

.github/workflows/cli.yaml

@@ -9,6 +9,7 @@ on:
       - "app/package.json"
       - "app/bun.lock"
       - ".github/workflows/cli.yaml"
+      - ".github/scripts/bun-install.sh"
   pull_request:
     types: [opened, synchronize, reopened]
     paths:
@@ -17,6 +18,7 @@ on:
       - "app/package.json"
       - "app/bun.lock"
       - ".github/workflows/cli.yaml"
+      - ".github/scripts/bun-install.sh"
 
 permissions:
   contents: read
@@ -39,11 +41,11 @@ jobs:
       # The contract test compares the CLI's schemas with the app's.
       - name: 📥 Download app deps
         working-directory: app
-        run: bun install --frozen-lockfile
+        run: bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
 
       - name: 📥 Download CLI deps
         working-directory: atw-cli
-        run: bun install --frozen-lockfile
+        run: bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
 
       - name: 💄 Format check
         working-directory: atw-cli

.github/workflows/core.yaml

@@ -12,6 +12,7 @@ on:
       - "app/package.json"
       - "app/bun.lock"
       - ".github/workflows/core.yaml"
+      - ".github/scripts/bun-install.sh"
   pull_request:
     types: [opened, synchronize, reopened]
     paths:
@@ -23,6 +24,7 @@ on:
       - "app/package.json"
       - "app/bun.lock"
       - ".github/workflows/core.yaml"
+      - ".github/scripts/bun-install.sh"
 
 permissions:
   contents: read
@@ -65,13 +67,13 @@ jobs:
       # migrations.
       - name: 📥 Download app deps
         working-directory: app
-        run: bun install --frozen-lockfile
+        run: bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
 
       # core is a member of the root workspace (with web), so this installs
       # from the root lockfile.
       - name: 📥 Download core deps
         working-directory: core
-        run: bun install --frozen-lockfile
+        run: bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
 
       - name: 💄 Format check
         working-directory: core

.github/workflows/deploy.yaml

@@ -43,8 +43,8 @@ jobs:
 
       - name: 📥 Download deps
         run: |
-          bun install --frozen-lockfile
-          (cd infra && bun install --frozen-lockfile)
+          bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
+          (cd infra && bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh")
 
       - name: 🧱 Build web
         working-directory: web
@@ -83,8 +83,8 @@ jobs:
 
       - name: 📥 Download deps
         run: |
-          bun install --frozen-lockfile
-          (cd infra && bun install --frozen-lockfile)
+          bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
+          (cd infra && bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh")
 
       - name: 🧹 Destroy
         working-directory: infra

.github/workflows/infra-ci.yaml

@@ -7,12 +7,14 @@ on:
       - "infra/**"
       - "web/src/compatibility.ts"
       - ".github/workflows/infra-ci.yaml"
+      - ".github/scripts/bun-install.sh"
   pull_request:
     types: [opened, synchronize, reopened]
     paths:
       - "infra/**"
       - "web/src/compatibility.ts"
       - ".github/workflows/infra-ci.yaml"
+      - ".github/scripts/bun-install.sh"
 
 permissions:
   contents: read
@@ -34,7 +36,7 @@ jobs:
 
       - name: 📥 Download deps
         working-directory: infra
-        run: bun install --frozen-lockfile
+        run: bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
 
       - name: 💄 Format check
         working-directory: infra

.github/workflows/lint.yaml

@@ -30,25 +30,25 @@ jobs:
 
       # oxlint and the root workspace (brand, core, web, tools/xss-scan).
       - name: 📥 Download root deps
-        run: bun install --frozen-lockfile
+        run: bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
 
       # Type-aware rules and import checks read every package's types, so
       # each package with its own lockfile gets its dependencies too.
       - name: 📥 Download app deps
         working-directory: app
-        run: bun install --frozen-lockfile
+        run: bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
 
       - name: 📥 Download CLI deps
         working-directory: atw-cli
-        run: bun install --frozen-lockfile
+        run: bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
 
       - name: 📥 Download infra deps
         working-directory: infra
-        run: bun install --frozen-lockfile
+        run: bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
 
       - name: 📥 Download pr-header deps
         working-directory: tools/pr-header
-        run: bun install --frozen-lockfile
+        run: bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
 
       # web/src imports the manifest its build writes to web/dist.
       - name: 🏗️ Build web

.github/workflows/pr-header-ci.yaml

@@ -32,7 +32,7 @@ jobs:
 
       - name: 📥 Download deps
         working-directory: tools/pr-header
-        run: bun install --frozen-lockfile
+        run: bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
 
       - name: 💄 Format check
         working-directory: tools/pr-header

.github/workflows/web.yaml

@@ -16,6 +16,7 @@ on:
       - "app/package.json"
       - "app/bun.lock"
       - ".github/workflows/web.yaml"
+      - ".github/scripts/bun-install.sh"
   pull_request:
     types: [opened, synchronize, reopened]
     paths:
@@ -31,6 +32,7 @@ on:
       - "app/package.json"
       - "app/bun.lock"
       - ".github/workflows/web.yaml"
+      - ".github/scripts/bun-install.sh"
 
 permissions:
   contents: read
@@ -71,10 +73,10 @@ jobs:
       # Worker.
       - name: 📥 Download app deps
         working-directory: app
-        run: bun install --frozen-lockfile
+        run: bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
 
       - name: 📥 Download web and core deps
-        run: bun install --frozen-lockfile
+        run: bash "$GITHUB_WORKSPACE/.github/scripts/bun-install.sh"
 
       - name: 💄 Format check
         working-directory: web