ci: retry yarn install on transient registry errors

[chirag-madlani]

Describe your changes:

CI-only change, no linked issue (skip-pr-checks). Fixes the RDF Playwright failure in run 38749383300 attempt 1, where registry.yarnpkg.com returned 502 Bad Gateway for one tarball and yarn v1 aborted the install.

yarn v1 does not retry HTTP 5xx on tarball fetches. playwright-e2e-reusable.yml already wraps its installs in a 3-attempt retry loop (15s/30s backoff, --network-timeout 100000); this PR applies the same loop to every other yarn install whose failure fails the job — keeping each step's existing flags:

• playwright-knowledge-graph-postgresql-e2e.yml, playwright-search-nightly.yml, playwright-sso-login-nightly.yml, playwright-visual.yml
• release-branch-validate.yml, security-scan.yml, update-playwright-e2e-docs.yml, ui-sonarcloud-nightly.yml, yarn-coverage.yml
• typescript-type-generation.yml (root + UI installs)
• playwright-e2e-reusable.yml — the dockerized core-components install in the plan job

Left as-is: the report-deps install in playwright-postgresql-e2e.yml (continue-on-error, can't fail the job) and the Maven frontend-maven-plugin installs (pom change, out of scope).

Type of change:

• Improvement

High-level design:

N/A — same retry block copied into each workflow step; no behaviour change on success.

Tests:

Use cases covered

• A transient registry 5xx during yarn install retries up to 3 times instead of failing the job.

Unit tests

Not applicable — workflow-only change.

Backend integration tests

• Not applicable (no backend API changes).

Ingestion integration tests

• Not applicable (no ingestion changes).

Playwright (UI) tests

• Not applicable (no UI changes).

Manual testing performed

1. All 11 edited workflows parse with yaml.safe_load.
2. actionlint on the edited files reports nothing on the changed steps (only pre-existing shellcheck notes elsewhere).

UI screen recording:

Not applicable — CI workflow change.

Checklist:

• I have read the CONTRIBUTING document.
• My PR title is Fixes <issue-number>: <short explanation> — N/A, CI fix with skip-pr-checks.
• My PR is linked to a GitHub issue via Fixes #<issue-number> above. — N/A, CI fix with skip-pr-checks.
• I have commented on my code, particularly in hard-to-understand areas.
• For JSON Schema changes: N/A.
• For a UI feature or feature task: N/A.
• I have added tests — N/A, workflow-only change.
• Decision check: adds ADR:2026-10-16-ci-yarn-installs-retry-transient-registry-errors (retry budget is a judgment-call value).

🤖 Generated with Claude Code

Confidence Score: 5/5

The PR appears safe to merge.

Summary

Adds bounded retries to dependency installs across 11 CI workflows.

• CI jobs retry Yarn installs before giving up.

_{Reviews (4) · Last reviewed commit: "Merge remote-tracking branch 'origin/mai..." · Reviewed by Greptile}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

✅ SSO Login Nightly — PASSED

View workflow run · Commit 6ce4219

Provider	Status	Pass	Fail	Flaky	Skip	Duration
basic	✅ pass	28	0	0	0	6m 10s
ldap	✅ pass	7	0	0	0	1m 02s
keycloak-oidc-confidential	✅ pass	12	0	0	0	1m 27s
keycloak-oidc-public	✅ pass	11	0	0	0	1m 33s
msal-mock	✅ pass	7	0	0	0	0m 49s
auth0-mock	✅ pass	6	0	0	0	0m 51s
okta	✅ pass	24	0	0	0	5m 57s
keycloak-azure-saml	✅ pass	23	0	0	0	5m 37s
keycloak-azure-saml-crosssite	⏩ skipped	-	-	-	-	-

Totals: 118 passed · 0 failed · 0 flaky · 0 skipped · duration 23m 29s

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[gitar-bot]

Code Review ✅ Approved 1 closed / 1 findings

🟡 Medium risk · Adding three-attempt Yarn install retries across 11 CI workflows could prolong job failures and consume runner time during persistent registry outages.

Adds a 3-attempt retry loop with backoff to every yarn install step whose failure fails the job, across the Playwright, nightly, security-scan, and type-generation workflows, to tolerate transient registry 5xx errors. The previously open finding about the undocumented retry budget and network timeout is resolved by the new decision record docs/decisions/2026-10-16-ci-yarn-installs-retry-transient-registry-errors.md, and the loop is kept inline rather than in a shared action so PR-head code is not executed. No open issues found.

✅ 1 closed

✅ Quality: CI-wide yarn retry budget and network timeout are unrecorded

📄 .github/workflows/playwright-e2e-reusable.yml:722-736 📄 .github/workflows/typescript-type-generation.yml 📄 .github/workflows/security-scan.yml 📄 .github/workflows/yarn-coverage.yml 📄 .github/workflows/ui-sonarcloud-nightly.yml 📄 .github/workflows/release-branch-validate.yml 📄 .github/workflows/update-playwright-e2e-docs.yml 📄 .github/workflows/playwright-visual.yml 📄 .github/workflows/playwright-search-nightly.yml 📄 .github/workflows/playwright-sso-login-nightly.yml 📄 .github/workflows/playwright-knowledge-graph-postgresql-e2e.yml
This PR takes a retry budget that was a judgment call (3 attempts, 15s then 30s backoff, --network-timeout 100000) and makes it the rule for CI. The description says it "applies the same loop to every other yarn install whose failure fails the job", and for 10 workflows it also replaces yarn's default 30s network timeout with 100s. Nothing in docs/decisions/ records this. The loop that was copied in playwright-e2e-reusable.yml has no record either, so this change doesn't fall under an existing one. The record would state: "Every CI yarn v1 install whose failure fails the job runs in a 3-attempt retry loop with 15s/30s linear backoff and --network-timeout 100000. Installs marked continue-on-error and Maven frontend-plugin installs are exempt." One option is a small record in docs/decisions/ that states this rule. Another is a single shared composite action or script that holds the values, so the next workflow picks up the policy instead of copying the block by hand.

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}