fix: hold bitgo back via committed private + --include-private

.github/actions/verify-npm-packages/index.js

@@ -16,7 +16,8 @@ async function getPublicPackages() {
     if (!fs.existsSync(pkgPath)) continue;
 
     const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
-    if (pkg.private) continue;
+    // bitgo is private but still published via lerna --include-private.
+    if (pkg.private && entry.name !== "bitgo") continue;
 
     packages.push({ name: pkg.name, dir: entry.name });
   }

.github/workflows/npmjs-release.yml

@@ -304,44 +304,19 @@ jobs:
         run: |
           yarn lerna version --sign-git-tag --sign-git-commit --include-merged-tags --conventional-commits --conventional-graduate --yes
 
-      # Two-phase publish (WCN-1818): bitgo's `prepack` script resolves its
-      # siblings from the registry, but a single combined `lerna publish` packs
-      # every package's lifecycle hooks before uploading any of them — so bitgo
-      # would try to resolve siblings that aren't live yet (this is what broke
-      # `npm install bitgo` for every consumer, WCI-1200). Hold bitgo back
-      # (private), publish siblings first, then restore and publish bitgo alone
-      # once its siblings are actually resolvable. Runs identically for the
-      # normal path (after the version bump above) and the recovery path (no
-      # preceding bump) — `from-package` only publishes what's missing from npm
-      # either way, so re-running is idempotent.
-      - name: Hold back bitgo umbrella for the siblings publish pass
-        if: inputs.dry-run == false
-        run: npx tsx ./scripts/set-umbrella-publishable.ts false
-
       - name: Publish siblings (pass 1)
         if: inputs.dry-run == false
-        run: |
-          # `from-package` reads each package.json's `version`, queries npm,
-          # and publishes only versions missing from the registry.
-          yarn lerna publish from-package --yes
+        run: yarn lerna publish from-package --yes
         env:
           NPM_CONFIG_PROVENANCE: true
 
-      - name: Restore bitgo umbrella for its own publish pass
-        if: ${{ always() && inputs.dry-run == false }}
-        run: npx tsx ./scripts/set-umbrella-publishable.ts true
-
       - name: Publish bitgo (pass 2)
         if: inputs.dry-run == false
         run: |
-          yarn lerna publish from-package --yes
+          bitgo_name=$(jq -r '.name' modules/bitgo/package.json)
+          yarn lerna publish from-package --include-private "$bitgo_name" --yes
         env:
           NPM_CONFIG_PROVENANCE: true
-          # Tells bitgo's `prepack` script (scripts/generate-bitgo-shrinkwrap.ts) to
-          # actually generate npm-shrinkwrap.json — kept opt-in so a plain local
-          # `npm pack` doesn't force a network install of the full dependency tree.
-          # Siblings published in the pass above are live on the registry by now,
-          # so resolution succeeds.
           BITGO_GENERATE_SHRINKWRAP: true
 
       - name: Verify recovery published the missing versions
@@ -353,7 +328,7 @@ jobs:
           # (e.g., another transient registry error).
           missing=()
           for f in modules/*/package.json; do
-            if [ "$(jq -r '.private // false' "$f")" = "true" ]; then continue; fi
+            if [ "$(jq -r '.private // false' "$f")" = "true" ] && [ "$f" != "modules/bitgo/package.json" ]; then continue; fi
             name=$(jq -r '.name' "$f")
             version=$(jq -r '.version' "$f")
             code=$(curl -sL -o /dev/null -w "%{http_code}" -- "https://registry.npmjs.org/${name}/${version}")

.github/workflows/publish.yml

@@ -100,15 +100,6 @@ jobs:
       - name: Commit Local Changes
         run: git commit -am "Auto updated ${{ env.preid }} branch" --no-verify || echo "No changes to commit"
 
-      # Two-phase publish (WCN-1818): bitgo's `prepack` script resolves its siblings
-      # from the registry, but a single combined `lerna publish` packs every
-      # package's lifecycle hooks before uploading any of them — so bitgo would
-      # try to resolve siblings that aren't live yet. Hold bitgo back (private),
-      # publish siblings first, then restore and publish bitgo alone once its
-      # siblings are actually resolvable.
-      - name: Hold back bitgo umbrella for the siblings publish pass
-        run: npx tsx ./scripts/set-umbrella-publishable.ts false
-
       - name: Lerna Publish (siblings)
         # In recovery mode a stuck package's Rekor conflict fails this step outright; let it
         # continue so Verify Publish below still gets a chance to bump+retry that package.
@@ -117,18 +108,11 @@ jobs:
         env:
           NPM_CONFIG_PROVENANCE: true
 
-      - name: Restore bitgo umbrella for its own publish pass
-        if: always()
-        run: npx tsx ./scripts/set-umbrella-publishable.ts true
-
       - name: Lerna Publish (bitgo)
-        # Siblings published above are now live on the registry, so bitgo's
-        # `prepack` script (scripts/generate-bitgo-shrinkwrap.ts) can resolve them
-        # for real. BITGO_GENERATE_SHRINKWRAP is set here (unlike historically on
-        # this workflow) so alpha/beta actually exercises shrinkwrap generation
-        # instead of silently no-oping on it.
         continue-on-error: ${{ inputs.recovery-mode }}
-        run: yarn lerna publish from-package --preid ${{ env.preid }} --dist-tag ${{ env.preid }} --force-publish --yes --loglevel silly
+        run: |
+          bitgo_name=$(jq -r '.name' modules/bitgo/package.json)
+          yarn lerna publish from-package --include-private "$bitgo_name" --preid ${{ env.preid }} --dist-tag ${{ env.preid }} --force-publish --yes --loglevel silly
         env:
           NPM_CONFIG_PROVENANCE: true
           BITGO_GENERATE_SHRINKWRAP: true

modules/bitgo/package.json

@@ -2,6 +2,7 @@
   "name": "bitgo",
   "version": "52.4.1",
   "description": "BitGo JavaScript SDK",
+  "private": true,
   "main": "./dist/src/index.js",
   "types": "./dist/types/src/index.d.ts",
   "keywords": [

scripts/generate-bitgo-shrinkwrap.ts

@@ -25,8 +25,9 @@
  * package's lifecycle hooks (bitgo's `prepack` included) before uploading any of
  * them, so bitgo's siblings are not yet published at the point this script tries to
  * resolve them. The release workflow is responsible for publishing siblings in a
- * separate, earlier pass (with bitgo held back via `set-umbrella-publishable.ts`)
- * before invoking a second pass that packs bitgo with generation enabled. If a
+ * separate, earlier pass — bitgo is committed `private`, so `lerna publish
+ * from-package` filters it out of that pass — before invoking a second pass that
+ * re-includes bitgo (`--include-private`) and packs it with generation enabled. If a
  * sibling version genuinely isn't resolvable (wrong pass ordering, a sibling publish
  * that itself failed, etc.), the `npm install` below fails loudly and the release
  * fails — which is correct: better a failed release than a silently broken

scripts/update-dockerfile.ts

@@ -30,7 +30,8 @@ const walkDependencies = (
     .filter((dep) => graph[dep])
     .map((name) => managedModules.find((mod) => mod.name === name));
   managedDeps.forEach((module) => {
-    if (module && !module.private && !setDeps.has(module)) {
+    // bitgo is private but still shipped in the express image, so keep walking it.
+    if (module && (!module.private || module.name === 'bitgo') && !setDeps.has(module)) {
       setDeps.add(module);
       walkDependencies(module.name, setDeps, graph, managedModules);
     }

scripts/verify-release.ts

@@ -67,7 +67,8 @@ async function verifyPackage(dir: string, preid = 'beta'): Promise<boolean> {
   const json = JSON.parse(
     readFileSync(path.join(cwd, 'package.json'), { encoding: 'utf-8' }),
   );
-  if (json.private) {
+  // bitgo is private but still published via lerna --include-private.
+  if (json.private && path.basename(cwd) !== 'bitgo') {
     return true;
   }