[David Fowler (davidfowl)]

Description

Fixes the npm fresh-release E404 part of the Polyglot SDK Validation TypeScript flake tracked in #21600.

Root cause

TypeScript AppHost scaffolds and fixtures declare floating npm ranges. The TypeScript validation container runs npm install without a release-age limit. If a run installs a few minutes after an upstream publish, npm picks the new version from the packument while its tarball still returns 404. aspire init --language typescript then fails with npm error code E404 / ❌ The app could not be created.

In the last 7 days this caused 5 failed jobs across 3 unrelated branches (details in #21633). Each failure came 2–4 minutes after the upstream publish of @typescript-eslint/typescript-estree@8.72.1 or @types/estree@1.0.10. These are the same publishes #21615 fixes for the CLI E2E Docker shells, but that PR doesn't cover this container.

Fix

The Run TypeScript SDK validation step now passes npm_config_before=<now − 1 day> into the container (npm before config). This matches #21615. npm range resolution in aspire init, the fixture installs, the JavaScript app installer and the Nuxt fixture only selects releases that have had time to propagate. The global tool installs at image build time are unaffected. pnpm, Yarn and Bun don't read this setting. No retries, sleeps or skips are added.

Validation

• Mock registry with npm 11.19.0 (the image's npm): the packument lists 1.1.0 (published 2 minutes ago, tarball 404) and 1.0.0 (30 days old).
  • Without the cutoff, npm install pkg@^1.0.0 fails with npm error code E404, the CI signature.
  • With the cutoff, it installs 1.0.0.
• Real registry with npm 11.19.0 and the cutoff:
  • The TypeScript scaffold's dependency set installs.
  • playground/NuxtApp/web installs, with 596 packages including nuxt@4.5.2.
  • All 58 npm-managed tests/PolyglotAppHosts/*/TypeScript and integration playground package.json files resolve. No ETARGET.
  • The pnpm fixture resolves.
• actionlint: passes on polyglot-validation.yml.

Other intermittent TypeScript validation failures from the same window have different causes and are not addressed here: the Nuxt dev-mode health wait timing out (3), bun install ConnectionRefused (2), and an MCR pull failure (1).

Fixes #21633

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
  • No. Follow-up changes expected.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
  • No (CI workflow configuration only; validated as described above)
• Did you add public API?
  • Yes
  • No
• Does the change make any security assumptions or guarantees?
  • Yes
  • No

🤖 Posted by AspireAgent (AI Agent)

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 21634

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 21634"

[github-actions]

Tests selector

1 / 100 PR test projects · 1 PR job, from 1 changed file.

Selected PR test projects (1 / 100)

Infrastructure.Tests

Selected PR jobs (1)

polyglot

---

How these were chosen — grouped by what changed

📄 .github/workflows/polyglot-validation.yml (changed)
→ 1 directly: Infrastructure.Tests

Job reasons

Job	Triggered by
polyglot	.github/workflows/polyglot-validation.yml

---

Selection computed for commit b4aa957.

[Copilot]

🟢 Approval recommended

No active review issues remain for the npm release-cutoff change in TypeScript validation.

No open issues 🎉

What changed in this PR

Reduces fresh-release npm E404 failures in TypeScript Polyglot SDK Validation, addressing #21633 and extending the approach used for CLI E2E shells in #21615.

Changes:

• Computes a UTC cutoff one day before the validation run and passes it into the container as npm_config_before.
• Documents why npm range resolution excludes just-published releases; image-build tool installs remain unchanged.

File	Description
.github/​workflows/​polyglot-validation.yml	Adds the npm release cutoff to the TypeScript validation container and explains the workaround.

_{Review effort: Balanced}

[aspire-repo-bot]

✅ No documentation update needed.

docs_optional → build_or_ci_only. Triggered signal: pr_body_has_cli_flag_mention (a false positive; the evidence is the PR body's aspire init --language typescript error text, not a new flag). The only changed file, .github/workflows/polyglot-validation.yml, matches .github/**, and the change only sets npm_config_before in CI.