fix(ci): stop version-bump commits from accumulating user-agent lines in .npmrc

[davidfirst]

Since #10528, the CI install step appends user-agent=bit-repo-circleci to the tracked .npmrc. The bit ci merge version-bump commit stages all tracked changes, so every release committed one more duplicate line to master (21 so far). Since the last occurrence of an npmrc key wins, the committed file ended up overriding bit-repo-local, so local installs were mislabeled as CI too.

• reset .npmrc back to the single user-agent=bit-repo-local line
• after appending the CI agent, mark .npmrc with git update-index --skip-worktree so git treats it as unchanged: installs in this and later jobs (the flag persists via the workspace) still send bit-repo-circleci, but no commit made from the CI workspace can pick the mutation up

[qodo-free-for-open-source-projects]

PR Summary by Qodo

fix(ci): prevent CI user-agent mutations from being committed to .npmrc

🐞 Bug fix ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Remove duplicated CI user-agent lines from tracked .npmrc to restore local labeling.
• In CircleCI, append CI user-agent then mark .npmrc as skip-worktree.
• Prevent bit ci merge release commits from staging CI-mutated .npmrc changes.

Diagram

graph TD
  A["CircleCI setup_harmony"] --> B[".npmrc (tracked)"] --> C["Append CI agent"] --> D["Set skip-worktree"] --> E["bbit install"]
  D --> F["bit ci merge"] --> G["Stage + commit"]
  D -. "ignore .npmrc" .-> G

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Use env var instead of editing .npmrc

• ➕ Avoids mutating a tracked file entirely (no need for skip-worktree).
• ➕ Makes intent explicit at the step level (scoped to a single command).
• ➖ May not propagate cleanly across persisted workspaces / later jobs without extra wiring.
• ➖ Tooling (bbit/npm/pnpm) may handle user-agent/env overrides inconsistently across versions.

2. Revert .npmrc after install (checkout/restore)

• ➕ Simple and familiar git pattern; keeps index clean without skip-worktree.
• ➖ Would remove the CI agent for subsequent jobs unless re-applied each time.
• ➖ Easy to get wrong if later steps rely on the CI user-agent being present.

3. Change bit ci merge to stage only intended files

• ➕ Eliminates a whole class of accidental CI workspace mutations being committed.
• ➖ Conflicts with current design note that checkout/tag flows can legitimately modify additional files.
• ➖ Higher behavioral risk; needs careful audit to avoid missing required release artifacts.

Recommendation: The PR’s skip-worktree approach is a targeted, low-risk fix that preserves CI user-agent attribution across workspace-persisted jobs while preventing release commits from re-committing the mutation. Consider an env-based override longer-term if you want to fully avoid editing tracked config files, but that would require validating propagation across all CI steps.

Files changed (2) +11 / -22

Bug fix (1) +0 / -21

.npmrcRemove accumulated CI user-agent duplicates +0/-21

Remove accumulated CI user-agent duplicates

• Resets the tracked .npmrc to a single local user-agent line (bit-repo-local) by removing repeated CI-appended entries. Ensures local installs are not mislabeled as CI due to last-key-wins behavior.

.npmrc

Other (1) +11 / -1

config.ymlSkip-worktree .npmrc after CI user-agent append +11/-1

Skip-worktree .npmrc after CI user-agent append

• Reworks the setup_harmony install command to append the CI-specific npm user-agent and then mark .npmrc as skip-worktree. Adds inline documentation explaining the release-commit interaction and why the flag persists across CircleCI workspaces.

.circleci/config.yml

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

1. Skip-worktree can stale .npmrc 🐞 Bug ☼ Reliability

Description

Marking the tracked project .npmrc as skip-worktree can cause later git pull --rebase /
checkout operations during bit ci merge to update the index without updating the working-tree
.npmrc. If .npmrc ever changes on the default branch, CI can keep using an older (mutated)
.npmrc while Git appears clean, making new .npmrc settings ineffective in CI.

Code

.circleci/config.yml[R667-668]

+            echo "user-agent=bit-repo-circleci" >> .npmrc &&
+            git update-index --skip-worktree .npmrc &&

Evidence

The CI job sets .npmrc to skip-worktree during setup_harmony and persists the repo to the
CircleCI workspace; the later bit_merge job attaches that workspace and runs bit ci merge, which
performs git pull --rebase and a checkout flow. With skip-worktree enabled, .npmrc may not be
refreshed in the working tree to match the pulled/checked-out commit, so subsequent npm/pnpm usage
can read stale config despite the repo appearing clean.

.circleci/config.yml[656-680]
.circleci/config.yml[848-905]
scopes/git/ci/ci.main.runtime.ts[1552-1589]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The CircleCI job mutates the tracked `.npmrc` and then sets `git update-index --skip-worktree .npmrc`. This can leave CI using a stale working-tree `.npmrc` after `bit ci merge` performs `git pull --rebase` / checkout operations, because Git may not update skip-worktree files in the working tree.
## Issue Context
- The config intentionally persists this index flag via `persist_to_workspace`, so the merge job inherits it.
- `bit ci merge` performs Git pull/rebase and checkout operations before tagging/committing.
## Fix Focus Areas
- .circleci/config.yml[656-669]
## What to change
- Prefer setting the CI user-agent without editing the tracked `.npmrc` (e.g., provide the user-agent via environment for the install step / npm config override), so the workflow no longer needs `--skip-worktree`.
- If mutating `.npmrc` is unavoidable, ensure the workflow does not keep `.npmrc` in skip-worktree state across Git pull/checkout phases (this likely requires moving the logic closer to the staging/commit phase rather than the initial install phase).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

Previous review results

Review updated until commit 0c1c537 ⚖️ Balanced

Results up to commit 8473b86

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

1. Skip-worktree can stale .npmrc 🐞 Bug ☼ Reliability

Description

Marking the tracked project .npmrc as skip-worktree can cause later git pull --rebase /
checkout operations during bit ci merge to update the index without updating the working-tree
.npmrc. If .npmrc ever changes on the default branch, CI can keep using an older (mutated)
.npmrc while Git appears clean, making new .npmrc settings ineffective in CI.

Code

.circleci/config.yml[R667-668]

+            echo "user-agent=bit-repo-circleci" >> .npmrc &&
+            git update-index --skip-worktree .npmrc &&

Evidence

The CI job sets .npmrc to skip-worktree during setup_harmony and persists the repo to the
CircleCI workspace; the later bit_merge job attaches that workspace and runs bit ci merge, which
performs git pull --rebase and a checkout flow. With skip-worktree enabled, .npmrc may not be
refreshed in the working tree to match the pulled/checked-out commit, so subsequent npm/pnpm usage
can read stale config despite the repo appearing clean.

.circleci/config.yml[656-680]
.circleci/config.yml[848-905]
scopes/git/ci/ci.main.runtime.ts[1552-1589]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The CircleCI job mutates the tracked `.npmrc` and then sets `git update-index --skip-worktree .npmrc`. This can leave CI using a stale working-tree `.npmrc` after `bit ci merge` performs `git pull --rebase` / checkout operations, because Git may not update skip-worktree files in the working tree.
## Issue Context
- The config intentionally persists this index flag via `persist_to_workspace`, so the merge job inherits it.
- `bit ci merge` performs Git pull/rebase and checkout operations before tagging/committing.
## Fix Focus Areas
- .circleci/config.yml[656-669]
## What to change
- Prefer setting the CI user-agent without editing the tracked `.npmrc` (e.g., provide the user-agent via environment for the install step / npm config override), so the workflow no longer needs `--skip-worktree`.
- If mutating `.npmrc` is unavoidable, ensure the workflow does not keep `.npmrc` in skip-worktree state across Git pull/checkout phases (this likely requires moving the logic closer to the staging/commit phase rather than the initial install phase).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Results up to commit b5bb8d6

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

1. Skip-worktree can stale .npmrc 🐞 Bug ☼ Reliability

Description

Marking the tracked project .npmrc as skip-worktree can cause later git pull --rebase /
checkout operations during bit ci merge to update the index without updating the working-tree
.npmrc. If .npmrc ever changes on the default branch, CI can keep using an older (mutated)
.npmrc while Git appears clean, making new .npmrc settings ineffective in CI.

Code

.circleci/config.yml[R667-668]

+            echo "user-agent=bit-repo-circleci" >> .npmrc &&
+            git update-index --skip-worktree .npmrc &&

Evidence

The CI job sets .npmrc to skip-worktree during setup_harmony and persists the repo to the
CircleCI workspace; the later bit_merge job attaches that workspace and runs bit ci merge, which
performs git pull --rebase and a checkout flow. With skip-worktree enabled, .npmrc may not be
refreshed in the working tree to match the pulled/checked-out commit, so subsequent npm/pnpm usage
can read stale config despite the repo appearing clean.

.circleci/config.yml[656-680]
.circleci/config.yml[848-905]
scopes/git/ci/ci.main.runtime.ts[1552-1589]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The CircleCI job mutates the tracked `.npmrc` and then sets `git update-index --skip-worktree .npmrc`. This can leave CI using a stale working-tree `.npmrc` after `bit ci merge` performs `git pull --rebase` / checkout operations, because Git may not update skip-worktree files in the working tree.

## Issue Context
- The config intentionally persists this index flag via `persist_to_workspace`, so the merge job inherits it.
- `bit ci merge` performs Git pull/rebase and checkout operations before tagging/committing.

## Fix Focus Areas
- .circleci/config.yml[656-669]

## What to change
- Prefer setting the CI user-agent without editing the tracked `.npmrc` (e.g., provide the user-agent via environment for the install step / npm config override), so the workflow no longer needs `--skip-worktree`.
- If mutating `.npmrc` is unavoidable, ensure the workflow does not keep `.npmrc` in skip-worktree state across Git pull/checkout phases (this likely requires moving the logic closer to the staging/commit phase rather than the initial install phase).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[qodo-free-for-open-source-projects]

1. Skip-worktree can stale .npmrc 🐞 Bug ☼ Reliability

Marking the tracked project .npmrc as skip-worktree can cause later git pull --rebase /
checkout operations during bit ci merge to update the index without updating the working-tree
.npmrc. If .npmrc ever changes on the default branch, CI can keep using an older (mutated)
.npmrc while Git appears clean, making new .npmrc settings ineffective in CI.

Agent Prompt

## Issue description
The CircleCI job mutates the tracked `.npmrc` and then sets `git update-index --skip-worktree .npmrc`. This can leave CI using a stale working-tree `.npmrc` after `bit ci merge` performs `git pull --rebase` / checkout operations, because Git may not update skip-worktree files in the working tree.

## Issue Context
- The config intentionally persists this index flag via `persist_to_workspace`, so the merge job inherits it.
- `bit ci merge` performs Git pull/rebase and checkout operations before tagging/committing.

## Fix Focus Areas
- .circleci/config.yml[656-669]

## What to change
- Prefer setting the CI user-agent without editing the tracked `.npmrc` (e.g., provide the user-agent via environment for the install step / npm config override), so the workflow no longer needs `--skip-worktree`.
- If mutating `.npmrc` is unavoidable, ensure the workflow does not keep `.npmrc` in skip-worktree state across Git pull/checkout phases (this likely requires moving the logic closer to the staging/commit phase rather than the initial install phase).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

[qodo-free-for-open-source-projects]

Code review by qodo was updated up to the latest commit 8473b86

[qodo-free-for-open-source-projects]

Code review by qodo was updated up to the latest commit 0c1c537