npm in Node.js 22.22.2 toolcache has broken module tree (missing promise-retry) #13883

Description

The pre-cached Node.js 22.22.2 installation at /opt/hostedtoolcache/node/22.22.2/x64/ ships with a broken npm 10.9.7 — the promise-retry module is missing from npm's own internal dependency tree. Any command that triggers @npmcli/arborist (including npm install -g) fails immediately with MODULE_NOT_FOUND.

This blocks any workflow that needs to upgrade npm (e.g., for OIDC provenance publishing which requires npm 11.5.1+).

npm error code MODULE_NOT_FOUND
npm error Cannot find module 'promise-retry'
npm error Require stack:
npm error - /opt/hostedtoolcache/node/22.22.2/x64/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/rebuild.js
npm error - /opt/hostedtoolcache/node/22.22.2/x64/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/index.js
npm error - /opt/hostedtoolcache/node/22.22.2/x64/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/index.js
npm error - /opt/hostedtoolcache/node/22.22.2/x64/lib/node_modules/npm/node_modules/libnpmfund/lib/index.js
npm error - /opt/hostedtoolcache/node/22.22.2/x64/lib/node_modules/npm/node_modules/npm/lib/utils/reify-output.js
npm error - /opt/hostedtoolcache/node/22.22.2/x64/lib/node_modules/npm/node_modules/npm/lib/utils/reify-finish.js
npm error - /opt/hostedtoolcache/node/22.22.2/x64/lib/node_modules/npm/node_modules/npm/lib/commands/install.js
npm error - /opt/hostedtoolcache/node/22.22.2/x64/lib/node_modules/npm/lib/npm.js
npm error - /opt/hostedtoolcache/node/22.22.2/x64/lib/node_modules/npm/lib/cli/entry.js
npm error - /opt/hostedtoolcache/node/22.22.2/x64/lib/node_modules/npm/lib/cli.js
npm error - /opt/hostedtoolcache/node/22.22.2/x64/lib/node_modules/npm/bin/npm-cli.js

Platforms affected

• Azure DevOps
• GitHub Actions - Standard Runners
• GitHub Actions - Larger Runners

Runner images affected

• Ubuntu 22.04
• Ubuntu 24.04
• Ubuntu Slim
• macOS 14
• macOS 14 Arm64
• macOS 15
• macOS 15 Arm64
• macOS 26
• macOS 26 Arm64
• Windows Server 2022
• Windows Server 2025
• Windows Server 2025 with Visual Studio 2026

Image version and build link

Broken image: 20260329.72.1

• Isolated repro (private, visible to GH staff): https://github.com/inkeep/runner-image-repro/actions/runs/23968645163
• Real-world failure (public): https://github.com/inkeep/agents/actions/runs/23965641899/job/69904905421

Is it regression?

Yes. Image 20260323.65.1 works correctly. Identical workflow, no code changes between runs. 5 consecutive failures on the new image.

Expected behavior

npm install -g npm@latest should succeed using the pre-cached npm 10.9.7 bundled with Node.js 22.22.2 in the toolcache.

Actual behavior

npm crashes immediately with MODULE_NOT_FOUND for promise-retry. The module should be present at /opt/hostedtoolcache/node/22.22.2/x64/lib/node_modules/npm/node_modules/promise-retry/ but is missing from the image.

Repro steps

1. Create a workflow targeting ubuntu-latest (or ubuntu-24.04)
2. Set up Node.js 22 with actions/setup-node@v6
3. Run npm install -g npm@latest
4. Observe MODULE_NOT_FOUND error for promise-retry

Minimal repro workflow:

name: Repro
on: workflow_dispatch
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/setup-node@v6
        with:
          node-version: "22"
      - run: |
          echo "Node: $(node --version)"
          echo "npm: $(npm --version)"
          ls -la "$(npm prefix -g)/lib/node_modules/npm/node_modules/promise-retry/" || echo "MISSING"
      - run: npm install -g npm@latest

Confirmed failing run: https://github.com/inkeep/runner-image-repro/actions/runs/23968645163