From adf11bc3bf33844000ff2c27bf72b7b45c8f2331 Mon Sep 17 00:00:00 2001
From: Klemen Zajc <klemenzajc@redeemeum.com>
Date: Thu, 28 May 2026 17:20:24 +0200
Subject: [PATCH 1/4] ci: harden npm ci with timeouts and offline-preferring
 flags
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Workflows have been hanging indefinitely on `npm ci`, burning 6h of runner
time before failing. Two changes:

- Add timeout-minutes to every job (30 min for build/publish, 60 min for
  e2e and pin-to-pinata) so a stuck step fails fast and can be rerun.
- Switch `npm ci` to `npm ci --prefer-offline --no-audit --no-fund` to
  prefer the actions/setup-node npm cache, skip the audit endpoint, and
  skip funding metadata. These flags only affect non-essential network
  calls — installation correctness is unchanged.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 .github/workflows/ci.yaml            | 6 ++++--
 .github/workflows/pin-to-pinata.yaml | 3 ++-
 .github/workflows/publish-alpha.yaml | 6 ++++--
 3 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 6ef23f6bc..747e2893a 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -10,6 +10,7 @@ jobs:
   lint-build-test:
     name: Lint, build and test
     runs-on: ubuntu-24.04
+    timeout-minutes: 30
     outputs:
       JOB_LINT: ${{ steps.lint.outcome }}
       JOB_TEST: ${{ steps.test.outcome }}
@@ -28,7 +29,7 @@ jobs:
           key: turbo-${{ runner.os }}-${{ github.sha }}
           restore-keys: |
             turbo-${{ runner.os }}
-      - run: npm ci
+      - run: npm ci --prefer-offline --no-audit --no-fund
       - id: lint
         run: npm run lint -- --cache-dir=".turbo"
       - id: build
@@ -39,6 +40,7 @@ jobs:
   e2e-tests:
     name: Run e2e tests
     runs-on: ubuntu-24.04
+    timeout-minutes: 60
     needs: [lint-build-test]
     steps:
       - uses: actions/checkout@v3
@@ -57,7 +59,7 @@ jobs:
           key: turbo-${{ runner.os }}-${{ github.sha }}
           restore-keys: |
             turbo-${{ runner.os }}
-      - run: npm ci
+      - run: npm ci --prefer-offline --no-audit --no-fund
       - name: Build
         run: |
           npm run build -- --cache-dir=".turbo"
diff --git a/.github/workflows/pin-to-pinata.yaml b/.github/workflows/pin-to-pinata.yaml
index a231dcc40..0e6002ec5 100644
--- a/.github/workflows/pin-to-pinata.yaml
+++ b/.github/workflows/pin-to-pinata.yaml
@@ -9,6 +9,7 @@ jobs:
   pin-to-pinata:
     name: Pin images to Pinata
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     steps:
       - uses: actions/checkout@v3
       - uses: actions/setup-node@v3
@@ -23,7 +24,7 @@ jobs:
           key: turbo-${{ runner.os }}-${{ github.sha }}
           restore-keys: |
             turbo-${{ runner.os }}
-      - run: npm ci
+      - run: npm ci --prefer-offline --no-audit --no-fund
       - id: build
         run: npm run build -- --cache-dir=".turbo"
       - name: Set current date as env variable
diff --git a/.github/workflows/publish-alpha.yaml b/.github/workflows/publish-alpha.yaml
index a29f1989e..814ad995b 100644
--- a/.github/workflows/publish-alpha.yaml
+++ b/.github/workflows/publish-alpha.yaml
@@ -12,6 +12,7 @@ jobs:
   publish:
     name: Publish alpha packages
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     if: ${{ github.event_name != 'workflow_dispatch' }}
     # is automatically triggered on push to main
     outputs:
@@ -41,7 +42,7 @@ jobs:
           key: turbo-${{ runner.os }}-${{ github.sha }}
           restore-keys: |
             turbo-${{ runner.os }}
-      - run: npm ci
+      - run: npm ci --prefer-offline --no-audit --no-fund
       - run: npm run build -- --cache-dir=".turbo"
       - name: Set github bot
         run: |
@@ -97,6 +98,7 @@ jobs:
   publish_latest_release:
     name: Publish latest packages
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     if: ${{ github.event_name == 'workflow_dispatch' }}
     # is manually triggered to publish latest release
     permissions:
@@ -124,7 +126,7 @@ jobs:
           key: turbo-${{ runner.os }}-${{ github.sha }}
           restore-keys: |
             turbo-${{ runner.os }}
-      - run: npm ci
+      - run: npm ci --prefer-offline --no-audit --no-fund
       - run: npm run build -- --cache-dir=".turbo"
       - name: Publish
         env:

From 71a4bd27435601c7271756e3cadaab86e160c72a Mon Sep 17 00:00:00 2001
From: Klemen Zajc <klemenzajc@redeemeum.com>
Date: Thu, 28 May 2026 17:33:44 +0200
Subject: [PATCH 2/4] ci: disable actions/setup-node npm cache to fix hang
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The actual hang root cause: actions/setup-node@v3's npm cache restore
(cache: \"npm\") deadlocks on this monorepo — same issue tracked in
https://github.com/actions/setup-node/issues/516. The chromatic workflow
and the e2e-tests job both already skip this cache and never hang.

Remove cache: \"npm\" from every setup-node usage (lint-build-test,
publish-alpha publish + publish_latest_release, pin-to-pinata). Also drop
--prefer-offline since there's no GH-managed cache to prefer; keep
--no-audit and --no-fund.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 .github/workflows/ci.yaml            |  8 +++++---
 .github/workflows/pin-to-pinata.yaml |  6 ++++--
 .github/workflows/publish-alpha.yaml | 12 ++++++++----
 3 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 747e2893a..8aba5e6d4 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -20,7 +20,9 @@ jobs:
       - uses: actions/setup-node@v3
         with:
           node-version: "24"
-          cache: "npm"
+          # NOTE: cache: "npm" is intentionally disabled — actions/setup-node's
+          # npm cache restore hangs indefinitely on this monorepo
+          # (see https://github.com/actions/setup-node/issues/516).
       - name: Turbo Cache
         id: turbo-cache
         uses: actions/cache@v3
@@ -29,7 +31,7 @@ jobs:
           key: turbo-${{ runner.os }}-${{ github.sha }}
           restore-keys: |
             turbo-${{ runner.os }}
-      - run: npm ci --prefer-offline --no-audit --no-fund
+      - run: npm ci --no-audit --no-fund
       - id: lint
         run: npm run lint -- --cache-dir=".turbo"
       - id: build
@@ -59,7 +61,7 @@ jobs:
           key: turbo-${{ runner.os }}-${{ github.sha }}
           restore-keys: |
             turbo-${{ runner.os }}
-      - run: npm ci --prefer-offline --no-audit --no-fund
+      - run: npm ci --no-audit --no-fund
       - name: Build
         run: |
           npm run build -- --cache-dir=".turbo"
diff --git a/.github/workflows/pin-to-pinata.yaml b/.github/workflows/pin-to-pinata.yaml
index 0e6002ec5..e0222e80d 100644
--- a/.github/workflows/pin-to-pinata.yaml
+++ b/.github/workflows/pin-to-pinata.yaml
@@ -15,7 +15,9 @@ jobs:
       - uses: actions/setup-node@v3
         with:
           node-version: "24"
-          cache: "npm"
+          # NOTE: cache: "npm" is intentionally disabled — actions/setup-node's
+          # npm cache restore hangs indefinitely on this monorepo
+          # (see https://github.com/actions/setup-node/issues/516).
       - name: Turbo Cache
         id: turbo-cache
         uses: actions/cache@v3
@@ -24,7 +26,7 @@ jobs:
           key: turbo-${{ runner.os }}-${{ github.sha }}
           restore-keys: |
             turbo-${{ runner.os }}
-      - run: npm ci --prefer-offline --no-audit --no-fund
+      - run: npm ci --no-audit --no-fund
       - id: build
         run: npm run build -- --cache-dir=".turbo"
       - name: Set current date as env variable
diff --git a/.github/workflows/publish-alpha.yaml b/.github/workflows/publish-alpha.yaml
index 814ad995b..daeae663c 100644
--- a/.github/workflows/publish-alpha.yaml
+++ b/.github/workflows/publish-alpha.yaml
@@ -33,7 +33,9 @@ jobs:
         with:
           node-version: "24"
           registry-url: "https://registry.npmjs.org"
-          cache: "npm"
+          # NOTE: cache: "npm" is intentionally disabled — actions/setup-node's
+          # npm cache restore hangs indefinitely on this monorepo
+          # (see https://github.com/actions/setup-node/issues/516).
       - name: Turbo Cache
         id: turbo-cache
         uses: actions/cache@v3
@@ -42,7 +44,7 @@ jobs:
           key: turbo-${{ runner.os }}-${{ github.sha }}
           restore-keys: |
             turbo-${{ runner.os }}
-      - run: npm ci --prefer-offline --no-audit --no-fund
+      - run: npm ci --no-audit --no-fund
       - run: npm run build -- --cache-dir=".turbo"
       - name: Set github bot
         run: |
@@ -117,7 +119,9 @@ jobs:
         with:
           node-version: "24"
           registry-url: "https://registry.npmjs.org"
-          cache: "npm"
+          # NOTE: cache: "npm" is intentionally disabled — actions/setup-node's
+          # npm cache restore hangs indefinitely on this monorepo
+          # (see https://github.com/actions/setup-node/issues/516).
       - name: Turbo Cache
         id: turbo-cache
         uses: actions/cache@v3
@@ -126,7 +130,7 @@ jobs:
           key: turbo-${{ runner.os }}-${{ github.sha }}
           restore-keys: |
             turbo-${{ runner.os }}
-      - run: npm ci --prefer-offline --no-audit --no-fund
+      - run: npm ci --no-audit --no-fund
       - run: npm run build -- --cache-dir=".turbo"
       - name: Publish
         env:

From 4592673cc7a2708bab51df4d49c280778c6fcfb4 Mon Sep 17 00:00:00 2001
From: Klemen Zajc <klemenzajc@redeemeum.com>
Date: Thu, 28 May 2026 17:41:57 +0200
Subject: [PATCH 3/4] ci: bump actions/checkout, setup-node, cache to v4
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

v3 of these actions uses the deprecated Node 16 runtime, which may be
contributing to the npm ci hangs. The chromatic workflow — which doesn't
hang — already uses actions/checkout@v4. Bring the other hot-path
workflows in line.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 .github/workflows/ci.yaml            | 14 +++++++-------
 .github/workflows/pin-to-pinata.yaml |  6 +++---
 .github/workflows/publish-alpha.yaml | 12 ++++++------
 3 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 8aba5e6d4..e064fe872 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -16,8 +16,8 @@ jobs:
       JOB_TEST: ${{ steps.test.outcome }}
       JOB_BUILD: ${{ steps.build.outcome }}
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
         with:
           node-version: "24"
           # NOTE: cache: "npm" is intentionally disabled — actions/setup-node's
@@ -25,7 +25,7 @@ jobs:
           # (see https://github.com/actions/setup-node/issues/516).
       - name: Turbo Cache
         id: turbo-cache
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: .turbo
           key: turbo-${{ runner.os }}-${{ github.sha }}
@@ -45,17 +45,17 @@ jobs:
     timeout-minutes: 60
     needs: [lint-build-test]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           submodules: "recursive"
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: "24"
           # NOTE: Disabled until https://github.com/actions/setup-node/issues/516 is resolved
           # cache: "npm"
       - name: Turbo Cache
         id: turbo-cache
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: .turbo
           key: turbo-${{ runner.os }}-${{ github.sha }}
@@ -130,7 +130,7 @@ jobs:
       JOB_TEST: ${{ needs.lint-build-test.outputs.JOB_TEST }}
       JOB_BUILD: ${{ needs.lint-build-test.outputs.JOB_BUILD }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Adding Job Summary
         run: |
           echo "| Command | Status |" >> $GITHUB_STEP_SUMMARY
diff --git a/.github/workflows/pin-to-pinata.yaml b/.github/workflows/pin-to-pinata.yaml
index e0222e80d..100ddcb10 100644
--- a/.github/workflows/pin-to-pinata.yaml
+++ b/.github/workflows/pin-to-pinata.yaml
@@ -11,8 +11,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
         with:
           node-version: "24"
           # NOTE: cache: "npm" is intentionally disabled — actions/setup-node's
@@ -20,7 +20,7 @@ jobs:
           # (see https://github.com/actions/setup-node/issues/516).
       - name: Turbo Cache
         id: turbo-cache
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: .turbo
           key: turbo-${{ runner.os }}-${{ github.sha }}
diff --git a/.github/workflows/publish-alpha.yaml b/.github/workflows/publish-alpha.yaml
index daeae663c..3e1eb26ae 100644
--- a/.github/workflows/publish-alpha.yaml
+++ b/.github/workflows/publish-alpha.yaml
@@ -23,13 +23,13 @@ jobs:
       id-token: write # Required for trusted publishing (https://docs.npmjs.com/trusted-publishers)
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           token: ${{ secrets.BSNORG_ACTIONS_SECRET }}
           # pulls all commits (needed for lerna / semantic release to correctly version)
           fetch-depth: "0"
       - name: Setup .npmrc file for publish
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: "24"
           registry-url: "https://registry.npmjs.org"
@@ -38,7 +38,7 @@ jobs:
           # (see https://github.com/actions/setup-node/issues/516).
       - name: Turbo Cache
         id: turbo-cache
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: .turbo
           key: turbo-${{ runner.os }}-${{ github.sha }}
@@ -109,13 +109,13 @@ jobs:
       id-token: write # Required for trusted publishing (https://docs.npmjs.com/trusted-publishers)
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           token: ${{ secrets.BSNORG_ACTIONS_SECRET }}
           # pulls all commits (needed for lerna / semantic release to correctly version)
           fetch-depth: "0"
       - name: Setup .npmrc file for publish
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: "24"
           registry-url: "https://registry.npmjs.org"
@@ -124,7 +124,7 @@ jobs:
           # (see https://github.com/actions/setup-node/issues/516).
       - name: Turbo Cache
         id: turbo-cache
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: .turbo
           key: turbo-${{ runner.os }}-${{ github.sha }}

From b6ffb2e84978f8d7c8318c64a5e86c996d8a1c0c Mon Sep 17 00:00:00 2001
From: Klemen Zajc <klemenzajc@redeemeum.com>
Date: Thu, 28 May 2026 17:58:01 +0200
Subject: [PATCH 4/4] ci: downgrade Node from 24 to 22 to match volta config
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Hypothesis for the npm ci hangs: Node 24 ships npm 11, which interacts
poorly with this monorepo's lockfile. Evidence:

- The chromatic workflow doesn't use actions/setup-node, so it picks up
  the ubuntu-latest runner's default Node (currently 22). It never hangs.
- All workflows that explicitly set node-version: \"24\" hang on npm ci.
- The project's volta config already pins node 22.18.0 + npm 10.9.0,
  i.e. devs run on Node 22 locally — which matches \"works locally\".

Bring the hot-path CI/publish/pin workflows back to Node 22 to match.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 .github/workflows/ci.yaml            | 4 ++--
 .github/workflows/pin-to-pinata.yaml | 2 +-
 .github/workflows/publish-alpha.yaml | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index e064fe872..9a0bfa0a2 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -19,7 +19,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: "24"
+          node-version: "22"
           # NOTE: cache: "npm" is intentionally disabled — actions/setup-node's
           # npm cache restore hangs indefinitely on this monorepo
           # (see https://github.com/actions/setup-node/issues/516).
@@ -50,7 +50,7 @@ jobs:
           submodules: "recursive"
       - uses: actions/setup-node@v4
         with:
-          node-version: "24"
+          node-version: "22"
           # NOTE: Disabled until https://github.com/actions/setup-node/issues/516 is resolved
           # cache: "npm"
       - name: Turbo Cache
diff --git a/.github/workflows/pin-to-pinata.yaml b/.github/workflows/pin-to-pinata.yaml
index 100ddcb10..c4aa30778 100644
--- a/.github/workflows/pin-to-pinata.yaml
+++ b/.github/workflows/pin-to-pinata.yaml
@@ -14,7 +14,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: "24"
+          node-version: "22"
           # NOTE: cache: "npm" is intentionally disabled — actions/setup-node's
           # npm cache restore hangs indefinitely on this monorepo
           # (see https://github.com/actions/setup-node/issues/516).
diff --git a/.github/workflows/publish-alpha.yaml b/.github/workflows/publish-alpha.yaml
index 3e1eb26ae..d7f30202a 100644
--- a/.github/workflows/publish-alpha.yaml
+++ b/.github/workflows/publish-alpha.yaml
@@ -31,7 +31,7 @@ jobs:
       - name: Setup .npmrc file for publish
         uses: actions/setup-node@v4
         with:
-          node-version: "24"
+          node-version: "22"
           registry-url: "https://registry.npmjs.org"
           # NOTE: cache: "npm" is intentionally disabled — actions/setup-node's
           # npm cache restore hangs indefinitely on this monorepo
@@ -117,7 +117,7 @@ jobs:
       - name: Setup .npmrc file for publish
         uses: actions/setup-node@v4
         with:
-          node-version: "24"
+          node-version: "22"
           registry-url: "https://registry.npmjs.org"
           # NOTE: cache: "npm" is intentionally disabled — actions/setup-node's
           # npm cache restore hangs indefinitely on this monorepo