ci: disable setup-node npm cache + add job timeouts

.github/workflows/ci.yaml

@@ -10,25 +10,28 @@ jobs:
   lint-build-test:
     name: Lint, build and test
     runs-on: ubuntu-24.04
+    timeout-minutes: 30
     outputs:
       JOB_LINT: ${{ steps.lint.outcome }}
       JOB_TEST: ${{ steps.test.outcome }}
       JOB_BUILD: ${{ steps.build.outcome }}
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
         with:
-          node-version: "24"
-          cache: "npm"
+          node-version: "22"
+          # NOTE: cache: "npm" is intentionally disabled — actions/setup-node's
+          # npm cache restore hangs indefinitely on this monorepo
+          # (see https://github.com/actions/setup-node/issues/516).
       - name: Turbo Cache
         id: turbo-cache
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: .turbo
           key: turbo-${{ runner.os }}-${{ github.sha }}
           restore-keys: |
             turbo-${{ runner.os }}
-      - run: npm ci
+      - run: npm ci --no-audit --no-fund
       - id: lint
         run: npm run lint -- --cache-dir=".turbo"
       - id: build
@@ -39,25 +42,26 @@ jobs:
   e2e-tests:
     name: Run e2e tests
     runs-on: ubuntu-24.04
+    timeout-minutes: 60
     needs: [lint-build-test]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           submodules: "recursive"
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
-          node-version: "24"
+          node-version: "22"
           # NOTE: Disabled until https://github.com/actions/setup-node/issues/516 is resolved
           # cache: "npm"
       - name: Turbo Cache
         id: turbo-cache
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: .turbo
           key: turbo-${{ runner.os }}-${{ github.sha }}
           restore-keys: |
             turbo-${{ runner.os }}
-      - run: npm ci
+      - run: npm ci --no-audit --no-fund
       - name: Build
         run: |
           npm run build -- --cache-dir=".turbo"
@@ -126,7 +130,7 @@ jobs:
       JOB_TEST: ${{ needs.lint-build-test.outputs.JOB_TEST }}
       JOB_BUILD: ${{ needs.lint-build-test.outputs.JOB_BUILD }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Adding Job Summary
         run: |
           echo "| Command | Status |" >> $GITHUB_STEP_SUMMARY

.github/workflows/pin-to-pinata.yaml

@@ -9,21 +9,24 @@ jobs:
   pin-to-pinata:
     name: Pin images to Pinata
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
         with:
-          node-version: "24"
-          cache: "npm"
+          node-version: "22"
+          # NOTE: cache: "npm" is intentionally disabled — actions/setup-node's
+          # npm cache restore hangs indefinitely on this monorepo
+          # (see https://github.com/actions/setup-node/issues/516).
       - name: Turbo Cache
         id: turbo-cache
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: .turbo
           key: turbo-${{ runner.os }}-${{ github.sha }}
           restore-keys: |
             turbo-${{ runner.os }}
-      - run: npm ci
+      - run: npm ci --no-audit --no-fund
       - id: build
         run: npm run build -- --cache-dir=".turbo"
       - name: Set current date as env variable

.github/workflows/publish-alpha.yaml

@@ -12,6 +12,7 @@ jobs:
   publish:
     name: Publish alpha packages
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     if: ${{ github.event_name != 'workflow_dispatch' }}
     # is automatically triggered on push to main
     outputs:
@@ -22,26 +23,28 @@ jobs:
       id-token: write # Required for trusted publishing (https://docs.npmjs.com/trusted-publishers)
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           token: ${{ secrets.BSNORG_ACTIONS_SECRET }}
           # pulls all commits (needed for lerna / semantic release to correctly version)
           fetch-depth: "0"
       - name: Setup .npmrc file for publish
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
-          node-version: "24"
+          node-version: "22"
           registry-url: "https://registry.npmjs.org"
-          cache: "npm"
+          # NOTE: cache: "npm" is intentionally disabled — actions/setup-node's
+          # npm cache restore hangs indefinitely on this monorepo
+          # (see https://github.com/actions/setup-node/issues/516).
       - name: Turbo Cache
         id: turbo-cache
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: .turbo
           key: turbo-${{ runner.os }}-${{ github.sha }}
           restore-keys: |
             turbo-${{ runner.os }}
-      - run: npm ci
+      - run: npm ci --no-audit --no-fund
       - run: npm run build -- --cache-dir=".turbo"
       - name: Set github bot
         run: |
@@ -97,6 +100,7 @@ jobs:
   publish_latest_release:
     name: Publish latest packages
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     if: ${{ github.event_name == 'workflow_dispatch' }}
     # is manually triggered to publish latest release
     permissions:
@@ -105,26 +109,28 @@ jobs:
       id-token: write # Required for trusted publishing (https://docs.npmjs.com/trusted-publishers)
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           token: ${{ secrets.BSNORG_ACTIONS_SECRET }}
           # pulls all commits (needed for lerna / semantic release to correctly version)
           fetch-depth: "0"
       - name: Setup .npmrc file for publish
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
-          node-version: "24"
+          node-version: "22"
           registry-url: "https://registry.npmjs.org"
-          cache: "npm"
+          # NOTE: cache: "npm" is intentionally disabled — actions/setup-node's
+          # npm cache restore hangs indefinitely on this monorepo
+          # (see https://github.com/actions/setup-node/issues/516).
       - name: Turbo Cache
         id: turbo-cache
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: .turbo
           key: turbo-${{ runner.os }}-${{ github.sha }}
           restore-keys: |
             turbo-${{ runner.os }}
-      - run: npm ci
+      - run: npm ci --no-audit --no-fund
       - run: npm run build -- --cache-dir=".turbo"
       - name: Publish
         env: