npm ci hangs in workflow for certain versions of node

[lamontadams]

Description: For certain versions of node, npm ci hangs until github kills the workflow (about 6 hours).

Failing versions:

• 18
• 21

Working versions:

• 16
• 18.5

npm ci runs successfully for the same package.json locally on all of the above identified failing versions.

Action version: Currently 4.0.2, observed same behavior with version 3 and 2.

Platform:

• [x] Ubuntu
• [ ] macOS
• [ ] Windows

Runner type:

• [x] Hosted
• [ ] Self-hosted

Tools version: npm package manager, failure noted with node version 18 and 21.

Repro steps:
Workflow yaml - this uses v3 of the action but as stated above, I have seen this issue with versions 2 and 4.02 (which I understand to be the current latest):

jobs:
  build_and_push:
    runs-on: ubuntu-latest
    environment: qa
    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Set up Node.js
        uses: actions/setup-node@v3
        with:
          node-version: '21'
          scope: '@recurate'
          registry-url: 'https://npm.pkg.github.com'

      - name: Install Dependencies and Build
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NODE_ENV: qa
        run: |
          npm ci
          npm run build
          

Expected behavior: npm ci executes correctly

Actual behavior: npm ci outputs some (sadly expected) warnings and hangs until the workflow execution is terminated.

Current runner version: '2.317.0'
Operating System
Runner Image
Runner Image Provisioner
GITHUB_TOKEN Permissions
Secret source: Actions
Prepare workflow directory
Prepare all required actions
Getting action download info
Download action repository 'actions/checkout@v3' (SHA:f43a0e5ff2bd294095638e18286ca9a3d1956744)
Download action repository 'actions/setup-node@v3' (SHA:1a4442cacd436585916779262731d5b162bc6ec7)
Complete job name: build_and_push
3s
Run actions/checkout@v3
Syncing repository: recurate/core-admin-dashboard
Getting Git version info
Temporarily overriding HOME='/home/runner/work/_temp/30272686-482e-40ce-bf14-1823932ef51f' before making global git config changes
Adding repository directory to the temporary git global config as a safe directory
/usr/bin/git config --global --add safe.directory /home/runner/work/core-admin-dashboard/core-admin-dashboard
Deleting the contents of '/home/runner/work/core-admin-dashboard/core-admin-dashboard'
Initializing the repository
Disabling automatic garbage collection
Setting up auth
Fetching the repository
Determining the checkout info
Checking out the ref
/usr/bin/git log -1 --format='%H'
'd916c5006fee2adde84426194bd0269bb960fe82'
5s
Run actions/setup-node@v3
Attempting to download 21...
Not found in manifest. Falling back to download directly from Node
Acquiring 21.7.3 - x64 from https://nodejs.org/dist/v21.7.3/node-v21.7.3-linux-x64.tar.gz
Extracting ...
/usr/bin/tar xz --strip 1 --warning=no-unknown-keyword -C /home/runner/work/_temp/88413323-87b7-44f9-8105-55eb929b8002 -f /home/runner/work/_temp/b355c15b-f014-46d6-abb3-02247f2872dc
Adding to the cache ...
Done
Environment details
  node: v21.7.3
  npm: 10.5.0
  yarn: 1.22.22
  
  Run 
  npm ci
  npm run build
  shell: /usr/bin/bash -e {0}
  env:
    NPM_CONFIG_USERCONFIG: /home/runner/work/_temp/.npmrc
    NODE_AUTH_TOKEN: ***
    RECURATE_NPM_TOKEN: ***
    GITHUB_TOKEN: ***
    NODE_ENV: qa
  
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: [email protected]
npm WARN Found: [email protected]
npm WARN node_modules/react
npm WARN   react@"^17.0.2" from the root project
npm WARN   40 more (@emotion/react, @emotion/styled, ...)
npm WARN 
npm WARN Could not resolve dependency:
npm WARN peer react@"^0.14.0 || ^15.0.0 || ^16.0.0" from [email protected]
npm WARN node_modules/react-form-validator-core/node_modules/create-react-context
npm WARN   create-react-context@"^0.3.0" from [email protected]
npm WARN   node_modules/react-form-validator-core
npm WARN 
npm WARN Conflicting peer dependency: [email protected]
npm WARN node_modules/react
npm WARN   peer react@"^0.14.0 || ^15.0.0 || ^16.0.0" from [email protected]
npm WARN   node_modules/react-form-validator-core/node_modules/create-react-context
npm WARN     create-react-context@"^0.3.0" from [email protected]
npm WARN     node_modules/react-form-validator-core