FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

tools: add non-default OpenSSL versions to the test-shared workflow · nodejs/node@027bef4 · GitHub

/ node Public

Commit 027bef4

Browse files
panva
authored and
aduh95
committed
tools: add non-default OpenSSL versions to the test-shared workflow
Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #62862 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
1 parent b9f3abd commit 027bef4

5 files changed

Lines changed: 260 additions & 29 deletions

File tree

‎.github/actions/build-shared/action.yml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
name: Build Node.js (shared libraries)
2+
description: >
3+
Downloads the slim tarball built by the `build-tarball` job, extracts it,
4+
installs Nix (+ cachix + sccache), then builds Node.js and runs the CI
5+
test suite inside the pinned nix-shell.
6+
7+
inputs:
8+
system:
9+
description: System label (e.g. x86_64-linux, aarch64-darwin).
10+
required: true
11+
extra-nix-args:
12+
description: Additional arguments appended to the nix-shell invocation.
13+
required: false
14+
default: ''
15+
cachix-auth-token:
16+
description: Cachix auth token for nodejs.cachix.org.
17+
required: false
18+
default: ''
19+
20+
runs:
21+
using: composite
22+
steps:
23+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
24+
if: ${{ github.event_name != 'workflow_dispatch' }}
25+
with:
26+
name: tarballs
27+
path: tarballs
28+
29+
- name: Extract tarball
30+
if: ${{ github.event_name != 'workflow_dispatch' }}
31+
shell: bash
32+
run: |
33+
tar xzf tarballs/*.tar.gz -C "$RUNNER_TEMP"
34+
echo "TAR_DIR=$RUNNER_TEMP/$(basename tarballs/*.tar.gz .tar.gz)" >> "$GITHUB_ENV"
35+
36+
- uses: cachix/install-nix-action@96951a368ba55167b55f1c916f7d416bac6505fe # v31.10.3
37+
with:
38+
extra_nix_config: sandbox = true
39+
40+
- uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
41+
with:
42+
name: nodejs
43+
authToken: ${{ inputs.cachix-auth-token }}
44+
45+
- name: Configure sccache
46+
if: github.base_ref == 'main' || github.ref_name == 'main'
47+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
48+
with:
49+
script: |
50+
core.exportVariable('SCCACHE_GHA_ENABLED', 'on');
51+
core.exportVariable('ACTIONS_CACHE_SERVICE_V2', 'on');
52+
core.exportVariable('ACTIONS_RESULTS_URL', process.env.ACTIONS_RESULTS_URL || '');
53+
core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
54+
core.exportVariable('NIX_SCCACHE', '(import <nixpkgs> {}).sccache');
55+
56+
- name: Build Node.js and run tests
57+
shell: bash
58+
run: |
59+
nix-shell \
60+
-I "nixpkgs=$TAR_DIR/tools/nix/pkgs.nix" \
61+
--pure --keep TAR_DIR --keep FLAKY_TESTS \
62+
--keep SCCACHE_GHA_ENABLED --keep ACTIONS_CACHE_SERVICE_V2 --keep ACTIONS_RESULTS_URL --keep ACTIONS_RUNTIME_TOKEN \
63+
--arg loadJSBuiltinsDynamically false \
64+
--arg useSeparateDerivationForV8 true \
65+
--arg ccache "${NIX_SCCACHE:-null}" \
66+
--arg devTools '[]' \
67+
--arg benchmarkTools '[]' \
68+
${{ endsWith(inputs.system, '-darwin') && '--arg withAmaro false --arg withLief false --arg withSQLite false --arg withFFI false --arg extraConfigFlags ''["--without-inspector" "--without-node-options"]'' \' || '\' }}
69+
${{ inputs.extra-nix-args }} \
70+
--run '
71+
make -C "$TAR_DIR" run-ci -j4 V=1 TEST_CI_ARGS="-p actions --measure-flakiness 9 --skip-tests=$CI_SKIP_TESTS"
72+
' "$TAR_DIR/shell.nix"

‎.github/workflows/test-shared.yml‎

Lines changed: 92 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ on:
4747
- vcbuild.bat
4848
- .**
4949
- '!.github/workflows/test-shared.yml'
50+
- '!.github/actions/build-shared/**'
5051
types: [opened, synchronize, reopened, ready_for_review]
5152
push:
5253
branches:
@@ -97,6 +98,7 @@ on:
9798
- vcbuild.bat
9899
- .**
99100
- '!.github/workflows/test-shared.yml'
101+
- '!.github/actions/build-shared/**'
100102

101103
concurrency:
102104
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
@@ -144,59 +146,121 @@ jobs:
144146
include:
145147
- runner: ubuntu-24.04
146148
system: x86_64-linux
147-
- runner: ubuntu-24.04-arm
148-
system: aarch64-linux
149+
# built separately in build-aarch64-linux-v8
150+
# - runner: ubuntu-24.04-arm
151+
# system: aarch64-linux
149152
- runner: macos-15-intel
150153
system: x86_64-darwin
151154
- runner: macos-latest
152155
system: aarch64-darwin
153156
name: '${{ matrix.system }}: with shared libraries'
154157
runs-on: ${{ matrix.runner }}
155158
steps:
156-
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
159+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
157160
if: ${{ github.event_name != 'workflow_dispatch' }}
161+
with:
162+
persist-credentials: false
163+
sparse-checkout: .github/actions
164+
- uses: ./.github/actions/build-shared
165+
if: ${{ github.event_name != 'workflow_dispatch' }}
166+
with:
167+
system: ${{ matrix.system }}
168+
cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
169+
170+
build-aarch64-linux-v8:
171+
needs: build-tarball
172+
runs-on: ubuntu-24.04-arm
173+
name: 'aarch64-linux: Cache V8 build'
174+
steps:
175+
- name: Check if Cachix is available
176+
id: cachix-check
177+
run: echo 'IS_AVAILABLE=${{ secrets.CACHIX_AUTH_TOKEN && 'true' }}' >> "$GITHUB_OUTPUT"
178+
179+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
180+
if: ${{ steps.cachix-check.outputs.IS_AVAILABLE == 'true' }}
158181
with:
159182
name: tarballs
160183
path: tarballs
161184

162185
- name: Extract tarball
163-
if: ${{ github.event_name != 'workflow_dispatch' }}
186+
if: ${{ steps.cachix-check.outputs.IS_AVAILABLE == 'true' }}
187+
shell: bash
164188
run: |
165189
tar xzf tarballs/*.tar.gz -C "$RUNNER_TEMP"
166190
echo "TAR_DIR=$RUNNER_TEMP/$(basename tarballs/*.tar.gz .tar.gz)" >> "$GITHUB_ENV"
167191
168192
- uses: cachix/install-nix-action@96951a368ba55167b55f1c916f7d416bac6505fe # v31.10.3
193+
if: ${{ steps.cachix-check.outputs.IS_AVAILABLE == 'true' }}
169194
with:
170195
extra_nix_config: sandbox = true
171196

172197
- uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
198+
if: ${{ steps.cachix-check.outputs.IS_AVAILABLE == 'true' }}
173199
with:
174200
name: nodejs
175201
authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
176202

177-
- name: Configure sccache
178-
if: github.base_ref == 'main' || github.ref_name == 'main'
179-
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
203+
- name: Build V8 derivation
204+
if: ${{ steps.cachix-check.outputs.IS_AVAILABLE == 'true' }}
205+
run: |
206+
nix-build "$(
207+
nix-instantiate -E "builtins.filter (p: p.pname == ''v8'') (import $TAR_DIR/shell.nix { useSeparateDerivationForV8=true; }).buildInputs"
208+
)"
209+
210+
# Builds the matrix for `build-openssl` from tools/nix/openssl-matrix.json.
211+
# Output shape:
212+
# [{ "version": "3.6.1", "attr": "openssl_3_6", "continue-on-error": false }, ...]
213+
collect-openssl-versions:
214+
if: github.event.pull_request.draft == false
215+
runs-on: ubuntu-slim
216+
outputs:
217+
matrix: ${{ steps.query.outputs.matrix }}
218+
steps:
219+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
180220
with:
181-
script: |
182-
core.exportVariable('SCCACHE_GHA_ENABLED', 'on');
183-
core.exportVariable('ACTIONS_CACHE_SERVICE_V2', 'on');
184-
core.exportVariable('ACTIONS_RESULTS_URL', process.env.ACTIONS_RESULTS_URL || '');
185-
core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
186-
core.exportVariable('NIX_SCCACHE', '(import <nixpkgs> {}).sccache');
187-
188-
- name: Build Node.js and run tests
221+
persist-credentials: false
222+
sparse-checkout: tools/nix/openssl-matrix.json
223+
sparse-checkout-cone-mode: false
224+
- id: query
189225
run: |
190-
nix-shell \
191-
-I "nixpkgs=$TAR_DIR/tools/nix/pkgs.nix" \
192-
--pure --keep TAR_DIR --keep FLAKY_TESTS \
193-
--keep SCCACHE_GHA_ENABLED --keep ACTIONS_CACHE_SERVICE_V2 --keep ACTIONS_RESULTS_URL --keep ACTIONS_RUNTIME_TOKEN \
194-
--arg loadJSBuiltinsDynamically false \
195-
--arg useSeparateDerivationForV8 true \
196-
--arg ccache "${NIX_SCCACHE:-null}" \
197-
--arg devTools '[]' \
198-
--arg benchmarkTools '[]' \
199-
${{ endsWith(matrix.system, '-darwin') && '--arg withAmaro false --arg withLief false --arg withSQLite false --arg withFFI false --arg extraConfigFlags ''["--without-inspector" "--without-node-options"]'' \' || '\' }}
200-
--run '
201-
make -C "$TAR_DIR" run-ci -j4 V=1 TEST_CI_ARGS="-p actions --measure-flakiness 9 --skip-tests=$CI_SKIP_TESTS"
202-
' "$TAR_DIR/shell.nix"
226+
{
227+
echo 'matrix<<EOF'
228+
cat tools/nix/openssl-matrix.json
229+
echo 'EOF'
230+
} >> "$GITHUB_OUTPUT"
231+
232+
# Builds and tests Node.js with shared libraries against every supported
233+
# OpenSSL release version available in the repo-pinned nixpkgs. The default
234+
# shared `openssl` from tools/nix/sharedLibDeps.nix is overridden per matrix
235+
# entry, while all other shared libs remain at their defaults. Only runs on
236+
# a single runner/system (aarch64-linux) to keep the matrix to a minimum.
237+
build-openssl:
238+
needs:
239+
- build-aarch64-linux-v8
240+
- collect-openssl-versions
241+
strategy:
242+
fail-fast: false
243+
matrix:
244+
openssl: ${{ fromJSON(needs.collect-openssl-versions.outputs.matrix) }}
245+
name: 'aarch64-linux: with shared ${{ matrix.openssl.attr }} (${{ matrix.openssl.version }})'
246+
runs-on: ubuntu-24.04-arm
247+
continue-on-error: ${{ matrix.openssl['continue-on-error'] }}
248+
env:
249+
OPENSSL_ATTR: ${{ matrix.openssl.attr }}
250+
OPENSSL_VERSION: ${{ matrix.openssl.version }}
251+
steps:
252+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
253+
with:
254+
persist-credentials: false
255+
sparse-checkout: .github/actions
256+
- uses: ./.github/actions/build-shared
257+
with:
258+
system: aarch64-linux
259+
cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
260+
# Override just the `openssl` attr of the default shared-lib set with
261+
# the matrix-selected nixpkgs attribute (e.g. `openssl_3_6`). All
262+
# other shared libs (brotli, cares, libuv, …) keep their defaults.
263+
# `permittedInsecurePackages` whitelists just the matrix-selected
264+
# release (e.g. `openssl-1.1.1w`) so EOL-with-extended-support
265+
# cycles evaluate without relaxing nixpkgs' meta check globally.
266+
extra-nix-args: --arg sharedLibDeps "(import $TAR_DIR/tools/nix/sharedLibDeps.nix {}) // { openssl = (import $TAR_DIR/tools/nix/pkgs.nix { config.permittedInsecurePackages = [ \"openssl-$OPENSSL_VERSION\" ]; }).$OPENSSL_ATTR; }"

‎tools/dep_updaters/update-nixpkgs-pin.sh‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ set -ex
55

66
BASE_DIR=$(cd "$(dirname "$0")/../.." && pwd)
77
NIXPKGS_PIN_FILE="$BASE_DIR/tools/nix/pkgs.nix"
8+
OPENSSL_MATRIX_FILE="$BASE_DIR/tools/nix/openssl-matrix.json"
89

910
NIXPKGS_REPO=$(grep 'repo =' "$NIXPKGS_PIN_FILE" | awk -F'"' '{ print $2 }')
1011
CURRENT_VERSION_SHA1=$(grep 'rev =' "$NIXPKGS_PIN_FILE" | awk -F'"' '{ print $2 }')
@@ -25,12 +26,14 @@ TMP_FILE=$(mktemp)
2526
sed "s/$CURRENT_VERSION_SHA1/$NEW_UPSTREAM_SHA1/;s/$CURRENT_TARBALL_HASH/$NEW_TARBALL_HASH/" "$NIXPKGS_PIN_FILE" > "$TMP_FILE"
2627
mv "$TMP_FILE" "$NIXPKGS_PIN_FILE"
2728

29+
"$BASE_DIR/tools/nix/collect-openssl-matrix.sh" | jq . > "$OPENSSL_MATRIX_FILE"
30+
2831
cat -<<EOF
2932
All done!
3033
3134
Please git add and commit the new version:
3235
33-
$ git add $NIXPKGS_PIN_FILE
36+
$ git add $NIXPKGS_PIN_FILE $OPENSSL_MATRIX_FILE
3437
$ git commit -m 'tools: bump nixpkgs-unstable pin to $NEW_VERSION'
3538
EOF
3639

‎tools/nix/collect-openssl-matrix.sh‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
#!/bin/sh
2+
#
3+
# Emits the JSON source data of OpenSSL releases to test Node.js against with
4+
# shared libraries.
5+
#
6+
# This helper is used by tools/dep_updaters/update-nixpkgs-pin.sh to
7+
# regenerate tools/nix/openssl-matrix.json.
8+
#
9+
# Output (stdout): a JSON array with shape
10+
# [{ "version": "3.6.1", "attr": "openssl_3_6", "continue-on-error": false }, ...]
11+
#
12+
# Usage: ./tools/nix/collect-openssl-matrix.sh
13+
14+
set -eu
15+
16+
# Latest OpenSSL major.minor cycle we support
17+
# running tests with. Newer cycles are emitted
18+
# with "continue-on-error": true.
19+
SUPPORTED_OPENSSL_VERSION=4.0
20+
21+
here=$(cd -- "$(dirname -- "$0")" && pwd)
22+
23+
# 1. Enumerate every `openssl_N` / `openssl_N_M` attribute exposed by the
24+
# repo-pinned nixpkgs. `tryEval` skips aliases that raise (e.g.
25+
# `openssl_3_0` → renamed to `openssl_3`) so we only keep attributes
26+
# that resolve to a real derivation with a `.version`.
27+
nix_json=$(nix-instantiate --eval --strict --json -E "
28+
let
29+
pkgs = import $here/pkgs.nix {};
30+
names = builtins.filter
31+
(n: builtins.match \"openssl_[0-9]+(_[0-9]+)?\" n != null)
32+
(builtins.attrNames pkgs);
33+
safe = builtins.filter (n:
34+
let t = builtins.tryEval pkgs.\${n}; in
35+
t.success && (builtins.tryEval t.value.version).success) names;
36+
in map (n: { attr = n; version = pkgs.\${n}.version; }) safe
37+
")
38+
39+
# 2. Fetch OpenSSL release versions from endoflife.date, keep entries that
40+
# are either not past EOL or still under extended support, then pick the
41+
# first nix attr whose `.version` starts with the release version
42+
# followed by `.` / letter / end-of-string (so "3.6" matches "3.6.1",
43+
# "1.1.1" matches "1.1.1w", and "1.1" does NOT swallow "1.1.1").
44+
# Releases without a matching nix attr are dropped.
45+
curl -sf https://endoflife.date/api/openssl.json \
46+
| jq -c \
47+
--argjson nix "$nix_json" \
48+
--arg supported "$SUPPORTED_OPENSSL_VERSION" '
49+
(now | strftime("%Y-%m-%d")) as $today |
50+
# Compare OpenSSL major.minor cycles as numeric tuples.
51+
def cycle_tuple($v):
52+
($v | split(".") | map(tonumber));
53+
[ .[]
54+
| select(.eol == false or .eol > $today or .extendedSupport == true)
55+
| .cycle as $v
56+
| ($nix
57+
| map(select(.version | test("^" + ($v | gsub("\\."; "\\.")) + "([.a-z]|$)")))
58+
| first) as $m
59+
| select($m != null)
60+
| {
61+
version: $m.version,
62+
attr: $m.attr,
63+
"continue-on-error": (cycle_tuple($v) > cycle_tuple($supported))
64+
}
65+
]'

‎tools/nix/openssl-matrix.json‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
[
2+
{
3+
"version": "4.0.0",
4+
"attr": "openssl_4_0",
5+
"continue-on-error": false
6+
},
7+
{
8+
"version": "3.6.1",
9+
"attr": "openssl_3_6",
10+
"continue-on-error": false
11+
},
12+
{
13+
"version": "3.5.5",
14+
"attr": "openssl_3_5",
15+
"continue-on-error": false
16+
},
17+
{
18+
"version": "3.0.19",
19+
"attr": "openssl_3",
20+
"continue-on-error": false
21+
},
22+
{
23+
"version": "1.1.1w",
24+
"attr": "openssl_1_1",
25+
"continue-on-error": false
26+
}
27+
]

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL