Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 027bef4

Browse filesBrowse files
panvaaduh95
panva
authored and
aduh95
committed
tools: add non-default OpenSSL versions to the test-shared workflow
Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #62862 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
1 parent b9f3abd commit 027bef4
Copy full SHA for 027bef4

5 files changed

+260-29Lines changed: 260 additions & 29 deletions

File tree

Expand file treeCollapse file tree
Open diff view settings
Filter options
Expand file treeCollapse file tree
Open diff view settings
Collapse file

‎.github/actions/build-shared/action.yml‎

Copy file name to clipboard
+72Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
name: Build Node.js (shared libraries)
2+
description: >
3+
Downloads the slim tarball built by the `build-tarball` job, extracts it,
4+
installs Nix (+ cachix + sccache), then builds Node.js and runs the CI
5+
test suite inside the pinned nix-shell.
6+
7+
inputs:
8+
system:
9+
description: System label (e.g. x86_64-linux, aarch64-darwin).
10+
required: true
11+
extra-nix-args:
12+
description: Additional arguments appended to the nix-shell invocation.
13+
required: false
14+
default: ''
15+
cachix-auth-token:
16+
description: Cachix auth token for nodejs.cachix.org.
17+
required: false
18+
default: ''
19+
20+
runs:
21+
using: composite
22+
steps:
23+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
24+
if: ${{ github.event_name != 'workflow_dispatch' }}
25+
with:
26+
name: tarballs
27+
path: tarballs
28+
29+
- name: Extract tarball
30+
if: ${{ github.event_name != 'workflow_dispatch' }}
31+
shell: bash
32+
run: |
33+
tar xzf tarballs/*.tar.gz -C "$RUNNER_TEMP"
34+
echo "TAR_DIR=$RUNNER_TEMP/$(basename tarballs/*.tar.gz .tar.gz)" >> "$GITHUB_ENV"
35+
36+
- uses: cachix/install-nix-action@96951a368ba55167b55f1c916f7d416bac6505fe # v31.10.3
37+
with:
38+
extra_nix_config: sandbox = true
39+
40+
- uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
41+
with:
42+
name: nodejs
43+
authToken: ${{ inputs.cachix-auth-token }}
44+
45+
- name: Configure sccache
46+
if: github.base_ref == 'main' || github.ref_name == 'main'
47+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
48+
with:
49+
script: |
50+
core.exportVariable('SCCACHE_GHA_ENABLED', 'on');
51+
core.exportVariable('ACTIONS_CACHE_SERVICE_V2', 'on');
52+
core.exportVariable('ACTIONS_RESULTS_URL', process.env.ACTIONS_RESULTS_URL || '');
53+
core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
54+
core.exportVariable('NIX_SCCACHE', '(import <nixpkgs> {}).sccache');
55+
56+
- name: Build Node.js and run tests
57+
shell: bash
58+
run: |
59+
nix-shell \
60+
-I "nixpkgs=$TAR_DIR/tools/nix/pkgs.nix" \
61+
--pure --keep TAR_DIR --keep FLAKY_TESTS \
62+
--keep SCCACHE_GHA_ENABLED --keep ACTIONS_CACHE_SERVICE_V2 --keep ACTIONS_RESULTS_URL --keep ACTIONS_RUNTIME_TOKEN \
63+
--arg loadJSBuiltinsDynamically false \
64+
--arg useSeparateDerivationForV8 true \
65+
--arg ccache "${NIX_SCCACHE:-null}" \
66+
--arg devTools '[]' \
67+
--arg benchmarkTools '[]' \
68+
${{ endsWith(inputs.system, '-darwin') && '--arg withAmaro false --arg withLief false --arg withSQLite false --arg withFFI false --arg extraConfigFlags ''["--without-inspector" "--without-node-options"]'' \' || '\' }}
69+
${{ inputs.extra-nix-args }} \
70+
--run '
71+
make -C "$TAR_DIR" run-ci -j4 V=1 TEST_CI_ARGS="-p actions --measure-flakiness 9 --skip-tests=$CI_SKIP_TESTS"
72+
' "$TAR_DIR/shell.nix"
Collapse file

‎.github/workflows/test-shared.yml‎

Copy file name to clipboardExpand all lines: .github/workflows/test-shared.yml
+92-28Lines changed: 92 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ on:
4747
- vcbuild.bat
4848
- .**
4949
- '!.github/workflows/test-shared.yml'
50+
- '!.github/actions/build-shared/**'
5051
types: [opened, synchronize, reopened, ready_for_review]
5152
push:
5253
branches:
@@ -97,6 +98,7 @@ on:
9798
- vcbuild.bat
9899
- .**
99100
- '!.github/workflows/test-shared.yml'
101+
- '!.github/actions/build-shared/**'
100102

101103
concurrency:
102104
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
@@ -144,59 +146,121 @@ jobs:
144146
include:
145147
- runner: ubuntu-24.04
146148
system: x86_64-linux
147-
- runner: ubuntu-24.04-arm
148-
system: aarch64-linux
149+
# built separately in build-aarch64-linux-v8
150+
# - runner: ubuntu-24.04-arm
151+
# system: aarch64-linux
149152
- runner: macos-15-intel
150153
system: x86_64-darwin
151154
- runner: macos-latest
152155
system: aarch64-darwin
153156
name: '${{ matrix.system }}: with shared libraries'
154157
runs-on: ${{ matrix.runner }}
155158
steps:
156-
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
159+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
157160
if: ${{ github.event_name != 'workflow_dispatch' }}
161+
with:
162+
persist-credentials: false
163+
sparse-checkout: .github/actions
164+
- uses: ./.github/actions/build-shared
165+
if: ${{ github.event_name != 'workflow_dispatch' }}
166+
with:
167+
system: ${{ matrix.system }}
168+
cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
169+
170+
build-aarch64-linux-v8:
171+
needs: build-tarball
172+
runs-on: ubuntu-24.04-arm
173+
name: 'aarch64-linux: Cache V8 build'
174+
steps:
175+
- name: Check if Cachix is available
176+
id: cachix-check
177+
run: echo 'IS_AVAILABLE=${{ secrets.CACHIX_AUTH_TOKEN && 'true' }}' >> "$GITHUB_OUTPUT"
178+
179+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
180+
if: ${{ steps.cachix-check.outputs.IS_AVAILABLE == 'true' }}
158181
with:
159182
name: tarballs
160183
path: tarballs
161184

162185
- name: Extract tarball
163-
if: ${{ github.event_name != 'workflow_dispatch' }}
186+
if: ${{ steps.cachix-check.outputs.IS_AVAILABLE == 'true' }}
187+
shell: bash
164188
run: |
165189
tar xzf tarballs/*.tar.gz -C "$RUNNER_TEMP"
166190
echo "TAR_DIR=$RUNNER_TEMP/$(basename tarballs/*.tar.gz .tar.gz)" >> "$GITHUB_ENV"
167191
168192
- uses: cachix/install-nix-action@96951a368ba55167b55f1c916f7d416bac6505fe # v31.10.3
193+
if: ${{ steps.cachix-check.outputs.IS_AVAILABLE == 'true' }}
169194
with:
170195
extra_nix_config: sandbox = true
171196

172197
- uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
198+
if: ${{ steps.cachix-check.outputs.IS_AVAILABLE == 'true' }}
173199
with:
174200
name: nodejs
175201
authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
176202

177-
- name: Configure sccache
178-
if: github.base_ref == 'main' || github.ref_name == 'main'
179-
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
203+
- name: Build V8 derivation
204+
if: ${{ steps.cachix-check.outputs.IS_AVAILABLE == 'true' }}
205+
run: |
206+
nix-build "$(
207+
nix-instantiate -E "builtins.filter (p: p.pname == ''v8'') (import $TAR_DIR/shell.nix { useSeparateDerivationForV8=true; }).buildInputs"
208+
)"
209+
210+
# Builds the matrix for `build-openssl` from tools/nix/openssl-matrix.json.
211+
# Output shape:
212+
# [{ "version": "3.6.1", "attr": "openssl_3_6", "continue-on-error": false }, ...]
213+
collect-openssl-versions:
214+
if: github.event.pull_request.draft == false
215+
runs-on: ubuntu-slim
216+
outputs:
217+
matrix: ${{ steps.query.outputs.matrix }}
218+
steps:
219+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
180220
with:
181-
script: |
182-
core.exportVariable('SCCACHE_GHA_ENABLED', 'on');
183-
core.exportVariable('ACTIONS_CACHE_SERVICE_V2', 'on');
184-
core.exportVariable('ACTIONS_RESULTS_URL', process.env.ACTIONS_RESULTS_URL || '');
185-
core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
186-
core.exportVariable('NIX_SCCACHE', '(import <nixpkgs> {}).sccache');
187-
188-
- name: Build Node.js and run tests
221+
persist-credentials: false
222+
sparse-checkout: tools/nix/openssl-matrix.json
223+
sparse-checkout-cone-mode: false
224+
- id: query
189225
run: |
190-
nix-shell \
191-
-I "nixpkgs=$TAR_DIR/tools/nix/pkgs.nix" \
192-
--pure --keep TAR_DIR --keep FLAKY_TESTS \
193-
--keep SCCACHE_GHA_ENABLED --keep ACTIONS_CACHE_SERVICE_V2 --keep ACTIONS_RESULTS_URL --keep ACTIONS_RUNTIME_TOKEN \
194-
--arg loadJSBuiltinsDynamically false \
195-
--arg useSeparateDerivationForV8 true \
196-
--arg ccache "${NIX_SCCACHE:-null}" \
197-
--arg devTools '[]' \
198-
--arg benchmarkTools '[]' \
199-
${{ endsWith(matrix.system, '-darwin') && '--arg withAmaro false --arg withLief false --arg withSQLite false --arg withFFI false --arg extraConfigFlags ''["--without-inspector" "--without-node-options"]'' \' || '\' }}
200-
--run '
201-
make -C "$TAR_DIR" run-ci -j4 V=1 TEST_CI_ARGS="-p actions --measure-flakiness 9 --skip-tests=$CI_SKIP_TESTS"
202-
' "$TAR_DIR/shell.nix"
226+
{
227+
echo 'matrix<<EOF'
228+
cat tools/nix/openssl-matrix.json
229+
echo 'EOF'
230+
} >> "$GITHUB_OUTPUT"
231+
232+
# Builds and tests Node.js with shared libraries against every supported
233+
# OpenSSL release version available in the repo-pinned nixpkgs. The default
234+
# shared `openssl` from tools/nix/sharedLibDeps.nix is overridden per matrix
235+
# entry, while all other shared libs remain at their defaults. Only runs on
236+
# a single runner/system (aarch64-linux) to keep the matrix to a minimum.
237+
build-openssl:
238+
needs:
239+
- build-aarch64-linux-v8
240+
- collect-openssl-versions
241+
strategy:
242+
fail-fast: false
243+
matrix:
244+
openssl: ${{ fromJSON(needs.collect-openssl-versions.outputs.matrix) }}
245+
name: 'aarch64-linux: with shared ${{ matrix.openssl.attr }} (${{ matrix.openssl.version }})'
246+
runs-on: ubuntu-24.04-arm
247+
continue-on-error: ${{ matrix.openssl['continue-on-error'] }}
248+
env:
249+
OPENSSL_ATTR: ${{ matrix.openssl.attr }}
250+
OPENSSL_VERSION: ${{ matrix.openssl.version }}
251+
steps:
252+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
253+
with:
254+
persist-credentials: false
255+
sparse-checkout: .github/actions
256+
- uses: ./.github/actions/build-shared
257+
with:
258+
system: aarch64-linux
259+
cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
260+
# Override just the `openssl` attr of the default shared-lib set with
261+
# the matrix-selected nixpkgs attribute (e.g. `openssl_3_6`). All
262+
# other shared libs (brotli, cares, libuv, …) keep their defaults.
263+
# `permittedInsecurePackages` whitelists just the matrix-selected
264+
# release (e.g. `openssl-1.1.1w`) so EOL-with-extended-support
265+
# cycles evaluate without relaxing nixpkgs' meta check globally.
266+
extra-nix-args: --arg sharedLibDeps "(import $TAR_DIR/tools/nix/sharedLibDeps.nix {}) // { openssl = (import $TAR_DIR/tools/nix/pkgs.nix { config.permittedInsecurePackages = [ \"openssl-$OPENSSL_VERSION\" ]; }).$OPENSSL_ATTR; }"
Collapse file

‎tools/dep_updaters/update-nixpkgs-pin.sh‎

Copy file name to clipboardExpand all lines: tools/dep_updaters/update-nixpkgs-pin.sh
+4-1Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ set -ex
55

66
BASE_DIR=$(cd "$(dirname "$0")/../.." && pwd)
77
NIXPKGS_PIN_FILE="$BASE_DIR/tools/nix/pkgs.nix"
8+
OPENSSL_MATRIX_FILE="$BASE_DIR/tools/nix/openssl-matrix.json"
89

910
NIXPKGS_REPO=$(grep 'repo =' "$NIXPKGS_PIN_FILE" | awk -F'"' '{ print $2 }')
1011
CURRENT_VERSION_SHA1=$(grep 'rev =' "$NIXPKGS_PIN_FILE" | awk -F'"' '{ print $2 }')
@@ -25,12 +26,14 @@ TMP_FILE=$(mktemp)
2526
sed "s/$CURRENT_VERSION_SHA1/$NEW_UPSTREAM_SHA1/;s/$CURRENT_TARBALL_HASH/$NEW_TARBALL_HASH/" "$NIXPKGS_PIN_FILE" > "$TMP_FILE"
2627
mv "$TMP_FILE" "$NIXPKGS_PIN_FILE"
2728

29+
"$BASE_DIR/tools/nix/collect-openssl-matrix.sh" | jq . > "$OPENSSL_MATRIX_FILE"
30+
2831
cat -<<EOF
2932
All done!
3033
3134
Please git add and commit the new version:
3235
33-
$ git add $NIXPKGS_PIN_FILE
36+
$ git add $NIXPKGS_PIN_FILE $OPENSSL_MATRIX_FILE
3437
$ git commit -m 'tools: bump nixpkgs-unstable pin to $NEW_VERSION'
3538
EOF
3639

Collapse file

‎tools/nix/collect-openssl-matrix.sh‎

Copy file name to clipboard
+65Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
#!/bin/sh
2+
#
3+
# Emits the JSON source data of OpenSSL releases to test Node.js against with
4+
# shared libraries.
5+
#
6+
# This helper is used by tools/dep_updaters/update-nixpkgs-pin.sh to
7+
# regenerate tools/nix/openssl-matrix.json.
8+
#
9+
# Output (stdout): a JSON array with shape
10+
# [{ "version": "3.6.1", "attr": "openssl_3_6", "continue-on-error": false }, ...]
11+
#
12+
# Usage: ./tools/nix/collect-openssl-matrix.sh
13+
14+
set -eu
15+
16+
# Latest OpenSSL major.minor cycle we support
17+
# running tests with. Newer cycles are emitted
18+
# with "continue-on-error": true.
19+
SUPPORTED_OPENSSL_VERSION=4.0
20+
21+
here=$(cd -- "$(dirname -- "$0")" && pwd)
22+
23+
# 1. Enumerate every `openssl_N` / `openssl_N_M` attribute exposed by the
24+
# repo-pinned nixpkgs. `tryEval` skips aliases that raise (e.g.
25+
# `openssl_3_0` → renamed to `openssl_3`) so we only keep attributes
26+
# that resolve to a real derivation with a `.version`.
27+
nix_json=$(nix-instantiate --eval --strict --json -E "
28+
let
29+
pkgs = import $here/pkgs.nix {};
30+
names = builtins.filter
31+
(n: builtins.match \"openssl_[0-9]+(_[0-9]+)?\" n != null)
32+
(builtins.attrNames pkgs);
33+
safe = builtins.filter (n:
34+
let t = builtins.tryEval pkgs.\${n}; in
35+
t.success && (builtins.tryEval t.value.version).success) names;
36+
in map (n: { attr = n; version = pkgs.\${n}.version; }) safe
37+
")
38+
39+
# 2. Fetch OpenSSL release versions from endoflife.date, keep entries that
40+
# are either not past EOL or still under extended support, then pick the
41+
# first nix attr whose `.version` starts with the release version
42+
# followed by `.` / letter / end-of-string (so "3.6" matches "3.6.1",
43+
# "1.1.1" matches "1.1.1w", and "1.1" does NOT swallow "1.1.1").
44+
# Releases without a matching nix attr are dropped.
45+
curl -sf https://endoflife.date/api/openssl.json \
46+
| jq -c \
47+
--argjson nix "$nix_json" \
48+
--arg supported "$SUPPORTED_OPENSSL_VERSION" '
49+
(now | strftime("%Y-%m-%d")) as $today |
50+
# Compare OpenSSL major.minor cycles as numeric tuples.
51+
def cycle_tuple($v):
52+
($v | split(".") | map(tonumber));
53+
[ .[]
54+
| select(.eol == false or .eol > $today or .extendedSupport == true)
55+
| .cycle as $v
56+
| ($nix
57+
| map(select(.version | test("^" + ($v | gsub("\\."; "\\.")) + "([.a-z]|$)")))
58+
| first) as $m
59+
| select($m != null)
60+
| {
61+
version: $m.version,
62+
attr: $m.attr,
63+
"continue-on-error": (cycle_tuple($v) > cycle_tuple($supported))
64+
}
65+
]'
Collapse file

‎tools/nix/openssl-matrix.json‎

Copy file name to clipboard
+27Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
[
2+
{
3+
"version": "4.0.0",
4+
"attr": "openssl_4_0",
5+
"continue-on-error": false
6+
},
7+
{
8+
"version": "3.6.1",
9+
"attr": "openssl_3_6",
10+
"continue-on-error": false
11+
},
12+
{
13+
"version": "3.5.5",
14+
"attr": "openssl_3_5",
15+
"continue-on-error": false
16+
},
17+
{
18+
"version": "3.0.19",
19+
"attr": "openssl_3",
20+
"continue-on-error": false
21+
},
22+
{
23+
"version": "1.1.1w",
24+
"attr": "openssl_1_1",
25+
"continue-on-error": false
26+
}
27+
]

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.