Skip to content

Commit 5a7baff

Browse files
panvapanva
committed
let the updater drive the matrix in the workflow
1 parent 1311e12 commit 5a7baff

3 files changed

Lines changed: 82 additions & 51 deletions

File tree

‎.github/workflows/test-shared.yml‎

Lines changed: 18 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,9 @@ concurrency:
106106

107107
env:
108108
FLAKY_TESTS: keep_retrying
109+
# Latest OpenSSL major.minor cycle we support running tests with.
110+
# The nixpkgs updater regenerates the OpenSSL matrix using this value.
111+
SUPPORTED_OPENSSL_VERSION: '4.0'
109112

110113
permissions:
111114
contents: read
@@ -166,33 +169,6 @@ jobs:
166169
system: ${{ matrix.system }}
167170
cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
168171

169-
# Builds the matrix for the `build-openssl` job. The logic lives in
170-
# tools/nix/collect-openssl-matrix.sh.
171-
# Output shape:
172-
# [{ "version": "3.6.1", "attr": "openssl_3_6", "continue-on-error": false }, ...]
173-
collect-openssl-versions:
174-
if: github.event.pull_request.draft == false
175-
runs-on: ubuntu-slim
176-
outputs:
177-
matrix: ${{ steps.query.outputs.matrix }}
178-
steps:
179-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
180-
with:
181-
persist-credentials: false
182-
sparse-checkout: tools/nix
183-
sparse-checkout-cone-mode: false
184-
- uses: cachix/install-nix-action@96951a368ba55167b55f1c916f7d416bac6505fe # v31.10.3
185-
with:
186-
extra_nix_config: sandbox = true
187-
- id: query
188-
env:
189-
# Latest OpenSSL release we support running tests with. Anything
190-
# newer runs with continue-on-error in `build-openssl`.
191-
SUPPORTED_OPENSSL_VERSION: '4.0'
192-
run: |
193-
matrix=$(./tools/nix/collect-openssl-matrix.sh)
194-
echo "matrix=$matrix" >> "$GITHUB_OUTPUT"
195-
196172
# Builds and tests Node.js with shared libraries against every supported
197173
# OpenSSL release version available in the repo-pinned nixpkgs. The default
198174
# shared `openssl` from tools/nix/sharedLibDeps.nix is overridden per matrix
@@ -201,11 +177,24 @@ jobs:
201177
build-openssl:
202178
needs:
203179
- build-tarball
204-
- collect-openssl-versions
205180
strategy:
206181
fail-fast: false
207182
matrix:
208-
openssl: ${{ fromJSON(needs.collect-openssl-versions.outputs.matrix) }}
183+
openssl:
184+
# BEGIN_OPENSSL_MATRIX (autogenerated by tools/dep_updaters/update-nixpkgs-pin.sh)
185+
- version: 4.0.0
186+
attr: openssl_4_0
187+
continue-on-error: false
188+
- version: 3.6.1
189+
attr: openssl_3_6
190+
continue-on-error: false
191+
- version: 3.0.19
192+
attr: openssl_3
193+
continue-on-error: false
194+
- version: 1.1.1w
195+
attr: openssl_1_1
196+
continue-on-error: false
197+
# END_OPENSSL_MATRIX
209198
name: 'aarch64-linux: with shared ${{ matrix.openssl.attr }} (${{ matrix.openssl.version }})'
210199
runs-on: ubuntu-24.04-arm
211200
continue-on-error: ${{ matrix.openssl['continue-on-error'] }}

‎tools/dep_updaters/update-nixpkgs-pin.sh‎

Lines changed: 56 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ set -ex
55

66
BASE_DIR=$(cd "$(dirname "$0")/../.." && pwd)
77
NIXPKGS_PIN_FILE="$BASE_DIR/tools/nix/pkgs.nix"
8+
TEST_SHARED_WORKFLOW_FILE="$BASE_DIR/.github/workflows/test-shared.yml"
89

910
NIXPKGS_REPO=$(grep 'repo =' "$NIXPKGS_PIN_FILE" | awk -F'"' '{ print $2 }')
1011
CURRENT_VERSION_SHA1=$(grep 'rev =' "$NIXPKGS_PIN_FILE" | awk -F'"' '{ print $2 }')
@@ -25,12 +26,66 @@ TMP_FILE=$(mktemp)
2526
sed "s/$CURRENT_VERSION_SHA1/$NEW_UPSTREAM_SHA1/;s/$CURRENT_TARBALL_HASH/$NEW_TARBALL_HASH/" "$NIXPKGS_PIN_FILE" > "$TMP_FILE"
2627
mv "$TMP_FILE" "$NIXPKGS_PIN_FILE"
2728

29+
SUPPORTED_OPENSSL_VERSION=$(sed -nE "s/^[[:space:]]*SUPPORTED_OPENSSL_VERSION:[[:space:]]*'([^']+)'[[:space:]]*$/\1/p" "$TEST_SHARED_WORKFLOW_FILE" | head -n1)
30+
31+
if [ -z "$SUPPORTED_OPENSSL_VERSION" ]; then
32+
echo "Could not resolve SUPPORTED_OPENSSL_VERSION from $TEST_SHARED_WORKFLOW_FILE" >&2
33+
exit 1
34+
fi
35+
36+
OPENSSL_MATRIX_BLOCK=$("$BASE_DIR/tools/nix/collect-openssl-matrix.sh" | jq -r --arg supported "$SUPPORTED_OPENSSL_VERSION" '
37+
# Compare OpenSSL major.minor cycles as numeric tuples.
38+
def cycle_tuple($v):
39+
($v | capture("^(?<cycle>[0-9]+\\.[0-9]+)").cycle | split(".") | map(tonumber));
40+
[
41+
" # BEGIN_OPENSSL_MATRIX (autogenerated by tools/dep_updaters/update-nixpkgs-pin.sh)",
42+
(
43+
.[]
44+
| " - version: \(.version)\n attr: \(.attr)\n continue-on-error: \(cycle_tuple(.version) > cycle_tuple($supported))"
45+
),
46+
" # END_OPENSSL_MATRIX"
47+
]
48+
| join("\n")
49+
')
50+
51+
if ! grep -q "BEGIN_OPENSSL_MATRIX" "$TEST_SHARED_WORKFLOW_FILE"; then
52+
echo "Could not find BEGIN_OPENSSL_MATRIX marker in $TEST_SHARED_WORKFLOW_FILE" >&2
53+
exit 1
54+
fi
55+
56+
if ! grep -q "END_OPENSSL_MATRIX" "$TEST_SHARED_WORKFLOW_FILE"; then
57+
echo "Could not find END_OPENSSL_MATRIX marker in $TEST_SHARED_WORKFLOW_FILE" >&2
58+
exit 1
59+
fi
60+
61+
TMP_WORKFLOW_FILE=$(mktemp)
62+
TMP_BLOCK_FILE=$(mktemp)
63+
printf '%s\n' "$OPENSSL_MATRIX_BLOCK" > "$TMP_BLOCK_FILE"
64+
65+
awk -v block_file="$TMP_BLOCK_FILE" '
66+
/BEGIN_OPENSSL_MATRIX/ {
67+
while ((getline line < block_file) > 0) {
68+
print line;
69+
}
70+
close(block_file);
71+
in_block = 1;
72+
next;
73+
}
74+
/END_OPENSSL_MATRIX/ {
75+
in_block = 0;
76+
next;
77+
}
78+
!in_block { print }
79+
' "$TEST_SHARED_WORKFLOW_FILE" > "$TMP_WORKFLOW_FILE"
80+
mv "$TMP_WORKFLOW_FILE" "$TEST_SHARED_WORKFLOW_FILE"
81+
rm -f "$TMP_BLOCK_FILE"
82+
2883
cat -<<EOF
2984
All done!
3085
3186
Please git add and commit the new version:
3287
33-
$ git add $NIXPKGS_PIN_FILE
88+
$ git add $NIXPKGS_PIN_FILE $TEST_SHARED_WORKFLOW_FILE
3489
$ git commit -m 'tools: bump nixpkgs-unstable pin to $NEW_VERSION'
3590
EOF
3691

‎tools/nix/collect-openssl-matrix.sh‎

Lines changed: 8 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,19 @@
11
#!/bin/sh
22
#
3-
# Emits a JSON matrix of OpenSSL releases to test Node.js against with
4-
# shared libraries, consumed by the `build-openssl` job in
5-
# .github/workflows/test-shared.yml.
3+
# Emits the JSON source data of OpenSSL releases to test Node.js against with
4+
# shared libraries.
65
#
7-
# Inputs (env):
8-
# SUPPORTED_OPENSSL_VERSION Latest OpenSSL release we support running
9-
# tests with. Anything newer is emitted with
10-
# "continue-on-error": true.
6+
# This helper is used by tools/dep_updaters/update-nixpkgs-pin.sh to
7+
# regenerate the autogenerated OpenSSL matrix block in
8+
# .github/workflows/test-shared.yml.
119
#
1210
# Output (stdout): a JSON array with shape
13-
# [{ "version": "3.6.1", "attr": "openssl_3_6", "continue-on-error": false }, ...]
11+
# [{ "version": "3.6.1", "attr": "openssl_3_6" }, ...]
1412
#
15-
# Usage: SUPPORTED_OPENSSL_VERSION=4.0 ./tools/nix/collect-openssl-matrix.sh
13+
# Usage: ./tools/nix/collect-openssl-matrix.sh
1614

1715
set -eu
1816

19-
: "${SUPPORTED_OPENSSL_VERSION:?SUPPORTED_OPENSSL_VERSION must be set}"
20-
2117
here=$(cd -- "$(dirname -- "$0")" && pwd)
2218

2319
# 1. Enumerate every `openssl_N` / `openssl_N_M` attribute exposed by the
@@ -53,17 +49,8 @@ default_openssl_version=$(nix-instantiate --eval --strict --json -E "
5349
curl -sf https://endoflife.date/api/openssl.json \
5450
| jq -c \
5551
--argjson nix "$nix_json" \
56-
--arg supported "$SUPPORTED_OPENSSL_VERSION" \
5752
--arg default_version "$default_openssl_version" '
5853
(now | strftime("%Y-%m-%d")) as $today |
59-
# Compare two dotted version strings as arrays of numbers
60-
# (e.g. "4.1" > "4.0" => true, "4.0" > "4.0" => false).
61-
def gt($a; $b):
62-
([$a, $b] | map(split(".") | map(tonumber))) as [$x, $y]
63-
| ($x | length) as $n | ($y | length) as $m
64-
| [range(0; if $n > $m then $n else $m end)
65-
| ((($x[.]) // 0) - (($y[.]) // 0))]
66-
| map(select(. != 0)) | (.[0] // 0) > 0;
6754
[ .[]
6855
| select(.eol == false or .eol > $today or .extendedSupport == true)
6956
| .cycle as $v
@@ -72,5 +59,5 @@ curl -sf https://endoflife.date/api/openssl.json \
7259
| first) as $m
7360
| select($m != null)
7461
| select($m.version != $default_version)
75-
| { version: $m.version, attr: $m.attr, "continue-on-error": gt($v; $supported) }
62+
| { version: $m.version, attr: $m.attr }
7663
]'

0 commit comments

Comments
 (0)