Skip to content

Commit 7dcc129

Browse files
panvapanva
committed
tools: add non-default OpenSSL versions to the test-shared workflow
Signed-off-by: Filip Skokan <[email protected]>
1 parent 3e32a13 commit 7dcc129

2 files changed

Lines changed: 170 additions & 0 deletions

File tree

‎.github/workflows/test-shared.yml‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -200,3 +200,99 @@ jobs:
200200
--run '
201201
make -C "$TAR_DIR" run-ci -j4 V=1 TEST_CI_ARGS="-p actions --measure-flakiness 9 --skip-tests=$CI_SKIP_TESTS"
202202
' "$TAR_DIR/shell.nix"
203+
204+
# Builds the matrix for the `build-openssl` job. The logic lives in
205+
# tools/nix/collect-openssl-matrix.sh.
206+
# Output shape:
207+
# [{ "version": "3.6", "attr": "openssl_3_6", "continue-on-error": false }, ...]
208+
collect-openssl-versions:
209+
if: github.event.pull_request.draft == false
210+
runs-on: ubuntu-slim
211+
outputs:
212+
matrix: ${{ steps.query.outputs.matrix }}
213+
steps:
214+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
215+
with:
216+
persist-credentials: false
217+
sparse-checkout: tools/nix
218+
sparse-checkout-cone-mode: false
219+
- uses: cachix/install-nix-action@96951a368ba55167b55f1c916f7d416bac6505fe # v31.10.3
220+
with:
221+
extra_nix_config: sandbox = true
222+
- id: query
223+
env:
224+
# Latest OpenSSL release we support running tests with. Anything
225+
# newer runs with continue-on-error in `build-openssl`.
226+
SUPPORTED_OPENSSL_VERSION: '4.0'
227+
run: |
228+
matrix=$(./tools/nix/collect-openssl-matrix.sh)
229+
echo "matrix=$matrix" >> "$GITHUB_OUTPUT"
230+
231+
# Builds and tests Node.js with shared libraries against every supported
232+
# OpenSSL release version available in the repo-pinned nixpkgs. The default
233+
# shared `openssl` from tools/nix/sharedLibDeps.nix is overridden per matrix
234+
# entry, while all other shared libs remain at their defaults. Only runs on
235+
# a single runner/system (x86_64-linux) to keep the matrix to a minimum.
236+
build-openssl:
237+
needs:
238+
- build-tarball
239+
- collect-openssl-versions
240+
strategy:
241+
fail-fast: false
242+
matrix:
243+
openssl: ${{ fromJSON(needs.collect-openssl-versions.outputs.matrix) }}
244+
name: 'x86_64-linux: with shared ${{ matrix.openssl.attr }} (${{ matrix.openssl.version }})'
245+
runs-on: ubuntu-24.04
246+
continue-on-error: ${{ matrix.openssl['continue-on-error'] }}
247+
steps:
248+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
249+
with:
250+
name: tarballs
251+
path: tarballs
252+
253+
- name: Extract tarball
254+
run: |
255+
tar xzf tarballs/*.tar.gz -C "$RUNNER_TEMP"
256+
echo "TAR_DIR=$RUNNER_TEMP/$(basename tarballs/*.tar.gz .tar.gz)" >> "$GITHUB_ENV"
257+
258+
- uses: cachix/install-nix-action@96951a368ba55167b55f1c916f7d416bac6505fe # v31.10.3
259+
with:
260+
extra_nix_config: sandbox = true
261+
262+
- uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
263+
with:
264+
name: nodejs
265+
authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
266+
267+
- name: Configure sccache
268+
if: github.base_ref == 'main' || github.ref_name == 'main'
269+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
270+
with:
271+
script: |
272+
core.exportVariable('SCCACHE_GHA_ENABLED', 'on');
273+
core.exportVariable('ACTIONS_CACHE_SERVICE_V2', 'on');
274+
core.exportVariable('ACTIONS_RESULTS_URL', process.env.ACTIONS_RESULTS_URL || '');
275+
core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
276+
core.exportVariable('NIX_SCCACHE', '(import <nixpkgs> {}).sccache');
277+
278+
- name: Build Node.js and run tests
279+
env:
280+
OPENSSL_ATTR: ${{ matrix.openssl.attr }}
281+
run: |
282+
# Same invocation as the `build` job, except `--arg sharedLibDeps`
283+
# overrides the `openssl` attr of the default shared-lib set with
284+
# the matrix-selected nixpkgs attribute (e.g. `openssl_3_6`). All
285+
# other shared libs (brotli, cares, libuv, …) keep their defaults.
286+
nix-shell \
287+
-I "nixpkgs=$TAR_DIR/tools/nix/pkgs.nix" \
288+
--pure --keep TAR_DIR --keep FLAKY_TESTS \
289+
--keep SCCACHE_GHA_ENABLED --keep ACTIONS_CACHE_SERVICE_V2 --keep ACTIONS_RESULTS_URL --keep ACTIONS_RUNTIME_TOKEN \
290+
--arg loadJSBuiltinsDynamically false \
291+
--arg useSeparateDerivationForV8 true \
292+
--arg ccache "${NIX_SCCACHE:-null}" \
293+
--arg devTools '[]' \
294+
--arg benchmarkTools '[]' \
295+
--arg sharedLibDeps "(import $TAR_DIR/tools/nix/sharedLibDeps.nix {}) // { openssl = (import $TAR_DIR/tools/nix/pkgs.nix {}).$OPENSSL_ATTR; }" \
296+
--run '
297+
make -C "$TAR_DIR" run-ci -j4 V=1 TEST_CI_ARGS="-p actions --measure-flakiness 9 --skip-tests=$CI_SKIP_TESTS"
298+
' "$TAR_DIR/shell.nix"

‎tools/nix/collect-openssl-matrix.sh‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
#!/usr/bin/env bash
2+
#
3+
# Emits a JSON matrix of OpenSSL releases to test Node.js against with
4+
# shared libraries, consumed by the `build-openssl` job in
5+
# .github/workflows/test-shared.yml.
6+
#
7+
# Inputs (env):
8+
# SUPPORTED_OPENSSL_VERSION Latest OpenSSL release we support running
9+
# tests with. Anything newer is emitted with
10+
# "continue-on-error": true.
11+
#
12+
# Output (stdout): a JSON array with shape
13+
# [{ "version": "3.6", "attr": "openssl_3_6", "continue-on-error": false }, ...]
14+
#
15+
# Usage: SUPPORTED_OPENSSL_VERSION=4.0 ./tools/nix/collect-openssl-matrix.sh
16+
17+
set -euo pipefail
18+
19+
here=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
20+
21+
# 1. Enumerate every `openssl_N` / `openssl_N_M` attribute exposed by the
22+
# repo-pinned nixpkgs. `tryEval` skips aliases that raise (e.g.
23+
# `openssl_3_0` → renamed to `openssl_3`) so we only keep attributes
24+
# that resolve to a real derivation with a `.version`.
25+
nix_json=$(nix-instantiate --eval --strict --json -E "
26+
let
27+
pkgs = import $here/pkgs.nix {};
28+
names = builtins.filter
29+
(n: builtins.match \"openssl_[0-9]+(_[0-9]+)?\" n != null)
30+
(builtins.attrNames pkgs);
31+
safe = builtins.filter (n:
32+
let t = builtins.tryEval pkgs.\${n}; in
33+
t.success && (builtins.tryEval t.value.version).success) names;
34+
in map (n: { attr = n; version = pkgs.\${n}.version; }) safe
35+
")
36+
37+
# 2. Resolve the OpenSSL version the `build` job already covers (the default
38+
# from sharedLibDeps.nix) so we can drop it from the matrix to avoid
39+
# duplicate coverage.
40+
default_openssl_version=$(nix-instantiate --eval --strict --json -E "
41+
(import $here/sharedLibDeps.nix {}).openssl.version
42+
" | jq -r .)
43+
44+
# 3. Fetch OpenSSL release versions from endoflife.date, keep entries that
45+
# are either not past EOL or still under extended support, then pick the
46+
# first nix attr whose `.version` starts with the release version
47+
# followed by `.` / letter / end-of-string (so "3.6" matches "3.6.1",
48+
# "1.1.1" matches "1.1.1w", and "1.1" does NOT swallow "1.1.1").
49+
# Releases without a matching nix attr and the one covered by default in
50+
# `build` are dropped.
51+
curl -sf https://endoflife.date/api/openssl.json \
52+
| jq -c \
53+
--argjson nix "$nix_json" \
54+
--arg supported "$SUPPORTED_OPENSSL_VERSION" \
55+
--arg default_version "$default_openssl_version" '
56+
(now | strftime("%Y-%m-%d")) as $today |
57+
# Compare two dotted version strings as arrays of numbers
58+
# (e.g. "4.1" > "4.0" => true, "4.0" > "4.0" => false).
59+
def gt($a; $b):
60+
([$a, $b] | map(split(".") | map(tonumber))) as [$x, $y]
61+
| ($x | length) as $n | ($y | length) as $m
62+
| [range(0; if $n > $m then $n else $m end)
63+
| ((($x[.]) // 0) - (($y[.]) // 0))]
64+
| map(select(. != 0)) | (.[0] // 0) > 0;
65+
[ .[]
66+
| select(.eol == false or .eol > $today or .extendedSupport == true)
67+
| .cycle as $v
68+
| ($nix
69+
| map(select(.version | test("^" + ($v | gsub("\\."; "\\.")) + "([.a-z]|$)")))
70+
| first) as $m
71+
| select($m != null)
72+
| select($m.version != $default_version)
73+
| { version: $v, attr: $m.attr, "continue-on-error": gt($v; $supported) }
74+
]'

0 commit comments

Comments
 (0)