tools: cache V8 builds in test-shared

Author: aduh95

.github/workflows/test-shared.yml

@@ -106,9 +106,6 @@ concurrency:
 
 env:
   FLAKY_TESTS: keep_retrying
-  # Latest OpenSSL major.minor cycle we support running tests with.
-  # The nixpkgs updater regenerates the OpenSSL matrix using this value.
-  SUPPORTED_OPENSSL_VERSION: '4.0'
 
 permissions:
   contents: read
@@ -149,8 +146,9 @@ jobs:
         include:
           - runner: ubuntu-24.04
             system: x86_64-linux
-          - runner: ubuntu-24.04-arm
-            system: aarch64-linux
+          # built separately in build-aarch64-linux-v8
+          # - runner: ubuntu-24.04-arm
+          #   system: aarch64-linux
           - runner: macos-15-intel
             system: x86_64-darwin
           - runner: macos-latest
@@ -169,6 +167,46 @@ jobs:
           system: ${{ matrix.system }}
           cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
+  build-aarch64-linux-v8:
+    needs: build-tarball
+    runs-on: ubuntu-24.04-arm
+    name: 'aarch64-linux: Cache V8 build'
+    steps:
+      - name: Check if Cachix is available
+        id: cachix-check
+        run: echo 'IS_AVAILABLE=${{ secrets.CACHIX_AUTH_TOKEN && 'true' }}' >> "$GITHUB_OUTPUT"
+
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        if: ${{ steps.cachix-check.outputs.IS_AVAILABLE == 'true' }}
+        with:
+          name: tarballs
+          path: tarballs
+
+      - name: Extract tarball
+        if: ${{ steps.cachix-check.outputs.IS_AVAILABLE == 'true' }}
+        shell: bash
+        run: |
+          tar xzf tarballs/*.tar.gz -C "$RUNNER_TEMP"
+          echo "TAR_DIR=$RUNNER_TEMP/$(basename tarballs/*.tar.gz .tar.gz)" >> "$GITHUB_ENV"
+
+      - uses: cachix/install-nix-action@96951a368ba55167b55f1c916f7d416bac6505fe  # v31.10.3
+        if: ${{ steps.cachix-check.outputs.IS_AVAILABLE == 'true' }}
+        with:
+          extra_nix_config: sandbox = true
+
+      - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c  # v17
+        if: ${{ steps.cachix-check.outputs.IS_AVAILABLE == 'true' }}
+        with:
+          name: nodejs
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
+      - name: Build V8 derivation
+        if: ${{ steps.cachix-check.outputs.IS_AVAILABLE == 'true' }}
+        run: |
+          nix-build "$(
+            nix-instantiate -E "builtins.filter (p: p.pname == ''v8'') (import $TAR_DIR/shell.nix { useSeparateDerivationForV8=true; }).buildInputs"
+          )"
+
   # Builds the matrix for `build-openssl` from tools/nix/openssl-matrix.json.
   # Output shape:
   # [{ "version": "3.6.1", "attr": "openssl_3_6", "continue-on-error": false }, ...]
@@ -181,12 +219,15 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           persist-credentials: false
-          sparse-checkout: tools/nix
+          sparse-checkout: tools/nix/openssl-matrix.json
           sparse-checkout-cone-mode: false
       - id: query
         run: |
-          matrix=$(jq -c . tools/nix/openssl-matrix.json)
-          echo "matrix=$matrix" >> "$GITHUB_OUTPUT"
+          {
+            echo 'matrix<<EOF'
+            cat tools/nix/openssl-matrix.json
+            echo 'EOF'
+          } >> "$GITHUB_OUTPUT"
 
   # Builds and tests Node.js with shared libraries against every supported
   # OpenSSL release version available in the repo-pinned nixpkgs. The default
@@ -195,7 +236,7 @@ jobs:
   # a single runner/system (aarch64-linux) to keep the matrix to a minimum.
   build-openssl:
     needs:
-      - build-tarball
+      - build-aarch64-linux-v8
       - collect-openssl-versions
     strategy:
       fail-fast: false

tools/dep_updaters/update-nixpkgs-pin.sh

@@ -27,15 +27,7 @@ TMP_FILE=$(mktemp)
 sed "s/$CURRENT_VERSION_SHA1/$NEW_UPSTREAM_SHA1/;s/$CURRENT_TARBALL_HASH/$NEW_TARBALL_HASH/" "$NIXPKGS_PIN_FILE" > "$TMP_FILE"
 mv "$TMP_FILE" "$NIXPKGS_PIN_FILE"
 
-SUPPORTED_OPENSSL_VERSION=$(sed -nE "s/^[[:space:]]*SUPPORTED_OPENSSL_VERSION:[[:space:]]*'([^']+)'[[:space:]]*$/\1/p" "$TEST_SHARED_WORKFLOW_FILE" | head -n1)
-
-if [ -z "$SUPPORTED_OPENSSL_VERSION" ]; then
-	echo "Could not resolve SUPPORTED_OPENSSL_VERSION from $TEST_SHARED_WORKFLOW_FILE" >&2
-	exit 1
-fi
-
-SUPPORTED_OPENSSL_VERSION="$SUPPORTED_OPENSSL_VERSION" \
-	"$BASE_DIR/tools/nix/collect-openssl-matrix.sh" | jq . > "$OPENSSL_MATRIX_FILE"
+"$BASE_DIR/tools/nix/collect-openssl-matrix.sh" | jq . > "$OPENSSL_MATRIX_FILE"
 
 cat -<<EOF
 All done!

tools/nix/collect-openssl-matrix.sh

@@ -6,19 +6,17 @@
 # This helper is used by tools/dep_updaters/update-nixpkgs-pin.sh to
 # regenerate tools/nix/openssl-matrix.json.
 #
-# Inputs (env):
-#   SUPPORTED_OPENSSL_VERSION  Latest OpenSSL major.minor cycle we support
-#                              running tests with. Newer cycles are emitted
-#                              with "continue-on-error": true.
-#
 # Output (stdout): a JSON array with shape
 #   [{ "version": "3.6.1", "attr": "openssl_3_6", "continue-on-error": false }, ...]
 #
-# Usage: SUPPORTED_OPENSSL_VERSION=4.0 ./tools/nix/collect-openssl-matrix.sh
+# Usage: ./tools/nix/collect-openssl-matrix.sh
 
 set -eu
 
-: "${SUPPORTED_OPENSSL_VERSION:?SUPPORTED_OPENSSL_VERSION must be set}"
+# Latest OpenSSL major.minor cycle we support
+# running tests with. Newer cycles are emitted
+# with "continue-on-error": true.
+SUPPORTED_OPENSSL_VERSION=4.0
 
 here=$(cd -- "$(dirname -- "$0")" && pwd)
 
@@ -38,25 +36,16 @@ nix_json=$(nix-instantiate --eval --strict --json -E "
   in map (n: { attr = n; version = pkgs.\${n}.version; }) safe
 ")
 
-# 2. Resolve the OpenSSL version the `build` job already covers (the default
-#    from sharedLibDeps.nix) so we can drop it from the matrix to avoid
-#    duplicate coverage.
-default_openssl_version=$(nix-instantiate --eval --strict --json -E "
-  (import $here/sharedLibDeps.nix {}).openssl.version
-" | jq -r .)
-
-# 3. Fetch OpenSSL release versions from endoflife.date, keep entries that
+# 2. Fetch OpenSSL release versions from endoflife.date, keep entries that
 #    are either not past EOL or still under extended support, then pick the
 #    first nix attr whose `.version` starts with the release version
 #    followed by `.` / letter / end-of-string (so "3.6" matches "3.6.1",
 #    "1.1.1" matches "1.1.1w", and "1.1" does NOT swallow "1.1.1").
-#    Releases without a matching nix attr and the one covered by default in
-#    `build` are dropped.
+#    Releases without a matching nix attr are dropped.
 curl -sf https://endoflife.date/api/openssl.json \
   | jq -c \
       --argjson nix "$nix_json" \
-      --arg supported "$SUPPORTED_OPENSSL_VERSION" \
-      --arg default_version "$default_openssl_version" '
+      --arg supported "$SUPPORTED_OPENSSL_VERSION" '
     (now | strftime("%Y-%m-%d")) as $today |
     # Compare OpenSSL major.minor cycles as numeric tuples.
     def cycle_tuple($v):
@@ -68,7 +57,6 @@ curl -sf https://endoflife.date/api/openssl.json \
           | map(select(.version | test("^" + ($v | gsub("\\."; "\\.")) + "([.a-z]|$)")))
           | first) as $m
       | select($m != null)
-      | select($m.version != $default_version)
       | {
           version: $m.version,
           attr: $m.attr,

tools/nix/openssl-matrix.json

@@ -9,6 +9,11 @@
     "attr": "openssl_3_6",
     "continue-on-error": false
   },
+  {
+    "version": "3.5.5",
+    "attr": "openssl_3_5",
+    "continue-on-error": false
+  },
   {
     "version": "3.0.19",
     "attr": "openssl_3",