Skip to content

Commit a301de0

Browse files
panvapanva
committed
tools: add non-default OpenSSL versions to the test-shared workflow
Signed-off-by: Filip Skokan <[email protected]>
1 parent 21436f0 commit a301de0

5 files changed

Lines changed: 246 additions & 40 deletions

File tree

‎.github/actions/build-shared/action.yml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
name: Build Node.js (shared libraries)
2+
description: >
3+
Downloads the slim tarball built by the `build-tarball` job, extracts it,
4+
installs Nix (+ cachix + sccache), then builds Node.js and runs the CI
5+
test suite inside the pinned nix-shell.
6+
7+
inputs:
8+
system:
9+
description: System label (e.g. x86_64-linux, aarch64-darwin).
10+
required: true
11+
extra-nix-args:
12+
description: Additional arguments appended to the nix-shell invocation.
13+
required: false
14+
default: ''
15+
cachix-auth-token:
16+
description: Cachix auth token for nodejs.cachix.org.
17+
required: false
18+
default: ''
19+
20+
runs:
21+
using: composite
22+
steps:
23+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
24+
if: ${{ github.event_name != 'workflow_dispatch' }}
25+
with:
26+
name: tarballs
27+
path: tarballs
28+
29+
- name: Extract tarball
30+
if: ${{ github.event_name != 'workflow_dispatch' }}
31+
shell: bash
32+
run: |
33+
tar xzf tarballs/*.tar.gz -C "$RUNNER_TEMP"
34+
echo "TAR_DIR=$RUNNER_TEMP/$(basename tarballs/*.tar.gz .tar.gz)" >> "$GITHUB_ENV"
35+
36+
- uses: cachix/install-nix-action@96951a368ba55167b55f1c916f7d416bac6505fe # v31.10.3
37+
with:
38+
extra_nix_config: sandbox = true
39+
40+
- uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
41+
with:
42+
name: nodejs
43+
authToken: ${{ inputs.cachix-auth-token }}
44+
45+
- name: Configure sccache
46+
if: github.base_ref == 'main' || github.ref_name == 'main'
47+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
48+
with:
49+
script: |
50+
core.exportVariable('SCCACHE_GHA_ENABLED', 'on');
51+
core.exportVariable('ACTIONS_CACHE_SERVICE_V2', 'on');
52+
core.exportVariable('ACTIONS_RESULTS_URL', process.env.ACTIONS_RESULTS_URL || '');
53+
core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
54+
core.exportVariable('NIX_SCCACHE', '(import <nixpkgs> {}).sccache');
55+
56+
- name: Build Node.js and run tests
57+
shell: bash
58+
run: |
59+
nix-shell \
60+
-I "nixpkgs=$TAR_DIR/tools/nix/pkgs.nix" \
61+
--pure --keep TAR_DIR --keep FLAKY_TESTS \
62+
--keep SCCACHE_GHA_ENABLED --keep ACTIONS_CACHE_SERVICE_V2 --keep ACTIONS_RESULTS_URL --keep ACTIONS_RUNTIME_TOKEN \
63+
--arg loadJSBuiltinsDynamically false \
64+
--arg useSeparateDerivationForV8 true \
65+
--arg ccache "${NIX_SCCACHE:-null}" \
66+
--arg devTools '[]' \
67+
--arg benchmarkTools '[]' \
68+
${{ endsWith(inputs.system, '-darwin') && '--arg withAmaro false --arg withLief false --arg withSQLite false --arg withFFI false --arg extraConfigFlags ''["--without-inspector" "--without-node-options"]'' \' || '\' }}
69+
${{ inputs.extra-nix-args }} \
70+
--run '
71+
make -C "$TAR_DIR" run-ci -j4 V=1 TEST_CI_ARGS="-p actions --measure-flakiness 9 --skip-tests=$CI_SKIP_TESTS"
72+
' "$TAR_DIR/shell.nix"

‎.github/workflows/test-shared.yml‎

Lines changed: 62 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ on:
4747
- vcbuild.bat
4848
- .**
4949
- '!.github/workflows/test-shared.yml'
50+
- '!.github/actions/build-shared/**'
5051
types: [opened, synchronize, reopened, ready_for_review]
5152
push:
5253
branches:
@@ -97,13 +98,17 @@ on:
9798
- vcbuild.bat
9899
- .**
99100
- '!.github/workflows/test-shared.yml'
101+
- '!.github/actions/build-shared/**'
100102

101103
concurrency:
102104
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
103105
cancel-in-progress: true
104106

105107
env:
106108
FLAKY_TESTS: keep_retrying
109+
# Latest OpenSSL major.minor cycle we support running tests with.
110+
# The nixpkgs updater regenerates the OpenSSL matrix using this value.
111+
SUPPORTED_OPENSSL_VERSION: '4.0'
107112

108113
permissions:
109114
contents: read
@@ -153,50 +158,68 @@ jobs:
153158
name: '${{ matrix.system }}: with shared libraries'
154159
runs-on: ${{ matrix.runner }}
155160
steps:
156-
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
161+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
157162
if: ${{ github.event_name != 'workflow_dispatch' }}
158163
with:
159-
name: tarballs
160-
path: tarballs
161-
162-
- name: Extract tarball
164+
persist-credentials: false
165+
sparse-checkout: .github/actions
166+
- uses: ./.github/actions/build-shared
163167
if: ${{ github.event_name != 'workflow_dispatch' }}
164-
run: |
165-
tar xzf tarballs/*.tar.gz -C "$RUNNER_TEMP"
166-
echo "TAR_DIR=$RUNNER_TEMP/$(basename tarballs/*.tar.gz .tar.gz)" >> "$GITHUB_ENV"
167-
168-
- uses: cachix/install-nix-action@96951a368ba55167b55f1c916f7d416bac6505fe # v31.10.3
169168
with:
170-
extra_nix_config: sandbox = true
169+
system: ${{ matrix.system }}
170+
cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
171171

172-
- uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
172+
# Builds the matrix for `build-openssl` from tools/nix/openssl-matrix.json.
173+
# Output shape:
174+
# [{ "version": "3.6.1", "attr": "openssl_3_6", "continue-on-error": false }, ...]
175+
collect-openssl-versions:
176+
if: github.event.pull_request.draft == false
177+
runs-on: ubuntu-slim
178+
outputs:
179+
matrix: ${{ steps.query.outputs.matrix }}
180+
steps:
181+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
173182
with:
174-
name: nodejs
175-
authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
183+
persist-credentials: false
184+
sparse-checkout: tools/nix
185+
sparse-checkout-cone-mode: false
186+
- id: query
187+
run: |
188+
matrix=$(jq -c . tools/nix/openssl-matrix.json)
189+
echo "matrix=$matrix" >> "$GITHUB_OUTPUT"
176190
177-
- name: Configure sccache
178-
if: github.base_ref == 'main' || github.ref_name == 'main'
179-
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
191+
# Builds and tests Node.js with shared libraries against every supported
192+
# OpenSSL release version available in the repo-pinned nixpkgs. The default
193+
# shared `openssl` from tools/nix/sharedLibDeps.nix is overridden per matrix
194+
# entry, while all other shared libs remain at their defaults. Only runs on
195+
# a single runner/system (aarch64-linux) to keep the matrix to a minimum.
196+
build-openssl:
197+
needs:
198+
- build-tarball
199+
- collect-openssl-versions
200+
strategy:
201+
fail-fast: false
202+
matrix:
203+
openssl: ${{ fromJSON(needs.collect-openssl-versions.outputs.matrix) }}
204+
name: 'aarch64-linux: with shared ${{ matrix.openssl.attr }} (${{ matrix.openssl.version }})'
205+
runs-on: ubuntu-24.04-arm
206+
continue-on-error: ${{ matrix.openssl['continue-on-error'] }}
207+
env:
208+
OPENSSL_ATTR: ${{ matrix.openssl.attr }}
209+
OPENSSL_VERSION: ${{ matrix.openssl.version }}
210+
steps:
211+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
180212
with:
181-
script: |
182-
core.exportVariable('SCCACHE_GHA_ENABLED', 'on');
183-
core.exportVariable('ACTIONS_CACHE_SERVICE_V2', 'on');
184-
core.exportVariable('ACTIONS_RESULTS_URL', process.env.ACTIONS_RESULTS_URL || '');
185-
core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
186-
core.exportVariable('NIX_SCCACHE', '(import <nixpkgs> {}).sccache');
187-
188-
- name: Build Node.js and run tests
189-
run: |
190-
nix-shell \
191-
-I "nixpkgs=$TAR_DIR/tools/nix/pkgs.nix" \
192-
--pure --keep TAR_DIR --keep FLAKY_TESTS \
193-
--keep SCCACHE_GHA_ENABLED --keep ACTIONS_CACHE_SERVICE_V2 --keep ACTIONS_RESULTS_URL --keep ACTIONS_RUNTIME_TOKEN \
194-
--arg loadJSBuiltinsDynamically false \
195-
--arg useSeparateDerivationForV8 true \
196-
--arg ccache "${NIX_SCCACHE:-null}" \
197-
--arg devTools '[]' \
198-
--arg benchmarkTools '[]' \
199-
${{ endsWith(matrix.system, '-darwin') && '--arg withAmaro false --arg withLief false --arg withSQLite false --arg withFFI false --arg extraConfigFlags ''["--without-inspector" "--without-node-options"]'' \' || '\' }}
200-
--run '
201-
make -C "$TAR_DIR" run-ci -j4 V=1 TEST_CI_ARGS="-p actions --measure-flakiness 9 --skip-tests=$CI_SKIP_TESTS"
202-
' "$TAR_DIR/shell.nix"
213+
persist-credentials: false
214+
sparse-checkout: .github/actions
215+
- uses: ./.github/actions/build-shared
216+
with:
217+
system: aarch64-linux
218+
cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
219+
# Override just the `openssl` attr of the default shared-lib set with
220+
# the matrix-selected nixpkgs attribute (e.g. `openssl_3_6`). All
221+
# other shared libs (brotli, cares, libuv, …) keep their defaults.
222+
# `permittedInsecurePackages` whitelists just the matrix-selected
223+
# release (e.g. `openssl-1.1.1w`) so EOL-with-extended-support
224+
# cycles evaluate without relaxing nixpkgs' meta check globally.
225+
extra-nix-args: --arg sharedLibDeps "(import $TAR_DIR/tools/nix/sharedLibDeps.nix {}) // { openssl = (import $TAR_DIR/tools/nix/pkgs.nix { config.permittedInsecurePackages = [ \"openssl-$OPENSSL_VERSION\" ]; }).$OPENSSL_ATTR; }"

‎tools/dep_updaters/update-nixpkgs-pin.sh‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ set -ex
55

66
BASE_DIR=$(cd "$(dirname "$0")/../.." && pwd)
77
NIXPKGS_PIN_FILE="$BASE_DIR/tools/nix/pkgs.nix"
8+
OPENSSL_MATRIX_FILE="$BASE_DIR/tools/nix/openssl-matrix.json"
9+
TEST_SHARED_WORKFLOW_FILE="$BASE_DIR/.github/workflows/test-shared.yml"
810

911
NIXPKGS_REPO=$(grep 'repo =' "$NIXPKGS_PIN_FILE" | awk -F'"' '{ print $2 }')
1012
CURRENT_VERSION_SHA1=$(grep 'rev =' "$NIXPKGS_PIN_FILE" | awk -F'"' '{ print $2 }')
@@ -25,12 +27,22 @@ TMP_FILE=$(mktemp)
2527
sed "s/$CURRENT_VERSION_SHA1/$NEW_UPSTREAM_SHA1/;s/$CURRENT_TARBALL_HASH/$NEW_TARBALL_HASH/" "$NIXPKGS_PIN_FILE" > "$TMP_FILE"
2628
mv "$TMP_FILE" "$NIXPKGS_PIN_FILE"
2729

30+
SUPPORTED_OPENSSL_VERSION=$(sed -nE "s/^[[:space:]]*SUPPORTED_OPENSSL_VERSION:[[:space:]]*'([^']+)'[[:space:]]*$/\1/p" "$TEST_SHARED_WORKFLOW_FILE" | head -n1)
31+
32+
if [ -z "$SUPPORTED_OPENSSL_VERSION" ]; then
33+
echo "Could not resolve SUPPORTED_OPENSSL_VERSION from $TEST_SHARED_WORKFLOW_FILE" >&2
34+
exit 1
35+
fi
36+
37+
SUPPORTED_OPENSSL_VERSION="$SUPPORTED_OPENSSL_VERSION" \
38+
"$BASE_DIR/tools/nix/collect-openssl-matrix.sh" | jq . > "$OPENSSL_MATRIX_FILE"
39+
2840
cat -<<EOF
2941
All done!
3042
3143
Please git add and commit the new version:
3244
33-
$ git add $NIXPKGS_PIN_FILE
45+
$ git add $NIXPKGS_PIN_FILE $OPENSSL_MATRIX_FILE
3446
$ git commit -m 'tools: bump nixpkgs-unstable pin to $NEW_VERSION'
3547
EOF
3648

‎tools/nix/collect-openssl-matrix.sh‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
#!/bin/sh
2+
#
3+
# Emits the JSON source data of OpenSSL releases to test Node.js against with
4+
# shared libraries.
5+
#
6+
# This helper is used by tools/dep_updaters/update-nixpkgs-pin.sh to
7+
# regenerate tools/nix/openssl-matrix.json.
8+
#
9+
# Inputs (env):
10+
# SUPPORTED_OPENSSL_VERSION Latest OpenSSL major.minor cycle we support
11+
# running tests with. Newer cycles are emitted
12+
# with "continue-on-error": true.
13+
#
14+
# Output (stdout): a JSON array with shape
15+
# [{ "version": "3.6.1", "attr": "openssl_3_6", "continue-on-error": false }, ...]
16+
#
17+
# Usage: SUPPORTED_OPENSSL_VERSION=4.0 ./tools/nix/collect-openssl-matrix.sh
18+
19+
set -eu
20+
21+
: "${SUPPORTED_OPENSSL_VERSION:?SUPPORTED_OPENSSL_VERSION must be set}"
22+
23+
here=$(cd -- "$(dirname -- "$0")" && pwd)
24+
25+
# 1. Enumerate every `openssl_N` / `openssl_N_M` attribute exposed by the
26+
# repo-pinned nixpkgs. `tryEval` skips aliases that raise (e.g.
27+
# `openssl_3_0` → renamed to `openssl_3`) so we only keep attributes
28+
# that resolve to a real derivation with a `.version`.
29+
nix_json=$(nix-instantiate --eval --strict --json -E "
30+
let
31+
pkgs = import $here/pkgs.nix {};
32+
names = builtins.filter
33+
(n: builtins.match \"openssl_[0-9]+(_[0-9]+)?\" n != null)
34+
(builtins.attrNames pkgs);
35+
safe = builtins.filter (n:
36+
let t = builtins.tryEval pkgs.\${n}; in
37+
t.success && (builtins.tryEval t.value.version).success) names;
38+
in map (n: { attr = n; version = pkgs.\${n}.version; }) safe
39+
")
40+
41+
# 2. Resolve the OpenSSL version the `build` job already covers (the default
42+
# from sharedLibDeps.nix) so we can drop it from the matrix to avoid
43+
# duplicate coverage.
44+
default_openssl_version=$(nix-instantiate --eval --strict --json -E "
45+
(import $here/sharedLibDeps.nix {}).openssl.version
46+
" | jq -r .)
47+
48+
# 3. Fetch OpenSSL release versions from endoflife.date, keep entries that
49+
# are either not past EOL or still under extended support, then pick the
50+
# first nix attr whose `.version` starts with the release version
51+
# followed by `.` / letter / end-of-string (so "3.6" matches "3.6.1",
52+
# "1.1.1" matches "1.1.1w", and "1.1" does NOT swallow "1.1.1").
53+
# Releases without a matching nix attr and the one covered by default in
54+
# `build` are dropped.
55+
curl -sf https://endoflife.date/api/openssl.json \
56+
| jq -c \
57+
--argjson nix "$nix_json" \
58+
--arg supported "$SUPPORTED_OPENSSL_VERSION" \
59+
--arg default_version "$default_openssl_version" '
60+
(now | strftime("%Y-%m-%d")) as $today |
61+
# Compare OpenSSL major.minor cycles as numeric tuples.
62+
def cycle_tuple($v):
63+
($v | split(".") | map(tonumber));
64+
[ .[]
65+
| select(.eol == false or .eol > $today or .extendedSupport == true)
66+
| .cycle as $v
67+
| ($nix
68+
| map(select(.version | test("^" + ($v | gsub("\\."; "\\.")) + "([.a-z]|$)")))
69+
| first) as $m
70+
| select($m != null)
71+
| select($m.version != $default_version)
72+
| {
73+
version: $m.version,
74+
attr: $m.attr,
75+
"continue-on-error": (cycle_tuple($v) > cycle_tuple($supported))
76+
}
77+
]'

‎tools/nix/openssl-matrix.json‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
[
2+
{
3+
"version": "4.0.0",
4+
"attr": "openssl_4_0",
5+
"continue-on-error": false
6+
},
7+
{
8+
"version": "3.6.1",
9+
"attr": "openssl_3_6",
10+
"continue-on-error": false
11+
},
12+
{
13+
"version": "3.0.19",
14+
"attr": "openssl_3",
15+
"continue-on-error": false
16+
},
17+
{
18+
"version": "1.1.1w",
19+
"attr": "openssl_1_1",
20+
"continue-on-error": false
21+
}
22+
]

0 commit comments

Comments
 (0)