Skip to content

Commit bc5e7eb

Browse files
panvapanva
committed
bring collect-openssl-versions back but simpler
1 parent bad2e25 commit bc5e7eb

4 files changed

Lines changed: 66 additions & 67 deletions

File tree

‎.github/workflows/test-shared.yml‎

Lines changed: 21 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,25 @@ jobs:
169169
system: ${{ matrix.system }}
170170
cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
171171

172+
# Builds the matrix for `build-openssl` from tools/nix/openssl-matrix.json.
173+
# Output shape:
174+
# [{ "version": "3.6.1", "attr": "openssl_3_6", "continue-on-error": false }, ...]
175+
collect-openssl-versions:
176+
if: github.event.pull_request.draft == false
177+
runs-on: ubuntu-slim
178+
outputs:
179+
matrix: ${{ steps.query.outputs.matrix }}
180+
steps:
181+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
182+
with:
183+
persist-credentials: false
184+
sparse-checkout: tools/nix
185+
sparse-checkout-cone-mode: false
186+
- id: query
187+
run: |
188+
matrix=$(jq -c . tools/nix/openssl-matrix.json)
189+
echo "matrix=$matrix" >> "$GITHUB_OUTPUT"
190+
172191
# Builds and tests Node.js with shared libraries against every supported
173192
# OpenSSL release version available in the repo-pinned nixpkgs. The default
174193
# shared `openssl` from tools/nix/sharedLibDeps.nix is overridden per matrix
@@ -177,24 +196,11 @@ jobs:
177196
build-openssl:
178197
needs:
179198
- build-tarball
199+
- collect-openssl-versions
180200
strategy:
181201
fail-fast: false
182202
matrix:
183-
openssl:
184-
# BEGIN_OPENSSL_MATRIX (autogenerated by tools/dep_updaters/update-nixpkgs-pin.sh)
185-
- version: 4.0.0
186-
attr: openssl_4_0
187-
continue-on-error: false
188-
- version: 3.6.1
189-
attr: openssl_3_6
190-
continue-on-error: false
191-
- version: 3.0.19
192-
attr: openssl_3
193-
continue-on-error: false
194-
- version: 1.1.1w
195-
attr: openssl_1_1
196-
continue-on-error: false
197-
# END_OPENSSL_MATRIX
203+
openssl: ${{ fromJSON(needs.collect-openssl-versions.outputs.matrix) }}
198204
name: 'aarch64-linux: with shared ${{ matrix.openssl.attr }} (${{ matrix.openssl.version }})'
199205
runs-on: ubuntu-24.04-arm
200206
continue-on-error: ${{ matrix.openssl['continue-on-error'] }}

‎tools/dep_updaters/update-nixpkgs-pin.sh‎

Lines changed: 4 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ set -ex
55

66
BASE_DIR=$(cd "$(dirname "$0")/../.." && pwd)
77
NIXPKGS_PIN_FILE="$BASE_DIR/tools/nix/pkgs.nix"
8+
OPENSSL_MATRIX_FILE="$BASE_DIR/tools/nix/openssl-matrix.json"
89
TEST_SHARED_WORKFLOW_FILE="$BASE_DIR/.github/workflows/test-shared.yml"
910

1011
NIXPKGS_REPO=$(grep 'repo =' "$NIXPKGS_PIN_FILE" | awk -F'"' '{ print $2 }')
@@ -33,59 +34,15 @@ if [ -z "$SUPPORTED_OPENSSL_VERSION" ]; then
3334
exit 1
3435
fi
3536

36-
OPENSSL_MATRIX_BLOCK=$("$BASE_DIR/tools/nix/collect-openssl-matrix.sh" | jq -r --arg supported "$SUPPORTED_OPENSSL_VERSION" '
37-
# Compare OpenSSL major.minor cycles as numeric tuples.
38-
def cycle_tuple($v):
39-
($v | capture("^(?<cycle>[0-9]+\\.[0-9]+)").cycle | split(".") | map(tonumber));
40-
[
41-
" # BEGIN_OPENSSL_MATRIX (autogenerated by tools/dep_updaters/update-nixpkgs-pin.sh)",
42-
(
43-
.[]
44-
| " - version: \(.version)\n attr: \(.attr)\n continue-on-error: \(cycle_tuple(.version) > cycle_tuple($supported))"
45-
),
46-
" # END_OPENSSL_MATRIX"
47-
]
48-
| join("\n")
49-
')
50-
51-
if ! grep -q "BEGIN_OPENSSL_MATRIX" "$TEST_SHARED_WORKFLOW_FILE"; then
52-
echo "Could not find BEGIN_OPENSSL_MATRIX marker in $TEST_SHARED_WORKFLOW_FILE" >&2
53-
exit 1
54-
fi
55-
56-
if ! grep -q "END_OPENSSL_MATRIX" "$TEST_SHARED_WORKFLOW_FILE"; then
57-
echo "Could not find END_OPENSSL_MATRIX marker in $TEST_SHARED_WORKFLOW_FILE" >&2
58-
exit 1
59-
fi
60-
61-
TMP_WORKFLOW_FILE=$(mktemp)
62-
TMP_BLOCK_FILE=$(mktemp)
63-
printf '%s\n' "$OPENSSL_MATRIX_BLOCK" > "$TMP_BLOCK_FILE"
64-
65-
awk -v block_file="$TMP_BLOCK_FILE" '
66-
/BEGIN_OPENSSL_MATRIX/ {
67-
while ((getline line < block_file) > 0) {
68-
print line;
69-
}
70-
close(block_file);
71-
in_block = 1;
72-
next;
73-
}
74-
/END_OPENSSL_MATRIX/ {
75-
in_block = 0;
76-
next;
77-
}
78-
!in_block { print }
79-
' "$TEST_SHARED_WORKFLOW_FILE" > "$TMP_WORKFLOW_FILE"
80-
mv "$TMP_WORKFLOW_FILE" "$TEST_SHARED_WORKFLOW_FILE"
81-
rm -f "$TMP_BLOCK_FILE"
37+
SUPPORTED_OPENSSL_VERSION="$SUPPORTED_OPENSSL_VERSION" \
38+
"$BASE_DIR/tools/nix/collect-openssl-matrix.sh" | jq . > "$OPENSSL_MATRIX_FILE"
8239

8340
cat -<<EOF
8441
All done!
8542
8643
Please git add and commit the new version:
8744
88-
$ git add $NIXPKGS_PIN_FILE $TEST_SHARED_WORKFLOW_FILE
45+
$ git add $NIXPKGS_PIN_FILE $OPENSSL_MATRIX_FILE
8946
$ git commit -m 'tools: bump nixpkgs-unstable pin to $NEW_VERSION'
9047
EOF
9148

‎tools/nix/collect-openssl-matrix.sh‎

Lines changed: 19 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,22 @@
44
# shared libraries.
55
#
66
# This helper is used by tools/dep_updaters/update-nixpkgs-pin.sh to
7-
# regenerate the autogenerated OpenSSL matrix block in
8-
# .github/workflows/test-shared.yml.
7+
# regenerate tools/nix/openssl-matrix.json.
8+
#
9+
# Inputs (env):
10+
# SUPPORTED_OPENSSL_VERSION Latest OpenSSL major.minor cycle we support
11+
# running tests with. Newer cycles are emitted
12+
# with "continue-on-error": true.
913
#
1014
# Output (stdout): a JSON array with shape
11-
# [{ "version": "3.6.1", "attr": "openssl_3_6" }, ...]
15+
# [{ "version": "3.6.1", "attr": "openssl_3_6", "continue-on-error": false }, ...]
1216
#
13-
# Usage: ./tools/nix/collect-openssl-matrix.sh
17+
# Usage: SUPPORTED_OPENSSL_VERSION=4.0 ./tools/nix/collect-openssl-matrix.sh
1418

1519
set -eu
1620

21+
: "${SUPPORTED_OPENSSL_VERSION:?SUPPORTED_OPENSSL_VERSION must be set}"
22+
1723
here=$(cd -- "$(dirname -- "$0")" && pwd)
1824

1925
# 1. Enumerate every `openssl_N` / `openssl_N_M` attribute exposed by the
@@ -49,8 +55,12 @@ default_openssl_version=$(nix-instantiate --eval --strict --json -E "
4955
curl -sf https://endoflife.date/api/openssl.json \
5056
| jq -c \
5157
--argjson nix "$nix_json" \
58+
--arg supported "$SUPPORTED_OPENSSL_VERSION" \
5259
--arg default_version "$default_openssl_version" '
5360
(now | strftime("%Y-%m-%d")) as $today |
61+
# Compare OpenSSL major.minor cycles as numeric tuples.
62+
def cycle_tuple($v):
63+
($v | split(".") | map(tonumber));
5464
[ .[]
5565
| select(.eol == false or .eol > $today or .extendedSupport == true)
5666
| .cycle as $v
@@ -59,5 +69,9 @@ curl -sf https://endoflife.date/api/openssl.json \
5969
| first) as $m
6070
| select($m != null)
6171
| select($m.version != $default_version)
62-
| { version: $m.version, attr: $m.attr }
72+
| {
73+
version: $m.version,
74+
attr: $m.attr,
75+
"continue-on-error": (cycle_tuple($v) > cycle_tuple($supported))
76+
}
6377
]'

‎tools/nix/openssl-matrix.json‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
[
2+
{
3+
"version": "4.0.0",
4+
"attr": "openssl_4_0",
5+
"continue-on-error": false
6+
},
7+
{
8+
"version": "3.6.1",
9+
"attr": "openssl_3_6",
10+
"continue-on-error": false
11+
},
12+
{
13+
"version": "3.0.19",
14+
"attr": "openssl_3",
15+
"continue-on-error": false
16+
},
17+
{
18+
"version": "1.1.1w",
19+
"attr": "openssl_1_1",
20+
"continue-on-error": false
21+
}
22+
]

0 commit comments

Comments
 (0)