Skip to content

Commit fa455ee

Browse files
aduh95aduh95
committed
move openssl-matrix to a nix file
1 parent c202696 commit fa455ee

3 files changed

Lines changed: 65 additions & 52 deletions

File tree

‎.github/actions/build-shared/action.yml‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,6 @@ description: >
55
test suite inside the pinned nix-shell.
66
77
inputs:
8-
system:
9-
description: System label (e.g. x86_64-linux, aarch64-darwin).
10-
required: true
118
extra-nix-args:
129
description: Additional arguments appended to the nix-shell invocation.
1310
required: false
@@ -19,15 +16,14 @@ inputs:
1916

2017
runs:
2118
using: composite
19+
name: Build and test Node.js
2220
steps:
2321
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
24-
if: ${{ github.event_name != 'workflow_dispatch' }}
2522
with:
2623
name: tarballs
2724
path: tarballs
2825

2926
- name: Extract tarball
30-
if: ${{ github.event_name != 'workflow_dispatch' }}
3127
shell: bash
3228
run: |
3329
tar xzf tarballs/*.tar.gz -C "$RUNNER_TEMP"
@@ -61,11 +57,9 @@ runs:
6157
--pure --keep TAR_DIR --keep FLAKY_TESTS \
6258
--keep SCCACHE_GHA_ENABLED --keep ACTIONS_CACHE_SERVICE_V2 --keep ACTIONS_RESULTS_URL --keep ACTIONS_RUNTIME_TOKEN \
6359
--arg loadJSBuiltinsDynamically false \
64-
--arg useSeparateDerivationForV8 true \
6560
--arg ccache "${NIX_SCCACHE:-null}" \
6661
--arg devTools '[]' \
6762
--arg benchmarkTools '[]' \
68-
${{ endsWith(inputs.system, '-darwin') && '--arg withAmaro false --arg withLief false --arg withSQLite false --arg withFFI false --arg extraConfigFlags ''["--without-inspector" "--without-node-options"]'' \' || '\' }}
6963
${{ inputs.extra-nix-args }} \
7064
--run '
7165
make -C "$TAR_DIR" run-ci -j4 V=1 TEST_CI_ARGS="-p actions --measure-flakiness 9 --skip-tests=$CI_SKIP_TESTS"

‎.github/workflows/test-shared.yml‎

Lines changed: 49 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -117,12 +117,10 @@ jobs:
117117
runs-on: ubuntu-slim
118118
steps:
119119
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
120-
if: ${{ github.event_name != 'workflow_dispatch' }}
121120
with:
122121
persist-credentials: false
123122

124123
- name: Make tarball
125-
if: ${{ github.event_name != 'workflow_dispatch' }}
126124
run: |
127125
export DATESTRING=$(date "+%Y-%m-%d")
128126
export COMMIT=$(git rev-parse --short=10 "$GITHUB_SHA")
@@ -131,7 +129,6 @@ jobs:
131129
DISTTYPE: nightly
132130

133131
- name: Upload tarball artifact
134-
if: ${{ github.event_name != 'workflow_dispatch' }}
135132
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
136133
with:
137134
name: tarballs
@@ -157,102 +154,105 @@ jobs:
157154
runs-on: ${{ matrix.runner }}
158155
steps:
159156
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
160-
if: ${{ github.event_name != 'workflow_dispatch' }}
161157
with:
162158
persist-credentials: false
163159
sparse-checkout: .github/actions
160+
sparse-checkout-cone-mode: false
164161
- uses: ./.github/actions/build-shared
165-
if: ${{ github.event_name != 'workflow_dispatch' }}
166162
with:
167-
system: ${{ matrix.system }}
168163
cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
164+
extra-nix-attrs: |
165+
--arg useSeparateDerivationForV8 true \
166+
${{ endsWith(matrix.system, '-darwin') && '--arg withAmaro false --arg withLief false --arg withSQLite false --arg withFFI false --arg extraConfigFlags ''["--without-inspector" "--without-node-options"]'' \' || '\' }}
169167
170168
build-aarch64-linux-v8:
171169
needs: build-tarball
172170
runs-on: ubuntu-24.04-arm
173-
name: 'aarch64-linux: Cache V8 build'
171+
name: 'aarch64-linux: Build V8'
172+
outputs:
173+
matrix: ${{ steps.query.outputs.matrix }}
174174
steps:
175-
- name: Check if Cachix is available
176-
id: cachix-check
177-
run: echo 'IS_AVAILABLE=${{ secrets.CACHIX_AUTH_TOKEN && 'true' }}' >> "$GITHUB_OUTPUT"
178-
179175
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
180-
if: ${{ steps.cachix-check.outputs.IS_AVAILABLE == 'true' }}
181176
with:
182177
name: tarballs
183178
path: tarballs
184179

185180
- name: Extract tarball
186-
if: ${{ steps.cachix-check.outputs.IS_AVAILABLE == 'true' }}
187181
shell: bash
188182
run: |
189183
tar xzf tarballs/*.tar.gz -C "$RUNNER_TEMP"
190184
echo "TAR_DIR=$RUNNER_TEMP/$(basename tarballs/*.tar.gz .tar.gz)" >> "$GITHUB_ENV"
191185
192186
- uses: cachix/install-nix-action@96951a368ba55167b55f1c916f7d416bac6505fe # v31.10.3
193-
if: ${{ steps.cachix-check.outputs.IS_AVAILABLE == 'true' }}
194187
with:
195188
extra_nix_config: sandbox = true
196189

197190
- uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
198-
if: ${{ steps.cachix-check.outputs.IS_AVAILABLE == 'true' }}
199191
with:
200192
name: nodejs
201193
authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
202194

203195
- name: Build V8 derivation
204-
if: ${{ steps.cachix-check.outputs.IS_AVAILABLE == 'true' }}
196+
id: build
205197
run: |
206-
nix-build "$(
198+
echo "V8_DIR=$(nix-build "$(
207199
nix-instantiate -E "builtins.filter (p: p.pname == ''v8'') (import $TAR_DIR/shell.nix { useSeparateDerivationForV8=true; }).buildInputs"
208-
)"
200+
)")" >> "$GITHUB_OUTPUT"
209201
210-
# Builds the matrix for `build-openssl` from tools/nix/openssl-matrix.json.
211-
# Output shape:
212-
# [{ "version": "3.6.1", "attr": "openssl_3_6", "continue-on-error": false }, ...]
213-
collect-openssl-versions:
214-
if: github.event.pull_request.draft == false
215-
runs-on: ubuntu-slim
216-
outputs:
217-
matrix: ${{ steps.query.outputs.matrix }}
218-
steps:
219-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
202+
- name: Upload tarball artifact
203+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
220204
with:
221-
persist-credentials: false
222-
sparse-checkout: tools/nix/openssl-matrix.json
223-
sparse-checkout-cone-mode: false
224-
- id: query
205+
name: libv8
206+
path: ${{ steps.build.outputs.V8_DIR }}
207+
208+
- run: |
209+
echo "$V8_DIR"
210+
ls "$V8_DIR"
211+
env:
212+
V8_DIR: ${{ steps.build.outputs.V8_DIR }}
213+
214+
- name: Compute OpenSSL support matrix
215+
id: query
225216
run: |
226-
{
227-
echo 'matrix<<EOF'
228-
cat tools/nix/openssl-matrix.json
229-
echo 'EOF'
230-
} >> "$GITHUB_OUTPUT"
217+
echo "matrix=$(nix-instantiate --eval --strict --json -E "
218+
let
219+
matrix = import $TAR_DIR/tools/nix/openssl-matrix.nix {};
220+
in
221+
builtins.map (attr: { inherit attr; inherit (builtins.getAttr attr matrix) name; }) (builtins.attrNames matrix)
222+
")" >> "$GITHUB_OUTPUT"
231223
232224
# Builds and tests Node.js with shared libraries against every supported
233225
# OpenSSL release version available in the repo-pinned nixpkgs. The default
234226
# shared `openssl` from tools/nix/sharedLibDeps.nix is overridden per matrix
235227
# entry, while all other shared libs remain at their defaults. Only runs on
236228
# a single runner/system (aarch64-linux) to keep the matrix to a minimum.
237229
build-openssl:
238-
needs:
239-
- build-aarch64-linux-v8
240-
- collect-openssl-versions
230+
needs: build-aarch64-linux-v8
241231
strategy:
242232
fail-fast: false
243233
matrix:
244-
openssl: ${{ fromJSON(needs.collect-openssl-versions.outputs.matrix) }}
245-
name: 'aarch64-linux: with shared ${{ matrix.openssl.attr }} (${{ matrix.openssl.version }})'
234+
openssl: ${{ fromJSON(needs.build-aarch64-linux-v8.outputs.matrix) }}
235+
name: 'aarch64-linux: with shared ${{ matrix.openssl.name }}'
246236
runs-on: ubuntu-24.04-arm
247-
continue-on-error: ${{ matrix.openssl['continue-on-error'] }}
237+
continue-on-error: false
248238
env:
249239
OPENSSL_ATTR: ${{ matrix.openssl.attr }}
250-
OPENSSL_VERSION: ${{ matrix.openssl.version }}
251240
steps:
252241
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
253242
with:
254243
persist-credentials: false
255244
sparse-checkout: .github/actions
245+
sparse-checkout-cone-mode: false
246+
247+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
248+
with:
249+
name: libv8
250+
path: ${{ runner.temp }}/libv8
251+
252+
- run: |
253+
echo "$RUNNER_TEMP/libv8"
254+
ls "$RUNNER_TEMP/libv8"
255+
256256
- uses: ./.github/actions/build-shared
257257
with:
258258
system: aarch64-linux
@@ -263,4 +263,8 @@ jobs:
263263
# `permittedInsecurePackages` whitelists just the matrix-selected
264264
# release (e.g. `openssl-1.1.1w`) so EOL-with-extended-support
265265
# cycles evaluate without relaxing nixpkgs' meta check globally.
266-
extra-nix-args: --arg sharedLibDeps "(import $TAR_DIR/tools/nix/sharedLibDeps.nix {}) // { openssl = (import $TAR_DIR/tools/nix/pkgs.nix { config.permittedInsecurePackages = [ \"openssl-$OPENSSL_VERSION\" ]; }).$OPENSSL_ATTR; }"
266+
extra-nix-args: |
267+
--arg useSeparateDerivationForV8 "$RUNNER_TEMP/libv8" \
268+
--arg sharedLibDeps "(import $TAR_DIR/tools/nix/sharedLibDeps.nix {}) // {
269+
openssl = (import $TAR_DIR/tools/nix/openssl-matrix.nix {}).$OPENSSL_ATTR;
270+
}" \

‎tools/nix/openssl-matrix.nix‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
{
2+
pkgs ? import ./pkgs.nix {
3+
config.permittedInsecurePackages = [ "openssl-1.1.1w" ];
4+
},
5+
}:
6+
7+
{
8+
inherit (pkgs)
9+
openssl_1_1
10+
openssl_3
11+
openssl_3_5
12+
openssl_3_6
13+
openssl_4_0
14+
;
15+
}

0 commit comments

Comments
 (0)