node/.github/workflows/test-shared.yml

# This action uses the following secrets:
#   CACHIX_AUTH_TOKEN: Write access to nodejs.cachix.org – without it, the cache is read-only.
name: Test Shared libraries

on:
  pull_request:
    paths-ignore:
      - '**.md'
      - eslint.config.mjs
      - '**/eslint.config_partial.mjs'
      - android-configure
      - android-configure.py
      - android-patches/**
      - benchmarks/**
      - codecov.yml
      - deps/LIEF/**
      - deps/ada/**
      - deps/brotli/**
      - deps/cares/**
      - deps/corepack/**
      - deps/crates/**
      - deps/googletest/**
      - deps/histogram/**
      - deps/icu-small/**
      - deps/icu-tmp/**
      - deps/libffi/**
      - deps/llhttp/**
      - deps/merve/**
      - deps/nbytes/**
      - deps/nghttp2/**
      - deps/ngtcp2/**
      - deps/openssl/*/**
      - deps/perfetto/**
      - deps/simdjson/**
      - deps/sqlite/**
      - deps/uv/**
      - deps/uvwasi/**
      - deps/v8/third_party/abseil-cpp/**
      - deps/v8/third_party/highway/**
      - deps/v8/third_party/simdutf/**
      - deps/zlib/**
      - deps/zstd/**
      - doc/**
      - pyproject.yml
      - tsconfig.json
      - test/internet/**
      - tools/**
      - '!tools/gyp/**'
      - '!tools/nix/**'
      - '!tools/v8/**'
      - '!tools/v8_gypfiles/**'
      - tools/nix/list-requisites.sh
      - typings/**
      - vcbuild.bat
      - .**
      - '!.github/workflows/test-shared.yml'
      - '!.github/workflows/build-shared.yml'
    types: [opened, synchronize, reopened, ready_for_review]
  push:
    branches:
      - main
      - canary
      - v[0-9]+.x-staging
      - v[0-9]+.x
    paths-ignore:
      - '**.md'
      - eslint.config.mjs
      - '**/eslint.config_partial.mjs'
      - android-configure
      - android-configure.py
      - android-patches/**
      - benchmarks/**
      - codecov.yml
      - deps/LIEF/**
      - deps/ada/**
      - deps/brotli/**
      - deps/cares/**
      - deps/corepack/**
      - deps/crates/**
      - deps/googletest/**
      - deps/histogram/**
      - deps/icu-small/**
      - deps/icu-tmp/**
      - deps/libffi/**
      - deps/llhttp/**
      - deps/merve/**
      - deps/nbytes/**
      - deps/nghttp2/**
      - deps/ngtcp2/**
      - deps/openssl/*/**
      - deps/perfetto/**
      - deps/simdjson/**
      - deps/sqlite/**
      - deps/uv/**
      - deps/uvwasi/**
      - deps/v8/third_party/abseil-cpp/**
      - deps/v8/third_party/highway/**
      - deps/v8/third_party/simdutf/**
      - deps/zlib/**
      - deps/zstd/**
      - doc/**
      - pyproject.yml
      - tsconfig.json
      - test/internet/**
      - tools/**
      - '!tools/gyp/**'
      - '!tools/nix/**'
      - '!tools/v8/**'
      - '!tools/v8_gypfiles/**'
      - tools/nix/list-requisites.sh
      - typings/**
      - vcbuild.bat
      - .**
      - '!.github/workflows/test-shared.yml'
      - '!.github/workflows/build-shared.yml'

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  build-tarball:
    if: github.event.pull_request.draft == false
    name: ${{ github.event_name == 'workflow_dispatch' && 'Skipped job' || 'Build slim tarball' }}
    runs-on: ubuntu-slim
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false

      - name: Make tarball
        run: |
          export DATESTRING=$(date "+%Y-%m-%d")
          export COMMIT=$(git rev-parse --short=10 "$GITHUB_SHA")
          ./configure && make tar -j4 SKIP_XZ=1 SKIP_SHARED_DEPS=1 GZIP_COMPRESSION=6
        env:
          DISTTYPE: nightly

      - name: Upload tarball artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          path: '*.tar.gz'
          archive: false

  build:
    needs: build-tarball
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-24.04
            system: x86_64-linux
            # Exercise the trace-event code against a perfetto-enabled V8.
            perfetto: true
          # built separately in build-aarch64-linux-v8
          # - runner: ubuntu-24.04-arm
          #   system: aarch64-linux
          - runner: macos-15-intel
            system: x86_64-darwin
          - runner: macos-latest
            system: aarch64-darwin
    name: '${{ matrix.system }}: with shared libraries${{ matrix.perfetto && '' and perfetto'' || '''' }}'
    uses: $/.github/workflows/build-shared.yml
    with:
      runner: ${{ matrix.runner }}
      with-sccache: ${{ github.base_ref == 'main' || github.ref_name == 'main' }}
      extra-nix-flags: ${{ matrix.perfetto && '--arg withPerfetto true' || '' }}
    secrets:
      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}

  build-aarch64-linux-v8:
    needs: build-tarball
    runs-on: ubuntu-24.04-arm
    name: 'aarch64-linux: Cache V8 build'
    outputs:
      local-cache: ${{ steps.upload.outcome != 'skipped' && 'true' || '' }}
      matrix: ${{ steps.query.outputs.matrix }}
    env:
      HAS_CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN && 'true' }}
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          path: tarballs

      - name: Extract tarball
        shell: bash
        run: |
          tar xzf tarballs/*.tar.gz -C "$RUNNER_TEMP"
          echo "TAR_DIR=$RUNNER_TEMP/$(basename tarballs/*.tar.gz .tar.gz)" >> "$GITHUB_ENV"

      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24  # v31.11.1
        with:
          extra_nix_config: sandbox = true

      - name: Evaluate V8 derivation, check its cache status
        id: v8-drv
        run: |
          V8_DRV=$(
            nix-instantiate -E "(import $TAR_DIR/tools/nix/ci-shell.nix {}).v8Derivation"
          )
          V8_STORE_PATH=$(nix-store -q --outputs "$V8_DRV")
          echo "V8_DRV=$V8_DRV" >> "$GITHUB_OUTPUT"
          set -x
          [ "$(curl -ISsw "%{http_code}" -o /dev/null "https://nodejs.cachix.org/$(basename ${V8_STORE_PATH%-v8-*}).narinfo")" != "200" ] ||
            echo "ALREADY_CACHED=true" >> "$GITHUB_OUTPUT"

      - uses: cachix/cachix-action@38b082610b782e7e93e209c35fd730d399dee866  # v17
        if: ${{ steps.v8-drv.outputs.ALREADY_CACHED != 'true' }}
        with:
          name: nodejs
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}

      - name: Build V8 to cache it
        if: ${{ steps.v8-drv.outputs.ALREADY_CACHED != 'true' }}
        run: nix-store --export "$(nix-build "$V8_DRV")" > libv8-aarch64-linux.nar
        env:
          V8_DRV: ${{ steps.v8-drv.outputs.V8_DRV }}

      - name: Upload libv8-aarch64-linux.nar
        if: ${{ steps.v8-drv.outputs.ALREADY_CACHED != 'true' && env.HAS_CACHIX_AUTH_TOKEN != 'true' }}
        id: upload
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: libv8-aarch64-linux.nar
          path: libv8-aarch64-linux.nar

      - name: Collect matrix of support OpenSSL versions
        id: query
        run: |
          echo "matrix=$(
            nix-instantiate --eval --strict --json -E "
              let
                matrix = import $TAR_DIR/tools/nix/openssl-matrix.nix {};
              in
              builtins.map (attr: { inherit attr; inherit (builtins.getAttr attr matrix) name; }) (builtins.attrNames matrix)
            "
          )" >> "$GITHUB_OUTPUT"

  # Builds and tests Node.js with shared libraries against every supported
  # OpenSSL release version available in the repo-pinned nixpkgs. The default
  # shared `openssl` from tools/nix/sharedLibDeps.nix is overridden per matrix
  # entry, while all other shared libs remain at their defaults. Only runs on
  # a single runner/system (aarch64-linux) to keep the matrix to a minimum.
  build-openssl:
    needs: build-aarch64-linux-v8
    strategy:
      fail-fast: false
      matrix:
        openssl: ${{ fromJSON(needs.build-aarch64-linux-v8.outputs.matrix) }}
    name: 'aarch64-linux: with shared ${{ matrix.openssl.name }}'
    uses: $/.github/workflows/build-shared.yml
    with:
      runner: ubuntu-24.04-arm
      v8-nar: ${{ needs.build-aarch64-linux-v8.outputs.local-cache && 'libv8-aarch64-linux.nar' }}
      pkcs11-store-test: ${{ matrix.openssl.attr == 'openssl' }}
      # Override just the `openssl` attr of the default shared-lib set with
      # the matrix-selected nixpkgs attribute (e.g. `openssl_3_6`). All
      # other shared libs (brotli, cares, libuv, …) keep their defaults.
      # `permittedInsecurePackages` whitelists just the matrix-selected
      # release so EOL-with-extended-support cycles evaluate without relaxing
      # nixpkgs' meta check globally.
      extra-nix-flags: |
        --arg useSeparateDerivationForV8 ${{ needs.build-aarch64-linux-v8.outputs.local-cache && '"$(nix-store --import < libv8-aarch64-linux.nar)"' || 'true' }} \
        --arg sharedLibDeps "(import $TAR_DIR/tools/nix/sharedLibDeps.nix {}) // {
            openssl = builtins.getAttr \"${{
              !contains(matrix.openssl.attr, '$') && !contains(matrix.openssl.attr, '\"') && !contains(matrix.openssl.attr, '\') && !contains(matrix.openssl.attr, '`') && matrix.openssl.attr
            }}\" (import $TAR_DIR/tools/nix/openssl-matrix.nix {});
          }" \
    secrets:
      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}