# This action uses the following secrets:
# CACHIX_AUTH_TOKEN: Write access to nodejs.cachix.org – without it, the cache is read-only.
name: Test Shared libraries
on:
pull_request:
paths-ignore:
- '**.md'
- eslint.config.mjs
- '**/eslint.config_partial.mjs'
- android-configure
- android-configure.py
- android-patches/**
- benchmarks/**
- codecov.yml
- deps/LIEF/**
- deps/ada/**
- deps/brotli/**
- deps/cares/**
- deps/corepack/**
- deps/crates/**
- deps/googletest/**
- deps/histogram/**
- deps/icu-small/**
- deps/icu-tmp/**
- deps/libffi/**
- deps/llhttp/**
- deps/merve/**
- deps/nbytes/**
- deps/nghttp2/**
- deps/ngtcp2/**
- deps/openssl/*/**
- deps/perfetto/**
- deps/simdjson/**
- deps/sqlite/**
- deps/uv/**
- deps/uvwasi/**
- deps/v8/third_party/abseil-cpp/**
- deps/v8/third_party/highway/**
- deps/v8/third_party/simdutf/**
- deps/zlib/**
- deps/zstd/**
- doc/**
- pyproject.yml
- tsconfig.json
- test/internet/**
- tools/**
- '!tools/gyp/**'
- '!tools/nix/**'
- '!tools/v8/**'
- '!tools/v8_gypfiles/**'
- tools/nix/list-requisites.sh
- typings/**
- vcbuild.bat
- .**
- '!.github/workflows/test-shared.yml'
- '!.github/workflows/build-shared.yml'
types: [opened, synchronize, reopened, ready_for_review]
push:
branches:
- main
- canary
- v[0-9]+.x-staging
- v[0-9]+.x
paths-ignore:
- '**.md'
- eslint.config.mjs
- '**/eslint.config_partial.mjs'
- android-configure
- android-configure.py
- android-patches/**
- benchmarks/**
- codecov.yml
- deps/LIEF/**
- deps/ada/**
- deps/brotli/**
- deps/cares/**
- deps/corepack/**
- deps/crates/**
- deps/googletest/**
- deps/histogram/**
- deps/icu-small/**
- deps/icu-tmp/**
- deps/libffi/**
- deps/llhttp/**
- deps/merve/**
- deps/nbytes/**
- deps/nghttp2/**
- deps/ngtcp2/**
- deps/openssl/*/**
- deps/perfetto/**
- deps/simdjson/**
- deps/sqlite/**
- deps/uv/**
- deps/uvwasi/**
- deps/v8/third_party/abseil-cpp/**
- deps/v8/third_party/highway/**
- deps/v8/third_party/simdutf/**
- deps/zlib/**
- deps/zstd/**
- doc/**
- pyproject.yml
- tsconfig.json
- test/internet/**
- tools/**
- '!tools/gyp/**'
- '!tools/nix/**'
- '!tools/v8/**'
- '!tools/v8_gypfiles/**'
- tools/nix/list-requisites.sh
- typings/**
- vcbuild.bat
- .**
- '!.github/workflows/test-shared.yml'
- '!.github/workflows/build-shared.yml'
concurrency:
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
cancel-in-progress: true
permissions:
contents: read
jobs:
build-tarball:
if: github.event.pull_request.draft == false
name: ${{ github.event_name == 'workflow_dispatch' && 'Skipped job' || 'Build slim tarball' }}
runs-on: ubuntu-slim
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Make tarball
run: |
export DATESTRING=$(date "+%Y-%m-%d")
export COMMIT=$(git rev-parse --short=10 "$GITHUB_SHA")
./configure && make tar -j4 SKIP_XZ=1 SKIP_SHARED_DEPS=1 GZIP_COMPRESSION=6
env:
DISTTYPE: nightly
- name: Upload tarball artifact
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
with:
path: '*.tar.gz'
archive: false
build:
needs: build-tarball
strategy:
fail-fast: false
matrix:
include:
- runner: ubuntu-24.04
system: x86_64-linux
# Exercise the trace-event code against a perfetto-enabled V8.
perfetto: true
# built separately in build-aarch64-linux-v8
# - runner: ubuntu-24.04-arm
# system: aarch64-linux
- runner: macos-15-intel
system: x86_64-darwin
- runner: macos-latest
system: aarch64-darwin
name: '${{ matrix.system }}: with shared libraries${{ matrix.perfetto && '' and perfetto'' || '''' }}'
uses: $/.github/workflows/build-shared.yml
with:
runner: ${{ matrix.runner }}
with-sccache: ${{ github.base_ref == 'main' || github.ref_name == 'main' }}
extra-nix-flags: ${{ matrix.perfetto && '--arg withPerfetto true' || '' }}
secrets:
CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
build-aarch64-linux-v8:
needs: build-tarball
runs-on: ubuntu-24.04-arm
name: 'aarch64-linux: Cache V8 build'
outputs:
local-cache: ${{ steps.upload.outcome != 'skipped' && 'true' || '' }}
matrix: ${{ steps.query.outputs.matrix }}
env:
HAS_CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN && 'true' }}
steps:
- uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
with:
path: tarballs
- name: Extract tarball
shell: bash
run: |
tar xzf tarballs/*.tar.gz -C "$RUNNER_TEMP"
echo "TAR_DIR=$RUNNER_TEMP/$(basename tarballs/*.tar.gz .tar.gz)" >> "$GITHUB_ENV"
- uses: cachix/install-nix-action@75c75c31ebece974e48ebc36b4ad125bd97bd97b # v31.11.3
with:
extra_nix_config: sandbox = true
- name: Evaluate V8 derivation, check its cache status
id: v8-drv
run: |
V8_DRV=$(
nix-instantiate -E "(import $TAR_DIR/tools/nix/ci-shell.nix {}).v8Derivation"
)
V8_STORE_PATH=$(nix-store -q --outputs "$V8_DRV")
echo "V8_DRV=$V8_DRV" >> "$GITHUB_OUTPUT"
set -x
[ "$(curl -ISsw "%{http_code}" -o /dev/null "https://nodejs.cachix.org/$(basename ${V8_STORE_PATH%-v8-*}).narinfo")" != "200" ] ||
echo "ALREADY_CACHED=true" >> "$GITHUB_OUTPUT"
- uses: cachix/cachix-action@38b082610b782e7e93e209c35fd730d399dee866 # v17
if: ${{ steps.v8-drv.outputs.ALREADY_CACHED != 'true' }}
with:
name: nodejs
authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
- name: Build V8 to cache it
if: ${{ steps.v8-drv.outputs.ALREADY_CACHED != 'true' }}
run: nix-store --export "$(nix-build "$V8_DRV")" > libv8-aarch64-linux.nar
env:
V8_DRV: ${{ steps.v8-drv.outputs.V8_DRV }}
- name: Upload libv8-aarch64-linux.nar
if: ${{ steps.v8-drv.outputs.ALREADY_CACHED != 'true' && env.HAS_CACHIX_AUTH_TOKEN != 'true' }}
id: upload
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
with:
name: libv8-aarch64-linux.nar
path: libv8-aarch64-linux.nar
- name: Collect matrix of support OpenSSL versions
id: query
run: |
echo "matrix=$(
nix-instantiate --eval --strict --json -E "
let
matrix = import $TAR_DIR/tools/nix/openssl-matrix.nix {};
in
builtins.map (attr: { inherit attr; inherit (builtins.getAttr attr matrix) name; }) (builtins.attrNames matrix)
"
)" >> "$GITHUB_OUTPUT"
# Builds and tests Node.js with shared libraries against every supported
# OpenSSL release version available in the repo-pinned nixpkgs. The default
# shared `openssl` from tools/nix/sharedLibDeps.nix is overridden per matrix
# entry, while all other shared libs remain at their defaults. Only runs on
# a single runner/system (aarch64-linux) to keep the matrix to a minimum.
build-openssl:
needs: build-aarch64-linux-v8
strategy:
fail-fast: false
matrix:
openssl: ${{ fromJSON(needs.build-aarch64-linux-v8.outputs.matrix) }}
name: 'aarch64-linux: with shared ${{ matrix.openssl.name }}'
uses: $/.github/workflows/build-shared.yml
with:
runner: ubuntu-24.04-arm
v8-nar: ${{ needs.build-aarch64-linux-v8.outputs.local-cache && 'libv8-aarch64-linux.nar' }}
pkcs11-store-test: ${{ matrix.openssl.attr == 'openssl_3_5' }}
# Override just the `openssl` attr of the default shared-lib set with
# the matrix-selected nixpkgs attribute (e.g. `openssl_3_6`). All
# other shared libs (brotli, cares, libuv, …) keep their defaults.
# `permittedInsecurePackages` whitelists just the matrix-selected
# release so EOL-with-extended-support cycles evaluate without relaxing
# nixpkgs' meta check globally.
extra-nix-flags: |
--arg useSeparateDerivationForV8 ${{ needs.build-aarch64-linux-v8.outputs.local-cache && '"$(nix-store --import < libv8-aarch64-linux.nar)"' || 'true' }} \
--arg sharedLibDeps "(import $TAR_DIR/tools/nix/sharedLibDeps.nix {}) // {
openssl = builtins.getAttr \"${{
!contains(matrix.openssl.attr, '$') && !contains(matrix.openssl.attr, '\"') && !contains(matrix.openssl.attr, '\') && !contains(matrix.openssl.attr, '`') && matrix.openssl.attr
}}\" (import $TAR_DIR/tools/nix/openssl-matrix.nix {});
}" \
secrets:
CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}