# This action uses the following secrets:

# CACHIX_AUTH_TOKEN: Write access to nodejs.cachix.org – without it, the cache is read-only.

name: Test Shared libraries

on:

pull_request:

paths-ignore:

- '**.md'

- eslint.config.mjs

- '**/eslint.config_partial.mjs'

- android-configure

- android-configure.py

- android-patches/**

- benchmarks/**

- codecov.yml

- deps/ada/**

- deps/brotli/**

- deps/cares/**

- deps/crates/**

- deps/corepack/**

- deps/googletest/**

- deps/histogram/**

- deps/icu-small/**

- deps/icu-tmp/**

- deps/libffi/**

- deps/llhttp/**

- deps/merve/**

- deps/nbytes/**

- deps/nghttp2/**

- deps/ngtcp2/**

- deps/openssl/*/**

- deps/perfetto/**

- deps/simdjson/**

- deps/sqlite/**

- deps/uv/**

- deps/uvwasi/**

- deps/v8/third_party/abseil-cpp/**

- deps/v8/third_party/highway/**

- deps/v8/third_party/simdutf/**

- deps/zlib/**

- deps/zstd/**

- doc/**

- pyproject.yml

- tsconfig.json

- test/internet/**

- tools/**

- '!tools/gyp/**'

- '!tools/nix/**'

- '!tools/v8/**'

- '!tools/v8_gypfiles/**'

- tools/nix/list-requisites.sh

- typings/**

- vcbuild.bat

- .**

- '!.github/workflows/test-shared.yml'

- '!.github/workflows/build-shared.yml'

types: [opened, synchronize, reopened, ready_for_review]

push:

branches:

- main

- canary

- v[0-9]+.x-staging

- v[0-9]+.x

paths-ignore:

- '**.md'

- eslint.config.mjs

- '**/eslint.config_partial.mjs'

- android-configure

- android-configure.py

- android-patches/**

- benchmarks/**

- codecov.yml

- deps/ada/**

- deps/brotli/**

- deps/cares/**

- deps/crates/**

- deps/corepack/**

- deps/googletest/**

- deps/histogram/**

- deps/icu-small/**

- deps/icu-tmp/**

- deps/libffi/**

- deps/llhttp/**

- deps/merve/**

- deps/nbytes/**

- deps/nghttp2/**

- deps/ngtcp2/**

- deps/openssl/*/**

- deps/perfetto/**

- deps/simdjson/**

- deps/sqlite/**

- deps/uv/**

- deps/uvwasi/**

- deps/v8/third_party/abseil-cpp/**

- deps/v8/third_party/highway/**

- deps/v8/third_party/simdutf/**

- deps/zlib/**

- deps/zstd/**

- doc/**

- pyproject.yml

- tsconfig.json

- test/internet/**

- tools/**

- '!tools/gyp/**'

- '!tools/nix/**'

- '!tools/v8/**'

- '!tools/v8_gypfiles/**'

- tools/nix/list-requisites.sh

- typings/**

- vcbuild.bat

- .**

- '!.github/workflows/test-shared.yml'

- '!.github/workflows/build-shared.yml'

concurrency:

group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}

cancel-in-progress: true

permissions:

contents: read

jobs:

build-tarball:

if: github.event.pull_request.draft == false

name: ${{ github.event_name == 'workflow_dispatch' && 'Skipped job' || 'Build slim tarball' }}

runs-on: ubuntu-slim

steps:

- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

with:

persist-credentials: false

- name: Make tarball

run: |

export DATESTRING=$(date "+%Y-%m-%d")

export COMMIT=$(git rev-parse --short=10 "$GITHUB_SHA")

./configure && make tar -j4 SKIP_XZ=1 SKIP_SHARED_DEPS=1

env:

DISTTYPE: nightly

- name: Upload tarball artifact

uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

with:

path: '*.tar.gz'

archive: false

build:

needs: build-tarball

strategy:

fail-fast: false

matrix:

include:

- runner: ubuntu-24.04

system: x86_64-linux

# Exercise the trace-event code against a perfetto-enabled V8.

perfetto: true

# built separately in build-aarch64-linux-v8

# - runner: ubuntu-24.04-arm

# system: aarch64-linux

- runner: macos-15-intel

system: x86_64-darwin

- runner: macos-latest

system: aarch64-darwin

name: '${{ matrix.system }}: with shared libraries${{ matrix.perfetto && '' and perfetto'' || '''' }}'

uses: $/.github/workflows/build-shared.yml

with:

runner: ${{ matrix.runner }}

with-sccache: ${{ github.base_ref == 'main' || github.ref_name == 'main' }}

extra-nix-flags: |

--arg useSeparateDerivationForV8 true \

${{ matrix.perfetto && '--arg withPerfetto true \' || '\' }}

${{ endsWith(matrix.system, '-darwin') && '--arg withAmaro false --arg withLief false --arg withSQLite false --arg withFFI false --arg extraConfigFlags ''["--without-inspector" "--without-node-options"]'' \' || '\' }}

secrets:

CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}

build-aarch64-linux-v8:

needs: build-tarball

runs-on: ubuntu-24.04-arm

name: 'aarch64-linux: Cache V8 build'

outputs:

local-cache: ${{ steps.upload.outcome != 'skipped' && 'true' || '' }}

matrix: ${{ steps.query.outputs.matrix }}

env:

HAS_CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN && 'true' }}

steps:

- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1

with:

path: tarballs

- name: Extract tarball

shell: bash

run: |

tar xzf tarballs/*.tar.gz -C "$RUNNER_TEMP"

echo "TAR_DIR=$RUNNER_TEMP/$(basename tarballs/*.tar.gz .tar.gz)" >> "$GITHUB_ENV"

- uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1

with:

extra_nix_config: sandbox = true

- name: Evaluate V8 derivation, check its cache status

id: v8-drv

run: |

V8_DRV=$(

nix-instantiate -E "builtins.filter (p: p.pname == ''v8'') (import $TAR_DIR/shell.nix { useSeparateDerivationForV8=true; }).buildInputs"

)

V8_STORE_PATH=$(nix-store -q --outputs "$V8_DRV")

echo "V8_DRV=$V8_DRV" >> "$GITHUB_OUTPUT"

set -x

[ "$(curl -ISsw "%{http_code}" -o /dev/null "https://nodejs.cachix.org/$(basename ${V8_STORE_PATH%-v8-*}).narinfo")" != "200" ] ||

echo "ALREADY_CACHED=true" >> "$GITHUB_OUTPUT"

- uses: cachix/cachix-action@38b082610b782e7e93e209c35fd730d399dee866 # v17

if: ${{ steps.v8-drv.outputs.ALREADY_CACHED != 'true' }}

with:

name: nodejs

authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}

- name: Build V8 to cache it

if: ${{ steps.v8-drv.outputs.ALREADY_CACHED != 'true' }}

run: nix-store --export "$(nix-build "$V8_DRV")" > libv8-aarch64-linux.nar

env:

V8_DRV: ${{ steps.v8-drv.outputs.V8_DRV }}

- name: Upload libv8-aarch64-linux.nar

if: ${{ steps.v8-drv.outputs.ALREADY_CACHED != 'true' && env.HAS_CACHIX_AUTH_TOKEN != 'true' }}

id: upload

uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

with:

name: libv8-aarch64-linux.nar

path: libv8-aarch64-linux.nar

- name: Collect matrix of support OpenSSL versions

id: query

run: |

echo "matrix=$(

nix-instantiate --eval --strict --json -E "

let

matrix = import $TAR_DIR/tools/nix/openssl-matrix.nix {};

in

builtins.map (attr: { inherit attr; inherit (builtins.getAttr attr matrix) name; }) (builtins.attrNames matrix)

"

)" >> "$GITHUB_OUTPUT"

# Builds and tests Node.js with shared libraries against every supported

# OpenSSL release version available in the repo-pinned nixpkgs. The default

# shared `openssl` from tools/nix/sharedLibDeps.nix is overridden per matrix

# entry, while all other shared libs remain at their defaults. Only runs on

# a single runner/system (aarch64-linux) to keep the matrix to a minimum.

build-openssl:

needs: build-aarch64-linux-v8

strategy:

fail-fast: false

matrix:

openssl: ${{ fromJSON(needs.build-aarch64-linux-v8.outputs.matrix) }}

name: 'aarch64-linux: with shared ${{ matrix.openssl.name }}'

uses: $/.github/workflows/build-shared.yml

with:

runner: ubuntu-24.04-arm

v8-nar: ${{ needs.build-aarch64-linux-v8.outputs.local-cache && 'libv8-aarch64-linux.nar' }}

pkcs11-store-test: ${{ matrix.openssl.attr == 'openssl' }}

# Override just the `openssl` attr of the default shared-lib set with

# the matrix-selected nixpkgs attribute (e.g. `openssl_3_6`). All

# other shared libs (brotli, cares, libuv, …) keep their defaults.

# `permittedInsecurePackages` whitelists just the matrix-selected

# release (e.g. `openssl-1.1.1w`) so EOL-with-extended-support

# cycles evaluate without relaxing nixpkgs' meta check globally.

extra-nix-flags: |

--arg useSeparateDerivationForV8 ${{ needs.build-aarch64-linux-v8.outputs.local-cache && '"$(nix-store --import < libv8-aarch64-linux.nar)"' || 'true' }} \

--arg sharedLibDeps "(import $TAR_DIR/tools/nix/sharedLibDeps.nix {}) // {

openssl = builtins.getAttr \"${{

!contains(matrix.openssl.attr, '$') && !contains(matrix.openssl.attr, '\"') && !contains(matrix.openssl.attr, '\') && !contains(matrix.openssl.attr, '`') && matrix.openssl.attr

}}\" (import $TAR_DIR/tools/nix/openssl-matrix.nix {});

}" \

secrets:

CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}