feat: add yarn audit fix after yarn install in upgrade-deps.sh #223
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| workflow_dispatch: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| tags: | |
| - '*' | |
| permissions: | |
| contents: read | |
| env: | |
| FORCE_COLOR: 1 | |
| PREBUILD_NODE_VERSION: '22' | |
| DEFAULT_NODE_VERSION: '26' | |
| ALPINE_VARIANT: 'alpine3.20' | |
| jobs: | |
| env_vars: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| prebuild_node_version: ${{ env.PREBUILD_NODE_VERSION }} | |
| default_node_version: ${{ env.DEFAULT_NODE_VERSION }} | |
| steps: | |
| - run: echo "exposing environment variables for passing to reusable workflows" | |
| verify-version: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Verify tag version matches package.json | |
| run: | | |
| # Check if we're running on a tag | |
| if [[ "$GITHUB_REF" == refs/tags/* ]]; then | |
| # Extract tag name from GITHUB_REF (e.g., refs/tags/v6.0.2 -> v6.0.2) | |
| TAG_NAME="${GITHUB_REF#refs/tags/}" | |
| # Remove 'v' prefix if present to get the version number | |
| TAG_VERSION="${TAG_NAME#v}" | |
| # Get version from package.json | |
| PACKAGE_VERSION=$(node -p "require('./package.json').version") | |
| echo "Tag version: $TAG_VERSION" | |
| echo "Package version: $PACKAGE_VERSION" | |
| if [ "$TAG_VERSION" != "$PACKAGE_VERSION" ]; then | |
| echo "ERROR: Tag version ($TAG_VERSION) does not match package.json version ($PACKAGE_VERSION)" | |
| echo "Please update package.json or create a new tag with the correct version" | |
| echo "GitHub release will NOT be created." | |
| exit 1 | |
| fi | |
| echo "Version match verified!" | |
| else | |
| echo "Skipping version verification - not a tag event" | |
| fi | |
| create-release: | |
| permissions: | |
| contents: write | |
| needs: [verify-version] | |
| if: startsWith(github.ref, 'refs/tags/') | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Create GitHub Release (draft) | |
| run: | | |
| TAG_NAME="${GITHUB_REF#refs/tags/}" | |
| echo "Creating draft release for tag: $TAG_NAME" | |
| gh release create "$TAG_NAME" --draft --title "$TAG_NAME" --notes "Release $TAG_NAME" | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: ${{ env.DEFAULT_NODE_VERSION }} | |
| - name: Install dependencies | |
| run: yarn install --frozen-lockfile --ignore-scripts | |
| - name: Run lint | |
| run: yarn lint | |
| build: | |
| permissions: | |
| contents: write | |
| needs: [verify-version, lint, create-release] | |
| if: >- | |
| !cancelled() && | |
| (needs.create-release.result == 'success' || needs.create-release.result == 'skipped') | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - os: macos-latest | |
| host: x64 | |
| target: x64 | |
| platform: macos-x64 | |
| node: 22 | |
| - os: macos-latest | |
| host: x64 | |
| target: x64 | |
| platform: macos-x64 | |
| node: 26 | |
| - os: ubuntu-24.04 | |
| host: x64 | |
| target: x64 | |
| platform: linux-x64 | |
| node: 22 | |
| - os: ubuntu-24.04 | |
| host: x64 | |
| target: x64 | |
| platform: linux-x64 | |
| node: 26 | |
| - os: windows-latest | |
| host: x64 | |
| target: x64 | |
| platform: win32-x64 | |
| node: 22 | |
| - os: windows-latest | |
| host: x64 | |
| target: x64 | |
| platform: win32-x64 | |
| node: 26 | |
| - os: windows-11-arm | |
| host: arm64 | |
| target: arm64 | |
| platform: win32-arm64 | |
| node: 22 | |
| - os: windows-11-arm | |
| host: arm64 | |
| target: arm64 | |
| platform: win32-arm64 | |
| node: 26 | |
| - os: macos-latest | |
| host: arm64 | |
| target: arm64 | |
| platform: macos-arm64 | |
| node: 22 | |
| - os: macos-latest | |
| host: arm64 | |
| target: arm64 | |
| platform: macos-arm64 | |
| node: 26 | |
| - os: ubuntu-24.04-arm | |
| host: arm64 | |
| target: arm64 | |
| platform: linux-arm64 | |
| node: 22 | |
| - os: ubuntu-24.04-arm | |
| host: arm64 | |
| target: arm64 | |
| platform: linux-arm64 | |
| node: 26 | |
| name: ${{ matrix.os }} (node=${{ matrix.node }}, host=${{ matrix.host }}, target=${{ matrix.target }}) | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: ${{ matrix.node }} | |
| architecture: ${{ matrix.host }} | |
| - name: Add msbuild to PATH | |
| uses: microsoft/setup-msbuild@v3 | |
| if: contains(matrix.os, 'windows') | |
| with: | |
| msbuild-architecture: ${{ matrix.target }} | |
| - name: Install dependencies | |
| run: yarn install --frozen-lockfile --ignore-scripts | |
| - name: Check Node compatibility | |
| run: node tools/semver-check.js | |
| - name: Add env vars | |
| shell: bash | |
| run: | | |
| echo "V=1" >> $GITHUB_ENV | |
| if [ "${{ matrix.target }}" = "x86" ]; then | |
| echo "TARGET=ia32" >> $GITHUB_ENV | |
| else | |
| echo "TARGET=${{ matrix.target }}" >> $GITHUB_ENV | |
| fi | |
| - name: Add Linux env vars | |
| if: contains(matrix.os, 'ubuntu') | |
| run: | | |
| echo "CFLAGS=${CFLAGS:-} -include ../src/gcc-preinclude.h" >> $GITHUB_ENV | |
| echo "CXXFLAGS=${CXXFLAGS:-} -include ../src/gcc-preinclude.h" >> $GITHUB_ENV | |
| - name: Build binaries | |
| run: yarn prebuild | |
| - name: Print binary info | |
| if: contains(matrix.os, 'ubuntu') | |
| run: | | |
| BIN=$(find prebuilds -name "*.node" | head -1) | |
| ldd "$BIN" | |
| echo "---" | |
| nm "$BIN" | grep "GLIBC_" | c++filt || true | |
| echo "---" | |
| file "$BIN" | |
| - name: Debug async hook stack integrity (macOS only, with diagnostic logging) | |
| if: contains(matrix.os, 'macos') | |
| shell: bash | |
| run: | | |
| SQLITE3_DEBUG_ASYNC_HOOKS=1 npx mocha -R spec --timeout 120000 test/async_hooks_stress.test.js 2>&1 | |
| - name: Run tests | |
| run: yarn test | |
| - name: Upload binaries to commit artifacts | |
| uses: actions/upload-artifact@v7 | |
| if: matrix.node == env.PREBUILD_NODE_VERSION | |
| with: | |
| name: prebuilt-binaries-${{ matrix.platform }} | |
| path: prebuilds/* | |
| retention-days: 7 | |
| - name: Upload binaries to GitHub Release | |
| shell: bash | |
| run: | | |
| TAG="${GITHUB_REF#refs/tags/}" | |
| for i in 1 2 3; do | |
| if gh release upload "$TAG" prebuilds/*/*.node --clobber; then | |
| echo "Upload succeeded on attempt $i" | |
| break | |
| else | |
| echo "Upload failed on attempt $i, retrying in 10s..." | |
| sleep 10 | |
| fi | |
| done | |
| if: matrix.node == env.PREBUILD_NODE_VERSION && startsWith(github.ref, 'refs/tags/') | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| - name: Upload coverage reports to Codecov | |
| uses: codecov/codecov-action@v6 | |
| if: matrix.node == env.DEFAULT_NODE_VERSION && matrix.platform == 'linux-x64' | |
| with: | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| slug: gms1/node-sqlite3 | |
| build-musl: | |
| permissions: | |
| contents: write | |
| needs: [verify-version, create-release] | |
| if: >- | |
| !cancelled() && | |
| (needs.create-release.result == 'success' || needs.create-release.result == 'skipped') && | |
| (github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/')) | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - runner: ubuntu-24.04-arm | |
| platform: linux/arm64 | |
| arch: arm64 | |
| - runner: ubuntu-24.04 | |
| platform: linux/amd64 | |
| arch: amd64 | |
| runs-on: ${{ matrix.runner }} | |
| name: musl ${{ matrix.arch }} | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Build binaries and test | |
| run: | | |
| docker build \ | |
| --file ./tools/BinaryBuilder.Dockerfile \ | |
| --tag sqlite-builder \ | |
| --no-cache \ | |
| --build-arg VARIANT=${{ env.ALPINE_VARIANT }} \ | |
| --build-arg NODE_VERSION=${{ env.PREBUILD_NODE_VERSION }} \ | |
| . | |
| CONTAINER_ID=$(docker create -it sqlite-builder) | |
| docker cp $CONTAINER_ID:/usr/src/build/prebuilds/ ./prebuilds | |
| - name: Upload binaries to commit artifacts | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: prebuilt-binaries-musl-${{ matrix.arch }} | |
| path: prebuilds/* | |
| retention-days: 7 | |
| - name: Upload binaries to GitHub Release | |
| shell: bash | |
| run: | | |
| TAG="${GITHUB_REF#refs/tags/}" | |
| for i in 1 2 3; do | |
| if gh release upload "$TAG" prebuilds/*/*.node --clobber; then | |
| echo "Upload succeeded on attempt $i" | |
| break | |
| else | |
| echo "Upload failed on attempt $i, retrying in 10s..." | |
| sleep 10 | |
| fi | |
| done | |
| if: startsWith(github.ref, 'refs/tags/') | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| package: | |
| needs: [build, build-musl] | |
| if: >- | |
| !cancelled() && | |
| needs.build.result == 'success' && | |
| (needs.build-musl.result == 'success' || needs.build-musl.result == 'skipped') | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: ${{ env.PREBUILD_NODE_VERSION }} | |
| - name: Install dependencies | |
| run: yarn install --frozen-lockfile --ignore-scripts | |
| - name: Download all prebuilt binary artifacts | |
| uses: actions/download-artifact@v8 | |
| with: | |
| path: prebuilds-artifacts | |
| merge-multiple: true | |
| - name: Merge prebuilds into package | |
| run: | | |
| mkdir -p prebuilds | |
| cp -r prebuilds-artifacts/* prebuilds/ | |
| rm -rf prebuilds-artifacts | |
| find prebuilds -name '*.node' -type f | |
| - name: Create npm tarball | |
| run: | | |
| npm pack | |
| echo "npm tarball created:" | |
| ls -la *.tgz | |
| - name: Upload npm tarball as commit artifact | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: npm-package-tarball | |
| path: '*.tgz' | |
| retention-days: 7 | |
| - name: Upload npm tarball to GitHub Release | |
| if: startsWith(github.ref, 'refs/tags/') | |
| run: gh release upload ${GITHUB_REF#refs/tags/} *.tgz --clobber | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| test-package: | |
| needs: [package, env_vars] | |
| if: >- | |
| !cancelled() && | |
| needs.package.result == 'success' | |
| uses: ./.github/workflows/test-npm-package.yml | |
| with: | |
| target_run_id: ${{ github.run_id }} | |
| node_version: ${{ needs.env_vars.outputs.default_node_version }} |