Merge v22 patches into 22.23.4 branch

.github/workflows/build-node-fibers.yml

@@ -1,14 +1,17 @@
-name: Build node-fibers with prebuilt Node
+name: Build Custom Fibers
 
 on:
   workflow_dispatch:
   workflow_run:
-    workflows: [Build Node]
+    workflows: ["Build Node (Standard)"]
     types:
       - completed
+    branches:
+      - v22.21.1
 
 jobs:
   build-fibers:
+    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
     strategy:
       matrix:
         include:
@@ -21,9 +24,12 @@ jobs:
     runs-on: ${{ matrix.runs_on }}
 
     env:
-      NODE_VERSION: v20.18.3
+      NODE_VERSION: v22.21.1
 
     steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+
       - name: Debug Matrix Values
         run: |
           echo "Matrix platform: ${{ matrix.platform }}"
@@ -34,39 +40,20 @@ jobs:
           gh release download node-${{ env.NODE_VERSION }}-release \
             --repo asana/node \
             --pattern "node-${{ env.NODE_VERSION }}-${{ matrix.platform }}-${{ matrix.arch }}-LATEST.tar.xz"
+          mv node-${{ env.NODE_VERSION }}-${{ matrix.platform }}-${{ matrix.arch }}-LATEST.tar.xz node.tar.xz
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Extract Node archive
-        run: |
-          mkdir -p node-install
-          tar -C node-install -xJf node-${{ env.NODE_VERSION }}-${{ matrix.platform }}-${{ matrix.arch }}-LATEST.tar.xz
-          echo "$GITHUB_WORKSPACE/node-install/usr/local/bin" >> $GITHUB_PATH
-
-      - name: Verify Node Binary Architecture
+      - name: Execute the Dockerfile
         run: |
-          echo "Node File:"
-          file $GITHUB_WORKSPACE/node-install/usr/local/bin/node
-          echo "Runner architecture:"
-          uname -m
-
-      - name: Checkout node-fibers fork
-        uses: actions/checkout@v3
-        with:
-          repository: asana/node-fibers
-          ref: jackstrohm_node20_fibers
-          path: node-fibers
+          pwd
+          docker build -t node22_fibers_build -f Dockerfile.Fibers .
 
-      - name: Build node-fibers
-        working-directory: node-fibers
+      - name: Extract resources
         run: |
-          which node
-          node -v
-          node -p "process.arch"
-          npm install --nodedir="$GITHUB_WORKSPACE/node-install/usr/local"
-          npm test || true
-          rm bin/repl
-          find .
+          docker create --name temp_node_fibers_extract node22_fibers_build
+          docker cp temp_node_fibers_extract:/usr/src/node/node-fibers $GITHUB_WORKSPACE/node-fibers
+          docker rm temp_node_fibers_extract
 
       - name: Find and archive fibers.node
         run: |

.github/workflows/build-node-openssl-fips.yml

@@ -1,37 +1,22 @@
-name: Build Node with options around OpenSSL dynamic linking and FIPS
+name: Build Node (FIPS)
 
 on:
   workflow_dispatch:
     inputs:
-      enableFips:
-        description: 'Whether OpenSSL should be FIPS-enabled'
-        default: true
-        type: boolean
-      dynamicLink:
-        description: 'If OpenSSL should be dynamically linked with node (rather than statically linked)'
-        default: false
-        type: boolean
-      sharedOpenSSLIncludes:
-        description: 'dir containing header files for OpenSSL'
-        default: ''
-        type: string
-      sharedOpenSSLLibname:
-        description: 'libname for dynamically linking to OpenSSL'
-        default: ''
-        type: string
-      sharedOpenSSLLibpath:
-        description: 'dir for searching for shared OpenSSL dlls'
-        default: ''
-        type: string
       BUILD_REF:
-        description: 'ref to build'
+        description: 'Git ref to build Node.js from'
+        required: true
+        default: 'v22.21.1'
+        type: string
+      DOCKER_FILE:
+        description: 'Dockerfile to use for building Node.js'
         required: true
-        default: 'main'
+        default: 'Dockerfile.Node22fips'
         type: string
 
 jobs:
   build-node:
-    name: Build ${{ matrix.platform }}-${{ matrix.arch }} with statically-linked FIPS OpenSSL
+    name: Build ${{ matrix.platform }}-${{ matrix.arch }} with FIPS OpenSSL
     strategy:
       matrix:
         include:
@@ -43,17 +28,13 @@ jobs:
             runs_on: ubuntu-22.04-arm
     runs-on: ${{ matrix.runs_on }}
 
-    env:
-      S3_BUCKET: your-bucket-name
-      AWS_REGION: us-east-1
-
     steps:
       - name: Checkout Node fork
         uses: actions/checkout@v3
         with:
           repository: Asana/node
           path: node
-          ref: ${{ BUILD_REF }}
+          ref: ${{ inputs.BUILD_REF }}
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Extract Node Version
@@ -74,56 +55,16 @@ jobs:
           echo "BUILD_ID=${TIMESTAMP}-${SHORT_SHA}" >> $GITHUB_ENV
           echo "build_id=${TIMESTAMP}-${SHORT_SHA}" >> $GITHUB_OUTPUT
 
-      - name: Install dependencies (Linux)
-        if: matrix.platform == 'linux'
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y python3 g++ make curl tar xz-utils
-
-      - name: Configure OpenSSL for fips
-        id: openssl-is-fips
-        if: inputs.enableFips
-        run: |
-          ./configure --openssl-is-fips
-
-      - name: Dynamically link OpenSSL in Node.js
-        id: openssl-dynamic-link
-        if: inputs.dynamicLink
-        run: |
-          ./configure --shared-openssl
-
-      - name: Define headers for OpenSSL
-        id: openssl-dynamic-link-headers
-        if: ${{ !empty(inputs.sharedOpenSSLIncludes) }}
-        run: |
-          ./configure --shared-openssl-includes ${{inputs.sharedOpenSSLIncludes}}
-
-      - name: alternative libname for openssl
-        id: openssl-dynamic-link-libname
-        if: ${{ !empty(inputs.sharedOpenSSLLibname) }}
-        run: |
-          ./configure --shared-openssl-libname ${{inputs.sharedOpenSSLLibname}}
-
-      - name: Define headers for OpenSSL
-        id: openssl-dynamic-link-libpath
-        if: ${{ !empty(inputs.sharedOpenSSLLibpath) }}
-        run: |
-          ./configure --shared-openssl-includes ${{inputs.sharedOpenSSLLibpath}}
-
-
-      - name: Build Node (linux)
+      - name: Execute the Dockerfile
         working-directory: node
-        if: matrix.platform == 'linux'
         run: |
-          ./configure --experimental-enable-pointer-compression
-          make -j4 install DESTDIR=$GITHUB_WORKSPACE/node-install
+          docker build -t node22_fips_build -f ./${{ inputs.DOCKER_FILE }} .
 
-      - name: Build Node (darwin)
-        working-directory: node
-        if: matrix.platform == 'darwin'
+      - name: Extract resources
         run: |
-          ./configure --experimental-enable-pointer-compression --without-snapshot
-          make -j2 install DESTDIR=$GITHUB_WORKSPACE/node-install
+          docker create --name temp_node_extract node22_fips_build
+          docker cp temp_node_extract:/usr/src/node/node-install $GITHUB_WORKSPACE/node-install
+          docker rm temp_node_extract
 
       - name: Archive Node
         run: |
@@ -150,8 +91,8 @@ jobs:
       - name: Upload Node archive to release
         uses: softprops/action-gh-release@v1
         with:
-          name: node-${{ env.NODE_VERSION }}-fips-static-LATEST
-          tag_name: node-${{ env.NODE_VERSION }}-fips-static-release
+          name: node-${{ env.NODE_VERSION }}-fips-LATEST
+          tag_name: node-${{ env.NODE_VERSION }}-fips-release
           files: ./artifacts/${{ env.NODE_ARCHIVE_LATEST }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/build-node-packages.yml

@@ -12,63 +12,37 @@ on:
 jobs:
   build-packages:
     if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
-    permissions:
-      id-token: write
-      contents: write
     strategy:
       matrix:
         include:
           - platform: linux
             arch: x64
-            bazel_arch: amd64
             runs_on: ubuntu-22.04
           - platform: linux
             arch: arm64
-            bazel_arch: arm64
             runs_on: ubuntu-22.04-arm
     runs-on: ${{ matrix.runs_on }}
 
     env:
       NODE_VERSION: v22.21.1
-      PLATFORM: ${{ matrix.platform }}
-      ARCH: ${{ matrix.arch }}
-      BAZEL_ARCH: ${{ matrix.bazel_arch }}
-      REPO: ${{ github.repository }}
 
     steps:
-      # Check out the v22.21.1 branch (not the workflow's default branch) so that
-      # Dockerfile.Packages and the Node source tree are present. The workflow YAML
-      # itself runs from whichever ref triggered it (main for workflow_dispatch, or
-      # v22.21.1 for workflow_run) — that's what the OIDC subject claim binds to,
-      # and it's how the IAM role's ref_patterns gate works. `ref:` here only
-      # controls which tree gets checked out into $GITHUB_WORKSPACE.
-      #
-      # Security note: v22.21.1 is not a protected branch, so in principle any of
-      # the repo's ~530 collaborators could push a malicious Dockerfile.Packages
-      # and have this workflow build+upload the resulting image. That same risk
-      # already existed for the Node source itself (which also lives on this
-      # branch), so this change does not expand the attack surface. A follow-up
-      # PR will propose a structural fix (branch protection, patch series, or
-      # submodule model) — tracked in our internal project notes.
       - name: Checkout repository
         uses: actions/checkout@v3
-        with:
-          ref: ${{ env.NODE_VERSION }}
 
       - name: Debug Matrix Values
         run: |
-          echo "Matrix platform: $PLATFORM"
-          echo "Matrix arch: $ARCH"
+          echo "Matrix platform: ${{ matrix.platform }}"
+          echo "Matrix arch: ${{ matrix.arch }}"
 
       - name: Download Node archive
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          ASSET="node-${NODE_VERSION}-${PLATFORM}-${ARCH}-LATEST.tar.xz"
-          gh release download "node-${NODE_VERSION}-release" \
+          gh release download node-${{ env.NODE_VERSION }}-release \
             --repo asana/node \
-            --pattern "$ASSET"
-          mv "$ASSET" node.tar.xz
+            --pattern "node-${{ env.NODE_VERSION }}-${{ matrix.platform }}-${{ matrix.arch }}-LATEST.tar.xz"
+          mv node-${{ env.NODE_VERSION }}-${{ matrix.platform }}-${{ matrix.arch }}-LATEST.tar.xz node.tar.xz
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Execute the Dockerfile
         run: |
@@ -91,73 +65,13 @@ jobs:
           mv node_modules/cld ./cld@2.9.1/node_modules/
           mv node_modules/unix-dgram ./unix-dgram@2.0.6/node_modules/
           mv "node_modules/@datadog/pprof" "./@datadog+pprof@5.8.0/node_modules/@datadog/"
-          tar --hard-dereference -cvzf "packages_${ARCH}.tar.gz" bcrypt@5.1.0 cld@2.9.1 unix-dgram@2.0.6 "@datadog+pprof@5.8.0"
+          tar --hard-dereference -cvzf packages_${{matrix.arch}}.tar.gz bcrypt@5.1.0 cld@2.9.1 unix-dgram@2.0.6 "@datadog+pprof@5.8.0"
 
       - name: Upload archive to release
-        # Use `gh release upload` (first-party GitHub CLI, pre-installed on runners)
-        # instead of softprops/action-gh-release (one-maintainer third-party action).
-        # Behavior: --clobber overwrites an existing asset with the same name, matching
-        # softprops's default. The release must already exist (created by build-node.yml).
+        uses: softprops/action-gh-release@v1
+        with:
+          name: node-${{ env.NODE_VERSION }}-LATEST
+          tag_name: node-${{ env.NODE_VERSION }}-release
+          files: packages_${{matrix.arch}}.tar.gz
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          gh release upload "node-${NODE_VERSION}-release" \
-            "packages_${ARCH}.tar.gz" \
-            --clobber \
-            --repo "$REPO"
-
-      # S3 upload is restricted to the protected main branch only. The IAM role
-      # (push_node_gyp_packages) trusts only refs/heads/main via OIDC. To upload
-      # packages to S3 after a Node upgrade, trigger workflow_dispatch from main.
-      - name: Configure AWS credentials
-        if: github.ref == 'refs/heads/main'
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          aws-region: us-east-1
-          role-to-assume: arn:aws:iam::403483446840:role/autogen_github_actions_beta_push_node_gyp_packages
-
-      - name: Upload packages to S3
-        if: github.ref == 'refs/heads/main'
-        run: |
-          # Upload to s3://asana-oss-cache/node-gyp/... (CloudFront path_patterns entry
-          # added in codez PR #390222 — that must be merged + applied via Spacelift
-          # before this workflow can successfully publish fetchable objects).
-          #
-          # No --acl public-read: the bucket has BucketOwnerEnforced
-          # (disable_confusing_acls = true), which disables ACLs entirely.
-          # BlockPublicAcls + IgnorePublicAcls provide additional coverage.
-          # Reads come via CloudFront OAC.
-          NODE_MAJOR=$(echo "$NODE_VERSION" | sed 's/^v//' | cut -d. -f1)
-          SHA256=$(sha256sum "packages_${ARCH}.tar.gz" | awk '{print $1}')
-          SHORT_HASH=${SHA256:0:8}
-          S3_KEY="node-gyp/packages_${BAZEL_ARCH}_node${NODE_MAJOR}-${SHORT_HASH}.tar.gz"
-          echo "Uploading packages_${ARCH}.tar.gz to s3://asana-oss-cache/$S3_KEY"
-          aws s3 cp "packages_${ARCH}.tar.gz" "s3://asana-oss-cache/$S3_KEY"
-          {
-            echo "S3_KEY=$S3_KEY"
-            echo "SHA256=$SHA256"
-            echo "NODE_MAJOR=$NODE_MAJOR"
-          } >> "$GITHUB_ENV"
-
-      - name: Verify upload is reachable via CloudFront
-        if: github.ref == 'refs/heads/main'
-        run: |
-          # Mac Bazel builds rewrite asana-oss-cache.s3.us-east-1.amazonaws.com/*
-          # to asana-oss-cache.asana.biz/* (CloudFront). If the S3 key prefix isn't
-          # allowlisted in CloudFront's path_patterns, Bazel fetches will 403.
-          # Fail fast here rather than after someone tries to build.
-          URL="https://asana-oss-cache.asana.biz/$S3_KEY"
-          echo "Checking $URL"
-          if ! curl -fsSI "$URL"; then
-            echo "CloudFront returned an error for $URL. Check path_patterns in system_packages.tf."
-            exit 1
-          fi
-
-      - name: Print tools_repositories.bzl stanza
-        if: github.ref == 'refs/heads/main'
-        run: |
-          echo ""
-          echo "=== Update tools_repositories.bzl in codez ==="
-          echo "  name = \"node_gyp_packages_${BAZEL_ARCH}_node${NODE_MAJOR}\","
-          echo "  urls = [\"https://asana-oss-cache.s3.us-east-1.amazonaws.com/$S3_KEY\"],"
-          echo "  sha256 = \"$SHA256\","