Node 26.13.1 build (RHEL 8 toolchain) for LunaServer

.github/workflows/build-node-openssl-fips.yml

@@ -0,0 +1,108 @@
+name: Build Node (FIPS)
+
+on:
+  workflow_dispatch:
+    inputs:
+      BUILD_REF:
+        description: 'Git ref to build Node.js from (defaults to the branch the workflow runs from)'
+        required: false
+        default: ''
+        type: string
+      DOCKER_FILE:
+        description: 'Dockerfile to use for building Node.js'
+        required: true
+        default: 'Dockerfile.Node26fips'
+        type: string
+
+permissions:
+  contents: write
+
+jobs:
+  build-node:
+    name: Build ${{ matrix.platform }}-${{ matrix.arch }} with FIPS OpenSSL
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: linux
+            arch: x64
+            runs_on: ubuntu-22.04
+          - platform: linux
+            arch: arm64
+            runs_on: ubuntu-22.04-arm
+    runs-on: ${{ matrix.runs_on }}
+
+    env:
+      REPO: ${{ github.repository }}
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+    steps:
+      - name: Checkout Node fork
+        uses: actions/checkout@v4
+        with:
+          path: node
+          ref: ${{ inputs.BUILD_REF || github.ref_name }}
+
+      - name: Extract Node Version
+        run: |
+           NODE_MAJOR_VERSION=$(grep '#define NODE_MAJOR_VERSION' node/src/node_version.h | awk '{print $3}')
+           NODE_MINOR_VERSION=$(grep '#define NODE_MINOR_VERSION' node/src/node_version.h | awk '{print $3}')
+           NODE_PATCH_VERSION=$(grep '#define NODE_PATCH_VERSION' node/src/node_version.h | awk '{print $3}')
+           echo "NODE_VERSION=v${NODE_MAJOR_VERSION}.${NODE_MINOR_VERSION}.${NODE_PATCH_VERSION}" >> $GITHUB_ENV
+
+      - name: Set build metadata
+        id: meta
+        working-directory: node
+        run: |
+          TIMESTAMP=$(date -u +%Y-%m-%dT%H-%M)
+          SHORT_SHA=$(git rev-parse --short HEAD)
+          echo "BUILD_SHA=$(git rev-parse HEAD)" >> $GITHUB_ENV
+          echo "build_id=${TIMESTAMP}-${SHORT_SHA}" >> $GITHUB_OUTPUT
+
+      - name: Execute the Dockerfile
+        working-directory: node
+        run: |
+          docker build -t node_fips_build -f ./${{ inputs.DOCKER_FILE }} .
+
+      - name: Extract resources
+        run: |
+          docker create --name temp_node_extract node_fips_build
+          docker cp temp_node_extract:/usr/src/node/node-install $GITHUB_WORKSPACE/node-install
+          docker rm temp_node_extract
+
+      - name: Verify build
+        run: |
+          bash node/asana-verify-build.sh node-install --fips
+
+      - name: Archive Node
+        run: |
+          mkdir -p artifacts
+          FILENAME=node-${NODE_VERSION}-fips-${{ matrix.platform }}-${{ matrix.arch }}-${{ steps.meta.outputs.build_id }}.tar.xz
+          FILENAME_LATEST=node-${NODE_VERSION}-fips-${{ matrix.platform }}-${{ matrix.arch }}-LATEST.tar.xz
+          tar -C node-install -cJf artifacts/$FILENAME .
+          cp artifacts/$FILENAME artifacts/$FILENAME_LATEST
+          echo "NODE_ARCHIVE=$FILENAME" >> $GITHUB_ENV
+          echo "NODE_ARCHIVE_LATEST=$FILENAME_LATEST" >> $GITHUB_ENV
+
+      - name: Upload Node archive
+        uses: actions/upload-artifact@v4
+        with:
+          name: node-${{ env.NODE_VERSION }}-fips-${{ matrix.platform }}-${{ matrix.arch }}-${{ steps.meta.outputs.build_id }}
+          path: artifacts/${{ env.NODE_ARCHIVE }}
+
+      - name: Upload Node archive latest
+        uses: actions/upload-artifact@v4
+        with:
+          name: node-${{ env.NODE_VERSION }}-fips-${{ matrix.platform }}-${{ matrix.arch }}-LATEST
+          path: artifacts/${{ env.NODE_ARCHIVE_LATEST }}
+
+      - name: Upload Node archive to release
+        run: |
+          TAG="node-${NODE_VERSION}-fips-release"
+          RELEASE_NAME="node-${NODE_VERSION}-fips-LATEST"
+          if ! gh release view "$TAG" --repo "$REPO" >/dev/null 2>&1; then
+            gh release create "$TAG" --title "$RELEASE_NAME" --notes "" --target "$BUILD_SHA" --repo "$REPO" \
+              || gh release view "$TAG" --repo "$REPO" >/dev/null
+          fi
+          gh release upload "$TAG" "artifacts/${NODE_ARCHIVE_LATEST}" --clobber --repo "$REPO"
+          gh release edit "$TAG" --title "$RELEASE_NAME" --repo "$REPO"

.github/workflows/build-node-packages.yml

@@ -0,0 +1,145 @@
+name: Build Node-Packages
+
+on:
+  workflow_dispatch:
+    inputs:
+      NODE_REF:
+        description: 'Branch with the Node source and Dockerfile.Packages (defaults to the ref the workflow runs from)'
+        required: false
+        default: ''
+        type: string
+
+jobs:
+  build-packages:
+    permissions:
+      id-token: write
+      contents: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: linux
+            arch: x64
+            bazel_arch: amd64
+            runs_on: ubuntu-22.04
+          - platform: linux
+            arch: arm64
+            bazel_arch: arm64
+            runs_on: ubuntu-22.04-arm
+    runs-on: ${{ matrix.runs_on }}
+
+    env:
+      PLATFORM: ${{ matrix.platform }}
+      ARCH: ${{ matrix.arch }}
+      BAZEL_ARCH: ${{ matrix.bazel_arch }}
+      REPO: ${{ github.repository }}
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+    steps:
+      # The workflow YAML runs from whichever ref triggered it (main for a workflow_dispatch
+      # that should upload to S3); that's what the OIDC subject claim binds to, and it's how
+      # the IAM role's ref_patterns gate works. `ref:` here only controls which tree gets
+      # checked out into $GITHUB_WORKSPACE.
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.NODE_REF || github.ref_name }}
+
+      - name: Extract Node Version
+        run: |
+           NODE_MAJOR_VERSION=$(grep '#define NODE_MAJOR_VERSION' src/node_version.h | awk '{print $3}')
+           NODE_MINOR_VERSION=$(grep '#define NODE_MINOR_VERSION' src/node_version.h | awk '{print $3}')
+           NODE_PATCH_VERSION=$(grep '#define NODE_PATCH_VERSION' src/node_version.h | awk '{print $3}')
+           echo "NODE_VERSION=v${NODE_MAJOR_VERSION}.${NODE_MINOR_VERSION}.${NODE_PATCH_VERSION}" >> $GITHUB_ENV
+
+      - name: Download Node archive
+        run: |
+          ASSET="node-${NODE_VERSION}-${PLATFORM}-${ARCH}-LATEST.tar.xz"
+          gh release download "node-${NODE_VERSION}-release" \
+            --repo "$REPO" \
+            --pattern "$ASSET"
+          mv "$ASSET" node.tar.xz
+
+      - name: Execute the Dockerfile
+        run: |
+          docker build -t node_packages_build -f Dockerfile.Packages .
+
+      - name: Extract resources
+        run: |
+          docker create --name temp_node_packages_extract node_packages_build
+          docker cp temp_node_packages_extract:/usr/src/node/node_modules $GITHUB_WORKSPACE/node_modules
+          docker rm temp_node_packages_extract
+
+      - name: Tar node-packages
+        run: |
+          # Lay each package out as its rules_js store directory: <name with / as +>@<version>.
+          version_of() { sed -n "s/^ARG $1=//p" Dockerfile.Packages; }
+          DIRS=()
+          for spec in "bcrypt BCRYPT_VERSION" "cld CLD_VERSION" "unix-dgram UNIX_DGRAM_VERSION" "@datadog/pprof PPROF_VERSION"; do
+            set -- $spec
+            name=$1
+            version=$(version_of "$2")
+            dir="${name//\//+}@${version}"
+            mkdir -p "$dir/node_modules/$(dirname "$name")"
+            mv "node_modules/$name" "$dir/node_modules/$name"
+            DIRS+=("$dir")
+          done
+          tar --hard-dereference -cvzf "packages_${ARCH}.tar.gz" "${DIRS[@]}"
+
+      - name: Upload archive to release
+        run: |
+          gh release upload "node-${NODE_VERSION}-release" \
+            "packages_${ARCH}.tar.gz" \
+            --clobber \
+            --repo "$REPO"
+
+      # S3 upload is restricted to the protected main branch only. The IAM role
+      # (push_node_gyp_packages) trusts only refs/heads/main via OIDC, and main's copy of this
+      # workflow builds Node 22's packages. When running from this branch, stage the release's
+      # packages_*.tar.gz with stage_for_s3.bash and upload them by hand.
+      - name: Configure AWS credentials
+        if: github.ref == 'refs/heads/main'
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-region: us-east-1
+          role-to-assume: arn:aws:iam::403483446840:role/autogen_github_actions_beta_push_node_gyp_packages
+
+      - name: Upload packages to S3
+        if: github.ref == 'refs/heads/main'
+        run: |
+          # No --acl public-read: the bucket has BucketOwnerEnforced
+          # (disable_confusing_acls = true), which disables ACLs entirely.
+          # Reads come via CloudFront OAC.
+          NODE_MAJOR=$(echo "$NODE_VERSION" | sed 's/^v//' | cut -d. -f1)
+          SHA256=$(sha256sum "packages_${ARCH}.tar.gz" | awk '{print $1}')
+          SHORT_HASH=${SHA256:0:8}
+          S3_KEY="node-gyp/packages_${BAZEL_ARCH}_node${NODE_MAJOR}-${SHORT_HASH}.tar.gz"
+          echo "Uploading packages_${ARCH}.tar.gz to s3://asana-oss-cache/$S3_KEY"
+          aws s3 cp "packages_${ARCH}.tar.gz" "s3://asana-oss-cache/$S3_KEY"
+          {
+            echo "S3_KEY=$S3_KEY"
+            echo "SHA256=$SHA256"
+            echo "NODE_MAJOR=$NODE_MAJOR"
+          } >> "$GITHUB_ENV"
+
+      - name: Verify upload is reachable via CloudFront
+        if: github.ref == 'refs/heads/main'
+        run: |
+          # Mac Bazel builds rewrite asana-oss-cache.s3.us-east-1.amazonaws.com/*
+          # to asana-oss-cache.asana.biz/* (CloudFront). If the S3 key prefix isn't
+          # allowlisted in CloudFront's path_patterns, Bazel fetches will 403.
+          URL="https://asana-oss-cache.asana.biz/$S3_KEY"
+          echo "Checking $URL"
+          if ! curl -fsSI "$URL"; then
+            echo "CloudFront returned an error for $URL. Check path_patterns in system_packages.tf."
+            exit 1
+          fi
+
+      - name: Print tools_repositories.bzl stanza
+        if: github.ref == 'refs/heads/main'
+        run: |
+          echo ""
+          echo "=== Update tools_repositories.bzl in codez ==="
+          echo "  name = \"node_gyp_packages_${BAZEL_ARCH}_node${NODE_MAJOR}\","
+          echo "  urls = [\"https://asana-oss-cache.s3.us-east-1.amazonaws.com/$S3_KEY\"],"
+          echo "  sha256 = \"$SHA256\","

.github/workflows/build-node.yml

@@ -0,0 +1,98 @@
+name: Build Node (Standard)
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  build-node:
+    name: Build ${{ matrix.platform }}-${{ matrix.arch }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: linux
+            arch: x64
+            runs_on: ubuntu-22.04
+          - platform: linux
+            arch: arm64
+            runs_on: ubuntu-22.04-arm
+    runs-on: ${{ matrix.runs_on }}
+
+    env:
+      REPO: ${{ github.repository }}
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+    steps:
+      - name: Checkout Node fork
+        uses: actions/checkout@v4
+        with:
+          path: node
+          ref: ${{ github.ref_name }}
+
+      - name: Extract Node Version
+        run: |
+           NODE_MAJOR_VERSION=$(grep '#define NODE_MAJOR_VERSION' node/src/node_version.h | awk '{print $3}')
+           NODE_MINOR_VERSION=$(grep '#define NODE_MINOR_VERSION' node/src/node_version.h | awk '{print $3}')
+           NODE_PATCH_VERSION=$(grep '#define NODE_PATCH_VERSION' node/src/node_version.h | awk '{print $3}')
+           echo "NODE_MAJOR_VERSION=${NODE_MAJOR_VERSION}" >> $GITHUB_ENV
+           echo "NODE_VERSION=v${NODE_MAJOR_VERSION}.${NODE_MINOR_VERSION}.${NODE_PATCH_VERSION}" >> $GITHUB_ENV
+
+      - name: Set build metadata
+        id: meta
+        working-directory: node
+        run: |
+          TIMESTAMP=$(date -u +%Y-%m-%dT%H-%M)
+          SHORT_SHA=$(git rev-parse --short HEAD)
+          echo "BUILD_SHA=$(git rev-parse HEAD)" >> $GITHUB_ENV
+          echo "build_id=${TIMESTAMP}-${SHORT_SHA}" >> $GITHUB_OUTPUT
+
+      - name: Execute the Dockerfile
+        working-directory: node
+        run: |
+          docker build -t node_build -f ./Dockerfile.Node${NODE_MAJOR_VERSION} .
+
+      - name: Extract resources
+        run: |
+          docker create --name temp_node_extract node_build
+          docker cp temp_node_extract:/usr/src/node/node-install $GITHUB_WORKSPACE/node-install
+          docker rm temp_node_extract
+
+      - name: Verify build
+        run: |
+          bash node/asana-verify-build.sh node-install
+
+      - name: Archive Node
+        run: |
+          mkdir -p artifacts
+          FILENAME=node-${NODE_VERSION}-${{ matrix.platform }}-${{ matrix.arch }}-${{ steps.meta.outputs.build_id }}.tar.xz
+          FILENAME_LATEST=node-${NODE_VERSION}-${{ matrix.platform }}-${{ matrix.arch }}-LATEST.tar.xz
+          tar -C node-install -cJf artifacts/$FILENAME .
+          cp artifacts/$FILENAME artifacts/$FILENAME_LATEST
+          echo "NODE_ARCHIVE=$FILENAME" >> $GITHUB_ENV
+          echo "NODE_ARCHIVE_LATEST=$FILENAME_LATEST" >> $GITHUB_ENV
+
+      - name: Upload Node archive
+        uses: actions/upload-artifact@v4
+        with:
+          name: node-${{ env.NODE_VERSION }}-${{ matrix.platform }}-${{ matrix.arch }}-${{ steps.meta.outputs.build_id }}
+          path: artifacts/${{ env.NODE_ARCHIVE }}
+
+      - name: Upload Node archive latest
+        uses: actions/upload-artifact@v4
+        with:
+          name: node-${{ env.NODE_VERSION }}-${{ matrix.platform }}-${{ matrix.arch }}-LATEST
+          path: artifacts/${{ env.NODE_ARCHIVE_LATEST }}
+
+      - name: Upload Node archive to release
+        run: |
+          TAG="node-${NODE_VERSION}-release"
+          RELEASE_NAME="node-${NODE_VERSION}-LATEST"
+          if ! gh release view "$TAG" --repo "$REPO" >/dev/null 2>&1; then
+            gh release create "$TAG" --title "$RELEASE_NAME" --notes "" --target "$BUILD_SHA" --repo "$REPO" \
+              || gh release view "$TAG" --repo "$REPO" >/dev/null
+          fi
+          gh release upload "$TAG" "artifacts/${NODE_ARCHIVE_LATEST}" --clobber --repo "$REPO"
+          gh release edit "$TAG" --title "$RELEASE_NAME" --repo "$REPO"