From 724b592251ecacd818b065d48c14df24dc6feb33 Mon Sep 17 00:00:00 2001 From: Filip Skokan Date: Sun, 13 Sep 2026 11:58:50 +0200 Subject: [PATCH 1/4] tools: make checkout credential use explicit Disable credential persistence for CodeQL. Signed-off-by: Filip Skokan Assisted-by: Codex --- .github/workflows/codeql.yml | 2 ++ .github/workflows/commit-queue.yml | 1 + 2 files changed, 3 insertions(+) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 0b83c888ecdc..10a9e299145b 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -25,6 +25,8 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL diff --git a/.github/workflows/commit-queue.yml b/.github/workflows/commit-queue.yml index 600dadc17bc4..8f29a390c678 100644 --- a/.github/workflows/commit-queue.yml +++ b/.github/workflows/commit-queue.yml @@ -188,6 +188,7 @@ jobs: # to be set here because `checkout` configures GitHub authentication # for push as well. token: ${{ secrets.GH_USER_TOKEN }} + persist-credentials: true - name: Start the Commit Queue if: steps.get_mergeable_prs.outputs.numbers != '' From 7f68667177337e2ca5c9bd727e5bb305642bf66b Mon Sep 17 00:00:00 2001 From: Filip Skokan Date: Sun, 13 Sep 2026 11:58:50 +0200 Subject: [PATCH 2/4] tools: correct Slack action version comments Signed-off-by: Filip Skokan Assisted-by: Codex --- .github/workflows/notify-on-push.yml | 4 ++-- .github/workflows/notify-on-review-wanted.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/notify-on-push.yml b/.github/workflows/notify-on-push.yml index 16bd91bccd2a..25421b8447d8 100644 --- a/.github/workflows/notify-on-push.yml +++ b/.github/workflows/notify-on-push.yml @@ -18,7 +18,7 @@ jobs: runs-on: ubuntu-24.04-arm steps: - name: Slack Notification - uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # 2.4.0 + uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0 env: SLACK_COLOR: '#DE512A' SLACK_ICON: https://github.com/nodejs.png?size=48 @@ -50,7 +50,7 @@ jobs: COMMITS: ${{ toJSON(github.event.commits) }} - name: Slack Notification if: ${{ failure() && steps.commit-check.conclusion == 'failure' && github.repository == 'nodejs/node' }} - uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # 2.4.0 + uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0 env: SLACK_COLOR: '#DE512A' SLACK_ICON: https://github.com/nodejs.png?size=48 diff --git a/.github/workflows/notify-on-review-wanted.yml b/.github/workflows/notify-on-review-wanted.yml index 2f1f3af8139b..effc6c209eb1 100644 --- a/.github/workflows/notify-on-review-wanted.yml +++ b/.github/workflows/notify-on-review-wanted.yml @@ -34,7 +34,7 @@ jobs: fi - name: Slack Notification - uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # 2.4.0 + uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0 env: MSG_MINIMAL: actions url SLACK_COLOR: '#3d85c6' From f36244a94326b10a4237213c4115c32ece4ce0c6 Mon Sep 17 00:00:00 2001 From: Filip Skokan Date: Sun, 13 Sep 2026 11:58:51 +0200 Subject: [PATCH 3/4] tools: use self-repository references Resolve local actions and reusable workflows from the running workflow commit with $/ references, independent of checkout paths. Remove the tarball job's action-only checkout and the WPT action checkout/copy workaround, which are no longer needed. Signed-off-by: Filip Skokan Assisted-by: Codex --- .github/workflows/build-tarball.yml | 7 +----- .../workflows/coverage-linux-without-intl.yml | 2 +- .github/workflows/coverage-linux.yml | 2 +- .github/workflows/daily-wpt-fyi.yml | 22 ++----------------- .github/workflows/stress-test.yml | 2 +- .github/workflows/test-internet.yml | 2 +- .github/workflows/test-linux-perfetto.yml | 2 +- .github/workflows/test-linux-quic.yml | 2 +- .github/workflows/test-linux.yml | 2 +- .github/workflows/test-shared.yml | 4 ++-- 10 files changed, 12 insertions(+), 35 deletions(-) diff --git a/.github/workflows/build-tarball.yml b/.github/workflows/build-tarball.yml index e173d4a544e0..045bd3ae93c2 100644 --- a/.github/workflows/build-tarball.yml +++ b/.github/workflows/build-tarball.yml @@ -104,13 +104,8 @@ jobs: SCCACHE_GHA_ENABLED: ${{ github.base_ref == 'main' || github.ref_name == 'main' }} SCCACHE_IDLE_TIMEOUT: '0' steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - persist-credentials: false - sparse-checkout: .github/actions/install-clang - sparse-checkout-cone-mode: false - name: Install Clang ${{ env.CLANG_VERSION }} - uses: ./.github/actions/install-clang + uses: $/.github/actions/install-clang with: clang-version: ${{ env.CLANG_VERSION }} - name: Set up Python ${{ env.PYTHON_VERSION }} diff --git a/.github/workflows/coverage-linux-without-intl.yml b/.github/workflows/coverage-linux-without-intl.yml index 7a73d69b70ec..a98492ec668e 100644 --- a/.github/workflows/coverage-linux-without-intl.yml +++ b/.github/workflows/coverage-linux-without-intl.yml @@ -54,7 +54,7 @@ jobs: with: persist-credentials: false - name: Install Clang ${{ env.CLANG_VERSION }} - uses: ./.github/actions/install-clang + uses: $/.github/actions/install-clang with: clang-version: ${{ env.CLANG_VERSION }} - name: Set up Python ${{ env.PYTHON_VERSION }} diff --git a/.github/workflows/coverage-linux.yml b/.github/workflows/coverage-linux.yml index 79c6eaaebc91..4ba373b790a2 100644 --- a/.github/workflows/coverage-linux.yml +++ b/.github/workflows/coverage-linux.yml @@ -54,7 +54,7 @@ jobs: with: persist-credentials: false - name: Install Clang ${{ env.CLANG_VERSION }} - uses: ./.github/actions/install-clang + uses: $/.github/actions/install-clang with: clang-version: ${{ env.CLANG_VERSION }} - name: Set up Python ${{ env.PYTHON_VERSION }} diff --git a/.github/workflows/daily-wpt-fyi.yml b/.github/workflows/daily-wpt-fyi.yml index 043de271faa9..8901ecbcee42 100644 --- a/.github/workflows/daily-wpt-fyi.yml +++ b/.github/workflows/daily-wpt-fyi.yml @@ -105,33 +105,15 @@ jobs: else echo "UNDICI_WPT=legacy" >> $GITHUB_ENV fi - # Checkout composite actions from the default branch since the - # version-specific checkout above overwrites .github/actions/ - - name: Checkout undici WPT actions - if: ${{ env.WPT_REPORT != '' }} - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - sparse-checkout: | - .github/actions/undici-wpt-current - .github/actions/undici-wpt-legacy - sparse-checkout-cone-mode: false - persist-credentials: false - path: _wpt_actions - clean: false - - name: Place undici WPT actions - if: ${{ env.WPT_REPORT != '' }} - run: | - mkdir -p .github/actions - cp -r _wpt_actions/.github/actions/undici-wpt-* .github/actions/ - name: Run undici WPT (current) if: ${{ env.UNDICI_WPT == 'current' }} - uses: ./.github/actions/undici-wpt-current + uses: $/.github/actions/undici-wpt-current with: undici-version: ${{ env.UNDICI_VERSION }} wpt-report: ${{ env.WPT_REPORT }} - name: Run undici WPT (legacy) if: ${{ env.UNDICI_WPT == 'legacy' }} - uses: ./.github/actions/undici-wpt-legacy + uses: $/.github/actions/undici-wpt-legacy with: undici-version: ${{ env.UNDICI_VERSION }} wpt-report: ${{ env.WPT_REPORT }} diff --git a/.github/workflows/stress-test.yml b/.github/workflows/stress-test.yml index a33cf81eaed4..0f17615671cd 100644 --- a/.github/workflows/stress-test.yml +++ b/.github/workflows/stress-test.yml @@ -60,7 +60,7 @@ jobs: path: node - name: Install Clang ${{ env.CLANG_VERSION }} if: runner.os == 'Linux' - uses: ./node/.github/actions/install-clang + uses: $/.github/actions/install-clang with: clang-version: ${{ env.CLANG_VERSION }} - name: Set up Xcode ${{ env.XCODE_VERSION }} diff --git a/.github/workflows/test-internet.yml b/.github/workflows/test-internet.yml index 497d5156fec9..672893a999aa 100644 --- a/.github/workflows/test-internet.yml +++ b/.github/workflows/test-internet.yml @@ -59,7 +59,7 @@ jobs: with: persist-credentials: false - name: Install Clang ${{ env.CLANG_VERSION }} - uses: ./.github/actions/install-clang + uses: $/.github/actions/install-clang with: clang-version: ${{ env.CLANG_VERSION }} - name: Set up Python ${{ env.PYTHON_VERSION }} diff --git a/.github/workflows/test-linux-perfetto.yml b/.github/workflows/test-linux-perfetto.yml index 3dc533720d43..e300ee59aa86 100644 --- a/.github/workflows/test-linux-perfetto.yml +++ b/.github/workflows/test-linux-perfetto.yml @@ -42,7 +42,7 @@ jobs: persist-credentials: false path: node - name: Install Clang ${{ env.CLANG_VERSION }} - uses: ./node/.github/actions/install-clang + uses: $/.github/actions/install-clang with: clang-version: ${{ env.CLANG_VERSION }} - name: Install Rust ${{ env.RUSTC_VERSION }} diff --git a/.github/workflows/test-linux-quic.yml b/.github/workflows/test-linux-quic.yml index 7c77d4668dc6..eca8521a310e 100644 --- a/.github/workflows/test-linux-quic.yml +++ b/.github/workflows/test-linux-quic.yml @@ -52,7 +52,7 @@ jobs: persist-credentials: false path: node - name: Install Clang ${{ env.CLANG_VERSION }} - uses: ./node/.github/actions/install-clang + uses: $/.github/actions/install-clang with: clang-version: ${{ env.CLANG_VERSION }} - name: Install Rust ${{ env.RUSTC_VERSION }} diff --git a/.github/workflows/test-linux.yml b/.github/workflows/test-linux.yml index acd1e04a04ab..65aead07b923 100644 --- a/.github/workflows/test-linux.yml +++ b/.github/workflows/test-linux.yml @@ -65,7 +65,7 @@ jobs: persist-credentials: false path: node - name: Install Clang ${{ env.CLANG_VERSION }} - uses: ./node/.github/actions/install-clang + uses: $/.github/actions/install-clang with: clang-version: ${{ env.CLANG_VERSION }} - name: Install Rust ${{ env.RUSTC_VERSION }} diff --git a/.github/workflows/test-shared.yml b/.github/workflows/test-shared.yml index f7483103016f..be3c22face09 100644 --- a/.github/workflows/test-shared.yml +++ b/.github/workflows/test-shared.yml @@ -159,7 +159,7 @@ jobs: - runner: macos-latest system: aarch64-darwin name: '${{ matrix.system }}: with shared libraries${{ matrix.perfetto && '' and perfetto'' || '''' }}' - uses: ./.github/workflows/build-shared.yml + uses: $/.github/workflows/build-shared.yml with: runner: ${{ matrix.runner }} with-sccache: ${{ github.base_ref == 'main' || github.ref_name == 'main' }} @@ -250,7 +250,7 @@ jobs: matrix: openssl: ${{ fromJSON(needs.build-aarch64-linux-v8.outputs.matrix) }} name: 'aarch64-linux: with shared ${{ matrix.openssl.name }}' - uses: ./.github/workflows/build-shared.yml + uses: $/.github/workflows/build-shared.yml with: runner: ubuntu-24.04-arm v8-nar: ${{ needs.build-aarch64-linux-v8.outputs.local-cache && 'libv8-aarch64-linux.nar' }} From 7349f4d32e8cca92a440f2c180af49bae8b1432a Mon Sep 17 00:00:00 2001 From: Filip Skokan Date: Sun, 13 Sep 2026 11:58:51 +0200 Subject: [PATCH 4/4] tools: avoid workflow shell interpolation Pass input, output, and version values through environment variables instead of expanding them into shell source. Split benchmark categories and PR numbers into arrays to retain separate arguments. Signed-off-by: Filip Skokan Assisted-by: Codex --- .github/workflows/auto-start-ci.yml | 4 +++- .github/workflows/benchmark.yml | 17 ++++++++++++----- .github/workflows/commit-queue.yml | 4 +++- .github/workflows/daily-wpt-fyi.yml | 7 +++++-- .github/workflows/timezone-update.yml | 4 ++-- .github/workflows/tools.yml | 2 +- 6 files changed, 26 insertions(+), 12 deletions(-) diff --git a/.github/workflows/auto-start-ci.yml b/.github/workflows/auto-start-ci.yml index 8c01b0592c2e..dc827d62ba71 100644 --- a/.github/workflows/auto-start-ci.yml +++ b/.github/workflows/auto-start-ci.yml @@ -72,7 +72,9 @@ jobs: - name: Start the CI run: | + read -r -a numbers <<< "$PULL_REQUESTS" curl -fsSL "https://github.com/${GITHUB_REPOSITORY}/raw/${GITHUB_SHA}/tools/actions/start-ci.sh" \ - | sh -s -- ${{ needs.get-prs-for-ci.outputs.numbers }} + | sh -s -- "${numbers[@]}" env: GH_TOKEN: ${{ github.token }} + PULL_REQUESTS: ${{ needs.get-prs-for-ci.outputs.numbers }} diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml index 924feb42725e..7f10917e238a 100644 --- a/.github/workflows/benchmark.yml +++ b/.github/workflows/benchmark.yml @@ -47,7 +47,9 @@ jobs: steps: - name: Mark token input as sensitive if: inputs.token != '' - run: echo "::add-mask::${{ inputs.token }}" + run: printf '::add-mask::%s\n' "$COMMENT_TOKEN" + env: + COMMENT_TOKEN: ${{ inputs.token }} - name: Add link to the current run id: comment run: | @@ -155,7 +157,7 @@ jobs: run: | nix-shell \ -I nixpkgs=./tools/nix/pkgs.nix \ - --pure --keep FILTER --keep LC_ALL --keep LANG \ + --pure --keep CATEGORIES --keep FILTER --keep RUNS --keep LC_ALL --keep LANG \ --arg loadJSBuiltinsDynamically false \ --arg ccache 'null' \ --arg icu 'null' \ @@ -163,11 +165,12 @@ jobs: --arg devTools '[]' \ --run ' set -o pipefail + read -r -a categories <<< "$CATEGORIES" ./base_node benchmark/compare.js \ --filter "$FILTER" \ - --runs ${{ inputs.runs }} \ + --runs "$RUNS" \ --old ./base_node --new ./node \ - -- ${{ inputs.category }} \ + -- "${categories[@]}" \ | tee /dev/stderr \ > ${{ matrix.system }}.csv echo "> [!WARNING] " @@ -185,7 +188,9 @@ jobs: echo "> using a dedicated machine, e.g. Jenkins CI." ' | tee /dev/stderr >> "$GITHUB_STEP_SUMMARY" env: + CATEGORIES: ${{ inputs.category }} FILTER: ${{ inputs.filter }} + RUNS: ${{ inputs.runs }} - name: Upload raw benchmark results uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 @@ -246,7 +251,9 @@ jobs: ' | tee /dev/stderr ${{ inputs.post-comment && 'body.txt' || '' }} >> "$GITHUB_STEP_SUMMARY" - name: Mark token input as sensitive if: inputs.token != '' - run: echo "::add-mask::${{ inputs.token }}" + run: printf '::add-mask::%s\n' "$COMMENT_TOKEN" + env: + COMMENT_TOKEN: ${{ inputs.token }} - name: Edit comment if: inputs.post-comment run: | diff --git a/.github/workflows/commit-queue.yml b/.github/workflows/commit-queue.yml index 8f29a390c678..83f921838b30 100644 --- a/.github/workflows/commit-queue.yml +++ b/.github/workflows/commit-queue.yml @@ -196,6 +196,8 @@ jobs: git config --local user.email "github-bot@iojs.org" git config --local user.name "Node.js GitHub Bot" ncu-config set token "$GH_TOKEN" - ./tools/actions/commit-queue.sh ${{ steps.get_mergeable_prs.outputs.numbers }} + read -r -a numbers <<< "$PULL_REQUESTS" + ./tools/actions/commit-queue.sh "${numbers[@]}" env: GH_TOKEN: ${{ secrets.GH_USER_TOKEN }} + PULL_REQUESTS: ${{ steps.get_mergeable_prs.outputs.numbers }} diff --git a/.github/workflows/daily-wpt-fyi.yml b/.github/workflows/daily-wpt-fyi.yml index 8901ecbcee42..d15f21010cd9 100644 --- a/.github/workflows/daily-wpt-fyi.yml +++ b/.github/workflows/daily-wpt-fyi.yml @@ -122,7 +122,9 @@ jobs: - name: Clone report for upload if: ${{ env.WPT_REPORT != '' }} working-directory: out/wpt - run: cp wptreport.json wptreport-${{ steps.setup-node.outputs.node-version }}.json + run: cp wptreport.json "wptreport-$NODE_VERSION.json" + env: + NODE_VERSION: ${{ steps.setup-node.outputs.node-version }} - name: Upload GitHub Actions artifact if: ${{ env.WPT_REPORT != '' }} uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 @@ -133,12 +135,13 @@ jobs: - name: Upload WPT Report to wpt.fyi API if: ${{ env.WPT_REPORT != '' }} env: + NODE_VERSION: ${{ steps.setup-node.outputs.node-version }} WPT_FYI_USERNAME: ${{ vars.WPT_FYI_USERNAME }} WPT_FYI_PASSWORD: ${{ secrets.WPT_FYI_PASSWORD }} working-directory: out/wpt run: | gzip wptreport.json - echo "## Node.js ${{ steps.setup-node.outputs.node-version }}" >> $GITHUB_STEP_SUMMARY + echo "## Node.js $NODE_VERSION" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY echo "WPT Revision: [\`${WPT_REVISION:0:7}\`](https://github.com/web-platform-tests/wpt/commits/$WPT_REVISION)" >> $GITHUB_STEP_SUMMARY for WPT_FYI_ENDPOINT in "https://wpt.fyi/api/results/upload" "https://staging.wpt.fyi/api/results/upload" diff --git a/.github/workflows/timezone-update.yml b/.github/workflows/timezone-update.yml index 481c20da4e05..abe4516db4a7 100644 --- a/.github/workflows/timezone-update.yml +++ b/.github/workflows/timezone-update.yml @@ -40,14 +40,14 @@ jobs: - name: Compare versions run: | - echo "Comparing current version ${{ env.current_version }} to new version ${{ env.new_version }}" + echo "Comparing current version $current_version to new version $new_version" - run: ./tools/dep_updaters/update-timezone.mjs if: ${{ env.new_version != env.current_version }} - name: Update the expected timezone version in test if: ${{ env.new_version != env.current_version }} - run: echo "${{ env.new_version }}" > test/fixtures/tz-version.txt + run: printf '%s\n' "$new_version" > test/fixtures/tz-version.txt - name: Open Pull Request if: ${{ env.new_version != env.current_version }} diff --git a/.github/workflows/tools.yml b/.github/workflows/tools.yml index e204c6b43140..b70bc4c34f70 100644 --- a/.github/workflows/tools.yml +++ b/.github/workflows/tools.yml @@ -329,7 +329,7 @@ jobs: - name: Generate commit message if not set if: env.COMMIT_MSG == '' && (github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id) run: | - echo "COMMIT_MSG=${{ matrix.subsystem }}: update ${{ matrix.id }} to ${{ env.NEW_VERSION }}" >> "$GITHUB_ENV" + echo "COMMIT_MSG=${{ matrix.subsystem }}: update ${{ matrix.id }} to $NEW_VERSION" >> "$GITHUB_ENV" - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 if: github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id # Creates a PR or update the Action's existing PR, or