Skip to content

Commit a9a955a

Browse files
harshita-guptaharshita-gupta
committed
workflows: replace softprops/action-gh-release with gh CLI
Supply-chain hardening: softprops/action-gh-release is a single-maintainer third-party action pinned to the mutable @v1 tag. Replacing it with the first-party `gh` CLI (pre-installed on GitHub-hosted runners, maintained by GitHub) removes that dependency from the release-upload path. Migrates all three release-upload call-sites on v24.13.0: - build-node.yml - build-node-fibers.yml - build-node-packages.yml (v24.13.0 has no build-node-openssl-fips.yml.) Each Upload step becomes: - view-or-create guard so the first matrix arm creates the release (and the second arm tolerates the race); - `gh release upload --clobber` for the asset (matches softprops's always-delete-then-upload behavior on name collision); - `gh release edit --title` to preserve softprops's behavior of always re-setting the release name on every upload. Each job also picks up `REPO: ${{ github.repository }}` in its env block.
1 parent 975437d commit a9a955a

3 files changed

Lines changed: 89 additions & 15 deletions

File tree

‎.github/workflows/build-node-fibers.yml‎

Lines changed: 28 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ jobs:
2121

2222
env:
2323
NODE_VERSION: v24.13.0
24+
REPO: ${{ github.repository }}
2425

2526
steps:
2627
- name: Debug Matrix Values
@@ -67,10 +68,32 @@ jobs:
6768
tar -czf "$ARCHIVE_NAME" -C "$(dirname "$FIBERS_DIR")" "$(basename "$FIBERS_DIR")"
6869
6970
- name: Upload archive to release
70-
uses: softprops/action-gh-release@v1
71-
with:
72-
name: node-${{ env.NODE_VERSION }}-LATEST
73-
tag_name: node-${{ env.NODE_VERSION }}-release
74-
files: ${{ env.ARCHIVE_NAME }}
71+
# Attach the built node-fibers archive to the same node-${NODE_VERSION}-release
72+
# release that hosts the corresponding Node binaries.
73+
#
74+
# This workflow is fired by `push` to v24.13.0 and by workflow_dispatch — it
75+
# is not chained off Build Node, so the release may not yet exist. The
76+
# matrix runs both arms (linux-x64, linux-arm64) in parallel, so both can
77+
# race to create the release. The view-or-create guard with the trailing
78+
# `|| gh release view` tolerates "already exists" from a losing racer and
79+
# propagates any other create failure through the final view.
80+
#
81+
# `--clobber` makes re-uploads idempotent on asset name collisions by
82+
# deleting the existing asset before uploading. If the new upload fails
83+
# after the delete, just re-run the job to rebuild.
84+
#
85+
# `gh release edit --title` after upload keeps the release title
86+
# deterministically derived from NODE_VERSION, overriding any manual rename
87+
# in the GitHub UI.
7588
env:
7689
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
90+
run: |
91+
set -euo pipefail
92+
TAG="node-${NODE_VERSION}-release"
93+
RELEASE_NAME="node-${NODE_VERSION}-LATEST"
94+
if ! gh release view "$TAG" --repo "$REPO" >/dev/null 2>&1; then
95+
gh release create "$TAG" --title "$RELEASE_NAME" --notes "" --repo "$REPO" \
96+
|| gh release view "$TAG" --repo "$REPO" >/dev/null
97+
fi
98+
gh release upload "$TAG" "$ARCHIVE_NAME" --clobber --repo "$REPO"
99+
gh release edit "$TAG" --title "$RELEASE_NAME" --repo "$REPO"

‎.github/workflows/build-node-packages.yml‎

Lines changed: 29 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ jobs:
2121

2222
env:
2323
NODE_VERSION: v24.13.0
24+
REPO: ${{ github.repository }}
2425

2526
steps:
2627
- name: Debug Matrix Values
@@ -68,10 +69,33 @@ jobs:
6869
tar --hard-dereference -cvzf packages_${{matrix.arch}}.tar.gz bcrypt@5.1.0 cld@2.9.1 unix-dgram@2.0.6
6970
7071
- name: Upload archive to release
71-
uses: softprops/action-gh-release@v1
72-
with:
73-
name: node-${{ env.NODE_VERSION }}-LATEST
74-
tag_name: node-${{ env.NODE_VERSION }}-release
75-
files: packages_${{matrix.arch}}.tar.gz
72+
# Attach the built gyp-package bundle to the same node-${NODE_VERSION}-release
73+
# release that hosts the corresponding Node binaries.
74+
#
75+
# This workflow is fired by `push` to v24.13.0 and by workflow_dispatch — it
76+
# is not chained off Build Node, so the release may not yet exist. The
77+
# matrix runs both arms (linux-x64, linux-arm64) in parallel, so both can
78+
# race to create the release. The view-or-create guard with the trailing
79+
# `|| gh release view` tolerates "already exists" from a losing racer and
80+
# propagates any other create failure through the final view.
81+
#
82+
# `--clobber` makes re-uploads idempotent on asset name collisions by
83+
# deleting the existing asset before uploading. If the new upload fails
84+
# after the delete, just re-run the job.
85+
#
86+
# `gh release edit --title` after upload keeps the release title
87+
# deterministically derived from NODE_VERSION, overriding any manual rename
88+
# in the GitHub UI.
7689
env:
7790
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
91+
run: |
92+
set -euo pipefail
93+
TAG="node-${NODE_VERSION}-release"
94+
RELEASE_NAME="node-${NODE_VERSION}-LATEST"
95+
FILE="packages_${{matrix.arch}}.tar.gz"
96+
if ! gh release view "$TAG" --repo "$REPO" >/dev/null 2>&1; then
97+
gh release create "$TAG" --title "$RELEASE_NAME" --notes "" --repo "$REPO" \
98+
|| gh release view "$TAG" --repo "$REPO" >/dev/null
99+
fi
100+
gh release upload "$TAG" "$FILE" --clobber --repo "$REPO"
101+
gh release edit "$TAG" --title "$RELEASE_NAME" --repo "$REPO"

‎.github/workflows/build-node.yml‎

Lines changed: 32 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ jobs:
2323
env:
2424
S3_BUCKET: your-bucket-name
2525
AWS_REGION: us-east-1
26+
REPO: ${{ github.repository }}
2627

2728
steps:
2829
- name: Checkout Node fork
@@ -85,10 +86,36 @@ jobs:
8586
path: artifacts/${{ env.NODE_ARCHIVE_LATEST }}
8687

8788
- name: Upload Node archive to release
88-
uses: softprops/action-gh-release@v1
89-
with:
90-
name: node-${{ env.NODE_VERSION }}-LATEST
91-
tag_name: node-${{ env.NODE_VERSION }}-release
92-
files: ./artifacts/${{ env.NODE_ARCHIVE_LATEST }}
89+
# Publish the built Node archive to the node-${NODE_VERSION}-release release.
90+
# This is the first uploader in the pipeline; build-node-packages and
91+
# build-node-fibers attach additional artifacts to the same release later.
92+
#
93+
# Matrix concurrency: both matrix arms (linux-x64, linux-arm64) hit this step
94+
# in parallel. On the first run for a new NODE_VERSION the release does not
95+
# yet exist, so both arms race to create it. The view-or-create guard with
96+
# the trailing `|| gh release view` tolerates "already exists" from the
97+
# losing arm (as long as the release now exists); any other create failure
98+
# propagates through that second view.
99+
#
100+
# `--clobber` makes re-uploads idempotent on asset name collisions: an
101+
# existing asset with the same name is deleted before the new one uploads.
102+
# Acceptable here because the -LATEST assets are always reproducible from
103+
# the build inputs; if the upload fails after the delete, just re-run the
104+
# job.
105+
#
106+
# `gh release edit --title` after upload keeps the release title
107+
# deterministically derived from NODE_VERSION even if someone renames the
108+
# release in the GitHub UI.
93109
env:
94110
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
111+
run: |
112+
set -euo pipefail
113+
TAG="node-${NODE_VERSION}-release"
114+
RELEASE_NAME="node-${NODE_VERSION}-LATEST"
115+
FILE="./artifacts/${NODE_ARCHIVE_LATEST}"
116+
if ! gh release view "$TAG" --repo "$REPO" >/dev/null 2>&1; then
117+
gh release create "$TAG" --title "$RELEASE_NAME" --notes "" --repo "$REPO" \
118+
|| gh release view "$TAG" --repo "$REPO" >/dev/null
119+
fi
120+
gh release upload "$TAG" "$FILE" --clobber --repo "$REPO"
121+
gh release edit "$TAG" --title "$RELEASE_NAME" --repo "$REPO"

0 commit comments

Comments
 (0)