fix: harden Node CI and Windows package smoke (#84)

Author: mldangelo-oai

.github/workflows/container-ci.yml

@@ -25,6 +25,10 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   container:
     name: linux-amd64
@@ -96,7 +100,8 @@ jobs:
           mkdir -p results state
           chmod 700 results state
           printf 'id,repository,revision\n' > repositories.csv
-          export CODEX_SECURITY_USER="$(id -u):$(id -g)"
+          CODEX_SECURITY_USER="$(id -u):$(id -g)"
+          export CODEX_SECURITY_USER
           docker compose config --quiet
           docker compose run --rm codex-security --version
 

.github/workflows/node-ci.yml

@@ -8,35 +8,51 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   test:
-    name: ${{ matrix.os }} / node-22
+    name: ${{ matrix.os }} / node-${{ matrix.node }}
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
+        node: ["22"]
+        include:
+          - os: ubuntu-latest
+            node: "24"
+          - os: ubuntu-latest
+            node: "26"
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
+      - name: Set up pnpm
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        with:
+          package_json_file: sdk/typescript/package.json
+          cache: true
+          cache_dependency_path: sdk/typescript/pnpm-lock.yaml
+
       - name: Set up Node.js
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
-          node-version: "22"
+          node-version: ${{ matrix.node }}
+          cache: npm
+          cache-dependency-path: sdk/typescript/pnpm-lock.yaml
 
       - name: Set up Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: "1.3.14"
 
-      - name: Enable pnpm
-        shell: bash
-        run: corepack enable && corepack prepare "$(node -p 'require("./sdk/typescript/package.json").packageManager')" --activate
-
       - name: Install dependencies
         run: pnpm --dir sdk/typescript install --frozen-lockfile
 
@@ -65,3 +81,18 @@ jobs:
         working-directory: sdk/typescript
         shell: bash
         run: pnpm run check:package ../../dist/*.tgz
+
+      - name: Smoke-test Node.js runtime
+        working-directory: sdk/typescript
+        shell: bash
+        run: |
+          set -euo pipefail
+          node --input-type=module --eval '
+            import { CodexSecurity } from "@openai/codex-security";
+
+            if (typeof CodexSecurity !== "function") {
+              throw new Error("The SDK does not export CodexSecurity.");
+            }
+          '
+          node bin/codex-security.mjs --version
+          node bin/codex-security.mjs --help

.github/workflows/node-release.yml

@@ -67,6 +67,7 @@ jobs:
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: "1.3.14"
+          no-cache: true
 
       - name: Enable pnpm
         shell: bash

sdk/typescript/scripts/check-package.mjs

@@ -4,6 +4,10 @@ import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { brotliDecompressSync, gunzipSync } from "node:zlib";
 import { assertExpectedGitHead } from "./package-provenance.mjs";
+import { packageSmokeTimeouts } from "./package-smoke-timeouts.mjs";
+
+const PACKAGE_SMOKE_PROCESS_TIMEOUT_MS =
+  packageSmokeTimeouts().processTimeoutMs;
 
 const args = process.argv.slice(2);
 if (args[0] === "--") args.shift();
@@ -279,15 +283,16 @@ if (args.length === 1) {
     [fileURLToPath(new URL("./smoke-package.mjs", import.meta.url)), archive],
     {
       stdio: "inherit",
-      timeout: 150_000,
+      timeout: PACKAGE_SMOKE_PROCESS_TIMEOUT_MS,
       killSignal: "SIGKILL",
       windowsHide: true,
     },
   );
   if (smoke.error?.code === "ETIMEDOUT") {
-    throw new Error("Installed npm package smoke timed out after 150000 ms.", {
-      cause: smoke.error,
-    });
+    throw new Error(
+      `Installed npm package smoke timed out after ${PACKAGE_SMOKE_PROCESS_TIMEOUT_MS} ms.`,
+      { cause: smoke.error },
+    );
   }
   if (smoke.error !== undefined) throw smoke.error;
   if (smoke.status !== 0) {

sdk/typescript/scripts/package-smoke-timeouts.mjs

@@ -0,0 +1,8 @@
+export function packageSmokeTimeouts(platform = process.platform) {
+  const commandTimeoutMs = platform === "win32" ? 180_000 : 120_000;
+
+  return {
+    commandTimeoutMs,
+    processTimeoutMs: commandTimeoutMs + 30_000,
+  };
+}

sdk/typescript/scripts/smoke-package.mjs

@@ -11,8 +11,9 @@ import {
 import { tmpdir } from "node:os";
 import { basename, dirname, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
+import { packageSmokeTimeouts } from "./package-smoke-timeouts.mjs";
 
-const PACKAGE_SMOKE_TIMEOUT_MS = 120_000;
+const PACKAGE_SMOKE_TIMEOUT_MS = packageSmokeTimeouts().commandTimeoutMs;
 const packageRoot = fileURLToPath(new URL("../", import.meta.url));
 const packageManifest = JSON.parse(
   await readFile(new URL("../package.json", import.meta.url), "utf8"),
@@ -191,12 +192,11 @@ try {
     [
       ...npm.args,
       "install",
+      "--prefer-offline",
       "--include=optional",
       "--ignore-scripts",
       "--no-audit",
       "--no-fund",
-      "--cache",
-      join(consumer, ".npm-cache"),
       archive,
     ],
     { cwd: consumer },

sdk/typescript/tests-ts/package-smoke-timeouts.test.ts

@@ -0,0 +1,45 @@
+import { describe, expect, test } from "bun:test";
+
+type PackageSmokeTimeouts = {
+  packageSmokeTimeouts: (platform?: NodeJS.Platform) => {
+    commandTimeoutMs: number;
+    processTimeoutMs: number;
+  };
+};
+
+const { packageSmokeTimeouts } = (await import(
+  new URL("../scripts/package-smoke-timeouts.mjs", import.meta.url).href
+)) as PackageSmokeTimeouts;
+
+describe("npm package smoke timeouts", () => {
+  test("preserves the existing timeout on Linux and macOS", () => {
+    for (const platform of ["linux", "darwin"] as const) {
+      expect(packageSmokeTimeouts(platform)).toEqual({
+        commandTimeoutMs: 120_000,
+        processTimeoutMs: 150_000,
+      });
+    }
+  });
+
+  test("allows the Windows npm install to complete", () => {
+    expect(packageSmokeTimeouts("win32")).toEqual({
+      commandTimeoutMs: 180_000,
+      processTimeoutMs: 210_000,
+    });
+  });
+
+  test("keeps the parent smoke timeout above the command timeout", () => {
+    for (const platform of ["linux", "darwin", "win32"] as const) {
+      const { commandTimeoutMs, processTimeoutMs } =
+        packageSmokeTimeouts(platform);
+
+      expect(processTimeoutMs).toBe(commandTimeoutMs + 30_000);
+    }
+  });
+
+  test("uses the active runtime platform by default", () => {
+    expect(packageSmokeTimeouts()).toEqual(
+      packageSmokeTimeouts(process.platform),
+    );
+  });
+});