Merge branch 'main' into native-glob

Author: avivkeller

.github/workflows/auto-start-ci.yml

@@ -1,3 +1,6 @@
+# This action uses the following secrets:
+#   JENKINS_USER: GitHub user whose Jenkins token is defined below
+#   JENKINS_TOKEN: Jenkins token, to be used to start CI
 name: Auto Start CI
 
 on:
@@ -36,11 +39,13 @@ jobs:
                   -t '{{ range . }}{{ .number }} {{ end }}' \
                   --limit 5)" >> "$GITHUB_OUTPUT"
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
   start-ci:
     permissions:
+      checks: read
       contents: read
       pull-requests: write
+      statuses: read
     needs: get-prs-for-ci
     if: needs.get-prs-for-ci.outputs.numbers != ''
     runs-on: ubuntu-slim
@@ -59,16 +64,15 @@ jobs:
           ncu-config set token "$GH_TOKEN"
           ncu-config set jenkins_token "$JENKINS_TOKEN"
           ncu-config set owner "$GITHUB_REPOSITORY_OWNER"
-          ncu-config set repo "$(echo "$GITHUB_REPOSITORY" | cut -d/ -f2)"
+          ncu-config set repo "${GITHUB_REPOSITORY#*/}"
         env:
           USERNAME: ${{ secrets.JENKINS_USER }}
-          GH_TOKEN: ${{ secrets.GH_USER_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
           JENKINS_TOKEN: ${{ secrets.JENKINS_TOKEN }}
 
       - name: Start the CI
         run: |
           curl -fsSL "https://github.com/${GITHUB_REPOSITORY}/raw/${GITHUB_SHA}/tools/actions/start-ci.sh" \
           | sh -s -- ${{ needs.get-prs-for-ci.outputs.numbers }}
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_REPO: ${{ github.repository }}
+          GH_TOKEN: ${{ github.token }}

.github/workflows/benchmark.yml

@@ -141,7 +141,7 @@ jobs:
             --arg devTools '[]' \
             --arg benchmarkTools '[]' \
             --run '
-                make -j4 V=1
+                make build-ci -j4 V=1
             '
 
       - name: Run benchmark

.github/workflows/build-tarball.yml

@@ -23,6 +23,7 @@ on:
       - tools/eslint-rules/**
       - tools/eslint/**
       - tools/lint-md/**
+      - tools/nix/**
       - typings/**
       - vcbuild.bat
       - .**
@@ -52,6 +53,7 @@ on:
       - tools/eslint-rules/**
       - tools/eslint/**
       - tools/lint-md/**
+      - tools/nix/**
       - typings/**
       - vcbuild.bat
       - .**

.github/workflows/commit-queue.yml

@@ -52,7 +52,7 @@ jobs:
                   jq -r -s 'reduce .[] as $pr ([]; if index($pr) then . else . + [$pr] end) | join(" ")')
           echo "candidates=$candidates" >> "$GITHUB_OUTPUT"
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
   commitQueue:
     needs: get_candidate_prs
     if: needs.get_candidate_prs.outputs.candidates != ''
@@ -63,18 +63,14 @@ jobs:
       statuses: read
     runs-on: ubuntu-slim
     steps:
-      # Install dependencies
       - name: Install Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
           node-version: ${{ env.NODE_VERSION }}
+
       - name: Install @node-core/utils
         run: npm install -g @node-core/utils
 
-      - name: Set variables
-        run: |
-          echo "REPOSITORY=$(echo "$GITHUB_REPOSITORY" | cut -d/ -f2)" >> "$GITHUB_ENV"
-
       - name: Configure @node-core/utils
         run: |
           # Keep the config outside the workspace so checkout does not remove it.
@@ -83,7 +79,7 @@ jobs:
           ncu-config --global set username "$USERNAME"
           ncu-config --global set token "$GH_TOKEN"
           ncu-config --global set jenkins_token "$JENKINS_TOKEN"
-          ncu-config --global set repo "${REPOSITORY}"
+          ncu-config --global set repo "${GITHUB_REPOSITORY#*/}"
           ncu-config --global set owner "${GITHUB_REPOSITORY_OWNER}"
         env:
           USERNAME: ${{ secrets.JENKINS_USER }}
@@ -102,8 +98,6 @@ jobs:
             metadata="${RUNNER_TEMP}/metadata-${pr}.json"
             output="${RUNNER_TEMP}/metadata-${pr}.txt"
             if git node metadata "$pr" \
-                    --owner "$GITHUB_REPOSITORY_OWNER" \
-                    --repo "$REPOSITORY" \
                     --readme "$readme" \
                     --json > "$metadata" 2> "$output"; then
               metadata_status=0
@@ -171,7 +165,9 @@ jobs:
       - name: Start the Commit Queue
         if: steps.get_mergeable_prs.outputs.numbers != ''
         run: |
+          git config --local user.email "github-bot@iojs.org"
+          git config --local user.name "Node.js GitHub Bot"
           ncu-config set token "$GH_TOKEN"
-          ./tools/actions/commit-queue.sh "${GITHUB_REPOSITORY_OWNER}" "${REPOSITORY}" ${{ steps.get_mergeable_prs.outputs.numbers }}
+          ./tools/actions/commit-queue.sh ${{ steps.get_mergeable_prs.outputs.numbers }}
         env:
           GH_TOKEN: ${{ secrets.GH_USER_TOKEN }}

.github/workflows/coverage-windows.yml

@@ -23,6 +23,7 @@ on:
       - tools/eslint-rules/**
       - tools/eslint/**
       - tools/lint-md/**
+      - tools/nix/**
       - typings/**
       - .**
       - '!.github/workflows/coverage-windows.yml'
@@ -49,6 +50,7 @@ on:
       - tools/eslint-rules/**
       - tools/eslint/**
       - tools/lint-md/**
+      - tools/nix/**
       - typings/**
       - .**
       - '!.github/workflows/coverage-windows.yml'

.github/workflows/nix-changes.yml

@@ -11,10 +11,12 @@ on:
       - v[0-9]+.x
     paths:
       - '**.nix'
+      - tools/nix/**
       - .github/workflows/nix-changes.yml
   pull_request:
     paths:
       - '**.nix'
+      - tools/nix/**
       - .github/workflows/nix-changes.yml
     types: [opened, synchronize, reopened, ready_for_review]
 
@@ -47,7 +49,9 @@ jobs:
         with:
           fetch-depth: 2
           persist-credentials: false
-          sparse-checkout: '*.nix'
+          sparse-checkout: |
+            shell.nix
+            tools/nix/
           sparse-checkout-cone-mode: false
 
       - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342  # v31.11.0
@@ -60,39 +64,14 @@ jobs:
           name: nodejs
 
       - name: Compute requisites after change
-        shell: bash  # See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference, we want the pipefail option.
-        run: |
-          nix-store --query --references "$(
-            nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
-              --arg devTools "
-                (import ./tools/nix/devTools.nix {})
-                ++ builtins.attrValues (
-                  { inherit (import <nixpkgs> {}) nixfmt-tree sccache; }
-                  // import ./tools/nix/openssl-matrix.nix {}
-                  // import ./tools/nix/pkcs11.nix {}
-                )")" \
-          | xargs nix-store --realise \
-          | xargs nix-store --query --requisites \
-          | sort -k1.45 \
-          > requisites-${{ matrix.system }}-after.list
+        run: ./tools/nix/list-requisites.sh > requisites-${{ matrix.system }}-after.list
 
       - name: Compute requisites before change
-        shell: bash  # See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference, we want the pipefail option.
         run: |
           git reset HEAD^ --hard
-          nix-store --query --references "$(
-            nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
-              --arg devTools "
-                (import ./tools/nix/devTools.nix {})
-                ++ builtins.attrValues (
-                  { inherit (import <nixpkgs> {}) nixfmt-tree sccache; }
-                  // import ./tools/nix/openssl-matrix.nix {}
-                  // import ./tools/nix/pkcs11.nix {}
-                )")" \
-          | xargs nix-store --realise \
-          | xargs nix-store --query --requisites \
-          | sort -k1.45 \
-          > requisites-${{ matrix.system }}-before.list
+          # TODO(aduh95): remove this once list-requisites.sh has reached `main`
+          [ -f tools/nix/list-requisites.sh ] || git checkout FETCH_HEAD -- tools/nix/list-requisites.sh
+          ./tools/nix/list-requisites.sh > requisites-${{ matrix.system }}-before.list
 
       - name: Output diff
         run: |

.github/workflows/test-linux.yml

@@ -9,6 +9,7 @@ on:
       - tools/actions/**
       - tools/clang-format/**
       - tools/dep_updaters/**
+      - tools/nix/**
       - test/internet/**
       - '**.nix'
       - .github/**
@@ -27,6 +28,7 @@ on:
       - tools/actions/**
       - tools/clang-format/**
       - tools/dep_updaters/**
+      - tools/nix/**
       - test/internet/**
       - '**.nix'
       - .github/**

.github/workflows/test-macos.yml

@@ -23,6 +23,7 @@ on:
       - tools/eslint-rules/**
       - tools/eslint/**
       - tools/lint-md/**
+      - tools/nix/**
       - typings/**
       - vcbuild.bat
       - .**
@@ -53,6 +54,7 @@ on:
       - tools/eslint-rules/**
       - tools/eslint/**
       - tools/lint-md/**
+      - tools/nix/**
       - typings/**
       - vcbuild.bat
       - .**

.github/workflows/test-shared.yml

@@ -44,6 +44,7 @@ on:
       - '!tools/nix/**'
       - '!tools/v8/**'
       - '!tools/v8_gypfiles/**'
+      - tools/nix/list-requisites.sh
       - typings/**
       - vcbuild.bat
       - .**
@@ -96,6 +97,7 @@ on:
       - '!tools/nix/**'
       - '!tools/v8/**'
       - '!tools/v8_gypfiles/**'
+      - tools/nix/list-requisites.sh
       - typings/**
       - vcbuild.bat
       - .**

.gitignore

@@ -163,7 +163,6 @@ install_manifest.txt
 
 # === Rules for AI assistants ===
 CLAUDE.md
-AGENTS.md
 
 # === Global Rules ===
 # Keep last to avoid being excluded