ci.yml

name: CI

on:
  push:
    branches:
     - main
     - current
     - next
     - 'v*'
  pull_request:

permissions:
  contents: read

jobs:
  dependency-review:
    if: ${{ github.event_name == 'pull_request' }}
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
        with:
          egress-policy: audit

      - name: Checkout Repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Dependency Review
        uses: actions/dependency-review-action@05fe4576374b728f0c523d6a13d64c25081e0803 # v4.8.3

  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          # Using `latest` as `lts` could point to previous major version.
          # Different versions of Node.js can cause different linting results
          # (e.g. dependening on process.getBuiltinModule())
          node-version: 'latest'

      - name: Install dependencies
        run: npm install

      - name: Lint
        run: npm run lint

  test:
    name: Test ${{ (matrix.node-version == '24' || matrix.node-version == '25') && matrix.runs-on == 'ubuntu-latest' && 'and Coverage ' || ''}}with Node.js ${{ matrix.node-version }} on ${{ matrix.runs-on }}
    strategy:
      fail-fast: false
      max-parallel: 0
      matrix:
        node-version: ['20', '22', '24', '25']
        runs-on: ['ubuntu-latest', 'windows-latest', 'macos-latest']
        exclude:
          - node-version: '20'
            runs-on: windows-latest
    uses: ./.github/workflows/nodejs.yml
    with:
      codecov: ${{ (matrix.node-version == '24' || matrix.node-version == '25') && matrix.runs-on == 'ubuntu-latest' }}
      node-version: ${{ matrix.node-version }}
      runs-on: ${{ matrix.runs-on }}
    secrets: inherit

  test-with-no-wasm-simd:
    name: Test with Node.js ${{ matrix.node-version }} on ${{ matrix.runs-on }} with WASM SIMD disabled
    strategy:
      fail-fast: false
      max-parallel: 0
      matrix:
        node-version: ['24', '25']
        runs-on: ['ubuntu-latest']
    uses: ./.github/workflows/nodejs.yml
    with:
      node-version: ${{ matrix.node-version }}
      runs-on: ${{ matrix.runs-on }}
      no-wasm-simd: '1'
    secrets: inherit

  test-without-intl:
    name: Test with Node.js ${{ matrix.node-version }} compiled --without-intl
    strategy:
      fail-fast: false
      max-parallel: 0
      matrix:
        node-version: ['20', '22', '24', '25']
    runs-on: ubuntu-latest
    timeout-minutes: 120
    steps:
      - name: Checkout Repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          submodules: recursive

      # Setup node, install deps, and build undici prior to building icu-less node and testing
      - name: Setup Node.js@${{ matrix.node-version }}
        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          node-version: ${{ matrix.node-version }}

      - name: Install dependencies
        run: npm install

      - name: Build undici
        run: npm run build:node

      - name: Determine latest release
        id: release
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          result-encoding: string
          script: |
            const req = await fetch('https://nodejs.org/download/release/index.json')
            const releases = await req.json()

            const latest = releases.find((r) => r.version.startsWith('v${{ matrix.node-version }}'))
            return latest.version

      - name: Download and extract source
        run: curl https://nodejs.org/download/release/${{ steps.release.outputs.result }}/node-${{ steps.release.outputs.result }}.tar.xz | tar xfJ -

      - name: Install ninja
        run: sudo apt-get install ninja-build

      - name: ccache
        uses: hendrikmuhs/ccache-action@bfa03e1de4d7f7c3e80ad9109feedd05c4f5a716 #v1.2.19
        with:
          key: node${{ matrix.node-version }}

      - name: Build node
        working-directory: ./node-${{ steps.release.outputs.result }}
        run: |
          export CC="ccache gcc"
          export CXX="ccache g++"
          ./configure --without-intl --ninja --prefix=./final
          make
          make install
          echo "$(pwd)/final/bin" >> $GITHUB_PATH

      - name: Print version information
        run: |
          echo OS: $(node -p "os.version()")
          echo Node.js: $(node --version)
          echo "Node.js built-in dependencies: $(node -p "'\r\n' + (Object.entries(process.versions).map(([k, v], i, arr) => (i !== arr.length - 1 ? '├──' : '└──') + k + '@' + v)).join('\r\n')")"
          echo npm: $(npm --version)
          echo git: $(git --version)
          echo icu config: $(node -e "console.log(process.config)" | grep icu)

      - name: Configure hosts file for WPT (Windows)
        if: runner.os == 'Windows'
        run: |
          cd ${{ github.workspace }}\test\web-platform-tests\wpt
          python wpt make-hosts-file | Out-File $env:SystemRoot\System32\drivers\etc\hosts -Encoding ascii -Append
        shell: powershell

      - name: Configure hosts file for WPT (Unix)
        if: runner.os != 'Windows'
        run: |
          cd ${{ github.workspace }}/test/web-platform-tests/wpt
          python3 wpt make-hosts-file | sudo tee -a /etc/hosts

      - name: Run tests
        run: npm run test:javascript:without-intl

  test-without-ssl:
    name: Test with Node.js ${{ matrix.node-version }} compiled --without-ssl
    strategy:
      fail-fast: false
      max-parallel: 0
      matrix:
        node-version: ['20', '22', '24', '25']
    runs-on: ubuntu-latest
    timeout-minutes: 120
    steps:
      - name: Checkout Repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          submodules: recursive

      # Setup node, install deps, and build undici prior to building icu-less node and testing
      - name: Setup Node.js@${{ matrix.node-version }}
        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          node-version: ${{ matrix.node-version }}

      - name: Install dependencies
        run: npm install

      - name: Build undici
        run: npm run build:node

      - name: Determine latest release
        id: release
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          result-encoding: string
          script: |
            const req = await fetch('https://nodejs.org/download/release/index.json')
            const releases = await req.json()

            const latest = releases.find((r) => r.version.startsWith('v${{ matrix.node-version }}'))
            return latest.version

      - name: Download and extract source
        run: curl https://nodejs.org/download/release/${{ steps.release.outputs.result }}/node-${{ steps.release.outputs.result }}.tar.xz | tar xfJ -

      - name: Install ninja
        run: sudo apt-get install ninja-build

      - name: ccache
        uses: hendrikmuhs/ccache-action@bfa03e1de4d7f7c3e80ad9109feedd05c4f5a716 #v1.2.19
        with:
          key: node${{ matrix.node-version }}

      - name: Build node
        working-directory: ./node-${{ steps.release.outputs.result }}
        run: |
          export CC="ccache gcc"
          export CXX="ccache g++"
          ./configure --without-ssl --ninja --prefix=./final
          make
          make install
          echo "$(pwd)/final/bin" >> $GITHUB_PATH

      - name: Print version information
        run: |
          echo OS: $(node -p "os.version()")
          echo Node.js: $(node --version)
          echo "Node.js built-in dependencies: $(node -p "'\r\n' + (Object.entries(process.versions).map(([k, v], i, arr) => (i !== arr.length - 1 ? '├──' : '└──') + k + '@' + v)).join('\r\n')")"
          echo npm: $(npm --version)
          echo git: $(git --version)
          echo icu config: $(node -e "console.log(process.config)" | grep icu)

      - name: Try loading Node.js without Crypto
        run: node index.js

  test-fuzzing:
    name: Fuzzing
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          node-version: lts/*

      - name: Install dependencies
        run: npm install

      - name: Run fuzzing tests
        run: npm run test:fuzzing

  test-shared-builtin:
    name: Test with Node.js ${{ matrix.node-version }} compiled --shared-builtin-undici/undici-path
    uses: ./.github/workflows/nodejs-shared.yml
    strategy:
      fail-fast: false
      max-parallel: 0
      matrix:
        node-version: ['24', '25']
        runs-on: ['ubuntu-latest']
    with:
      node-version: ${{ matrix.node-version }}

  test-types:
    name: Test TypeScript types
    timeout-minutes: 15
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          node-version: lts/*

      - name: Install dependencies
        run: npm install

      - name: Run typings tests
        run: npm run test:typescript

  automerge:
    if: >
      github.event_name == 'pull_request' && github.event.pull_request.user.login == 'dependabot[bot]'
    needs:
      - dependency-review
      - test
      - test-types
      - test-with-no-wasm-simd
      - test-without-intl
      - test-fuzzing
      - lint
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Merge Dependabot PR
        uses: fastify/github-action-merge-dependabot@1b2ed42db8f9d81a46bac83adedfc03eb5149dff # v3.11.2
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}