2026-08-26, Version 26.8.0 (Current)

.github/workflows/auto-start-ci.yml

@@ -1,3 +1,6 @@
+# This action uses the following secrets:
+#   JENKINS_USER: GitHub user whose Jenkins token is defined below
+#   JENKINS_TOKEN: Jenkins token, to be used to start CI
 name: Auto Start CI
 
 on:
@@ -36,11 +39,13 @@ jobs:
                   -t '{{ range . }}{{ .number }} {{ end }}' \
                   --limit 5)" >> "$GITHUB_OUTPUT"
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
   start-ci:
     permissions:
+      checks: read
       contents: read
       pull-requests: write
+      statuses: read
     needs: get-prs-for-ci
     if: needs.get-prs-for-ci.outputs.numbers != ''
     runs-on: ubuntu-slim
@@ -59,16 +64,15 @@ jobs:
           ncu-config set token "$GH_TOKEN"
           ncu-config set jenkins_token "$JENKINS_TOKEN"
           ncu-config set owner "$GITHUB_REPOSITORY_OWNER"
-          ncu-config set repo "$(echo "$GITHUB_REPOSITORY" | cut -d/ -f2)"
+          ncu-config set repo "${GITHUB_REPOSITORY#*/}"
         env:
           USERNAME: ${{ secrets.JENKINS_USER }}
-          GH_TOKEN: ${{ secrets.GH_USER_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
           JENKINS_TOKEN: ${{ secrets.JENKINS_TOKEN }}
 
       - name: Start the CI
         run: |
           curl -fsSL "https://github.com/${GITHUB_REPOSITORY}/raw/${GITHUB_SHA}/tools/actions/start-ci.sh" \
           | sh -s -- ${{ needs.get-prs-for-ci.outputs.numbers }}
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_REPO: ${{ github.repository }}
+          GH_TOKEN: ${{ github.token }}

.github/workflows/benchmark.yml

@@ -141,7 +141,7 @@ jobs:
             --arg devTools '[]' \
             --arg benchmarkTools '[]' \
             --run '
-                make -j4 V=1
+                make build-ci -j4 V=1
             '
 
       - name: Run benchmark

.github/workflows/build-tarball.yml

@@ -23,6 +23,7 @@ on:
       - tools/eslint-rules/**
       - tools/eslint/**
       - tools/lint-md/**
+      - tools/nix/**
       - typings/**
       - vcbuild.bat
       - .**
@@ -52,6 +53,7 @@ on:
       - tools/eslint-rules/**
       - tools/eslint/**
       - tools/lint-md/**
+      - tools/nix/**
       - typings/**
       - vcbuild.bat
       - .**
@@ -120,7 +122,7 @@ jobs:
         if: github.base_ref == 'main' || github.ref_name == 'main'
         uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba  # v0.0.11
         with:
-          version: v0.16.0
+          version: v0.17.0
       - name: Download tarball
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:

.github/workflows/commit-queue.yml

@@ -22,78 +22,152 @@ permissions:
   contents: read
 
 jobs:
-  get_mergeable_prs:
+  get_candidate_prs:
     permissions:
       pull-requests: read
     if: github.repository == 'nodejs/node'
     runs-on: ubuntu-slim
     outputs:
-      numbers: ${{ steps.get_mergeable_prs.outputs.numbers }}
+      candidates: ${{ steps.get_candidate_prs.outputs.candidates }}
     steps:
-      - name: Get Pull Requests
-        id: get_mergeable_prs
+      - name: Get Pull Request Candidates
+        id: get_candidate_prs
         run: |
-          prs=$(gh pr list \
+          list_prs() {
+            gh pr list \
                   --repo "$GITHUB_REPOSITORY" \
                   --base "$GITHUB_REF_NAME" \
                   --label 'commit-queue' \
+                  "$@" \
                   --json 'number' \
-                  --search "created:<=$(date --date="2 days ago"  +"%Y-%m-%dT%H:%M:%S%z") -label:blocked" \
                   -t '{{ range . }}{{ .number }} {{ end }}' \
-                  --limit 100)
-          fast_track_prs=$(gh pr list \
-                  --repo "$GITHUB_REPOSITORY" \
-                  --base "$GITHUB_REF_NAME" \
-                  --label 'commit-queue' \
+                  --limit 100
+          }
+          aged_prs=$(list_prs \
+                  --search "created:<=$(date --date="2 days ago"  +"%Y-%m-%dT%H:%M:%S%z") -label:blocked")
+          fast_track_prs=$(list_prs \
                   --label 'fast-track' \
-                  --search "-label:blocked" \
-                  --json 'number' \
-                  -t '{{ range . }}{{ .number }} {{ end }}' \
-                  --limit 100)
-          numbers=$(echo $prs' '$fast_track_prs | jq -r -s 'unique | join(" ")')
-          echo "numbers=$numbers" >> "$GITHUB_OUTPUT"
+                  --search "-label:blocked")
+          candidates=$(printf '%s %s\n' "$fast_track_prs" "$aged_prs" |
+                  jq -r -s 'reduce .[] as $pr ([]; if index($pr) then . else . + [$pr] end) | join(" ")')
+          echo "candidates=$candidates" >> "$GITHUB_OUTPUT"
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
   commitQueue:
-    needs: get_mergeable_prs
-    if: needs.get_mergeable_prs.outputs.numbers != ''
+    needs: get_candidate_prs
+    if: needs.get_candidate_prs.outputs.candidates != ''
+    permissions:
+      checks: read
+      contents: read
+      pull-requests: read
+      statuses: read
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
-        with:
-          # A personal token is required because pushing with GITHUB_TOKEN will
-          # prevent commits from running CI after they land. It needs
-          # to be set here because `checkout` configures GitHub authentication
-          # for push as well.
-          token: ${{ secrets.GH_USER_TOKEN }}
-
-      # Install dependencies
       - name: Install Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
           node-version: ${{ env.NODE_VERSION }}
+
       - name: Install @node-core/utils
         run: npm install -g @node-core/utils
 
-      - name: Set variables
-        run: |
-          echo "REPOSITORY=$(echo "$GITHUB_REPOSITORY" | cut -d/ -f2)" >> "$GITHUB_ENV"
-
       - name: Configure @node-core/utils
         run: |
-          ncu-config set branch "${GITHUB_REF_NAME}"
-          ncu-config set upstream origin
-          ncu-config set username "$USERNAME"
-          ncu-config set token "$GITHUB_TOKEN"
-          ncu-config set jenkins_token "$JENKINS_TOKEN"
-          ncu-config set repo "${REPOSITORY}"
-          ncu-config set owner "${GITHUB_REPOSITORY_OWNER}"
+          # Keep the config outside the workspace so checkout does not remove it.
+          ncu-config --global set branch "${GITHUB_REF_NAME}"
+          ncu-config --global set upstream origin
+          ncu-config --global set username "$USERNAME"
+          ncu-config --global set token "$GH_TOKEN"
+          ncu-config --global set jenkins_token "$JENKINS_TOKEN"
+          ncu-config --global set repo "${GITHUB_REPOSITORY#*/}"
+          ncu-config --global set owner "${GITHUB_REPOSITORY_OWNER}"
         env:
           USERNAME: ${{ secrets.JENKINS_USER }}
-          GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
           JENKINS_TOKEN: ${{ secrets.JENKINS_TOKEN }}
 
+      - name: Filter Pull Requests
+        id: get_mergeable_prs
+        run: |
+          readme="${RUNNER_TEMP}/README.md"
+          curl -fsSLo "$readme" "https://github.com/${GITHUB_REPOSITORY}/raw/${GITHUB_SHA}/README.md"
+
+          numbers=
+          # shellcheck disable=SC2086
+          for pr in $CANDIDATES; do
+            metadata="${RUNNER_TEMP}/metadata-${pr}.json"
+            output="${RUNNER_TEMP}/metadata-${pr}.txt"
+            if git node metadata "$pr" \
+                    --readme "$readme" \
+                    --json > "$metadata" 2> "$output"; then
+              metadata_status=0
+            else
+              metadata_status=$?
+            fi
+
+            if [ -s "$output" ]; then
+              cat "$output"
+            fi
+
+            case "$metadata_status" in
+              0|2[0-9]|4[0-9]) ;;
+              *)
+                echo "git node metadata failed for pr ${pr} with exit code ${metadata_status}"
+                exit 1
+                ;;
+            esac
+
+            metadata_exit_code=$(jq -r '.exitCode' "$metadata") || {
+              echo "failed to parse metadata JSON for pr ${pr}"
+              exit 1
+            }
+            if [ "$metadata_exit_code" != "$metadata_status" ]; then
+              echo "metadata JSON exitCode mismatch for pr ${pr}"
+              exit 1
+            fi
+            metadata_reason_codes=$(jq -r '.reasonCodes | join(", ")' "$metadata") || {
+              echo "failed to parse metadata reason codes for pr ${pr}"
+              exit 1
+            }
+
+            if [ "$metadata_status" -eq 0 ]; then
+              echo "pr ${pr} is ready for the commit queue"
+              numbers="$numbers $pr"
+              continue
+            fi
+
+            if [ "$metadata_status" -ge 20 ] && [ "$metadata_status" -le 29 ]; then
+              echo "pr ${pr} skipped, not ready to land"
+              echo "reason codes: ${metadata_reason_codes}"
+              continue
+            fi
+
+            echo "pr ${pr} will be handled by the commit queue"
+            echo "reason codes: ${metadata_reason_codes}"
+            numbers="$numbers $pr"
+          done
+
+          numbers=$(echo "$numbers" | xargs)
+          echo "numbers=$numbers" >> "$GITHUB_OUTPUT"
+        env:
+          CANDIDATES: ${{ needs.get_candidate_prs.outputs.candidates }}
+          GH_TOKEN: ${{ github.token }}
+
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        if: steps.get_mergeable_prs.outputs.numbers != ''
+        with:
+          # A personal token is required because pushing with GITHUB_TOKEN will
+          # prevent commits from running CI after they land. It needs
+          # to be set here because `checkout` configures GitHub authentication
+          # for push as well.
+          token: ${{ secrets.GH_USER_TOKEN }}
+
       - name: Start the Commit Queue
-        run: ./tools/actions/commit-queue.sh "${GITHUB_REPOSITORY_OWNER}" "${REPOSITORY}" ${{ needs.get_mergeable_prs.outputs.numbers }}
+        if: steps.get_mergeable_prs.outputs.numbers != ''
+        run: |
+          git config --local user.email "github-bot@iojs.org"
+          git config --local user.name "Node.js GitHub Bot"
+          ncu-config set token "$GH_TOKEN"
+          ./tools/actions/commit-queue.sh ${{ steps.get_mergeable_prs.outputs.numbers }}
         env:
-          GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
+          GH_TOKEN: ${{ secrets.GH_USER_TOKEN }}

.github/workflows/coverage-linux-without-intl.yml

@@ -66,7 +66,7 @@ jobs:
         if: github.base_ref == 'main' || github.ref_name == 'main'
         uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba  # v0.0.11
         with:
-          version: v0.16.0
+          version: v0.17.0
       - name: Install gcovr
         run: pip install gcovr==7.2
       - name: Configure

.github/workflows/coverage-linux.yml

@@ -66,7 +66,7 @@ jobs:
         if: github.base_ref == 'main' || github.ref_name == 'main'
         uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba  # v0.0.11
         with:
-          version: v0.16.0
+          version: v0.17.0
       - name: Install gcovr
         run: pip install gcovr==7.2
       - name: Configure

.github/workflows/coverage-windows.yml

@@ -23,6 +23,7 @@ on:
       - tools/eslint-rules/**
       - tools/eslint/**
       - tools/lint-md/**
+      - tools/nix/**
       - typings/**
       - .**
       - '!.github/workflows/coverage-windows.yml'
@@ -49,6 +50,7 @@ on:
       - tools/eslint-rules/**
       - tools/eslint/**
       - tools/lint-md/**
+      - tools/nix/**
       - typings/**
       - .**
       - '!.github/workflows/coverage-windows.yml'

.github/workflows/major-release.yml

@@ -2,7 +2,7 @@ name: Major Release
 
 on:
   schedule:
-    - cron: 0 0 15 2,8 *  # runs at midnight UTC every 15 February and 15 August
+    - cron: 0 0 15 2 *  # runs at midnight UTC every 15 February
 
 permissions:
   contents: read

.github/workflows/nix-changes.yml

@@ -11,10 +11,12 @@ on:
       - v[0-9]+.x
     paths:
       - '**.nix'
+      - tools/nix/**
       - .github/workflows/nix-changes.yml
   pull_request:
     paths:
       - '**.nix'
+      - tools/nix/**
       - .github/workflows/nix-changes.yml
     types: [opened, synchronize, reopened, ready_for_review]
 
@@ -47,7 +49,9 @@ jobs:
         with:
           fetch-depth: 2
           persist-credentials: false
-          sparse-checkout: '*.nix'
+          sparse-checkout: |
+            shell.nix
+            tools/nix/
           sparse-checkout-cone-mode: false
 
       - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342  # v31.11.0
@@ -60,39 +64,14 @@ jobs:
           name: nodejs
 
       - name: Compute requisites after change
-        shell: bash  # See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference, we want the pipefail option.
-        run: |
-          nix-store --query --references "$(
-            nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
-              --arg devTools "
-                (import ./tools/nix/devTools.nix {})
-                ++ builtins.attrValues (
-                  { inherit (import <nixpkgs> {}) nixfmt-tree sccache; }
-                  // import ./tools/nix/openssl-matrix.nix {}
-                  // import ./tools/nix/pkcs11.nix {}
-                )")" \
-          | xargs nix-store --realise \
-          | xargs nix-store --query --requisites \
-          | sort -k1.45 \
-          > requisites-${{ matrix.system }}-after.list
+        run: ./tools/nix/list-requisites.sh > requisites-${{ matrix.system }}-after.list
 
       - name: Compute requisites before change
-        shell: bash  # See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference, we want the pipefail option.
-        # TODO(panva): add `// import ./tools/nix/pkcs11.nix {}` once landed
         run: |
           git reset HEAD^ --hard
-          nix-store --query --references "$(
-            nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
-              --arg devTools "
-                (import ./tools/nix/devTools.nix {})
-                ++ builtins.attrValues (
-                  { inherit (import <nixpkgs> {}) nixfmt-tree sccache; }
-                  // import ./tools/nix/openssl-matrix.nix {}
-                )")" \
-          | xargs nix-store --realise \
-          | xargs nix-store --query --requisites \
-          | sort -k1.45 \
-          > requisites-${{ matrix.system }}-before.list
+          # TODO(aduh95): remove this once list-requisites.sh has reached `main`
+          [ -f tools/nix/list-requisites.sh ] || git checkout FETCH_HEAD -- tools/nix/list-requisites.sh
+          ./tools/nix/list-requisites.sh > requisites-${{ matrix.system }}-before.list
 
       - name: Output diff
         run: |

.github/workflows/stress-test.yml

@@ -78,7 +78,7 @@ jobs:
       - name: Set up sccache
         uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba  # v0.0.11
         with:
-          version: v0.16.0
+          version: v0.17.0
       # This is needed due to https://github.com/nodejs/build/issues/3878
       - name: Cleanup
         if: runner.os == 'macOS'