ci(deps): update action tooling - #153
Open
BridgeAR wants to merge 6 commits into
Open
Conversation
npm callers failed because the prebuild action invoked Yarn-specific wrappers and relied on an ambient node-gyp. The action now installs its locked runtime with npm. Node 12 builders could only run the obsolete node-gyp line, whose tar dependency remains vulnerable. The Docker path runs the action on Node 18 while retaining the existing images for their target libc and compiler.
The aggregate prebuild job still required the removed ia32 job, causing GitHub to reject the workflow graph before any job ran.
Node 12 builders fail before compilation because their glibc and Alpine repositories cannot provide the required runtime. Use Node 18 or newer images while preserving the existing libc compatibility boundaries.
The multi-architecture tag selects arm64 on the arm runner, which bypasses the arm version guard and builds the wrong target.
Node 18 remains the consumer floor, while build tooling can use Node 24. UBI 8 preserves the glibc 2.28 floor without relying on CentOS vault repositories.
There was a problem hiding this comment.
Pull request overview
Updates the action’s build tooling to use npm-managed dependencies, newer Node tooling, and supported Linux builders.
Changes:
- Replaces Yarn lockfiles and vendored modules with npm lockfiles.
- Updates node-gyp, node-gyp-build, napi-rs, ESLint, and CI actions.
- Removes Linux ia32 builds and modernizes Linux builder images.
Reviewed changes
Copilot reviewed 19 out of 96 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
README.md |
Documents Linux ia32 removal and naming option. |
package.json |
Updates runtime and lint tooling. |
eslint.config.js |
Adds ESLint flat configuration. |
.eslintrc.json |
Removes legacy ESLint configuration. |
.gitignore |
Stops tracking prebuild dependencies. |
.yarnrc |
Removes Yarn registry configuration. |
.github/workflows/build.yml |
Modernizes builders and removes Linux ia32. |
.github/workflows/project.yml |
Migrates project CI to npm. |
.github/workflows/test.yml |
Tests npm and node-gyp-build v4. |
.github/workflows/test_napi.yml |
Tests v4 N-API output naming. |
.github/workflows/test_neon.yml |
Migrates Neon testing to npm/v4. |
compute-matrix/yarn.lock |
Removes obsolete Yarn lockfile. |
platforms/index.js |
Excludes Linux ia32 platforms. |
platforms/yarn.lock |
Removes obsolete Yarn lockfile. |
prebuild/action.yml |
Installs locked runtime with npm. |
prebuild/docker.sh |
Adds container bootstrap script. |
prebuild/fetch_node_headers.js |
Modernizes failure handling. |
prebuild/index.js |
Uses locked node-gyp and updates Rust setup. |
prebuild/package.json |
Adds locked runtime tooling. |
prebuild/package-lock.json |
Locks prebuild dependencies. |
prebuild/targets.js |
Modernizes target filtering and fetch handling. |
prebuild/yarn.lock |
Removes Yarn runtime lockfile. |
test/napi/package.json |
Updates node-gyp-build. |
test/napi/package-lock.json |
Locks updated N-API dependency. |
test/neon/package.json |
Updates node-gyp-build. |
test/neon/package-lock.json |
Adds npm lockfile. |
test/neon/yarn.lock |
Removes Yarn lockfile. |
prebuild/node_modules/semver/** |
Removes vendored semver package files. |
prebuild/node_modules/retry/** |
Removes vendored retry package files. |
prebuild/node_modules/@napi-rs/cli/** |
Removes vendored napi-rs CLI files. |
Files not reviewed (3)
- prebuild/package-lock.json: Generated file
- test/napi/package-lock.json: Generated file
- test/neon/package-lock.json: Generated file
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
|
||
| if (NEON === 'true') { | ||
| execSync('rustup toolchain install nightly', { cwd, stdio, shell }) | ||
| process.env.RUSTUP_TOOLCHAIN = 'nightly' |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
npm callers failed because the prebuild action invoked Yarn-specific wrappers and relied on an ambient node-gyp. The action now installs its locked runtime with npm.
The CentOS 7 Docker builders cannot execute Node 18 because both official and NodeSource binaries require glibc 2.28. The draft keeps that remaining builder failure visible while a custom compatible image or newer builder target is selected.