fix(hermes-base): fail closed on lossy verification and bound subprocesses #219
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| on: | |
| pull_request: | |
| branches: | |
| - master | |
| push: | |
| branches: | |
| - master | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| lint: | |
| runs-on: blacksmith-4vcpu-ubuntu-2404 | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| persist-credentials: false | |
| - uses: oven-sh/setup-bun@v2 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: '24.x' | |
| registry-url: 'https://registry.npmjs.org' | |
| - name: Install Dependency | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: bun install --frozen-lockfile | |
| - name: Run lint and typecheck | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: bun run lint | |
| test: | |
| runs-on: blacksmith-4vcpu-ubuntu-2404 | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| persist-credentials: false | |
| - uses: oven-sh/setup-bun@v2 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: '24.x' | |
| registry-url: 'https://registry.npmjs.org' | |
| - name: Install Dependency | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: bun install --frozen-lockfile | |
| - name: Run unit tests with coverage | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: bun run test:coverage | |
| - name: Upload coverage artifact | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: coverage | |
| path: coverage | |
| if-no-files-found: error | |
| node18-smoke: | |
| runs-on: blacksmith-4vcpu-ubuntu-2404 | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| persist-credentials: false | |
| - uses: oven-sh/setup-bun@v2 | |
| - name: Install Dependency | |
| run: bun install --frozen-lockfile | |
| - name: Build package | |
| run: bun run build | |
| # Node 18 goes on PATH only after the build: typescript >= 7 ships an | |
| # extensionless ESM bin/tsc that Node 18.17 cannot load. | |
| - name: Set up the oldest supported Node.js | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: '18.17.0' | |
| - name: Load every built module and run the offline commands | |
| run: node scripts/smoke-lib.js | |
| - name: Check late abort errors on the oldest supported Node.js | |
| run: >- | |
| node tests/fixtures/hermes-async-check.cjs | |
| '{"operation":"abort","modulePath":"./lib/utils/hermes-base.js"}' | |
| publish-dry-run: | |
| runs-on: blacksmith-4vcpu-ubuntu-2404 | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - uses: oven-sh/setup-bun@v2 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: '24.x' | |
| registry-url: 'https://registry.npmjs.org' | |
| - name: Install Dependency | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: bun install --frozen-lockfile | |
| - name: Prepare dry run publish version | |
| env: | |
| PUBLISH_DRY_RUN: 'true' | |
| PUBLISH_VERSION: 0.0.0-dry-run.${{ github.run_id }}.${{ github.run_attempt }} | |
| run: bun scripts/prepublish.ts | |
| - name: Dry run publish | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: npm publish --dry-run --access public --tag dry-run | |
| hermes-integration: | |
| name: hermes-hbc-${{ matrix.hbc }} | |
| runs-on: blacksmith-4vcpu-ubuntu-2404 | |
| timeout-minutes: 15 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - hbc: 96 | |
| package: react-native@0.77.3 | |
| directory: react-native | |
| executable: sdks/hermesc/linux64-bin/hermesc | |
| - hbc: 98 | |
| package: hermes-compiler@250829098.0.16 | |
| directory: hermes-compiler | |
| executable: hermesc/linux64-bin/hermesc | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| persist-credentials: false | |
| - uses: oven-sh/setup-bun@v2 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: '24.x' | |
| - run: bun install --frozen-lockfile | |
| - name: Install the pinned real compiler | |
| shell: bash | |
| env: | |
| COMPILER_PACKAGE: ${{ matrix.package }} | |
| COMPILER_DIRECTORY: ${{ matrix.directory }} | |
| COMPILER_EXECUTABLE: ${{ matrix.executable }} | |
| EXPECTED_HBC: ${{ matrix.hbc }} | |
| run: | | |
| set -euo pipefail | |
| root="$RUNNER_TEMP/hermes-tests/$COMPILER_DIRECTORY" | |
| mkdir -p "$root" | |
| archive=$(npm pack "$COMPILER_PACKAGE" --pack-destination "$RUNNER_TEMP" --silent) | |
| tar -xzf "$RUNNER_TEMP/$archive" --strip-components=1 -C "$root" \ | |
| "package/$COMPILER_EXECUTABLE" package/package.json | |
| export HERMESC="$root/$COMPILER_EXECUTABLE" | |
| test -x "$HERMESC" | |
| "$HERMESC" -version | |
| bun -e 'import {probeHbcVersion} from "./src/utils/hermes-base"; if (probeHbcVersion(process.env.HERMESC) !== Number(process.env.EXPECTED_HBC)) throw new Error("unexpected HBC version");' | |
| echo "HERMESC=$HERMESC" >> "$GITHUB_ENV" | |
| - name: Run real compiler and fallback regressions | |
| run: bun test tests/hermes-*.test.ts | |
| - name: Run seeded differential fuzzing | |
| run: bun run fuzz:hermes-base --rounds 50 --seed ${{ matrix.hbc }} --out "${{ runner.temp }}/hermes-fuzz" | |
| - name: Preserve failing fuzz cases | |
| if: failure() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: hermes-fuzz-hbc-${{ matrix.hbc }} | |
| path: ${{ runner.temp }}/hermes-fuzz | |
| if-no-files-found: ignore |