93 Commits

Include renames

Author	SHA1	Message	Date
Jordan Harband	882ed79ece	[Docs] threat model: document the mirror payload/metadata trust boundary ... Payloads (binaries, plus source tarballs that nvm compiles and runs at install time) are trusted by construction, since nvm exists to build and run them; parsed metadata (index.tab, SHASUMS, LTS codenames) is not, and must never reach a command evaluator, an awk/sed program body, or an unvalidated filesystem path. This records why the existing version-string and checksum hardening exists, and scopes a malicious payload from a configured mirror as out of scope: no privilege boundary is crossed.	2026-07-15 13:44:04 -07:00
Jordan Harband	d83da5d75b	[actions] add tests-alpine: a green fast suite and a musl-binary regression matrix ... The full suite cannot run on Alpine: the install-based suites pin ancient Node (0.10.x, io.js) that has no musl binary and cannot source-compile on musl. Run the fast unit suite instead (mirroring the ubuntu runner: non-root via su-exec, passwordless sudo, a PTY, no system node), plus a binary-only regression matrix that installs every (Alpine, Node) pair with a real unofficial musl binary via `nvm install -b`: x64 back to node 8.17.0 on old Alpine, arm64 at the v20.20.1/v22.21.1/v24.9.0 floors on modern Alpine.	2026-07-14 23:18:07 -07:00
Jordan Harband	c7d5d7748b	[Tests] run every remaining test file: exec bits, fixes; add check-exec to CI ... urchin only executes test files that have the executable bit, silently skipping the rest, and `npm run test:check-exec` would catch non-executable ones, but no workflow ran it - so several test files have never actually run. Make all of them executable, and fix the ones that were broken: - the io.js source-install tests, skipped since 2016: io.js requires python 2 and gcc <= 5, so they now skip on toolchains that can not compile it, and a new gcc:4.9-container CI job runs them unmodified - resolving, downloading, checksumming, and compiling io.js for real. New `fake source` variants exercise nvm's source pipeline everywhere - cache lookup, offline resolution, extraction, configure, make, make install, activation - via a tiny fake source tree seeded into the download cache and installed with `--offline`. Also strengthen the `nvm run | grep` assertions with `--silent`, since the version banner used to satisfy the grep even when the built binary could not run, and give the final assertions the `die` they always meant to call. - `nvm uninstall ... incorrect file permissions fails nicely`, parked in 2025 as failing: `sudo npm` resets PATH, so node 5's npm crashed under the system node. The permissions check only trips on files that are neither writable nor self-owned, and that precondition only needs `sudo touch` - not npm, jspm, or the network - so use that, against a fake installed version, and skip only where passwordless sudo does not exist. - `nvm install --offline`: `nvm ls | tail -1` always grabbed an alias line, never a version; use `nvm_ls` and skip its trailing `system <version>` line. - `nvm exec ... help should not parse`: in a BRE, `[options]` is a bracket expression, so the grep could never match node's literal `Usage: node [options]` output. - `nvm use ... nvmrc containing not installed version`: current output once again matches its expectations verbatim; no changes needed. Rewrite `test:check-exec` in POSIX sh - npm runs scripts with /bin/sh, which is dash on Ubuntu, where the previous `[[`/`$'\n'` bashisms would break; match by extension, so that filenames containing dots can not dodge the check; and disable git's `core.quotePath` mangling of the non-ASCII test filenames. Then wire it into the lint workflow.	2026-07-09 22:40:07 -07:00
Jordan Harband	59cf9a4ef6	[actions] nvm-install-test: turn the expected v0.40.0 failures green ... The two `v0.40.0` + `nvmrc` jobs fail by design (https://github.com/nvm-sh/nvm/issues/3405), but job-level `continue-on-error` still displays them as failures on every run, which reads like the contributor broke something. Tolerate failure only in the steps that exercise the bug, scoped to that matrix combination, and add a final step that fails the job when the expected failure did not happen - so those jobs are green exactly when v0.40.0 misbehaves as documented, and turn red as a signal to remove this handling if v0.40.0 ever starts passing. This also restores strict failure semantics to the passing `v0.40.0` + `no nvmrc` jobs, which the job-level `continue-on-error` was needlessly masking.	2026-07-09 17:01:32 -07:00
Jordan Harband	419ff4efec	[actions] update workflows	2026-06-29 17:33:31 -05:00
Jordan Harband	7079a5d61c	[actions] nodejs.org PR: sync the fork before branching, and surface create-ref errors	2026-06-04 14:52:41 -07:00
Jordan Harband	306f04a90a	[actions] nodejs.org PR: fix force boolean and grab the latest tag on dispatch ... The branch-reset step sent `force` as a string via `gh api -f "force=true"`, which the Git refs API rejects ("not a boolean", HTTP 422), failing the release run. Use `-F` so it is sent as a boolean. Also resolve the version from the latest `vX.Y.Z` tag (via the tags API) rather than `releases/latest`, so a manual `workflow_dispatch` with no input works even before the GitHub release object for a freshly pushed tag is published.	2026-06-04 09:54:01 -07:00
Jordan Harband	77fca77ddd	[actions] fall back to the canonical nvmrc submodule when a fork lacks its own ... Upstream's `.gitmodules` uses a relative submodule url (`../nvmrc.git`), which resolves against the superproject's origin: on a fork without its own `nvmrc` fork that is `<owner>/nvmrc`, which 404s and fails `actions/checkout` with `submodules: true`. Keep `submodules: true` (so a fork's own `nvmrc` is used when present), but mark checkout `continue-on-error` and, only when it failed, re-point the submodule at `nvm-sh/nvmrc` and update.	2026-06-04 09:22:04 -07:00
Jordan Harband	16f6ddc3d5	[actions] set per-job permissions in the nvm install workflow ... CodeQL (actions/missing-workflow-permissions) flagged the matrix, test, and finisher jobs of nvm-install-test.yml for not declaring permissions. Every other test workflow already sets least-privilege permissions per job; add them here to match: `contents: read` for the matrix and test jobs, `contents: none` for the no-op finisher.	2026-06-03 14:09:02 -07:00
Jordan Harband	c4d9239cbb	[actions] allow DockerHub's CloudFront CDN so image pulls aren't blocked ... harden-runner runs with `egress-policy: block`, and the allow-list only included `production.cloudflare.docker.com`. DockerHub serves image blobs from either its Cloudflare or its CloudFront CDN; when a pull was routed to CloudFront (`production.cloudfront.docker.com`) the connection was dropped, causing `error pulling image configuration: ... connect: connection refused` and exit 125 in the xenial, installation_node, and fast (httpbin) suites. Allow both CDNs.	2026-06-03 13:29:38 -07:00
Jordan Harband	dd13968c1e	[Tests] reduce CI flakiness from transient Docker registry failures ... Container-based suites and the `nvm_download` httpbin check hard-fail whenever DockerHub is briefly unreachable (observed: `dial tcp ...:443: connect: connection refused` while pulling images), even though the change under test is fine. This is unrelated to any test logic. - tests-xenial / tests-installation-node: retry the `docker pull` up to 5 times before `docker run`, mirroring the existing apt-get retry - `nvm_download` test: retry the httpbin pull and skip the auth-header checks (rather than fail) when the image cannot be pulled or run, and make cleanup tolerant of a missing container.	2026-06-03 13:12:31 -07:00
Salman Muin Kayser ChishtiandJordan Harband	e11221d0d9	[actions] upgrade vampire/setup-wsl ... Signed-off-by: Salman Muin Kayser Chishti <13schishti@gmail.com>	2026-02-05 09:21:01 +00:00
Jordan Harband	4c556a19b0	[actions] add workflow to update nodejs.org nvm version ... Ref: https://github.com/nodejs/nodejs.org/issues/8628	2026-02-19 21:27:42 -08:00
Jordan Harband	242d997da5	[actions] add permissions to GHA workflow	2026-01-29 13:08:52 -08:00
Jordan Harband	6d761baef8	[Tests] add retry logic	2026-01-27 20:59:30 -08:00
Jordan Harband	973840565e	[Tests] add a timeout	2026-01-27 18:09:39 -08:00
Jordan Harband	b1dd81097f	[actions] add a finisher to lint	2026-01-27 17:29:59 -08:00
Peter Dave HelloandJordan Harband	4d98875a3a	Migrate GitHub Copilot instructions to AGENTS.md and CLAUDE.md ... Move .github/copilot-instructions.md to AGENTS.md, and generalize the wording, so it will apply to Codex CLI, Cursor, OpenCode, RooCode, and many other AI coding agents. Also add CLAUDE.md as a symlink to AGENTS.md so Claude Code reads the same guidance. Copilot coding agent now supports AGENTS.md custom instructions, as more coding agents support it. Migrating from GitHub Copilot's custom instructions file to AGENTS.md will help developers leverage more and different coding agents than just GitHub Copilot. Reference: - https://agents.md/ - https://github.blog/changelog/2025-08-28-copilot-coding-agent-now-supports-agents-md-custom-instructions/	2025-09-12 00:05:38 +08:00
Jordan Harband	4c3edc5e56	[actions] migrate Travis CI tests to GitHub Actions	2026-01-27 10:31:07 -08:00
Ulises GascónandJordan Harband	a36448ffcd	[security] add security escalation policy	2025-09-15 14:33:37 +02:00
Padraic SlatteryandJordan Harband	34d6d5d6fe	[actions] update outdated GitHub Actions versions	2026-01-19 17:39:42 +01:00
Jordan Harband	80cc4cdd1b	[actions] fix WSL tests: properly handle Debian apt sources issue ... The Debian WSL image has stale apt sources pointing to ftp.debian.org which no longer hosts bullseye-backports. The previous fix ran sed after the first setup-wsl call, but that call already failed because additional-packages triggers apt-get update internally. For wsl_matrix (Debian, Ubuntu): - Ubuntu: install with additional-packages directly (no apt issue) - Debian: install without packages first, fix sources.list with sed, then run apt-get update/upgrade/install manually with retries - Exclude Debian and Ubuntu-20.04 --lts since node v24+ has exec format errors on WSL1 For wsl_matrix_unofficial (Alpine): - Remove the Debian-specific fix entirely (Alpine uses apk, not apt) See https://github.com/Vampire/setup-wsl/issues/76	2026-01-19 22:11:41 -08:00
Jordan Harband	630a01f2e0	[actions] fix workflow permissions; add codeQL	2025-12-03 12:05:43 -08:00
Jordan Harband	44a3cdb9b8	[actions] temporary fix for WSL issue ... See https://github.com/Vampire/setup-wsl/issues/76	2025-09-05 09:20:08 -07:00
Jordan Harband	34ace599a2	[actions] add new github asset domain to harden-runner	2025-09-05 13:19:27 -07:00
copilot-swe-agent[bot]andJordan Harband	9602f4f959	[meta] Add comprehensive .github/copilot-instructions.md for better AI code assistance ... This comprehensive guide helps GitHub Copilot better understand and navigate the nvm codebase by providing: - Complete architecture explanation of nvm's POSIX-compliant design across multiple shells - Detailed mapping of top-level commands to internal functions (install, use, ls, alias, etc.) - Comprehensive testing infrastructure guide using urchin framework - Shell environment setup for bash, zsh, dash, sh, and ksh - CI environment details for GitHub Actions and Travis CI - shellcheck setup and usage guidelines - Development best practices for POSIX compliance and multi-shell compatibility - Windows support via WSL2, Cygwin, and Git Bash - Complete internal function categorization and debugging techniques The documentation covers all aspects of the codebase to enable more accurate AI assistance when working with nvm's complex shell script architecture.	2025-07-02 17:12:44 +00:00
3 people	0215ef8203	[actions] Fix Cygwin workflow HOME variable and add debug output ... Co-authored-by: ljharb <45469+ljharb@users.noreply.github.com>	2025-07-03 19:43:14 +00:00
Jordan Harband	1aab8b2d5a	[meta] update security policy; add IRP	2025-06-23 16:11:48 -07:00
Jordan Harband	e5521cfd3c	[actions] release test needs git tags	2025-02-04 08:44:48 -08:00
Jessica WagantallandJordan Harband	14507f807f	[Tests] migrate installation_iojs test suite to GitHub Actions ... Remove equivalent TravisCI entries Signed-off-by: Jessica Wagantall <jwagantall@linuxfoundation.org>	2024-11-21 15:14:14 -08:00
Jessica WagantallandJordan Harband	6135555b40	[Tests] Migrate slow test suite from Travis CI ... Signed-off-by: Jessica Wagantall <jwagantall@linuxfoundation.org>	2024-11-14 16:11:04 -08:00
Jordan Harband	b9b0ea8020	[Fix] install-latest-npm: npm v11 is out	2024-12-16 10:03:18 -08:00
Jordan Harband	dae1427f7e	[actions] TOC: use latest LTS node	2024-11-22 21:44:36 -10:00
menaechmiandJordan Harband	3de0b15810	[Tests] run urchin tests on pull requests	2024-11-12 12:58:53 -06:00
Jordan Harband	ccf6d16017	[meta] disable blank issues	2024-11-04 15:07:16 +00:00
Jordan HarbandandGitHub	ba98270442	[meta] update issue template	2024-11-04 15:01:26 +00:00
Cheerag PatelandJordan Harband	9c9ff4bac0	[meta] Rename .github/ISSUE_TEMPLATE.md to .github/ISSUE_TEMPLATE/ISSUE_TEMPLATE.md ... Moved issue template into ISSUE_TEMPLATE folder	2024-10-30 14:03:05 -07:00
Jordan Harband	9a28dbd394	[actions] use node/install instead of node/run	2024-08-28 11:28:52 -07:00
Jordan Harband	0d53381666	[Tests] move sourcing suite to GHA	2024-08-22 13:30:55 -07:00
Jordan Harband	c31a867c46	[Fix] --save: avoid a conflict with set -e ... Fixes #3405.	2024-08-10 15:52:24 +12:00
Jordan Harband	c20db2ab86	[actions] improve default action permissions	2024-06-10 08:59:48 -07:00
Jordan Harband	1750b8d327	[actions] update vampire/setup-wsl action	2024-05-30 12:37:36 -07:00
Jordan Harband	811c039e2b	[actions] finisher tweaks	2024-03-08 22:28:53 -08:00
Raphael BoidolandJordan Harband	c24c3134a7	[actions] update action versions to use node 20	2024-02-18 21:56:53 +01:00
Jordan HarbandandGitHub	6c9cd2f2d1	[security] fix typo in threat model	2023-12-15 09:46:35 -08:00
Jordan Harband	99646ee600	[security] add threat model	2023-11-15 10:10:29 -08:00
Jordan Harband	6b15796f66	[Tests] temporarily allow cygwin tests to fail	2023-12-04 15:49:09 -08:00
Jordan Harband	3e51872b98	[Tests] temporarily allow WSL tests to fail ... See https://github.com/Vampire/setup-wsl/issues/50 / https://github.com/actions/runner-images/discussions/8791	2023-12-04 13:06:24 -08:00
Andrius SolopovasandJordan Harband	ef7fc2f2c0	[Fix] nvm_get_arch: proper value for alpine linux	2023-09-30 23:54:11 +01:00
Jordan Harband	b64e5474ea	[Tests] ensure windows tests install a node that actually works ... - disable failing Alpine tests - disable Ubuntu-18.04 tests on node 18+ - add Ubuntu-20.04 tests	2023-11-01 16:12:12 -07:00