Merge main into deno-bundle-esbuild

Author: nathanwhit

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/vscode/devcontainers/rust:1-bullseye
+FROM mcr.microsoft.com/devcontainers/rust:1
 
 # Install cmake
 RUN apt-get update \

.github/workflows/ci.generate.ts

@@ -5,7 +5,7 @@ import { stringify } from "jsr:@std/yaml@^0.221/stringify";
 // Bump this number when you want to purge the cache.
 // Note: the tools/release/01_bump_crate_versions.ts script will update this version
 // automatically via regex, so ensure that this line maintains this format.
-const cacheVersion = 55;
+const cacheVersion = 57;
 
 const ubuntuX86Runner = "ubuntu-24.04";
 const ubuntuX86XlRunner = "ubuntu-24.04-xl";
@@ -88,7 +88,7 @@ export DEBIAN_FRONTEND=noninteractive
 sudo apt-get -qq remove --purge -y man-db  > /dev/null 2> /dev/null
 # Remove older clang before we install
 sudo apt-get -qq remove \
-  'clang-12*' 'clang-13*' 'clang-14*' 'clang-15*' 'clang-16*' 'clang-17*' 'clang-18*' 'llvm-12*' 'llvm-13*' 'llvm-14*' 'llvm-15*' 'llvm-16*' 'lld-12*' 'lld-13*' 'lld-14*' 'lld-15*' 'lld-16*' 'lld-17*' 'lld-18*' > /dev/null 2> /dev/null
+  'clang-12*' 'clang-13*' 'clang-14*' 'clang-15*' 'clang-16*' 'clang-17*' 'clang-18*' 'llvm-12*' 'llvm-13*' 'llvm-14*' 'llvm-15*' 'llvm-16*' 'llvm-17*' 'llvm-18*' 'lld-12*' 'lld-13*' 'lld-14*' 'lld-15*' 'lld-16*' 'lld-17*' 'lld-18*' > /dev/null 2> /dev/null
 
 # Install clang-XXX, lld-XXX, and debootstrap.
 echo "deb http://apt.llvm.org/jammy/ llvm-toolchain-jammy-${llvmVersion} main" |
@@ -105,7 +105,7 @@ ${installPkgsCommand} || echo 'Failed. Trying again.' && sudo apt-get clean && s
 clang-${llvmVersion} -c -o /tmp/memfd_create_shim.o tools/memfd_create_shim.c -fPIC
 
 echo "Decompressing sysroot..."
-wget -q https://github.com/denoland/deno_sysroot_build/releases/download/sysroot-20241030/sysroot-\`uname -m\`.tar.xz -O /tmp/sysroot.tar.xz
+wget -q https://github.com/denoland/deno_sysroot_build/releases/download/sysroot-20250207/sysroot-\`uname -m\`.tar.xz -O /tmp/sysroot.tar.xz
 cd /
 xzcat /tmp/sysroot.tar.xz | sudo tar -x
 sudo mount --rbind /dev /sysroot/dev
@@ -445,6 +445,7 @@ const ci = {
             job: "test",
             profile: "release",
             use_sysroot: true,
+            skip_pr: true,
           }, {
             ...Runners.macosX86,
             job: "lint",
@@ -606,13 +607,19 @@ const ci = {
         },
         {
           name: "Install macOS aarch64 lld",
+          env: {
+            GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}",
+          },
           run: [
             "./tools/install_prebuilt.js ld64.lld",
           ].join("\n"),
           if: `matrix.os == 'macos' && matrix.arch == 'aarch64'`,
         },
         {
           name: "Install rust-codesign",
+          env: {
+            GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}",
+          },
           run: [
             "./tools/install_prebuilt.js rcodesign",
             "echo $GITHUB_WORKSPACE/third_party/prebuilt/mac >> $GITHUB_PATH",
@@ -639,6 +646,9 @@ const ci = {
         {
           name: "Install benchmark tools",
           if: "matrix.job == 'bench'",
+          env: {
+            GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}",
+          },
           run: [
             installBenchTools,
           ].join("\n"),
@@ -689,8 +699,11 @@ const ci = {
         {
           name: "lint.js",
           if: "matrix.job == 'lint'",
+          env: {
+            GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}",
+          },
           run:
-            "deno run --allow-write --allow-read --allow-run --allow-net ./tools/lint.js",
+            "deno run --allow-write --allow-read --allow-run --allow-net --allow-env ./tools/lint.js",
         },
         {
           name: "jsdoc_checker.js",
@@ -935,6 +948,7 @@ const ci = {
             'gsutil -h "Cache-Control: public, max-age=3600" cp ./target/release/*.symcache gs://dl.deno.land/canary/$(git rev-parse HEAD)/',
             "echo ${{ github.sha }} > canary-latest.txt",
             'gsutil -h "Cache-Control: no-cache" cp canary-latest.txt gs://dl.deno.land/canary-$(rustc -vV | sed -n "s|host: ||p")-latest.txt',
+            "rm canary-latest.txt gha-creds-*.json",
           ].join("\n"),
         },
         {
@@ -986,6 +1000,20 @@ const ci = {
           ].join("\n"),
           run: "cargo test --release --locked --features=panic-trace",
         },
+        {
+          name: "Ensure no git changes",
+          if: "matrix.job == 'test'",
+          run: [
+            'if [[ -n "$(git status --porcelain)" ]]; then',
+            'echo "❌ Git working directory is dirty. Ensure `cargo test` is not modifying git tracked files."',
+            'echo ""',
+            'echo "📋 Status:"',
+            "git status",
+            'echo ""',
+            "exit 1",
+            "fi",
+          ].join("\n"),
+        },
         {
           name: "Configure hosts file for WPT",
           if: "matrix.wpt",
@@ -999,10 +1027,10 @@ const ci = {
             DENO_BIN: "./target/debug/deno",
           },
           run: [
-            "deno run -A --lock=tools/deno.lock.json --config tests/config/deno.json\\",
-            "        ./tests/wpt/wpt.ts setup",
-            "deno run -A --lock=tools/deno.lock.json --config tests/config/deno.json\\",
-            '         ./tests/wpt/wpt.ts run --quiet --binary="$DENO_BIN"',
+            "deno run -RWNE --allow-run --lock=tools/deno.lock.json --config tests/config/deno.json \\",
+            "    ./tests/wpt/wpt.ts setup",
+            "deno run -RWNE --allow-run --lock=tools/deno.lock.json --config tests/config/deno.json --unsafely-ignore-certificate-errors \\",
+            '    ./tests/wpt/wpt.ts run --quiet --binary="$DENO_BIN"',
           ].join("\n"),
         },
         {
@@ -1012,13 +1040,10 @@ const ci = {
             DENO_BIN: "./target/release/deno",
           },
           run: [
-            "deno run -A --lock=tools/deno.lock.json --config tests/config/deno.json\\",
-            "         ./tests/wpt/wpt.ts setup",
-            "deno run -A --lock=tools/deno.lock.json --config tests/config/deno.json\\",
-            "         ./tests/wpt/wpt.ts run --quiet --release         \\",
-            '                            --binary="$DENO_BIN"          \\',
-            "                            --json=wpt.json               \\",
-            "                            --wptreport=wptreport.json",
+            "deno run -RWNE --allow-run --lock=tools/deno.lock.json --config tests/config/deno.json \\",
+            "    ./tests/wpt/wpt.ts setup",
+            "deno run -RWNE --allow-run --lock=tools/deno.lock.json --config tests/config/deno.json --unsafely-ignore-certificate-errors \\",
+            '    ./tests/wpt/wpt.ts run --quiet --release --binary="$DENO_BIN" --json=wpt.json --wptreport=wptreport.json',
           ].join("\n"),
         },
         {

.github/workflows/ci.yml

@@ -123,10 +123,11 @@ jobs:
             profile: debug
           - os: linux
             arch: aarch64
-            runner: ubicloud-standard-16-arm
+            runner: '${{ (!contains(github.event.pull_request.labels.*.name, ''ci-full'') && (github.event_name == ''pull_request'')) && ''ubuntu-24.04'' || ''ubicloud-standard-16-arm'' }}'
             job: test
             profile: release
             use_sysroot: true
+            skip: '${{ !contains(github.event.pull_request.labels.*.name, ''ci-full'') && (github.event_name == ''pull_request'') }}'
           - os: macos
             arch: x86_64
             runner: macos-13
@@ -187,8 +188,8 @@ jobs:
             ~/.cargo/registry/index
             ~/.cargo/registry/cache
             ~/.cargo/git/db
-          key: '55-cargo-home-${{ matrix.os }}-${{ matrix.arch }}-${{ hashFiles(''Cargo.lock'') }}'
-          restore-keys: '55-cargo-home-${{ matrix.os }}-${{ matrix.arch }}-'
+          key: '57-cargo-home-${{ matrix.os }}-${{ matrix.arch }}-${{ hashFiles(''Cargo.lock'') }}'
+          restore-keys: '57-cargo-home-${{ matrix.os }}-${{ matrix.arch }}-'
         if: '!(matrix.skip)'
       - uses: dsherret/rust-toolchain-file@v1
         if: '!(matrix.skip)'
@@ -268,7 +269,7 @@ jobs:
           # to complete.
           sudo apt-get -qq remove --purge -y man-db  > /dev/null 2> /dev/null
           # Remove older clang before we install
-          sudo apt-get -qq remove   'clang-12*' 'clang-13*' 'clang-14*' 'clang-15*' 'clang-16*' 'clang-17*' 'clang-18*' 'llvm-12*' 'llvm-13*' 'llvm-14*' 'llvm-15*' 'llvm-16*' 'lld-12*' 'lld-13*' 'lld-14*' 'lld-15*' 'lld-16*' 'lld-17*' 'lld-18*' > /dev/null 2> /dev/null
+          sudo apt-get -qq remove   'clang-12*' 'clang-13*' 'clang-14*' 'clang-15*' 'clang-16*' 'clang-17*' 'clang-18*' 'llvm-12*' 'llvm-13*' 'llvm-14*' 'llvm-15*' 'llvm-16*' 'llvm-17*' 'llvm-18*' 'lld-12*' 'lld-13*' 'lld-14*' 'lld-15*' 'lld-16*' 'lld-17*' 'lld-18*' > /dev/null 2> /dev/null
 
           # Install clang-XXX, lld-XXX, and debootstrap.
           echo "deb http://apt.llvm.org/jammy/ llvm-toolchain-jammy-19 main" |
@@ -285,7 +286,7 @@ jobs:
           clang-19 -c -o /tmp/memfd_create_shim.o tools/memfd_create_shim.c -fPIC
 
           echo "Decompressing sysroot..."
-          wget -q https://github.com/denoland/deno_sysroot_build/releases/download/sysroot-20241030/sysroot-`uname -m`.tar.xz -O /tmp/sysroot.tar.xz
+          wget -q https://github.com/denoland/deno_sysroot_build/releases/download/sysroot-20250207/sysroot-`uname -m`.tar.xz -O /tmp/sysroot.tar.xz
           cd /
           xzcat /tmp/sysroot.tar.xz | sudo tar -x
           sudo mount --rbind /dev /sysroot/dev
@@ -348,9 +349,13 @@ jobs:
           rm ~/.curlrc || true
         if: '!(matrix.skip) && (matrix.os == ''macos'')'
       - name: Install macOS aarch64 lld
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
         run: ./tools/install_prebuilt.js ld64.lld
         if: '!(matrix.skip) && (matrix.os == ''macos'' && matrix.arch == ''aarch64'')'
       - name: Install rust-codesign
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
         run: |-
           ./tools/install_prebuilt.js rcodesign
           echo $GITHUB_WORKSPACE/third_party/prebuilt/mac >> $GITHUB_PATH
@@ -372,6 +377,8 @@ jobs:
         if: '!(matrix.skip)'
       - name: Install benchmark tools
         if: '!(matrix.skip) && (matrix.job == ''bench'')'
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
         run: ./tools/install_prebuilt.js wrk hyperfine
       - name: Restore cache build output (PR)
         uses: actions/cache/restore@v4
@@ -384,7 +391,7 @@ jobs:
             !./target/*/*.zip
             !./target/*/*.tar.gz
           key: never_saved
-          restore-keys: '55-cargo-target-${{ matrix.os }}-${{ matrix.arch }}-${{ matrix.profile }}-${{ matrix.job }}-'
+          restore-keys: '57-cargo-target-${{ matrix.os }}-${{ matrix.arch }}-${{ matrix.profile }}-${{ matrix.job }}-'
       - name: Apply and update mtime cache
         if: '!(matrix.skip) && (!startsWith(github.ref, ''refs/tags/''))'
         uses: ./.github/mtime_cache
@@ -406,7 +413,9 @@ jobs:
         run: deno run ./tools/verify_pr_title.js "$PR_TITLE"
       - name: lint.js
         if: '!(matrix.skip) && (matrix.job == ''lint'')'
-        run: deno run --allow-write --allow-read --allow-run --allow-net ./tools/lint.js
+        env:
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: deno run --allow-write --allow-read --allow-run --allow-net --allow-env ./tools/lint.js
       - name: jsdoc_checker.js
         if: '!(matrix.skip) && (matrix.job == ''lint'')'
         run: deno run --allow-read --allow-env --allow-sys ./tools/jsdoc_checker.js
@@ -572,6 +581,7 @@ jobs:
           gsutil -h "Cache-Control: public, max-age=3600" cp ./target/release/*.symcache gs://dl.deno.land/canary/$(git rev-parse HEAD)/
           echo ${{ github.sha }} > canary-latest.txt
           gsutil -h "Cache-Control: no-cache" cp canary-latest.txt gs://dl.deno.land/canary-$(rustc -vV | sed -n "s|host: ||p")-latest.txt
+          rm canary-latest.txt gha-creds-*.json
       - name: Autobahn testsuite
         if: |-
           !(matrix.skip) && ((matrix.os == 'linux' && matrix.arch != 'aarch64') &&
@@ -606,6 +616,9 @@ jobs:
           github.repository == 'denoland/deno' &&
           !startsWith(github.ref, 'refs/tags/'))))
         run: cargo test --release --locked --features=panic-trace
+      - name: Ensure no git changes
+        if: '!(matrix.skip) && (matrix.job == ''test'')'
+        run: "if [[ -n \"$(git status --porcelain)\" ]]; then\necho \"❌ Git working directory is dirty. Ensure `cargo test` is not modifying git tracked files.\"\necho \"\"\necho \"\U0001F4CB Status:\"\ngit status\necho \"\"\nexit 1\nfi"
       - name: Configure hosts file for WPT
         if: '!(matrix.skip) && (matrix.wpt)'
         run: ./wpt make-hosts-file | sudo tee -a /etc/hosts
@@ -615,22 +628,19 @@ jobs:
         env:
           DENO_BIN: ./target/debug/deno
         run: |-
-          deno run -A --lock=tools/deno.lock.json --config tests/config/deno.json\
-                  ./tests/wpt/wpt.ts setup
-          deno run -A --lock=tools/deno.lock.json --config tests/config/deno.json\
-                   ./tests/wpt/wpt.ts run --quiet --binary="$DENO_BIN"
+          deno run -RWNE --allow-run --lock=tools/deno.lock.json --config tests/config/deno.json \
+              ./tests/wpt/wpt.ts setup
+          deno run -RWNE --allow-run --lock=tools/deno.lock.json --config tests/config/deno.json --unsafely-ignore-certificate-errors \
+              ./tests/wpt/wpt.ts run --quiet --binary="$DENO_BIN"
       - name: Run web platform tests (release)
         if: '!(matrix.skip) && (matrix.wpt && matrix.profile == ''release'')'
         env:
           DENO_BIN: ./target/release/deno
         run: |-
-          deno run -A --lock=tools/deno.lock.json --config tests/config/deno.json\
-                   ./tests/wpt/wpt.ts setup
-          deno run -A --lock=tools/deno.lock.json --config tests/config/deno.json\
-                   ./tests/wpt/wpt.ts run --quiet --release         \
-                                      --binary="$DENO_BIN"          \
-                                      --json=wpt.json               \
-                                      --wptreport=wptreport.json
+          deno run -RWNE --allow-run --lock=tools/deno.lock.json --config tests/config/deno.json \
+              ./tests/wpt/wpt.ts setup
+          deno run -RWNE --allow-run --lock=tools/deno.lock.json --config tests/config/deno.json --unsafely-ignore-certificate-errors \
+              ./tests/wpt/wpt.ts run --quiet --release --binary="$DENO_BIN" --json=wpt.json --wptreport=wptreport.json
       - name: Upload wpt results to dl.deno.land
         continue-on-error: true
         if: |-
@@ -770,7 +780,7 @@ jobs:
             !./target/*/gn_root
             !./target/*/*.zip
             !./target/*/*.tar.gz
-          key: '55-cargo-target-${{ matrix.os }}-${{ matrix.arch }}-${{ matrix.profile }}-${{ matrix.job }}-${{ github.sha }}'
+          key: '57-cargo-target-${{ matrix.os }}-${{ matrix.arch }}-${{ matrix.profile }}-${{ matrix.job }}-${{ github.sha }}'
   wasm:
     name: build wasm32
     needs:

.github/workflows/node_compat_test.yml

@@ -26,6 +26,10 @@ jobs:
         uses: denoland/setup-deno@v2
         with:
           deno-version: canary
+      - name: Install Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: 3.11
       - name: Authenticate with Google Cloud
         uses: google-github-actions/auth@v2
         with:
@@ -38,7 +42,7 @@ jobs:
         with:
           project_id: denoland
       - name: Run tests
-        run: deno -A --config tests/config/deno.json tests/node_compat/run_all_test_unmodified.ts
+        run: deno -A tools/node_compat_tests.js
       - name: Gzip the report
         run: gzip tests/node_compat/report.json
       - name: Upload the report to dl.deno.land
@@ -55,6 +59,10 @@ jobs:
           submodules: true
       - name: Setup Deno
         uses: denoland/setup-deno@v2
+      - name: Install Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: 3.11
       - name: Authenticate with Google Cloud
         uses: google-github-actions/auth@v2
         with:

.github/workflows/post_publish.yml

@@ -31,4 +31,4 @@ jobs:
       - name: Upload version file to dl.deno.land
         run: |
           echo ${GITHUB_REF#refs/*/} > release-latest.txt
-          deno run --allow-net tools/release/version_greater_latest.ts ${GITHUB_REF#refs/*/} && gsutil -h "Cache-Control: no-cache" cp release-latest.txt gs://dl.deno.land/release-latest.txt
+          (deno run --allow-net tools/release/version_greater_latest.ts ${GITHUB_REF#refs/*/} || exit 0) && gsutil -h "Cache-Control: no-cache" cp release-latest.txt gs://dl.deno.land/release-latest.txt

.gitignore

@@ -1,6 +1,7 @@
 *.orig
 *.pyc
 *.swp
+*.symcache
 .env
 
 /.cargo_home/