GeezerVison

Review requested:

• @nodejs/actions
• @nodejs/security-wg

for 3.0 stream at least, quictls isn't using releases to manage new versions so the gh api call probably needs to look more like:

edit: adding link to comment quictls/openssl#114 (comment) for context

NEW_VERSION=$(gh api repos/quictls/openssl/tags -q '.[].name|select(contains("openssl-3.0"))|ltrimstr("openssl-")' | grep quic | head -n1)

so that we query the tags from quictls instead of releases

I suspect a similar pattern is needed for the 1.x stream also

for 3.0 stream at least, quictls isn't using releases to manage new versions so the gh api call probably needs to look more like:

NEW_VERSION=$(gh api repos/quictls/openssl/tags -q '.[].name|select(contains("openssl-3.0"))|ltrimstr("openssl-")' | grep quic | head -n1)

so that we query the tags from quictls instead of releases

I suspect a similar pattern is needed for the 1.x stream also

I guess you refactored it to use fetch instead, so the logic needs modification from what I suggested, but the principal of checking for tags rather than releases is my main point. The fetch also results in non-quic and quic tag names, so more logic may be necessary to filter on those.

@baparham could you check again now? also I think this doesnt apply for v1, I dont see v1 in https://api.github.com/repos/quictls/openssl/tags

They are deleting the releases, per that comment from @richsalz, so I don't think that's correct for the 1.1 stream. What's odd is I see tags here https://github.com/quictls/openssl/tags but not in the gh api call, like you pointed out.

Perhaps they are just remnants of previous "releases" and not actual tags or something weird. Either way, I suspect that the releases route won't succeed next time they update the versions.

The GH API is paginated and only returns a subset of results. For me at least the tags for 1.1.1 are on https://api.github.com/repos/quictls/openssl/tags?page=4.

Alternatively git/matching-refs API, e.g. https://api.github.com/repos/quictls/openssl/git/matching-refs/tags/OpenSSL_1_1_1 will return tags beginning with "OpenSSL_1_1_1".

The GH API is paginated and only returns a subset of results. For me at least the tags for 1.1.1 are on https://api.github.com/repos/quictls/openssl/tags?page=4.

Alternatively git/matching-refs API, e.g. https://api.github.com/repos/quictls/openssl/git/matching-refs/tags/OpenSSL_1_1_1 will return tags beginning with "OpenSSL_1_1_1".

I need a facepalm reaction on github comments, haha. I did not catch that it was paginated, thanks for pointing that out! the matching_refs endpoint is probably better to use then.

I've used matching ref but its a bit hacky wdyt?

Landed in 51ca71c

This commit does not land cleanly on and will need manual backport in case we want it in v18.

@marco-ippolito is the backport needed for v18 and v20? I assume no, right? We just need to revert it for main to not land it on v21.

I dont think it is needed since it will only run on main and then we can backport security patches. we can revert it since we dont support 16 anymore