tools: update OpenSSL on the selected branch

.github/workflows/update-openssl.yml

@@ -12,58 +12,60 @@ permissions:
 jobs:
   openssl-update:
     if: github.repository == 'nodejs/node'
+    name: OpenSSL update (${{ github.ref_name }})
     # Cannot use ubuntu-slim here because the update script requires Docker
     runs-on: ubuntu-latest
+    concurrency:
+      group: openssl-update-${{ github.ref_name }}
+      cancel-in-progress: false
+    env:
+      TARGET_BRANCH: ${{ github.ref_name }}
+      DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
+      - name: Setup Git config
+        run: |
+          git config user.name "Node.js GitHub Bot"
+          git config user.email "github-bot@iojs.org"
+          if [ "$TARGET_BRANCH" != "$DEFAULT_BRANCH" ]; then
+            echo "PR_TITLE_PREFIX=[${TARGET_BRANCH%-staging}] " >> "$GITHUB_ENV"
+          fi
       - name: Check and download new OpenSSL version
         run: |
-          ./tools/dep_updaters/update-openssl.sh download > temp-output
-          cat temp-output
-          tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
-          rm temp-output
+          ./tools/dep_updaters/update-openssl.sh download \
+          | tee /dev/stderr \
+          | tail -n1 \
+          | sed -n '/^NEW_VERSION=/p' >> "$GITHUB_ENV"
+        shell: bash
         env:
           GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
-      - name: Create PR with first commit
-        id: create-pull-request
+      - name: Commit OpenSSL sources
         if: env.NEW_VERSION
-        uses: gr2m/create-or-update-pull-request-action@b65137ca591da0b9f43bad7b24df13050ea45d1b  # v1.10.1
-        # Creates a PR with the new OpenSSL source code committed
-        env:
-          GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
-        with:
-          author: Node.js GitHub Bot <github-bot@iojs.org>
-          body: This is an automated update of OpenSSL to ${{ env.NEW_VERSION }}.
-          branch: actions/tools-update-openssl  # Custom branch *just* for this Action.
-          commit-message: 'deps: upgrade openssl sources to openssl-${{ env.NEW_VERSION }}'
-          labels: dependencies, openssl
-          title: 'deps: update OpenSSL to ${{ env.NEW_VERSION }}'
-          path: deps/openssl
-          update-pull-request-title-and-body: true
-          draft: true
+        run: |
+          git add -A deps/openssl/openssl
+          git commit -m "deps: upgrade openssl sources to openssl-$NEW_VERSION"
       - name: Regenerate platform specific files
         if: env.NEW_VERSION
         run: |
           sudo apt update && sudo apt install -y nasm libtext-template-perl
           ./tools/dep_updaters/update-openssl.sh regenerate
         env:
           GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
-      - name: Add second commit
-        # Adds a second commit to the PR with the generated platform-dependent files
+      - name: Commit generated files
         if: env.NEW_VERSION
-        uses: gr2m/create-or-update-pull-request-action@b65137ca591da0b9f43bad7b24df13050ea45d1b  # v1.10.1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
+        run: |
+          git add -A deps/openssl
+          git commit -m "deps: update archs files for openssl-$NEW_VERSION"
+      - name: Create or update PR
+        if: env.NEW_VERSION
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1  # v8.1.1
         with:
+          token: ${{ secrets.GH_USER_TOKEN }}
           author: Node.js GitHub Bot <github-bot@iojs.org>
-          branch: actions/tools-update-openssl  # Custom branch *just* for this Action.
-          commit-message: 'deps: update archs files for openssl-${{ env.NEW_VERSION }}'
-          path: deps/openssl
-      - name: Mark PR as ready for review
-        if: env.NEW_VERSION
-        env:
-          GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
-          PR_ID: ${{ steps.create-pull-request.outputs.pull-request-number }}
-        run: gh --repo "$GITHUB_REPOSITORY" pr ready "$PR_ID"
+          committer: Node.js GitHub Bot <github-bot@iojs.org>
+          body: This is an automated update of OpenSSL to ${{ env.NEW_VERSION }} for ${{ github.ref_name }}.
+          branch: actions/${{ github.ref_name != github.event.repository.default_branch && format('{0}/', github.ref_name) || '' }}tools-update-openssl
+          labels: dependencies, openssl
+          title: '${{ env.PR_TITLE_PREFIX }}deps: update OpenSSL to ${{ env.NEW_VERSION }}'

doc/contributing/maintaining/maintaining-openssl.md

@@ -30,39 +30,49 @@ NASM version 2.11.08
 
 ## 1. Obtain and extract new OpenSSL sources
 
-Get a new source from <https://github.com/openssl/openssl/tree/openssl-3.0.16>
-and copy all files into `deps/openssl/openssl`. Then add all files and commit
-them. (The link above, and the branch, will change with each new OpenSSL
-release).
+Get the sources for the desired `openssl-<version>` tag from
+<https://github.com/openssl/openssl> and copy all files into
+`deps/openssl/openssl`. Then add all files and commit them.
 
 ```bash
 git clone https://github.com/openssl/openssl
 cd openssl
+git checkout openssl-<version>
 cd ../node/deps/openssl
 rm -rf openssl
 cp -R ../../../openssl openssl
-rm -rf openssl/.git*
+rm -rf openssl/.git
 git add --all openssl
 git commit openssl
 ```
 
 ```text
-deps: upgrade openssl sources to openssl-3.0.16
+deps: upgrade openssl sources to openssl-<version>
 
 This updates all sources in deps/openssl/openssl by:
     $ git clone git@github.com:openssl/openssl.git
     $ cd openssl
-    $ git checkout openssl-3.0.16
+    $ git checkout openssl-<version>
     $ cd ../node/deps/openssl
     $ rm -rf openssl
     $ cp -R ../../../openssl openssl
-    $ rm -rf openssl/.git*
+    $ rm -rf openssl/.git
     $ git add --all openssl
     $ git commit openssl
 ```
 
 ## 2. Execute `make` in `deps/openssl/config` directory
 
+Fix up 32-bit Windows assembler directives. This will allow the commits to be
+cherry-picked to older release lines that still provide binaries on 32-bit Windows.
+
+```bash
+# Edit deps/openssl/openssl/crypto/perlasm/x86asm.pl changing
+# #ifdef/#endif to %ifdef/%endif for nasm on 32-bit Windows.
+# See: https://github.com/nodejs/node/pull/43603#issuecomment-1170670844
+# Reference: https://github.com/openssl/openssl/issues/18459
+```
+
 Use `make` to regenerate all platform dependent files in
 `deps/openssl/config/archs/`:
 
@@ -75,17 +85,6 @@ make -C deps/openssl/config clean
 make -C deps/openssl/config
 ```
 
-Fix up 32-bit Windows assembler directives. This will allow the commits to be
-cherry-picked to older release lines that still provide binaries on 32-bit Windows.
-
-```bash
-make -C deps/openssl/config clean
-# Edit deps/openssl/openssl/crypto/perlasm/x86asm.pl changing
-# #ifdef to %ifdef to make it compatible to nasm on 32-bit Windows.
-# See: https://github.com/nodejs/node/pull/43603#issuecomment-1170670844
-# Reference: https://github.com/openssl/openssl/issues/18459
-```
-
 ## 3. Check diffs
 
 Check diffs to ensure updates are right. Even if there are no updates in openssl
@@ -98,36 +97,36 @@ git diff -- deps/openssl
 
 _Note_: On Windows, OpenSSL Configure generates a `makefile` that can be
 used for the `nmake` command. The `make` command in step 2 (above) uses
-`Makefile_VC-WIN64A` and `Makefile_VC-WIN32` that are manually
-created. When source files or build options are updated in Windows,
-it needs to change these two Makefiles by hand. If you are not sure,
+`Makefile_VC-WIN64A`, `Makefile_VC-WIN32`, and `Makefile_VC-WIN64-ARM`,
+which are manually created. When source files or build options are updated in
+Windows, these Makefiles need to be changed by hand. If you are not sure,
 please ask @shigeki for details.
 
-## 4. Commit and make test
+## 4. Commit and test
 
 Update all architecture dependent files. Do not forget to git add or remove
 files if they are changed before committing:
 
 ```bash
-git add deps/openssl/config/archs
-git add deps/openssl/openssl
+git add -A deps/openssl/config/archs
+git add -A deps/openssl/openssl
 git commit
 ```
 
 The commit message can be written as (with the openssl version set
 to the relevant value):
 
 ```text
-deps: update archs files for openssl-3.0.16
+deps: update archs files for openssl-<version>
 
 After an OpenSSL source update, all the config files need to be
 regenerated and committed by:
     $ make -C deps/openssl/config
-    $ git add deps/openssl/config/archs
-    $ git add deps/openssl/openssl
+    $ git add -A deps/openssl/config/archs
+    $ git add -A deps/openssl/openssl
     $ git commit
 ```
 
-Finally, build Node.js and run the tests.
+Finally, build Node.js with the bundled OpenSSL and run the tests.
 
 [update-openssl-action]: ../../../.github/workflows/update-openssl.yml