CI workflow refactor

[mertssmnoglu]

Call for Contribution, Coveralls Page

This PR is created for making the CI pipeline stable again for future developments. The changes are very similar to express's CI pipeline to make sure expressjs organization follows the same or similar CI conditions.

Inspired by expressjs/express#5599 and compression ci

Changes Summary

• Add specific lint job for the CI
• Set default action permission to contents: read
• Use SHA hashes for action versions
• Cover all available nodejs releases
  • nodejs 0.8, 0.10, 0.12
  • iojs 1.8, 2.5, 3.3
  • nodejs 4 to 24
• Prefer ubuntu-latest as a base runner.
• Use capitalized run names. like Lint, Test and Coverage

---

zizmor report

 INFO zizmor: skipping impostor-commit: can't run without a GitHub API token INFO zizmor: skipping ref-confusion: can't run without a GitHub API token
INFO zizmor: skipping known-vulnerable-actions: can't run without a GitHub API token INFO zizmor: skipping forbidden-uses: audit not configured INFO zizmor: skipping stale-action-refs: can't run without a GitHub API token
INFO audit: zizmor: 🌈 completed .github/workflows/ci.yml
No findings to report. Good job!

Questions ❓

Do we want manual workflow triggering?

• ci: allow manual triggering of workflow express#6515
• https://github.com/expressjs/vhost/pull/52/files#diff-b803fcb7f17ed9235f1e5cb1fcd2f5d3b2838429d4368ae4c57ce4436577f03fR9-R13

[bjohansebas]

Is using latest version of ubuntu is a good practice? What about using ubuntu-24.04?

Yes, it's a good practice, especially in open source, since it reduces our maintenance burden. GitHub has secure machines, so there's no risk.

Should we remove deprecated node (and io.js) versions from the test matrix?

Nope, in Express there's another CI (see https://github.com/expressjs/express/blob/4.x/.github/workflows/iojs.yml), which covers support for io.js

[mertssmnoglu]

Should we remove deprecated node (and io.js) versions from the test matrix?

Nope, in Express there's another CI (see https://github.com/expressjs/express/blob/4.x/.github/workflows/iojs.yml), which covers support for io.js

I didn't notice this, thanks you so much.
14e2be0 This is basically a copy of the express 4.x iojs ci with package read permission and version fixings.

[mertssmnoglu]

iojs CI is failing when the step runs 'npm install'
Can it be a dependency problem?

npm install

npm ERR! Linux 6.11.0-1014-azure
npm ERR! argv "/home/runner/.nvm/versions/io.js/v1.8.4/bin/iojs""/home/runner/.nvm/versions/io.js/v1.8.4/bin/npm""install"
npm ERR! node v1.8.4
npm ERR! npm v2.9.0
npm ERR! path /home/runner/work/vhost/vhost/node_modules/eslint-plugin-markdown/node_modules/mdast-util-from-markdown/node_modules/@types/mdast/package.json
npm ERR! code ENOTDIR
npm ERR! errno -20
npm ERR! syscall open
npm ERR! ENOTDIR: not a directory, open '/home/runner/work/vhost/vhost/node_modules/eslint-plugin-markdown/node_modules/mdast-util-from-markdown/node_modules/@types/mdast/package.json'
npm ERR! npm ERR! If you need help, you may report this error at:
npm ERR!<https://github.com/npm/npm/issues>
npm ERR! Please include the following file with any support request:
npm ERR! /home/runner/work/vhost/vhost/npm-debug.log
Error: Process completed with exit code 236.

• https://github.com/expressjs/vhost/actions/runs/15098406183/job/42436447933?pr=52
• https://github.com/expressjs/vhost/actions/runs/15098406183/job/42436448111?pr=52
• https://github.com/expressjs/vhost/actions/runs/15098406183/job/42436448191?pr=52

---

I removed 'npm install' steps because vhost has 0 dependency. 423ade6

[bjohansebas]

I removed 'npm install' steps because vhost has 0 dependency

We still need to install the devDependencies to run the tests. So that command is necessary

We need to remove the linter for those versions :), like it’s being done in compression (https://github.com/expressjs/compression/blob/5f13b148d2a1a2daaa8647e03592214bb240bf18/.github/workflows/ci.yml#L204).

[mertssmnoglu]

We need to remove the linter for those versions :), like it’s being done in compression (https://github.com/expressjs/compression/blob/5f13b148d2a1a2daaa8647e03592214bb240bf18/.github/workflows/ci.yml#L204).

Okay. So this CI is similar to compress

I was thinking about using 2 separate workflow like in express but I think ci.yml will cover all versions. If everything goes well I can remove iojs.yml from this PR.

(ℹ️ I couldn't test it locally with act because it's ubuntu images are a bit different)

[UlisesGascon]

We are almost there! Great work @mertssmnoglu!

Seems like we need to fix the artifacts (ref):

Run actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
With the provided path, there will be 2 files uploaded
Artifact name is valid!
Root directory input is valid!
Error: Failed to CreateArtifact: Received non-retryable error: Failed request: (409) Conflict: an artifact with this name already exists on the workflow run

[UlisesGascon]

I solved the conflicts that I generated when I merged #50 👍

[mertssmnoglu]

We are almost there! Great work @mertssmnoglu!

Seems like we need to fix the artifacts (ref):

Run actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
With the provided path, there will be 2 files uploaded
Artifact name is valid!
Root directory input is valid!
Error: Failed to CreateArtifact: Received non-retryable error: Failed request: (409) Conflict: an artifact with this name already exists on the workflow run

I found a solution(walkaround) actions/upload-artifact#480 (comment)
0568f26

[mertssmnoglu]

Do you want manual workflow triggering? @bjohansebas

• ci: allow manual triggering of workflow express#6515
• https://github.com/expressjs/vhost/pull/52/files#diff-b803fcb7f17ed9235f1e5cb1fcd2f5d3b2838429d4368ae4c57ce4436577f03fR9-R13

Added b79cf04

[bjohansebas]

LGTM, thanks @mertssmnoglu !

[UlisesGascon]

LGTM!

[mertssmnoglu]

We're finally there! It's a great pleasure for me to see a pipeline without any failing step.