[v16.x] tools: automate update openssl v16

[marco-ippolito]

PR-URL: #48377
Reviewed-By: Rafael Gonzaga rafael.nunu@hotmail.com
Reviewed-By: Antoine du Hamel duhamelantoine1995@gmail.com
Reviewed-By: Paolo Insogna paolo@cowtech.it

[nodejs-github-bot]

Review requested:

• @nodejs/security-wg

[RafaelGSS]

I think we need another action for 1.1.1. IIRC scheduled workflows only run in the main branch. So I believe we need to have this automate update v16 on main.

cc: @nodejs/actions

[marco-ippolito]

I think we need another action for 1.1.1. IIRC scheduled workflows only run in the main branch. So I believe we need to have this automate update v16 on main.

cc: @nodejs/actions

The action update-openssl.yml checks out on v16.x-staging and executes the update-openssl.sh and opens a pr. I think it will work

[RafaelGSS]

I think we need another action for 1.1.1. IIRC scheduled workflows only run in the main branch. So I believe we need to have this automate update v16 on main.
cc: @nodejs/actions

The action update-openssl.yml checks out on v16.x-staging and executes the update-openssl.sh and opens a pr. I think it will work

but it won't run in the v16.x-staging branch. It will run only on main. @richardlau I remember you've mentioned it somewhere, right?

[richardlau]

GitHub Actions cron scheduler only runs workflow files from the default branch (e.g. main for this repository), which means it would be running https://github.com/nodejs/node/blob/main/.github/workflows/update-openssl.yml. However #48377 added a subjob that checks out the v16.x-staging branch

node/.github/workflows/update-openssl.yml

Lines 61 to 68 in 198affc

	openssl-v1-update:
	if: github.repository == 'nodejs/node'
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
	with:
	persist-credentials: false
	ref: v16.x-staging

so I think #48500 (review) should already be taken care of once this PR lands to update the scripts that the workflow in main references for openssl-v1-update.

[RafaelGSS]

LGTM. Sorry, I missed the openssl-v1-update.

[richardlau]

Given that Node.js 16 reaches End-of-Life in a few weeks (11 September 2023), I'm going to close this as won't land on v16.x.