[v16.x] tools: automate update openssl v16

[marco-ippolito]

PR-URL: https://github.com/nodejs/node/pull/48377 Reviewed-By: Rafael Gonzaga [email protected] Reviewed-By: Antoine du Hamel [email protected] Reviewed-By: Paolo Insogna [email protected]

[nodejs-github-bot]

Review requested:

• [ ] @nodejs/security-wg

[marco-ippolito]

I think we need another action for 1.1.1. IIRC scheduled workflows only run in the main branch. So I believe we need to have this automate update v16 on main.

cc: @nodejs/actions

The action update-openssl.yml checks out on v16.x-staging and executes the update-openssl.sh and opens a pr. I think it will work

[RafaelGSS]

I think we need another action for 1.1.1. IIRC scheduled workflows only run in the main branch. So I believe we need to have this automate update v16 on main. cc: @nodejs/actions

The action update-openssl.yml checks out on v16.x-staging and executes the update-openssl.sh and opens a pr. I think it will work

but it won't run in the v16.x-staging branch. It will run only on main. @richardlau I remember you've mentioned it somewhere, right?

[richardlau]

GitHub Actions cron scheduler only runs workflow files from the default branch (e.g. main for this repository), which means it would be running https://github.com/nodejs/node/blob/main/.github/workflows/update-openssl.yml. However https://github.com/nodejs/node/pull/48377 added a subjob that checks out the v16.x-staging branch https://github.com/nodejs/node/blob/198affc63973805ce5102d246f6b7822be57f5fc/.github/workflows/update-openssl.yml#L61-L68 so I think https://github.com/nodejs/node/pull/48500#pullrequestreview-1487172956 should already be taken care of once this PR lands to update the scripts that the workflow in main references for openssl-v1-update.

[richardlau]

Given that Node.js 16 reaches End-of-Life in a few weeks (11 September 2023), I'm going to close this as won't land on v16.x.