feat: add --allow-env option for environment variable permissions

.github/CODEOWNERS

@@ -83,15 +83,6 @@
 /src/node_http2* @nodejs/http2 @nodejs/net
 /src/node_mem* @nodejs/http2
 
-# quic
-
-/deps/ngtcp2/* @nodejs/quic
-/doc/api/quic.md @nodejs/quic
-/lib/quic.js @nodejs/quic
-/lib/internal/quic/* @nodejs/quic
-/src/quic/* @nodejs/quic
-/test/parallel/test-quic-* @nodejs/quic
-
 # modules, including loaders
 
 /doc/api/esm.md @nodejs/loaders

.github/workflows/close-stale-feature-requests.yml

@@ -0,0 +1,56 @@
+name: Close stale feature requests
+on:
+  workflow_dispatch:
+  schedule:
+    # Run every day at 1:00 AM UTC.
+    - cron: 0 1 * * *
+
+# yamllint disable rule:empty-lines
+env:
+  CLOSE_MESSAGE: >
+    There has been no activity on this feature request
+    and it is being closed. If you feel closing this issue is not the
+    right thing to do, please leave a comment.
+
+
+    For more information on how the project manages
+    feature requests, please consult the
+    [feature request management document](https://github.com/nodejs/node/blob/HEAD/doc/contributing/feature-request-management.md).
+
+  WARN_MESSAGE: >
+    There has been no activity on this feature request for
+    5 months. To help maintain relevant open issues, please
+    add the https://github.com/nodejs/node/labels/never-stale
+    label or close this issue if it should be closed. If not,
+    the issue will be automatically closed 6 months after the
+    last non-automated comment.
+
+    For more information on how the project manages
+    feature requests, please consult the
+    [feature request management document](https://github.com/nodejs/node/blob/HEAD/doc/contributing/feature-request-management.md).
+# yamllint enable
+
+permissions:
+  contents: read
+
+jobs:
+  stale:
+    permissions:
+      issues: write  # for actions/stale to close stale issues
+      pull-requests: write  # for actions/stale to close stale PRs
+    if: github.repository == 'nodejs/node'
+    runs-on: ubuntu-slim
+    steps:
+      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f  # v10.2.0
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          days-before-stale: 180
+          days-before-close: 30
+          stale-issue-label: stale
+          close-issue-message: ${{ env.CLOSE_MESSAGE }}
+          stale-issue-message: ${{ env.WARN_MESSAGE }}
+          only-labels: feature request
+          exempt-issue-labels: never-stale
+          # max requests it will send per run to the GitHub API before it deliberately exits to avoid hitting API rate limits
+          operations-per-run: 500
+          remove-stale-when-updated: true

.github/workflows/close-stale-pull-requests.yml

@@ -0,0 +1,59 @@
+name: Close stale pull requests
+on:
+  workflow_dispatch:
+    inputs:
+      endDate:
+        description: stop processing PRs after this date
+        required: false
+        type: string
+
+# yamllint disable rule:empty-lines
+env:
+  CLOSE_MESSAGE: >
+    This pull request was opened more than a year ago and there has
+    been no activity in the last 6 months. We value your contribution
+    but since it has not progressed in the last 6 months it is being
+    closed. If you feel closing this pull request is not the right thing
+    to do, please leave a comment.
+
+  WARN_MESSAGE: >
+    This pull request was opened more than a year ago and there has
+    been no activity in the last 5 months. We value your contribution
+    but since it has not progressed in the last 5 months it is being
+    marked stale and will be closed if there is no progress in the
+    next month. If you feel that is not the right thing to do please
+    comment on the pull request.
+# yamllint enable
+
+permissions:
+  contents: read
+
+jobs:
+  stale:
+    permissions:
+      pull-requests: write  # for actions/stale to close stale PRs
+    if: github.repository == 'nodejs/node'
+    runs-on: ubuntu-slim
+    steps:
+      - name: Set default end date which is 1 year ago
+        run: echo "END_DATE=$(date --date='525600 minutes ago' --rfc-2822)"  >> "$GITHUB_ENV"
+      - name: if date set in event override the default end date
+        env:
+          END_DATE_INPUT_VALUE: ${{ github.event.inputs.endDate }}
+        if: ${{ github.event.inputs.endDate != '' }}
+        run: echo "END_DATE=$END_DATE_INPUT_VALUE"  >> "$GITHUB_ENV"
+      - uses: mhdawson/stale@453d6581568dc43dbe345757f24408d7b451c651  # PR to add support for endDate
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          end-date: ${{ env.END_DATE }}
+          days-before-issue-stale: -1
+          days-before-issue-close: -1
+          days-before-stale: 150
+          days-before-close: 30
+          stale-issue-label: stale
+          close-issue-message: ${{ env.CLOSE_MESSAGE }}
+          stale-issue-message: ${{ env.WARN_MESSAGE }}
+          exempt-pr-labels: never-stale
+          # max requests it will send per run to the GitHub API before it deliberately exits to avoid hitting API rate limits
+          operations-per-run: 500
+          remove-stale-when-updated: true

.github/workflows/daily-wpt-fyi.yml

@@ -96,48 +96,6 @@ jobs:
             echo "WPT_REPORT=$(pwd)/out/wpt/wptreport.json" >> $GITHUB_ENV
           fi
 
-      # undici WPT Runner
-      - name: Set env.UNDICI_VERSION
-        if: ${{ env.WPT_REPORT != '' }}
-        run: |
-          UNDICI_VERSION=$(jq -r '.version' < deps/undici/src/package.json)
-          echo "UNDICI_VERSION=v$UNDICI_VERSION" >> $GITHUB_ENV
-          if [ "${UNDICI_VERSION%%.*}" -ge 7 ]; then
-            echo "UNDICI_WPT=current" >> $GITHUB_ENV
-          else
-            echo "UNDICI_WPT=legacy" >> $GITHUB_ENV
-          fi
-      # Checkout composite actions from the default branch since the
-      # version-specific checkout above overwrites .github/actions/
-      - name: Checkout undici WPT actions
-        if: ${{ env.WPT_REPORT != '' }}
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
-        with:
-          sparse-checkout: |
-            .github/actions/undici-wpt-current
-            .github/actions/undici-wpt-legacy
-          sparse-checkout-cone-mode: false
-          persist-credentials: false
-          path: _wpt_actions
-          clean: false
-      - name: Place undici WPT actions
-        if: ${{ env.WPT_REPORT != '' }}
-        run: |
-          mkdir -p .github/actions
-          cp -r _wpt_actions/.github/actions/undici-wpt-* .github/actions/
-      - name: Run undici WPT (current)
-        if: ${{ env.UNDICI_WPT == 'current' }}
-        uses: ./.github/actions/undici-wpt-current
-        with:
-          undici-version: ${{ env.UNDICI_VERSION }}
-          wpt-report: ${{ env.WPT_REPORT }}
-      - name: Run undici WPT (legacy)
-        if: ${{ env.UNDICI_WPT == 'legacy' }}
-        uses: ./.github/actions/undici-wpt-legacy
-        with:
-          undici-version: ${{ env.UNDICI_VERSION }}
-          wpt-report: ${{ env.WPT_REPORT }}
-
       # Upload artifacts
       - name: Clone report for upload
         if: ${{ env.WPT_REPORT != '' }}

.github/workflows/post-release.yml

@@ -20,10 +20,9 @@ jobs:
     steps:
       - name: Trigger update-links workflow on nodejs/release-cloudflare-worker
         run: |
-          gh workflow run update-links.yml --repo nodejs/release-cloudflare-worker -f version=$VERSION
+          gh workflow run update-links.yml --repo nodejs/release-cloudflare-worker
         env:
           GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
-          VERSION: ${{ inputs.version || github.event.release.tag_name }}
 
       - name: Trigger create-release-post workflow on nodejs/nodejs.org
         run: |

.github/workflows/test-linux.yml

@@ -77,14 +77,9 @@ jobs:
       - name: Environment Information
         run: npx envinfo
       - name: Build
-        working-directory: node
-        run: make build-ci -j4 V=1 CONFIG_FLAGS="--error-on-warn --v8-enable-temporal-support"
+        run: make -C node build-ci -j4 V=1 CONFIG_FLAGS="--error-on-warn --v8-enable-temporal-support"
       - name: Test
-        working-directory: node
-        run: make test-ci -j1 V=1 TEST_CI_ARGS="-p actions --measure-flakiness 9"
-      - name: Ensure running tests did not cause any change in the tree
-        working-directory: node
-        run: git add -A && git diff --name-only --exit-code --staged
+        run: make -C node test-ci -j1 V=1 TEST_CI_ARGS="-p actions --measure-flakiness 9"
       - name: Re-run test in a folder whose name contains unusual chars
         run: |
           mv node "$DIR"

.github/workflows/test-shared.yml

@@ -196,7 +196,7 @@ jobs:
             --arg ccache "${NIX_SCCACHE:-null}" \
             --arg devTools '[]' \
             --arg benchmarkTools '[]' \
-            ${{ endsWith(matrix.system, '-darwin') && '--arg withAmaro false --arg withLief false --arg withSQLite false --arg withFFI false --arg extraConfigFlags ''["--without-inspector" "--without-node-options"]'' \' || '\' }}
+            ${{ endsWith(matrix.system, '-darwin') && '--arg withAmaro false --arg withLief false --arg withSQLite false --arg extraConfigFlags ''["--without-inspector" "--without-node-options"]'' \' || '\' }}
             --run '
                 make -C "$TAR_DIR" run-ci -j4 V=1 TEST_CI_ARGS="-p actions --measure-flakiness 9 --skip-tests=$CI_SKIP_TESTS"
             ' "$TAR_DIR/shell.nix"

.github/workflows/tools.yml

@@ -26,7 +26,6 @@ on:
           - histogram
           - icu
           - inspector_protocol
-          - libffi
           - libuv
           - llhttp
           - minimatch
@@ -162,14 +161,6 @@ jobs:
               cat temp-output
               tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
               rm temp-output
-          - id: libffi
-            subsystem: deps
-            label: dependencies, ffi
-            run: |
-              ./tools/dep_updaters/update-libffi.sh > temp-output
-              cat temp-output
-              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
-              rm temp-output
           - id: libuv
             subsystem: deps
             label: dependencies