Safely run user code in isolated VMs, add isolation tests & result serializer option

.github/scripts/write-test-summary.mjs

@@ -0,0 +1,22 @@
+import fs from 'node:fs';
+
+const report = fs.existsSync('test-output.txt')
+	? fs.readFileSync('test-output.txt', 'utf8').trimEnd()
+	: 'No test report was generated.';
+
+const passed = process.env.TEST_OUTCOME === 'success';
+
+const summary = [
+	`## ${passed ? '✅ Tests passed' : '❌ Tests failed'}`,
+	'',
+	'<details open>',
+	'<summary>Test results</summary>',
+	'',
+	'```text',
+	report,
+	'```',
+	'</details>',
+	'',
+].join('\n');
+
+fs.appendFileSync(process.env.GITHUB_STEP_SUMMARY, summary);

.github/workflows/publish-to-npm.yml

@@ -6,20 +6,56 @@ on:
       - v*
   workflow_dispatch:
 
+permissions:
+  contents: read
+  # required for GitHub to issue the OIDC identity npm uses for Trusted Publishing
+  id-token: write
+
 jobs:
   publish-to-npm:
     runs-on: ubuntu-latest
+    environment: publish
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
+      - name: Check out repository
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
         with:
-          cache: npm
-          node-version: 'lts/*'
-          registry-url: 'https://registry.npmjs.org'
-      - name: Install Dependencies
-        run: npm ci
+          node-version-file: .nvmrc
+          registry-url: https://registry.npmjs.org
+          package-manager-cache: false
+
+      - name: Verify release version
+        run: >-
+          node -e "
+          const { version } = require('./package.json');
+          const expectedTag = \`v\${version}\`;
+          if (process.env.GITHUB_REF_NAME !== expectedTag) {
+            throw new Error(\`Tag \${process.env.GITHUB_REF_NAME} does not match package version \${expectedTag}\`);
+          }
+          "
+
+      - name: Install dependencies
+        run: |
+          npm ci --ignore-scripts
+          # isolated-vm requires its lifecycle scripts to build the native addon.
+          npm rebuild isolated-vm
+
+      - name: Test
+        run: npm test
+
+      - name: Build
+        run: npm run build
+
+      - name: Verify package contents
+        run: npm pack --dry-run
+
       - name: Publish
-        run: npm publish
-        continue-on-error: true
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          # git tags like `v1.0.0-rc.0` will be tagged as `next` version in NPM instead of `latest`
+          NPM_DIST_TAG: ${{ contains(github.ref_name, '-') && 'next' || 'latest' }}
+          run: npm publish --tag "$NPM_DIST_TAG"
+        run: npm publish

.github/workflows/test.yml

@@ -8,25 +8,51 @@ on:
     branches:
       - develop
     tags:
-      - v*
+      - 'v*'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
+      - name: Check out repository
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
         with:
-          node-version: 'lts/*'
+          node-version-file: .nvmrc
           cache: npm
+          cache-dependency-path: package-lock.json
+
       - name: Install Dependencies
-        run: npm ci
+        run: |
+          npm ci --ignore-scripts
+          # isolated-vm requires its lifecycle scripts to build the native addon.
+          npm rebuild isolated-vm
+
       - name: Test
-        run: npm test
+        id: test
+        env:
+          NO_COLOR: 1
+        run: npm run test:ci
+
+      - name: Add Test Summary
+        if: always()
+        env:
+          TEST_OUTCOME: ${{ steps.test.outcome }}
+        run: node .github/scripts/write-test-summary.mjs
+
       - name: Upload Test Results
         if: always()
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v7
         with:
-          name: Test Results
-          path: ${{ github.workspace }}/test-report
+          name: test-results-${{ github.run_id }}
+          path: test-output.txt
+          if-no-files-found: warn
+          retention-days: 14

.gitignore

@@ -4,4 +4,5 @@ ts-edsl.iml
 *.tsbuildinfo
 .DS_Store
 build
-docs
+docs
+test-output.txt

.nvmrc

@@ -0,0 +1 @@
+v24.18.0

README.md

@@ -14,10 +14,12 @@ A simple way to safely run user code written in Typescript.
 
 ## Requirements
 
-NodeJS >= 13.0.0
+NodeJS >= 24.0.0
 
-Because we are transpiling and running the typescript code as modules in a vm, we need to flag on the vm modules flag at runtime with
-```node --experimental-vm-modules```
+Because this library uses `isolated-vm`, node.js must be started with the `--no-node-snapshot` flag when this module is used:
+```
+node --no-node-snapshot
+```
 
 ## Example