Skip to content

Add force-mirror input to skip GitHub-hosted Node.js downloads - #1661

Open
KB1RMA wants to merge 2 commits into
actions:mainfrom
KB1RMA:christopher-snyder-lmig-force-mirror-input
Open

KB1RMA wants to merge 2 commits into
actions:mainfrom
KB1RMA:christopher-snyder-lmig-force-mirror-input

Conversation

@KB1RMA

@KB1RMA KB1RMA commented Nov 5, 2026 •

Copy link
Copy Markdown

Description:
This PR adds a force-mirror input for teams that must get Node.js from their own mirror.

Right now, mirror is only a fallback. setup-node checks GitHub first and uses the mirror only if the version isn't there. Some teams must get Node.js from their own mirror, and today they can't make setup-node do that.

When force-mirror is true, setup-node downloads official builds only from the mirror URL. It never downloads them from GitHub.

  • force-mirror defaults to false, so nothing changes for current users.
  • The version (including lts/*, latest, and check-latest) is looked up in the mirror's index.json.
  • If the mirror download fails, the step fails. It does not fall back to GitHub.
  • If mirror isn't set, setup-node logs an info message and downloads from https://nodejs.org.
  • Nightly, RC, and canary builds already use only the mirror, so they don't change.
- uses: actions/setup-node@v7
  with:
    node-version: 'lts/*'
    mirror: 'https://my-mirror.example.com'
    force-mirror: true

Related issue:
Fixes #1412

Check list:

  • Mark if documentation changes are required.
  • Mark if tests were added or updated to cover the changes.

Copilot

@KB1RMA KB1RMA changed the title Christopher snyder lmig force mirror input Add force-mirror input to skip GitHub-hosted Node.js downloads Nov 5, 2026
@KB1RMA
KB1RMA force-pushed the christopher-snyder-lmig-force-mirror-input branch 2 times, most recently from 76ae92e to f095933 Compare November 5, 2026 14:49
Comment on lines +180 to +189
if (
this.isLatestSyntax(this.nodeInfo.versionSpec) ||
this.nodeInfo.checkLatest
) {
core.info('Attempt to resolve the latest version from mirror...');
nodeJsVersions ??= await this.getNodeJsVersions();
this.nodeInfo.versionSpec = (
await this.findVersionInDist(nodeJsVersions)
).replace(/^v/, '');
core.info(`Resolved as '${this.nodeInfo.versionSpec}'`);

@KB1RMA KB1RMA Nov 5, 2026 •

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Question for maintainers: Should check-latest fail when the mirror is down?

In the normal flow, if check-latest can't fetch the manifest, the action logs it and moves on. In force-mirror mode, a failed fetch of the mirror's index.json fails the step. That seems right for "mirror only", but it is a difference.

Comment thread src/main.ts Resolved
run: __tests__/verify-node.sh "${{ matrix.node-version }}"
shell: bash

force-mirror:

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Question for maintainers: I'm adding a lot of jobs here. A total of 9. We should have an integration test, but do we want to limit which OS's this runs on potentially?

@KB1RMA
KB1RMA force-pushed the christopher-snyder-lmig-force-mirror-input branch from f095933 to bf442c8 Compare November 5, 2026 15:07
Comment on lines +192 to +198
const cachedPath = this.findVersionInHostedToolCacheDirectory();
if (cachedPath) {
core.info(`Found in cache @ ${cachedPath}`);
this.addToolPath(cachedPath);
await this.verifyNodeVersion(cachedPath);
return;
}

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Quesiton for maintainers: With force-mirror: true, the action is still using a matching version from the runner's tool cache.

Should force-mirror skip the cache in this case? I tend to think we want to keep the cache usage

When force-mirror is true, setup-node skips the actions/node-versions
manifest and downloads official builds only from the mirror (or
nodejs.org). LTS aliases, latest syntax, and check-latest are resolved
from the mirror's index.json. If the mirror download fails, the step
fails instead of falling back to GitHub.

Adds unit tests for force-mirror failure, parsing, and nightly behavior,
plus e2e coverage in the versions workflow.

Fixes actions#1412

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@KB1RMA
KB1RMA force-pushed the christopher-snyder-lmig-force-mirror-input branch from a04b2fc to ad205b6 Compare November 5, 2026 16:16
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@KB1RMA
KB1RMA marked this pull request as ready for review November 5, 2026 18:18
@KB1RMA
KB1RMA requested a review from a team as a code owner November 5, 2026 18:18

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Node distributions not pulled from authenticated mirrors

1 participant