mirror of
https://github.com/nvm-sh/nvm.git
synced 2026-09-10 00:00:08 +08:00
Jordan Harband
a5ff3a32f4
The Ubuntu entries were pinned but `Debian` and `Alpine` were floating aliases, so what those jobs tested drifted whenever the action updated. Every line now carries a pin and the newest release setup-wsl offers for it: Debian 12 and 13, Ubuntu 18.04, 20.04 and 24.04, Alpine 3.17 and 3.23. `Alpine-3.17` is the image the unofficial jobs already ran, named explicitly. Debian's pin is 12 rather than 11 because `Debian` and `Debian-11` share a floating `aka.ms/wsl-debian-gnulinux` redirect and so cannot be held still at all, where `Debian-12` is an immutable salsa.debian.org artifact. The Debian-only steps key off `startsWith`, so both Debian entries take the same path and moving a pin will not strand them. There is no floating "newest" name to use instead: `kali-linux` is the only unversioned distribution left, and setup-wsl's own CI disables `additional-packages` on it. The newest only moves when the action's major does, so the `uses:` ref is the thing to keep current. Which is the other half of this: move that ref from v6 to v7. v6 is a dead major, five months stale at v6.1.0 with no v6.2.0 and v7.0.0 tagged the next day, so new distributions will only ever appear on v7 and later. v7's only removals are the deprecated bare `Debian` and `Alpine`, which pinning has already stopped using, and every name here is valid on both. It also drops the Node.js 20 deprecation warning each WSL job currently emits, and it tightens two pins that v6 left floating: Ubuntu 20.04 moves from `aka.ms/wslubuntu2004` to a 20.04.6 image on releases.ubuntu.com, and 24.04 to a 24.04.4 one. Six of the seven platforms are now immutable artifacts; Ubuntu 18.04 predates the format and still redirects through aka.ms. Choosing a supported Debian also settles the 404s that had been failing every Debian job: bullseye left LTS on 2026-08-31 and its security suite is between homes, with `security.debian.org` still publishing an index whose pool is being pruned and `archive.debian.org` carrying no `debian-security` for bullseye yet. bookworm is on live mirrors, so `ca-certificates` is current again, which matters for a job whose whole purpose is to fetch nvm and node over TLS. To keep a pin working once its release ages out in turn, derive sources.list from the image's own codename and list every layout a release passes through: main and security move to the archive on separate schedules, and the security suite is renamed to `<codename>/updates` on the way. `apt-get update` discards whichever entries 404, and where an index outlives its pool we fall back once to main alone. Debian 13 moved to deb822, so clear both formats first and leave what we write as the only thing apt reads. Drop the blanket `apt-get upgrade` with it: it fetched 77 packages the test never uses, and `apt-get install` already takes the newest version any working mirror offers.
