fix(build): scrape through Cloudflare WARP; bump Node to Krypton

.github/scripts/ci-warp.sh

@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+# Start caomingjun/warp and run commands in a container that shares its network.
+# Used in CI so scrape egress goes through Cloudflare WARP.
+set -euo pipefail
+
+job_scope="${GITHUB_JOB:-local}"
+run_scope="${GITHUB_RUN_ID:-$$}"
+WARP_CONTAINER="${WARP_CONTAINER:-warp-${job_scope}-${run_scope}}"
+WARP_IMAGE="${WARP_IMAGE:-"caomingjun/warp@sha256:905b91c3fe197a625611064ef0664f27e9ecdd0a30a91c4ae7046e06a2bf2643"}"
+NODE_IMAGE="${NODE_IMAGE:-node:krypton-bookworm}"
+WORKSPACE="${GITHUB_WORKSPACE:-$PWD}"
+CURL_OPTS=(--connect-timeout 5 --max-time 10)
+
+cleanup() {
+  docker rm -f "$WARP_CONTAINER" >/dev/null 2>&1 || true
+}
+
+start_warp() {
+  local -a docker_run=(
+    docker run -d --name "$WARP_CONTAINER"
+    --device-cgroup-rule 'c 10:200 rwm'
+    --cap-add NET_ADMIN
+    --cap-add MKNOD
+    --cap-add AUDIT_WRITE
+    --sysctl net.ipv6.conf.all.disable_ipv6=0
+    --sysctl net.ipv4.conf.all.src_valid_mark=1
+    -e WARP_SLEEP=2
+  )
+  if [[ -n "${WARP_PORTS-}" ]]; then
+    docker_run+=(-p "$WARP_PORTS")
+  fi
+  docker_run+=("$WARP_IMAGE")
+
+  docker rm -f "$WARP_CONTAINER" >/dev/null 2>&1 || true
+  "${docker_run[@]}" >/dev/null
+}
+
+wait_for_warp() {
+  for attempt in $(seq 1 45); do
+    if docker run --rm --network "container:${WARP_CONTAINER}" curlimages/curl:8.12.1 \
+      -sf "${CURL_OPTS[@]}" https://www.cloudflare.com/cdn-cgi/trace | grep -Eq 'warp=(on|plus)'; then
+      echo "WARP connected"
+      sleep 5
+      return 0
+    fi
+    echo "Waiting for WARP (${attempt}/45)..."
+    sleep 2
+  done
+
+  echo "WARP failed to connect"
+  docker logs --tail 80 "$WARP_CONTAINER" 2>&1 || true
+  return 1
+}
+
+run_with_warp() {
+  local -a docker_args=(
+    docker run --rm --network "container:${WARP_CONTAINER}"
+    -v "${WORKSPACE}:/app" -w /app
+    -v "${HOME}/.npm:/root/.npm"
+    -e HUSKY=0
+  )
+  local var
+  for var in CI CI_TIMEOUT LOCAL_TIMEOUT; do
+    if [[ -n "${!var:-}" ]]; then
+      docker_args+=(-e "${var}=${!var}")
+    fi
+  done
+  docker_args+=("$NODE_IMAGE" bash -lc "$*")
+
+  "${docker_args[@]}"
+}
+
+case "${1:-}" in
+  start)
+    start_warp
+    wait_for_warp
+    ;;
+  run)
+    shift
+    if [[ $# -lt 1 ]]; then
+      echo "usage: $0 run <shell command>" >&2
+      exit 1
+    fi
+    trap cleanup EXIT
+    start_warp
+    wait_for_warp
+    run_with_warp "$@"
+    ;;
+  *)
+    echo "usage: $0 start | run <shell command>" >&2
+    exit 1
+    ;;
+esac

.github/workflows/build.yaml

@@ -18,16 +18,10 @@ jobs:
         with:
           node-version-file: '.nvmrc'
       - run: npm ci
-      - name: Tailscale
-        uses: tailscale/github-action@780049a30b6ff5c378a9e7b389d15ece7a204888 # v4.1.3
-        with:
-          oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
-          oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}
-          tags: tag:ci
-      - run: npm run build
+      - name: Build and test through WARP
         env:
-          PROXY_URL: ${{ secrets.SOLVERR_PROXY_URL }}
-      - run: npm test
+          CI: true
+        run: .github/scripts/ci-warp.sh run 'npm run build && npm test'
       - run: git checkout -- package-lock.json #prevent package-lock.json-only feat changes
       - uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0
         with:

.github/workflows/static.yaml

@@ -49,16 +49,10 @@ jobs:
         with:
           path: node_modules/
           key: ${{ runner.os }}-${{ github.run_id }}${{ github.run_number }}
-      - name: Tailscale
-        uses: tailscale/github-action@780049a30b6ff5c378a9e7b389d15ece7a204888 # v4.1.3
-        with:
-          oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
-          oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}
-          tags: tag:ci
-      - name: Build
-        run: npm run build
+      - name: Build through WARP
         env:
-          PROXY_URL: ${{ secrets.SOLVERR_PROXY_URL }}
+          CI: true
+        run: .github/scripts/ci-warp.sh run 'npm run build'
       - name: Save Cache
         uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:

.nvmrc

@@ -1 +1 @@
-lts/jod
+lts/krypton