permission: clamp Worker grants to parent for explicit execArgv

SEMVER-MAJOR: when the parent has the Permission Model enabled, a Worker
with explicit execArgv (including []) cannot obtain wider permission-related
grants than the parent.

Clamp EnvironmentOptions, then rebuild exec_argv_out so CreateEnvironment
enables Permission with the clamped allow lists (fixes empty execArgv).

Documented in permissions and worker_threads APIs.

Signed-off-by: yunshingng <yunshingng25@gmail.com>

Author: yunshingng

.github/workflows/auto-start-ci.yml

@@ -1,6 +1,3 @@
-# This action uses the following secrets:
-#   JENKINS_USER: GitHub user whose Jenkins token is defined below
-#   JENKINS_TOKEN: Jenkins token, to be used to start CI
 name: Auto Start CI
 
 on:
@@ -39,13 +36,11 @@ jobs:
                   -t '{{ range . }}{{ .number }} {{ end }}' \
                   --limit 5)" >> "$GITHUB_OUTPUT"
         env:
-          GH_TOKEN: ${{ github.token }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   start-ci:
     permissions:
-      checks: read
       contents: read
       pull-requests: write
-      statuses: read
     needs: get-prs-for-ci
     if: needs.get-prs-for-ci.outputs.numbers != ''
     runs-on: ubuntu-slim
@@ -64,15 +59,16 @@ jobs:
           ncu-config set token "$GH_TOKEN"
           ncu-config set jenkins_token "$JENKINS_TOKEN"
           ncu-config set owner "$GITHUB_REPOSITORY_OWNER"
-          ncu-config set repo "${GITHUB_REPOSITORY#*/}"
+          ncu-config set repo "$(echo "$GITHUB_REPOSITORY" | cut -d/ -f2)"
         env:
           USERNAME: ${{ secrets.JENKINS_USER }}
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ secrets.GH_USER_TOKEN }}
           JENKINS_TOKEN: ${{ secrets.JENKINS_TOKEN }}
 
       - name: Start the CI
         run: |
           curl -fsSL "https://github.com/${GITHUB_REPOSITORY}/raw/${GITHUB_SHA}/tools/actions/start-ci.sh" \
           | sh -s -- ${{ needs.get-prs-for-ci.outputs.numbers }}
         env:
-          GH_TOKEN: ${{ github.token }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}

.github/workflows/benchmark.yml

@@ -141,7 +141,7 @@ jobs:
             --arg devTools '[]' \
             --arg benchmarkTools '[]' \
             --run '
-                make build-ci -j4 V=1
+                make -j4 V=1
             '
 
       - name: Run benchmark

.github/workflows/build-tarball.yml

@@ -23,7 +23,6 @@ on:
       - tools/eslint-rules/**
       - tools/eslint/**
       - tools/lint-md/**
-      - tools/nix/**
       - typings/**
       - vcbuild.bat
       - .**
@@ -53,7 +52,6 @@ on:
       - tools/eslint-rules/**
       - tools/eslint/**
       - tools/lint-md/**
-      - tools/nix/**
       - typings/**
       - vcbuild.bat
       - .**

.github/workflows/commit-queue.yml

@@ -52,7 +52,7 @@ jobs:
                   jq -r -s 'reduce .[] as $pr ([]; if index($pr) then . else . + [$pr] end) | join(" ")')
           echo "candidates=$candidates" >> "$GITHUB_OUTPUT"
         env:
-          GH_TOKEN: ${{ github.token }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   commitQueue:
     needs: get_candidate_prs
     if: needs.get_candidate_prs.outputs.candidates != ''
@@ -63,14 +63,18 @@ jobs:
       statuses: read
     runs-on: ubuntu-slim
     steps:
+      # Install dependencies
       - name: Install Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
           node-version: ${{ env.NODE_VERSION }}
-
       - name: Install @node-core/utils
         run: npm install -g @node-core/utils
 
+      - name: Set variables
+        run: |
+          echo "REPOSITORY=$(echo "$GITHUB_REPOSITORY" | cut -d/ -f2)" >> "$GITHUB_ENV"
+
       - name: Configure @node-core/utils
         run: |
           # Keep the config outside the workspace so checkout does not remove it.
@@ -79,7 +83,7 @@ jobs:
           ncu-config --global set username "$USERNAME"
           ncu-config --global set token "$GH_TOKEN"
           ncu-config --global set jenkins_token "$JENKINS_TOKEN"
-          ncu-config --global set repo "${GITHUB_REPOSITORY#*/}"
+          ncu-config --global set repo "${REPOSITORY}"
           ncu-config --global set owner "${GITHUB_REPOSITORY_OWNER}"
         env:
           USERNAME: ${{ secrets.JENKINS_USER }}
@@ -98,6 +102,8 @@ jobs:
             metadata="${RUNNER_TEMP}/metadata-${pr}.json"
             output="${RUNNER_TEMP}/metadata-${pr}.txt"
             if git node metadata "$pr" \
+                    --owner "$GITHUB_REPOSITORY_OWNER" \
+                    --repo "$REPOSITORY" \
                     --readme "$readme" \
                     --json > "$metadata" 2> "$output"; then
               metadata_status=0
@@ -165,9 +171,7 @@ jobs:
       - name: Start the Commit Queue
         if: steps.get_mergeable_prs.outputs.numbers != ''
         run: |
-          git config --local user.email "github-bot@iojs.org"
-          git config --local user.name "Node.js GitHub Bot"
           ncu-config set token "$GH_TOKEN"
-          ./tools/actions/commit-queue.sh ${{ steps.get_mergeable_prs.outputs.numbers }}
+          ./tools/actions/commit-queue.sh "${GITHUB_REPOSITORY_OWNER}" "${REPOSITORY}" ${{ steps.get_mergeable_prs.outputs.numbers }}
         env:
           GH_TOKEN: ${{ secrets.GH_USER_TOKEN }}

.github/workflows/coverage-windows.yml

@@ -23,7 +23,6 @@ on:
       - tools/eslint-rules/**
       - tools/eslint/**
       - tools/lint-md/**
-      - tools/nix/**
       - typings/**
       - .**
       - '!.github/workflows/coverage-windows.yml'
@@ -50,7 +49,6 @@ on:
       - tools/eslint-rules/**
       - tools/eslint/**
       - tools/lint-md/**
-      - tools/nix/**
       - typings/**
       - .**
       - '!.github/workflows/coverage-windows.yml'

.github/workflows/nix-changes.yml

@@ -11,12 +11,10 @@ on:
       - v[0-9]+.x
     paths:
       - '**.nix'
-      - tools/nix/**
       - .github/workflows/nix-changes.yml
   pull_request:
     paths:
       - '**.nix'
-      - tools/nix/**
       - .github/workflows/nix-changes.yml
     types: [opened, synchronize, reopened, ready_for_review]
 
@@ -49,9 +47,7 @@ jobs:
         with:
           fetch-depth: 2
           persist-credentials: false
-          sparse-checkout: |
-            shell.nix
-            tools/nix/
+          sparse-checkout: '*.nix'
           sparse-checkout-cone-mode: false
 
       - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342  # v31.11.0
@@ -64,14 +60,39 @@ jobs:
           name: nodejs
 
       - name: Compute requisites after change
-        run: ./tools/nix/list-requisites.sh > requisites-${{ matrix.system }}-after.list
+        shell: bash  # See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference, we want the pipefail option.
+        run: |
+          nix-store --query --references "$(
+            nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
+              --arg devTools "
+                (import ./tools/nix/devTools.nix {})
+                ++ builtins.attrValues (
+                  { inherit (import <nixpkgs> {}) nixfmt-tree sccache; }
+                  // import ./tools/nix/openssl-matrix.nix {}
+                  // import ./tools/nix/pkcs11.nix {}
+                )")" \
+          | xargs nix-store --realise \
+          | xargs nix-store --query --requisites \
+          | sort -k1.45 \
+          > requisites-${{ matrix.system }}-after.list
 
       - name: Compute requisites before change
+        shell: bash  # See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference, we want the pipefail option.
         run: |
           git reset HEAD^ --hard
-          # TODO(aduh95): remove this once list-requisites.sh has reached `main`
-          [ -f tools/nix/list-requisites.sh ] || git checkout FETCH_HEAD -- tools/nix/list-requisites.sh
-          ./tools/nix/list-requisites.sh > requisites-${{ matrix.system }}-before.list
+          nix-store --query --references "$(
+            nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
+              --arg devTools "
+                (import ./tools/nix/devTools.nix {})
+                ++ builtins.attrValues (
+                  { inherit (import <nixpkgs> {}) nixfmt-tree sccache; }
+                  // import ./tools/nix/openssl-matrix.nix {}
+                  // import ./tools/nix/pkcs11.nix {}
+                )")" \
+          | xargs nix-store --realise \
+          | xargs nix-store --query --requisites \
+          | sort -k1.45 \
+          > requisites-${{ matrix.system }}-before.list
 
       - name: Output diff
         run: |

.github/workflows/test-linux.yml

@@ -9,7 +9,6 @@ on:
       - tools/actions/**
       - tools/clang-format/**
       - tools/dep_updaters/**
-      - tools/nix/**
       - test/internet/**
       - '**.nix'
       - .github/**
@@ -28,7 +27,6 @@ on:
       - tools/actions/**
       - tools/clang-format/**
       - tools/dep_updaters/**
-      - tools/nix/**
       - test/internet/**
       - '**.nix'
       - .github/**

.github/workflows/test-macos.yml

@@ -23,7 +23,6 @@ on:
       - tools/eslint-rules/**
       - tools/eslint/**
       - tools/lint-md/**
-      - tools/nix/**
       - typings/**
       - vcbuild.bat
       - .**
@@ -54,7 +53,6 @@ on:
       - tools/eslint-rules/**
       - tools/eslint/**
       - tools/lint-md/**
-      - tools/nix/**
       - typings/**
       - vcbuild.bat
       - .**

.github/workflows/test-shared.yml

@@ -44,7 +44,6 @@ on:
       - '!tools/nix/**'
       - '!tools/v8/**'
       - '!tools/v8_gypfiles/**'
-      - tools/nix/list-requisites.sh
       - typings/**
       - vcbuild.bat
       - .**
@@ -97,7 +96,6 @@ on:
       - '!tools/nix/**'
       - '!tools/v8/**'
       - '!tools/v8_gypfiles/**'
-      - tools/nix/list-requisites.sh
       - typings/**
       - vcbuild.bat
       - .**

.gitignore

@@ -163,6 +163,7 @@ install_manifest.txt
 
 # === Rules for AI assistants ===
 CLAUDE.md
+AGENTS.md
 
 # === Global Rules ===
 # Keep last to avoid being excluded