I'm not sure we should encourage this; letting repos come up with random versions of node via nvm is pretty likely to result in much less good npm audit capabilities, which is the primary purpose of LibUp. PopUps hard-coding node versions and committing built files is broken-by-design, unfortunately.

libup doesn't use nvm, it installs nodejs using the same version as CI. I agree with James, this is pretty fragile. Isn't node6 pretty old anyways? Can we update them to node10?

I moved it to node 10 in rEPOP4fb6120fc9b7: Upgrade from node 6 to node 10, now that CI is running that to match the version in CI at the time (and still), v10.15.2. However, it looks like LibUp is running on v10.21.0 instead?

In T264328#6510113, @Jdforrester-WMF wrote:

I moved it to node 10 in rEPOP4fb6120fc9b7: Upgrade from node 6 to node 10, now that CI is running that to match the version in CI at the time (and still), v10.15.2. However, it looks like LibUp is running on v10.21.0 instead?

I misremembered, because libup moved to buster we're using the nodejs from Debian, which is 10.21.0~dfsg-1~deb10u1. stretch-wikimedia's component/node10 is at 10.15.2~dfsg-1+wmf1. :|

Ah. We could move CI over to buster for node testing pretty easily, but it'd be less like production (though all node in production runs in the service pipeline nowadays, so that's less a concern).

@Jdforrester-WMF I came across this ticket as I was facing a similar issue in Vector when working on T257582. Vector has hard coded the version of node to 10.16.0 with nvm, but as mentioned CI images have version 10.5.2. Your comment about letting repos come up with random versions of node made sense, just interested to see how this gets resolved.

@Legoktm: Hmm, what exactly is this task stalled on ("If a report is waiting for further input (e.g. from its reporter or a third party) and can currently not be acted on")?

In T264328#6715362, @Aklapper wrote:

@Legoktm: Hmm, what exactly is this task stalled on ("If a report is waiting for further input (e.g. from its reporter or a third party) and can currently not be acted on")?

So the underlying problem is that the Popups (and a few other repositories) npm tests can only be run with a specific version of nodejs, otherwise they'll fail. For reasons I briefly explained above, LibUp uses a different version.

There are a few different ways forward, including:

• Change the nodejs version LibUp uses
• Change the version CI and Popups uses to be in sync with LibUp
• Change Popups so you can use arbitrary nodejs versions without it failing
• ...?

As the primary LibUp maintainer, I've provided input on what I'm willing to do and don't want to do. I think at this point we need feedback from the Popups maintainers to see what's reasonable on their end to figure out how to fix this, hence I marked the task as stalled.

at this point we need feedback from the Popups maintainers to see what's reasonable on their end to figure out how to fix this, hence I marked the task as stalled.

Explicitly adding Web-Team-Backlog - could this please get input? Thanks.

I'm not sure what input is required here from my team. We are waiting on the outcome of T279108 at which point we'll hopefully be able to remove this CI check. Until then it's essential that the Node version we hardcode must be synced with CI so we can verify that the developer is not submitting code that cannot be reproduced.