feat!: migrate nodejs to custom resources

[damacus]

Summary

Selected cookbook: nodejs

This is a Full Migration from the legacy recipe/attribute API to a custom-resource-only public API.

• Add nodejs_install, nodejs_repository, nodejs_npm_install, and nodejs_npm_packages resources.
• Modernize the existing npm_package resource and helper coverage.
• Move former recipe and attribute behavior into resource properties and test cookbook examples.
• Remove root recipes/ and root attributes/.
• Add resource docs, migration.md, LIMITATIONS.md, ChefSpec coverage, and full InSpec profiles.
• Refresh Kitchen/CI coverage around resource usage and current non-EOL Linux platforms.
• Align GitHub Actions workflow permissions to the exact reusable workflow/action sources checked.

Verification

• berks install
  • Result: pass
  • Output: resolved nodejs, local test, ark, chocolatey, git, seven_zip, and yum.
• chef exec ruby -c on resources/*.rb, resource partials, and libraries/nodejs_helper.rb
  • Result: pass
  • Output: all files reported Syntax OK.
• cookstyle
  • Result: pass
  • Output: 33 files inspected, no offenses detected.
• chef exec rspec --format documentation
  • Result: pass
  • Output: 50 examples, 0 failures.
• KITCHEN_LOCAL_YAML=kitchen.dokken.yml kitchen test default-ubuntu-2404 --destroy=always
  • Result: pass
  • Output: second converge idempotent with 0/23 resources updated; InSpec reported 2 successful controls, 6 successful tests, 0 failures, 0 skipped.
• KITCHEN_LOCAL_YAML=kitchen.dokken.yml kitchen test package-ubuntu-2404 --destroy=always
  • Result: pass
  • Output: second converge idempotent with 0/55 resources updated; InSpec reported 2 successful controls, 8 successful tests, 0 failures, 0 skipped.
• KITCHEN_LOCAL_YAML=kitchen.dokken.yml kitchen test source-oraclelinux-8 --destroy=always
  • Result: local ARM64 run reached source compilation after dependency setup; remaining local failure is Node.js source build rejecting the ARM64 runner's compiler flag -mbranch-protection=standard. The GitHub Actions suite validates this same platform on the x86_64 runner where the original CI failure occurred.
• Workflow/static checks
  • Result: pass
  • Output: workflow YAML parsed, actionlint, yamllint .github/workflows, and git diff --check passed.
• Final structural audit
  • Result: pass
  • ls -R was run locally.
  • Root recipes/ is absent.
  • Root attributes/ is absent.
  • test/cookbooks/test/recipes and full test/integration/*/inspec.yml profiles are present.

Platform and Support Evidence

Node.js is still actively supported and useful as a managed runtime. The migrated resource defaults target NodeSource package repositories for package installs, preserve binary/source install modes through ark, and keep Windows Chocolatey coverage in the resource API and tests.

Active Kitchen/CI coverage is focused on current non-EOL Linux platforms supported by the cookbook's package/binary workflows, including AlmaLinux 8-10, Amazon Linux 2023, CentOS Stream 9-10, Debian 12-13, Fedora latest, Oracle Linux 8-9, Rocky Linux 8-10, and Ubuntu 22.04/24.04. EOL platforms were removed from active testing.

Workflow Permission Sources Checked

Checked exact upstream files before changing caller permissions:

• sous-chefs/.github/.github/workflows/lint-unit.yml@6.0.0
  • Checked local dot-github tag 6.0.0.
  • check-metadata requires checks: write, pull-requests: write, and statuses: write; caller grants those plus contents: read for checkout paths.
  • Removed unneeded guessed actions: write and issues: write.
• sous-chefs/.github/.github/workflows/prevent-file-change.yml@6.0.0
  • Checked local dot-github tag 6.0.0.
  • Nested jobs require pull-requests: write; caller grants pull-requests: write.
• sous-chefs/.github/.github/workflows/conventional-commits.yml@6.0.0
  • Checked local dot-github tag 6.0.0.
  • Nested job requires pull-requests: read; caller grants pull-requests: read.
• sous-chefs/.github/.github/workflows/release-cookbook.yml@6.0.0
  • Checked local dot-github tag 6.0.0.
  • Required secrets confirmed and passed: token, supermarket_user, supermarket_key, slack_bot_token, and slack_channel_id.
• sous-chefs/.github/.github/actions/install-workstation/action.yml@6.0.0
  • Checked local dot-github tag 6.0.0; CI and Copilot setup use the pinned Cinc Workstation installer action.
• Nested release action sources checked:
  • googleapis/release-please-action@v4 README: release workflow keeps contents: write, issues: write, and pull-requests: write.
  • actions/upload-artifact@v7/action.yml: no extra caller permission identified beyond release job needs.
  • actions/attest-build-provenance@v4/action.yml: wraps actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26.
  • actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 README: release workflow keeps id-token: write, attestations: write, and artifact-metadata: write.
  • slackapi/slack-github-action@v3.0.1/action.yml: Slack token is passed as an input; no extra caller permission identified.

BREAKING CHANGE: root nodejs:: recipes and node['nodejs'] attributes have been removed. Consumers should declare the nodejs_* resources directly.

[github-actions]

Slowest examples

Top 10 slowest examples (1.88 seconds, 43.67% of total time)

Example	Description	Time in seconds
spec/unit/library/helper_spec.rb:18	helper methods npm_dist should return a url based on the version	0.72186
spec/unit/resources/nodejs_install_spec.rb:33	nodejs_install package install on rocky linux is expected to disable dnf_module "nodejs"	0.20991
spec/unit/resources/nodejs_npm_install_spec.rb:28	nodejs_npm_install source npm is expected to install nodejs_install "nodejs for npm"	0.17556
spec/unit/resources/nodejs_npm_install_spec.rb:29	nodejs_npm_install source npm is expected to install_with_make ark "npm"	0.14006
spec/unit/resources/nodejs_install_spec.rb:15	nodejs_install package install on ubuntu is expected to create nodejs_repository "nodesource"	0.13928
spec/unit/resources/nodejs_install_spec.rb:90	nodejs_install source install is expected to install_with_make ark "nodejs-source"	0.10213
spec/unit/resources/nodejs_install_spec.rb:86	nodejs_install source install is expected to install build_essential "install build tools"	0.10201
spec/unit/resources/nodejs_repository_spec.rb:18	nodejs_repository on ubuntu is expected to add apt_preference "nodesource"	0.10024
spec/unit/resources/nodejs_install_spec.rb:112	nodejs_install source install on rocky linux is expected to install package "tar"	0.09864
spec/unit/resources/nodejs_repository_spec.rb:41	nodejs_repository remove on ubuntu is expected to remove apt_repository "nodesource"	0.09689