tools: pin OpenSSL to 3.5.4 on test-shared workflow

Author: aduh95

.github/workflows/test-shared.yml

@@ -1,3 +1,5 @@
+# This action uses the following secrets:
+#   CACHIX_AUTH_TOKEN: Write access to nodejs.cachix.org – without it, the cache is read-only.
 name: Test Shared libraries
 
 on:
@@ -95,6 +97,11 @@ jobs:
         with:
           extra_nix_config: sandbox = true
 
+      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
+        with:
+          name: nodejs
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
       - name: Configure sccache
         uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea  # v7.0.1
         with:

shell.nix

@@ -12,7 +12,6 @@
       nghttp2
       nghttp3
       ngtcp2
-      openssl
       simdjson
       simdutf
       sqlite
@@ -21,6 +20,25 @@
       zstd
       ;
     http-parser = pkgs.llhttp;
+    openssl = pkgs.openssl.overrideAttrs (old: {
+      version = "3.5.4";
+      src = pkgs.fetchurl {
+        url = builtins.replaceStrings [ old.version ] [ "3.5.4" ] old.src.url;
+        hash = "sha256-lnMR+ElVMWlpvbHY1LmDcY70IzhjnGIexMNP3e81Xpk=";
+      };
+      doCheck = false;
+      configureFlags =
+        (old.configureFlags or [ ])
+        ++ [
+          "no-docs"
+          "no-tests"
+        ];
+      outputs = [
+        "bin"
+        "out"
+        "dev"
+      ];
+    });
   },
   ccache ? pkgs.ccache,
   ninja ? pkgs.ninja,