n8n/scripts/build-n8n.mjs

#!/usr/bin/env node
/**
 * This script is used to build the n8n application for production.
 * It will:
 * 1. Clean the previous build output
 * 2. Run pnpm install and build
 * 3. Prepare for deployment - clean package.json files
 * 4. Create a pruned production deployment in 'compiled'
 */

import { $, echo, fs, chalk } from 'zx';
import path from 'path';

// Check if running in a CI environment
const isCI = process.env.CI === 'true';

// Check if test controller should be excluded (CI + flag not set)
const excludeTestController =
	process.env.CI === 'true' && process.env.INCLUDE_TEST_CONTROLLER !== 'true';

// Disable verbose output and force color only if not in CI
$.verbose = !isCI;
process.env.FORCE_COLOR = isCI ? '0' : '1';

const scriptDir = path.dirname(new URL(import.meta.url).pathname);
const isInScriptsDir = path.basename(scriptDir) === 'scripts';
const rootDir = isInScriptsDir ? path.join(scriptDir, '..') : scriptDir;

// #region ===== Configuration =====
const config = {
	compiledAppDir: path.join(rootDir, 'compiled'),
	compiledTaskRunnerDir: path.join(rootDir, 'dist', 'task-runner-javascript'),
	cliDir: path.join(rootDir, 'packages', 'cli'),
	rootDir: rootDir,
};

// #endregion ===== Configuration =====

// #region ===== Helper Functions =====
const timers = new Map();

function startTimer(name) {
	timers.set(name, Date.now());
}

function getElapsedTime(name) {
	const start = timers.get(name);
	if (!start) return 0;
	return Math.floor((Date.now() - start) / 1000);
}

function formatDuration(seconds) {
	const hours = Math.floor(seconds / 3600);
	const minutes = Math.floor((seconds % 3600) / 60);
	const secs = seconds % 60;

	if (hours > 0) return `${hours}h ${minutes}m ${secs}s`;
	if (minutes > 0) return `${minutes}m ${secs}s`;
	return `${secs}s`;
}

function printHeader(title) {
	echo('');
	echo(chalk.blue.bold(`===== ${title} =====`));
}

function printDivider() {
	echo(chalk.gray('-----------------------------------------------'));
}

// #endregion ===== Helper Functions =====

// #region ===== Main Build Process =====
printHeader('n8n Build & Production Preparation');
echo(`INFO: Output Directory: ${config.compiledAppDir}`);
printDivider();

startTimer('total_build');

// 0. Clean Previous Build Output
echo(chalk.yellow(`INFO: Cleaning previous output directory: ${config.compiledAppDir}...`));
await fs.remove(config.compiledAppDir);
echo(
	chalk.yellow(
		`INFO: Cleaning previous task runner output directory: ${config.compiledTaskRunnerDir}...`,
	),
);
await fs.remove(config.compiledTaskRunnerDir);
printDivider();

// 1. Local Application Pre-build
echo(chalk.yellow('INFO: Starting local application pre-build...'));
startTimer('package_build');

echo(chalk.yellow('INFO: Running pnpm install and build...'));
try {
	const installProcess = $`cd ${config.rootDir} && pnpm install --frozen-lockfile`;
	installProcess.pipe(process.stdout);
	await installProcess;

	const buildProcess = $`cd ${config.rootDir} && pnpm build --summarize`;
	buildProcess.pipe(process.stdout);
	await buildProcess;

	echo(chalk.green('✅ pnpm install and build completed'));
} catch (error) {
	console.error(chalk.red('\n🛑 BUILD PROCESS FAILED!'));
	console.error(chalk.red('An error occurred during the build process:'));
	process.exit(1);
}

const packageBuildTime = getElapsedTime('package_build');
echo(chalk.green(`✅ Package build completed in ${formatDuration(packageBuildTime)}`));
printDivider();

// 2. Prepare for deployment - clean package.json files
echo(chalk.yellow('INFO: Performing pre-deploy cleanup on package.json files...'));

// Find and backup package.json files
const packageJsonFiles = await $`cd ${config.rootDir} && find . -name "package.json" \
-not -path "./node_modules/*" \
-not -path "*/node_modules/*" \
-not -path "./compiled/*" \
-type f`.lines();

// Backup all package.json files
// This is only needed locally, not in CI
if (process.env.CI !== 'true') {
	for (const file of packageJsonFiles) {
		if (file) {
			const fullPath = path.join(config.rootDir, file);
			await fs.copy(fullPath, `${fullPath}.bak`);
		}
	}
}
// Run FE trim script
await $`cd ${config.rootDir} && node .github/scripts/trim-fe-packageJson.js`;

echo(chalk.yellow(`INFO: Creating pruned production deployment in '${config.compiledAppDir}'...`));
startTimer('package_deploy');

await fs.ensureDir(config.compiledAppDir);

if (excludeTestController) {
	const cliPackagePath = path.join(config.rootDir, 'packages/cli/package.json');
	const content = await fs.readFile(cliPackagePath, 'utf8');
	const packageJson = JSON.parse(content);
	packageJson.files.push('!dist/**/e2e.*');
	await fs.writeFile(cliPackagePath, JSON.stringify(packageJson, null, 2));
	echo(chalk.gray('  - Excluded test controller from packages/cli/package.json'));
}

// The release SBOM is built by cdxgen inventorying the top-level node_modules of this
// deployed closure. Since #32569 dropped shamefully-hoist, only direct deps surface at
// top level, so cdxgen would miss the transitive tree (the manifest would be incomplete).
// Re-enable hoisting for the licenses build only — shipped images keep the non-hoisted
// layout, since regular builds leave N8N_GENERATE_LICENSES unset.
// `PNPM_CONFIG_*` and not `npm_config_*`: pnpm 11 no longer reads npm-style env config,
// so an `npm_config_` name here is silently ignored and the SBOM comes out incomplete.
const generateLicenses = process.env.N8N_GENERATE_LICENSES === 'true';
if (generateLicenses) {
	process.env.PNPM_CONFIG_SHAMEFULLY_HOIST = 'true';
}

await $`cd ${config.rootDir} && NODE_ENV=production DOCKER_BUILD=true pnpm --filter=n8n --prod --legacy deploy --no-optional ./compiled`;

// Strip test/example/benchmark dirs shipped inside production deps that lack a
// `files` field in their package.json. These are valid runtime deps but their
// authors published full source trees; syft inventories the subdirs as phantom
// packages with no license, which fails enterprise SBOM license gates.
echo(chalk.yellow('INFO: Stripping test/example/benchmark dirs from production closure...'));
const phantomDirs = [
	'resolve/*/test',
	'import-in-the-middle/*/test',
	'github-from-package/*/example',
	'tedious/*/benchmarks',
];
for (const pattern of phantomDirs) {
	await $`find ${config.compiledAppDir}/node_modules/.pnpm -type d -path "*/${pattern}" -exec rm -rf {} + 2>/dev/null || true`;
}
echo(chalk.green('✅ Phantom dirs stripped'));

// @confluentinc/kafka-javascript vendors librdkafka's full C source tree for its
// build-from-source fallback (~11MB), but the prebuilt binary - librdkafka statically
// linked in, no .so/.a shipped - is what actually loads at runtime on Alpine. The
// source is dead weight in the shipped image.
echo(chalk.yellow('INFO: Stripping unused librdkafka source tree...'));
await $`find ${config.compiledAppDir}/node_modules/.pnpm -type d -path "*/@confluentinc/kafka-javascript/deps" -exec rm -rf {} + 2>/dev/null || true`;
echo(chalk.green('✅ librdkafka source tree stripped'));

// Strip TypeScript declaration artifacts to cut the image's file count, which
// dominates layer extraction time on constrained hosts. Only these two explicit
// patterns are safe to remove by extension: several features read other
// "source-looking" files off disk at request time (dist/node-definitions/**/*.ts
// for AI node lookups, instance-ai skills/knowledge-base *.md), so broader globs
// like '*.ts' or '*.md' must not come back here. .js.map is also kept —
// source-map-support needs it for production stack traces.
echo(chalk.yellow('INFO: Stripping TypeScript declaration files from production closure...'));
await $`find ${config.compiledAppDir} -type f \\( -name '*.d.ts' -o -name '*.d.ts.map' \\) -delete 2>/dev/null || true`;
echo(chalk.green('✅ Declaration files stripped'));

// A build that loses these runtime-data trees (a strip regression, a package.json
// `files` change, a pnpm deploy change) still boots, so the damage only surfaces
// on the first AI request. Fail the build here instead.
// `.nothrow()` because zx runs with `pipefail`: one unreadable path would
// otherwise turn a healthy build into an unhandled rejection.
const runtimeAssetGlobs = [
	'*/@n8n/instance-ai/skills/*',
	'*/@n8n/instance-ai/knowledge-base/*',
	'*/dist/node-definitions/*',
];

echo(chalk.yellow('INFO: Verifying Runtime assets'));
for (const glob of runtimeAssetGlobs) {
	const found = await $`find ${config.compiledAppDir} -type f -path ${glob}`.nothrow();
	if (found.stdout.split('\n').filter(Boolean).length === 0) {
		echo(chalk.red(`ERROR: no files left under ${glob} — runtime assets were stripped`));
		process.exit(1);
	}
}
echo(chalk.green('✅ Runtime assets intact'));

await fs.ensureDir(config.compiledTaskRunnerDir);

echo(
	chalk.yellow(
		`INFO: Creating JavaScript task runner deployment in '${config.compiledTaskRunnerDir}'...`,
	),
);

await $`cd ${config.rootDir} && NODE_ENV=production DOCKER_BUILD=true pnpm --filter=@n8n/task-runner --prod --legacy deploy --no-optional ${config.compiledTaskRunnerDir}`;

// Check the production closure for single-instance dependency duplication. A curated
// library resolving to more than one physical copy silently breaks instanceof /
// singletons at runtime. Report-first: a duplicate is surfaced loudly but does NOT fail
// the build — matching the continue-on-error npm-install CI jobs, so a transitive
// third-party re-split can't hard-break every nightly/release with no config escape.
// Promote to a hard gate once it has proven stable across releases.
// Both closures this build produces are checked. The task runner is deployed independently and
// ships as its own image, and `@n8n/task-runner` is a host package — it carries the curated libs as
// real dependencies rather than peers, so it is if anything the likelier place for a second copy.
const verifySingleInstance = async (label, dir) => {
	echo(chalk.yellow(`INFO: Verifying single-instance dependency integrity in ${label}...`));
	// `--dir` rather than `--filter`: a filter that matches nothing exits 0, so a renamed or moved
	// package would report a passing check having run no verifier at all.
	const verifyProcess = $`cd ${config.rootDir} && pnpm --dir packages/testing/code-health exec tsx src/cli.ts verify-closure ${dir}`.nothrow();
	verifyProcess.pipe(process.stdout);
	const { exitCode } = await verifyProcess;
	// 0 and 3 are the only codes the verifier itself produces; everything else (tsx failing to load,
	// a missing package or closure, a crash) means the closure was never checked.
	if (exitCode === 0) {
		echo(chalk.green(`✅ Single-instance dependency check passed for ${label}`));
	} else if (exitCode === 3) {
		echo(
			chalk.red(
				`⚠️  Single-instance dependency duplication reported in ${label} (see above) — not failing the build (report-first).`,
			),
		);
	} else {
		echo(
			chalk.red(
				`⚠️  Single-instance verifier failed to run for ${label} (exit ${exitCode}); that closure was NOT checked. This is a tooling error, not a duplication report.`,
			),
		);
	}
};

await verifySingleInstance('the production closure', config.compiledAppDir);
await verifySingleInstance('the JavaScript task runner closure', config.compiledTaskRunnerDir);

const packageDeployTime = getElapsedTime('package_deploy');

// Generate SBOM + render THIRD_PARTY_LICENSES.md from the deployed runtime closure.
// Single source of truth: the SBOM. Both the runtime endpoint (packages/cli/) and the
// release asset (compiled/) get the same SBOM-derived attribution file.
// Tooling (cdxgen + renderer) is installed in .github/scripts/, alongside other CI
// scripts, so we don't carry a second isolated install.
//
// Default: skip. cdxgen + license rendering adds ~minutes to every build:deploy and
// is only needed for the release SBOM job. The release-publish workflow opts in by
// setting N8N_GENERATE_LICENSES=true; regular CI Docker prepare runs skip it.
if (generateLicenses) {
	echo(chalk.yellow('INFO: Generating SBOM and rendering THIRD_PARTY_LICENSES.md...'));
	try {
		const toolingDir = path.join(config.rootDir, '.github', 'scripts');
		await $`cd ${config.rootDir} && pnpm install --frozen-lockfile --dir .github/scripts --ignore-workspace`;
		const generateProcess = $`cd ${toolingDir} && pnpm generate-licenses`;
		generateProcess.pipe(process.stdout);
		await generateProcess;
		echo(chalk.green('✅ SBOM generated and THIRD_PARTY_LICENSES.md rendered'));
	} catch (error) {
		echo(chalk.red(`ERROR: SBOM/license generation failed: ${error.message}`));
		// In CI, fail loudly. A stale or missing THIRD_PARTY_LICENSES.md must never ship —
		// the release workflow uploads it unconditionally and would otherwise publish
		// an incomplete attribution file.
		if (process.env.CI === 'true') {
			throw error;
		}
		echo(chalk.yellow('⚠️  Warning: continuing local build (CI=true would have failed)'));
	}
} else {
	echo(chalk.gray('INFO: Skipping SBOM/license generation (set N8N_GENERATE_LICENSES=true to enable)'));
}

// Restore package.json files
// This is only needed locally, not in CI
if (process.env.CI !== 'true') {
	for (const file of packageJsonFiles) {
		if (file) {
			const fullPath = path.join(config.rootDir, file);
			const backupPath = `${fullPath}.bak`;
			if (await fs.pathExists(backupPath)) {
				await fs.move(backupPath, fullPath, { overwrite: true });
			}
		}
	}
}

// Calculate output size
const compiledAppOutputSize = (await $`du -sh ${config.compiledAppDir} | cut -f1`).stdout.trim();
const compiledTaskRunnerOutputSize = (
	await $`du -sh ${config.compiledTaskRunnerDir} | cut -f1`
).stdout.trim();

// Generate build manifests
const buildManifest = {
	buildTime: new Date().toISOString(),
	artifactSize: compiledAppOutputSize,
	buildDuration: {
		packageBuild: packageBuildTime,
		packageDeploy: packageDeployTime,
		total: getElapsedTime('total_build'),
	},
};

// Copy third-party licenses if they exist
const licensesSourcePath = path.join(config.cliDir, 'THIRD_PARTY_LICENSES.md');
if (await fs.pathExists(licensesSourcePath)) {
	await fs.copy(licensesSourcePath, path.join(config.compiledAppDir, 'THIRD_PARTY_LICENSES.md'));
}

await fs.writeJson(path.join(config.compiledAppDir, 'build-manifest.json'), buildManifest, {
	spaces: 2,
});

const taskRunnerbuildManifest = {
	buildTime: new Date().toISOString(),
	artifactSize: compiledTaskRunnerOutputSize,
	buildDuration: {
		packageBuild: packageBuildTime,
		packageDeploy: packageDeployTime,
		total: getElapsedTime('total_build'),
	},
};

await fs.writeJson(
	path.join(config.compiledTaskRunnerDir, 'build-manifest.json'),
	taskRunnerbuildManifest,
	{
		spaces: 2,
	},
);

echo(chalk.green(`✅ Package deployment completed in ${formatDuration(packageDeployTime)}`));
echo(`INFO: Size of ${config.compiledAppDir}: ${compiledAppOutputSize}`);
printDivider();

// Calculate total time
const totalBuildTime = getElapsedTime('total_build');

// #endregion ===== Main Build Process =====

// #region ===== Final Output =====
echo('');
echo(chalk.green.bold('================ BUILD SUMMARY ================'));
echo(chalk.green(`✅ n8n built successfully!`));
echo('');
echo(chalk.blue('📦 Build Output:'));
echo(chalk.green('   n8n:'));
echo(`   Directory:      ${path.resolve(config.compiledAppDir)}`);
echo(`   Size:           ${compiledAppOutputSize}`);
echo('');
echo(chalk.green('   task-runner-javascript:'));
echo(`   Directory:      ${path.resolve(config.compiledTaskRunnerDir)}`);
echo(`   Size:           ${compiledTaskRunnerOutputSize}`);
echo('');
echo(chalk.blue('⏱️  Build Times:'));
echo(`   Package Build:  ${formatDuration(packageBuildTime)}`);
echo(`   Package Deploy: ${formatDuration(packageDeployTime)}`);
echo(chalk.gray('   -----------------------------'));
echo(chalk.bold(`   Total Time:     ${formatDuration(totalBuildTime)}`));
echo('');
echo(chalk.blue('📋 Build Manifests:'));
echo(`   ${path.resolve(config.compiledAppDir)}/build-manifest.json`);
echo(`   ${path.resolve(config.compiledTaskRunnerDir)}/build-manifest.json`);
echo(chalk.green.bold('=============================================='));

// #endregion ===== Final Output =====

// Exit with success
process.exit(0);