tools: add opt-in BoringSSL test-shared job

Signed-off-by: Filip Skokan <panva.ip@gmail.com>

Author: panva

.github/workflows/test-shared.yml

@@ -278,3 +278,37 @@ jobs:
             --arg sharedLibDeps "(import $TAR_DIR/tools/nix/sharedLibDeps.nix {}) // {
                 openssl = (import $TAR_DIR/tools/nix/openssl-matrix.nix {}).$OPENSSL_ATTR;
               }" \
+
+  # Builds and tests Node.js with shared libraries against the BoringSSL
+  # package available in the repo-pinned nixpkgs. This is opt-in for PRs using
+  # the `test-shared-boringssl` label so the default shared-library coverage
+  # remains OpenSSL-based.
+  build-boringssl:
+    if: github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'test-shared-boringssl')
+    needs: build-aarch64-linux-v8
+    name: 'aarch64-linux: with shared BoringSSL'
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
+          sparse-checkout: .github/actions
+          sparse-checkout-cone-mode: false
+
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        if: ${{ needs.build-aarch64-linux-v8.outputs.local-cache }}
+        with:
+          name: libv8-aarch64-linux.nar
+
+      - uses: ./.github/actions/build-shared
+        name: Build and test Node.js
+        with:
+          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
+          # Override just the `openssl` attr of the default shared-lib set with
+          # the BoringSSL package from the repo-pinned nixpkgs. All other
+          # shared libs (brotli, cares, libuv, ...) keep their defaults.
+          extra-nix-flags: |
+            --arg useSeparateDerivationForV8 ${{ needs.build-aarch64-linux-v8.outputs.local-cache && '"$(nix-store --import < libv8-aarch64-linux.nar)"' || 'true' }} \
+            --arg sharedLibDeps "(import $TAR_DIR/tools/nix/sharedLibDeps.nix {}) // {
+                openssl = (import $TAR_DIR/tools/nix/pkgs.nix {}).boringssl;
+              }" \