[Tests] run every remaining test file: exec bits, fixes; add check-exec to CI

urchin only executes test files that have the executable bit, silently skipping the rest,
and `npm run test:check-exec` would catch non-executable ones, but no workflow ran it -
so several test files have never actually run.
Make all of them executable, and fix the ones that were broken:
- the io.js source-install tests, skipped since 2016: io.js requires python 2 and gcc <= 5,
so they now skip on toolchains that can not compile it,
and a new gcc:4.9-container CI job runs them unmodified -
resolving, downloading, checksumming, and compiling io.js for real.
New `fake source` variants exercise nvm's source pipeline everywhere -
cache lookup, offline resolution, extraction, configure, make, make install, activation -
via a tiny fake source tree seeded into the download cache and installed with `--offline`.
Also strengthen the `nvm run | grep` assertions with `--silent`,
since the version banner used to satisfy the grep even when the built binary could not run,
and give the final assertions the `die` they always meant to call.
- `nvm uninstall ... incorrect file permissions fails nicely`, parked in 2025 as failing:
`sudo npm` resets PATH, so node 5's npm crashed under the system node.
The permissions check only trips on files that are neither writable nor self-owned,
and that precondition only needs `sudo touch` - not npm, jspm, or the network -
so use that, against a fake installed version,
and skip only where passwordless sudo does not exist.
- `nvm install --offline`: `nvm ls | tail -1` always grabbed an alias line, never a version;
use `nvm_ls` and skip its trailing `system <version>` line.
- `nvm exec ... help should not parse`: in a BRE, `[options]` is a bracket expression,
so the grep could never match node's literal `Usage: node [options]` output.
- `nvm use ... nvmrc containing not installed version`: current output once again matches its expectations verbatim; no changes needed.

Rewrite `test:check-exec` in POSIX sh - npm runs scripts with /bin/sh, which is dash on Ubuntu,
where the previous `[[`/`$'\n'` bashisms would break;
match by extension, so that filenames containing dots can not dodge the check;
and disable git's `core.quotePath` mangling of the non-ASCII test filenames.
Then wire it into the lint workflow.

.github/workflows/lint.yml

@@ -71,11 +71,29 @@ jobs:
       - name: check tests filenames
         run: ./rename_test.sh --check
 
+  check_exec:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: step-security/harden-runner@v2
+        with:
+          allowed-endpoints:
+            github.com:443
+            raw.githubusercontent.com:443
+            nodejs.org:443
+            registry.npmjs.org:443
+      - uses: actions/checkout@v6
+      - uses: ljharb/actions/node/install@main
+        name: 'nvm install lts/* && npm install'
+        with:
+          node-version: 'lts/*'
+      - name: check that test files are executable
+        run: npm run test:check-exec
+
   all:
     permissions:
       contents: none
     name: 'all linting'
-    needs: [eclint, dockerfile_lint, doctoc, test_naming]
+    needs: [eclint, dockerfile_lint, doctoc, test_naming, check_exec]
     runs-on: ubuntu-latest
     steps:
       - run: true

.github/workflows/tests-installation-iojs.yml

@@ -98,11 +98,45 @@ jobs:
         run: sudo apt-get install curl -y
         shell: bash
 
+  installation_iojs_source_compile:
+    permissions:
+      contents: read
+
+    name: 'actually compile io.js from source (gcc 4.9 container)'
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          allowed-endpoints:
+            github.com:443
+            mirror.gcr.io:443
+            storage.googleapis.com:443
+            iojs.org:443
+      - uses: actions/checkout@v6
+      # io.js requires python 2 and gcc <= 5 to compile; the gcc:4.9 image
+      # (debian jessie) has both, plus curl/wget/xz and CA certificates that
+      # still validate iojs.org - so the source-install tests run unmodified,
+      # resolving, downloading, checksumming, and compiling for real.
+      # The image is pulled through Google's Docker Hub mirror: it serves
+      # manifests and blobs from a single stable hostname (Docker Hub's blob
+      # CDN hostnames rotate, which the blocked-egress policy can not allow),
+      # and it is not subject to Docker Hub's anonymous pull rate limits.
+      - name: compile io.js from source, for real
+        run: |
+          docker run --rm -v "${PWD}:/nvm-under-test" -e NVM_DIR=/nvm-under-test mirror.gcr.io/library/gcc:4.9 bash -ec '
+            cd "${NVM_DIR}/test/installation_iojs"
+            sh "./install from source"
+            sh "./install version specified in .nvmrc from source"
+          '
+
   all:
     permissions:
       contents: none
     name: 'all installation_iojs tests'
-    needs: [installation_iojs_without_curl]
+    needs: [installation_iojs_without_curl, installation_iojs_source_compile]
     runs-on: ubuntu-latest
     steps:
       - run: true