Preserve permissions with rsync

This is mostly just because if the opts are empty, it seems to error in
macOS for some reason...(rsync_opts[@]: unbound variable).

.github/workflows/release.yaml

@@ -45,7 +45,11 @@ jobs:
       # Cross-compile target.
       VSCODE_ARCH: ${{ matrix.vscode_arch }}
       npm_config_arch: ${{ matrix.npm_arch }}
+      # Ensure native modules are built from source to avoid prebuilds and use
+      # the correct version of glibc.
+      npm_config_build_from_source: true
       # Gulp target name.
+      # TODO: Pull from VSCODE_ARCH instead.
       VSCODE_TARGET: ${{ format('linux-{0}', matrix.vscode_arch) }}
 
     steps:
@@ -125,6 +129,8 @@ jobs:
       VSCODE_TARGET: ${{ matrix.vscode_target }}
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       TAG: ${{ inputs.version || github.ref_name }}
+      # Ensure native modules are built from source to avoid prebuilds.
+      npm_config_build_from_source: true
 
     steps:
       # The version of node-gyp we use depends on distutils but it was removed

ci/build/build-release.sh

@@ -79,7 +79,15 @@ EOF
   mv npm-shrinkwrap.json "$RELEASE_PATH"
 
   if [ "$KEEP_MODULES" = 1 ]; then
-    rsync node_modules/ "$RELEASE_PATH/node_modules"
+    local rsync_opts=(-a)
+    if [[ ${DEBUG-} = 1 ]]; then
+      rsync_opts+=(-vh)
+    fi
+    # If we build from source, exclude the prebuilds.
+    if [[ ${npm_config_build_from_source-} = true ]]; then
+      rsync_opts+=(--exclude /argon2/prebuilds)
+    fi
+    rsync "${rsync_opts[@]}" node_modules/ "$RELEASE_PATH/node_modules"
     # Remove dev dependencies.
     pushd "$RELEASE_PATH"
     npm prune --production
@@ -92,7 +100,7 @@ EOF
 bundle_vscode() {
   mkdir -p "$VSCODE_OUT_PATH"
 
-  local rsync_opts=()
+  local rsync_opts=(-a)
   if [[ ${DEBUG-} = 1 ]]; then
     rsync_opts+=(-vh)
   fi

package-lock.json

@@ -5067,9 +5067,9 @@
       }
     },
     "node_modules/picomatch": {
-      "version": "4.0.3",
+      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
-      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
       "dev": true,
       "license": "MIT",
       "engines": {

test/package-lock.json

@@ -4031,9 +4031,9 @@
       "license": "ISC"
     },
     "node_modules/picomatch": {
-      "version": "2.3.1",
+      "version": "2.3.2",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
-      "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
       "dev": true,
       "license": "MIT",
       "engines": {