fix(compile): make output more deterministic (#25092)

Closes https://github.com/denoland/deno/issues/25084

2 files changed, 20 insertions, 11 deletions

diff --git a/cli/standalone/binary.rs b/cli/standalone/binary.rs
index 168310efd..d80f8a969 100644
--- a/cli/standalone/binary.rs
+++ b/cli/standalone/binary.rs
@@ -100,6 +100,8 @@ pub struct SerializedWorkspaceResolver {
   pub pkg_json_resolution: PackageJsonDepResolution,
 }
 
+// Note: Don't use hashmaps/hashsets. Ensure the serialization
+// is deterministic.
 #[derive(Deserialize, Serialize)]
 pub struct Metadata {
   pub argv: Vec<String>,
@@ -111,7 +113,7 @@ pub struct Metadata {
   pub ca_stores: Option<Vec<String>>,
   pub ca_data: Option<Vec<u8>>,
   pub unsafely_ignore_certificate_errors: Option<Vec<String>>,
-  pub env_vars_from_env_file: HashMap<String, String>,
+  pub env_vars_from_env_file: IndexMap<String, String>,
   pub workspace_resolver: SerializedWorkspaceResolver,
   pub entrypoint_key: String,
   pub node_modules: Option<NodeModules>,
@@ -667,8 +669,10 @@ impl<'a> DenoCompileBinaryWriter<'a> {
           // but also don't make this dependent on the registry url
           let root_path = npm_resolver.global_cache_root_folder();
           let mut builder = VfsBuilder::new(root_path)?;
-          for package in npm_resolver.all_system_packages(&self.npm_system_info)
-          {
+          let mut packages =
+            npm_resolver.all_system_packages(&self.npm_system_info);
+          packages.sort_by(|a, b| a.id.cmp(&b.id)); // determinism
+          for package in packages {
             let folder =
               npm_resolver.resolve_pkg_folder_from_pkg_id(&package.id)?;
             builder.add_dir_recursive(&folder)?;
@@ -729,11 +733,13 @@ impl<'a> DenoCompileBinaryWriter<'a> {
           cli_options.workspace().root_dir().to_file_path().unwrap(),
         );
         while let Some(pending_dir) = pending_dirs.pop_front() {
-          let entries = fs::read_dir(&pending_dir).with_context(|| {
-            format!("Failed reading: {}", pending_dir.display())
-          })?;
+          let mut entries = fs::read_dir(&pending_dir)
+            .with_context(|| {
+              format!("Failed reading: {}", pending_dir.display())
+            })?
+            .collect::<Result<Vec<_>, _>>()?;
+          entries.sort_by_cached_key(|entry| entry.file_name()); // determinism
           for entry in entries {
-            let entry = entry?;
             let path = entry.path();
             if !path.is_dir() {
               continue;
@@ -755,8 +761,8 @@ impl<'a> DenoCompileBinaryWriter<'a> {
 /// in the passed environment file.
 fn get_file_env_vars(
   filename: String,
-) -> Result<HashMap<String, String>, dotenvy::Error> {
-  let mut file_env_vars = HashMap::new();
+) -> Result<IndexMap<String, String>, dotenvy::Error> {
+  let mut file_env_vars = IndexMap::new();
   for item in dotenvy::from_filename_iter(filename)? {
     let Ok((key, val)) = item else {
       continue; // this failure will be warned about on load
diff --git a/cli/standalone/virtual_fs.rs b/cli/standalone/virtual_fs.rs
index c44e2227b..53d045b62 100644
--- a/cli/standalone/virtual_fs.rs
+++ b/cli/standalone/virtual_fs.rs
@@ -90,8 +90,11 @@ impl VfsBuilder {
     let read_dir = std::fs::read_dir(path)
       .with_context(|| format!("Reading {}", path.display()))?;
 
-    for entry in read_dir {
-      let entry = entry?;
+    let mut dir_entries =
+      read_dir.into_iter().collect::<Result<Vec<_>, _>>()?;
+    dir_entries.sort_by_cached_key(|entry| entry.file_name()); // determinism
+
+    for entry in dir_entries {
       let file_type = entry.file_type()?;
       let path = entry.path();