mattermost/.github/workflows/server-ci.yml

# NOTE: This workflow name is referenced by other workflows:
# - server-ci-artifacts.yml
# - server-ci-report.yml
# - sentry.yaml
# If you rename this workflow, be sure to update those workflows as well.
name: Server CI
on:
  workflow_dispatch:  # Allow manual/API triggering for linked plugin CI
  push:
    branches:
      - master
      - release-*
  pull_request:
    paths:
      - "server/**"
      - ".github/workflows/server-ci.yml"
      - ".github/workflows/server-test-template.yml"
      - ".github/workflows/server-test-merge-template.yml"
      - ".github/workflows/mmctl-test-template.yml"
      - "!server/build/Dockerfile.buildenv"
      - "!server/build/Dockerfile.buildenv-fips"
      - "tools/mattermost-govet/**"
      - "!server/**/*.md"
      - "!server/NOTICE.txt"
      - "!server/CHANGELOG.md"

concurrency:
  group: ${{ github.event_name == 'pull_request' && format('{0}-{1}', github.workflow, github.ref) || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  go:
    name: Compute Go Version
    runs-on: ubuntu-22.04
    outputs:
      version: ${{ steps.calculate.outputs.GO_VERSION }}
      gomod-changed: ${{ steps.changed-files.outputs.any_changed }}
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Calculate version
        id: calculate
        working-directory: server/
        run: echo GO_VERSION=$(cat .go-version) >> "${GITHUB_OUTPUT}"
      - name: Check for go.mod changes
        id: changed-files
        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
        with:
          files: |
            **/go.mod            
  check-mocks:
    name: Check mocks
    needs: go
    runs-on: ubuntu-22.04
    container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
    defaults:
      run:
        working-directory: server
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Run setup-go-work
        run: make setup-go-work
      - name: Generate mocks
        run: make mocks
      - name: Check mocks
        run: if [[ -n $(git status --porcelain) ]]; then echo "Please update the mocks using `make mocks`"; exit 1; fi
  check-go-mod-tidy:
    name: Check go mod tidy
    needs: go
    runs-on: ubuntu-22.04
    container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
    defaults:
      run:
        working-directory: server
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Run setup-go-work
        run: make setup-go-work
      - name: Run go mod tidy
        run: make modules-tidy
      - name: Check modules
        run: if [[ -n $(git status --porcelain) ]]; then echo "Please tidy up the Go modules using make modules-tidy"; git diff; exit 1; fi
  check-go-fix:
    name: Check go fix
    needs: go
    runs-on: ubuntu-22.04
    container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
    defaults:
      run:
        working-directory: server
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Run setup-go-work
        run: make setup-go-work
      - name: Run go fix
        run: go fix ./...
      - name: Check go fix
        run: if [[ -n $(git status --porcelain) ]]; then echo "Please run 'go fix ./...' and commit the changes"; git diff; exit 1; fi
  check-style:
    name: check-style
    needs: go
    runs-on: ubuntu-22.04
    container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
    defaults:
      run:
        working-directory: server
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Run setup-go-work
        run: make setup-go-work
      - name: Run golangci
        run: make check-style
  check-gen-serialized:
    name: Check serialization methods for hot structs
    needs: go
    runs-on: ubuntu-22.04
    container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
    defaults:
      run:
        working-directory: server
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Run setup-go-work
        run: make setup-go-work
      - name: Run make-gen-serialized
        run: make gen-serialized
      - name: Check serialized
        run: if [[ -n $(git status --porcelain) ]]; then echo "Please update the serialized files using 'make gen-serialized'"; exit 1; fi
  check-mattermost-vet-api:
    name: Vet API
    needs: go
    runs-on: ubuntu-22.04
    container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
    defaults:
      run:
        working-directory: server
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Run setup-go-work
        run: make setup-go-work
      - name: Run mattermost-vet-api
        run: make vet-api
  check-migrations:
    name: Check migration files
    needs: go
    runs-on: ubuntu-22.04
    container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
    defaults:
      run:
        working-directory: server
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Extract migrations files
        run: make migrations-extract
      - name: Check migration files
        run: if [[ -n $(git status --porcelain) ]]; then echo "Please update the migrations using make migrations-extract"; exit 1; fi
  check-email-templates:
    name: Generate email templates
    needs: go
    runs-on: ubuntu-22.04
    container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
    defaults:
      run:
        working-directory: server
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Generate email templates
        run: |
          npm install -g mjml@4.9.0
          make build-templates          
      - name: Check generated email templates
        run: if [[ -n $(git status --porcelain) ]]; then echo "Please update the email templates using `make build-templates`"; exit 1; fi
  check-store-layers:
    name: Check store layers
    needs: go
    runs-on: ubuntu-22.04
    container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
    defaults:
      run:
        working-directory: server
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Run setup-go-work
        run: make setup-go-work
      - name: Generate store layers
        run: make store-layers
      - name: Check generated code
        run: if [[ -n $(git status --porcelain) ]]; then echo "Please update the store layers using make store-layers"; exit 1; fi
  check-default-roles-permissions:
    name: Check default roles permissions
    needs: go
    runs-on: ubuntu-22.04
    container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
    permissions:
      contents: read
    services:
      postgres:
        image: postgres:14
        env:
          POSTGRES_USER: mmuser
          POSTGRES_PASSWORD: mostest
        options: >-
          --health-cmd pg_isready
          --health-interval 5s
          --health-timeout 5s
          --health-retries 5          
    defaults:
      run:
        working-directory: server
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Run setup-go-work
        run: make setup-go-work
      - name: Generate default roles permissions
        env:
          IS_CI: "true"
        run: make default-roles-permissions
      - name: Check generated code
        run: if [[ -n $(git status --porcelain) ]]; then echo "Please update the default roles permissions using make default-roles-permissions"; exit 1; fi
  check-mmctl-docs:
    name: Check mmctl docs
    needs: go
    runs-on: ubuntu-22.04
    container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
    defaults:
      run:
        working-directory: server
    steps:
      - name: Checkout mattermost-server
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Run setup-go-work
        run: make setup-go-work
      - name: Check docs
        run: |
          echo "Making sure docs are updated"
          make mmctl-docs
          if [[ -n $(git status --porcelain) ]]; then echo "Please update the mmctl docs using make mmctl-docs"; exit 1; fi          
  # NOTE: Postgres with binary parameters has been moved to server-ci-weekly.yml
  # (runs Monday 1am EST / 5am UTC). Low regression risk doesn't justify
  # consuming 8-core runners on every push.

  # -- Sharded into 4 parallel runners for ~88% wall-time improvement --
  test-postgres-normal:
    name: Postgres (shard ${{ matrix.shard }})
    needs: go
    strategy:
      fail-fast: false # Let all shards complete so we get full test results
      matrix:
        shard: [0, 1, 2, 3]
    uses: ./.github/workflows/server-test-template.yml
    secrets: inherit
    with:
      name: "Postgres (shard ${{ matrix.shard }})"
      datasource: postgres://mmuser:mostest@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
      drivername: postgres
      # Each shard gets a unique artifact name so they don't collide
      logsartifact: "postgres-server-test-logs-shard-${{ matrix.shard }}"
      enablecoverage: ${{ github.event_name != 'pull_request' || !startsWith(github.event.pull_request.base.ref, 'release-') }}
      go-version: ${{ needs.go.outputs.version }}
      fips-enabled: false
      shard-index: ${{ matrix.shard }}
      shard-total: 4
  # -- Merge test results (handles both single-run and future sharded runs) --
  merge-postgres-test-results:
    name: Merge Postgres Test Results
    needs: test-postgres-normal
    if: always()
    uses: ./.github/workflows/server-test-merge-template.yml
    with:
      artifact-pattern: postgres-server-test-logs-shard-*
      artifact-name: postgres-server-test-logs
      save-timing-cache: true
      all-shards-passed: ${{ needs.test-postgres-normal.result == 'success' }}

  test-elasticsearch-v8:
    name: Elasticsearch v8 Compatibility
    needs: go
    uses: ./.github/workflows/server-test-template.yml
    secrets: inherit
    with:
      name: Elasticsearch v8 Compatibility
      datasource: postgres://mmuser:mostest@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
      drivername: postgres
      logsartifact: elasticsearch-v8-server-test-logs
      go-version: ${{ needs.go.outputs.version }}
      fips-enabled: false
      elasticsearch-version: "8.9.0"
      test-target: "test-server-elasticsearch"

  test-opensearch-v2:
    name: OpenSearch v2 Compatibility
    needs: go
    uses: ./.github/workflows/server-test-template.yml
    secrets: inherit
    with:
      name: OpenSearch v2 Compatibility
      datasource: postgres://mmuser:mostest@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
      drivername: postgres
      logsartifact: opensearch-v2-server-test-logs
      go-version: ${{ needs.go.outputs.version }}
      fips-enabled: false
      opensearch-version: "2.19.0"
      test-target: "test-server-opensearch"

  # FIPS tests: run on PRs when go.mod changed or branch name contains "fips".
  # Sharded for fast iteration. Weekly workflow provides regular full coverage.
  test-postgres-normal-fips:
    if: contains(github.head_ref, 'fips') || needs.go.outputs.gomod-changed == 'true'
    name: "Postgres FIPS (shard ${{ matrix.shard }})"
    needs: go
    strategy:
      fail-fast: false
      matrix:
        shard: [0, 1, 2, 3]
    uses: ./.github/workflows/server-test-template.yml
    secrets: inherit
    with:
      name: "Postgres FIPS (shard ${{ matrix.shard }})"
      datasource: postgres://mmuser:mostest-fips-test@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
      drivername: postgres
      logsartifact: "postgres-server-fips-test-logs-shard-${{ matrix.shard }}"
      go-version: ${{ needs.go.outputs.version }}
      fips-enabled: true
      shard-index: ${{ matrix.shard }}
      shard-total: 4
  merge-postgres-fips-test-results:
    name: Merge Postgres FIPS Test Results
    needs: test-postgres-normal-fips
    if: needs.test-postgres-normal-fips.result != 'skipped'
    uses: ./.github/workflows/server-test-merge-template.yml
    with:
      artifact-pattern: postgres-server-fips-test-logs-shard-*
      artifact-name: postgres-server-fips-test-logs

  test-mmctl:
    name: Run mmctl tests
    needs: go
    uses: ./.github/workflows/mmctl-test-template.yml
    secrets: inherit
    with:
      name: mmctl
      datasource: postgres://mmuser:mostest@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
      drivername: postgres
      logsartifact: mmctl-test-logs
      go-version: ${{ needs.go.outputs.version }}
      fips-enabled: false
  test-mmctl-fips:
    if: contains(github.head_ref, 'fips') || needs.go.outputs.gomod-changed == 'true'
    name: Run mmctl tests (FIPS)
    needs: go
    uses: ./.github/workflows/mmctl-test-template.yml
    secrets: inherit
    with:
      name: mmctl
      datasource: postgres://mmuser:mostest-fips-test@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
      drivername: postgres
      logsartifact: mmctl-fips-test-logs
      go-version: ${{ needs.go.outputs.version }}
      fips-enabled: true

  build-mattermost-server:
    name: Build mattermost server app
    needs: go
    runs-on: ubuntu-22.04
    container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
    defaults:
      run:
        working-directory: server
    env:
      BUILD_NUMBER: "${GITHUB_HEAD_REF}-${GITHUB_RUN_ID}"
      FIPS_ENABLED: false
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: ci/setup-node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: ".nvmrc"
          cache: "npm"
          cache-dependency-path: "webapp/package-lock.json"
      - name: Run setup-go-work
        run: make setup-go-work
      - name: Build
        run: |
          make config-reset
          make build-cmd
          make package          
      - name: Persist dist artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: server-dist-artifact
          path: server/dist/
          if-no-files-found: error
          compression-level: 0
          retention-days: 2
      - name: Persist build artifacts
        if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: server-build-artifact
          path: server/build/
          retention-days: 2