mattermost/.github/workflows/server-test-template.yml

name: Server Test Template
on:
  workflow_call:
    inputs:
      name:
        required: true
        type: string
      datasource:
        required: true
        type: string
      drivername:
        required: true
        type: string
      logsartifact:
        required: true
        type: string
      fullyparallel:
        required: false
        type: boolean
        default: true
      allow-failure:
        required: false
        type: boolean
        default: false
      enablecoverage:
        required: false
        type: boolean
        default: false
      go-version:
        required: true
        type: string
      fips-enabled:
        required: false
        default: false
        type: boolean
      elasticsearch-version:
        required: false
        type: string
        default: "9.0.0"
      opensearch-version:
        required: false
        type: string
        default: "3.0.0"
      test-target:
        required: false
        type: string
        default: "test-server"
      # -- Test sharding inputs (leave defaults for non-sharded callers) --
      shard-index:
        required: false
        type: number
        default: -1 # -1 = no sharding; run all tests
      shard-total:
        required: false
        type: number
        default: 1
      runner:
        description: "GitHub-hosted runner label (default: ubuntu-latest-8-cores)"
        required: false
        type: string
        default: "ubuntu-latest-8-cores"
      race-enabled:
        description: "Run tests with Go race detector (-race)"
        required: false
        type: boolean
        default: false

permissions:
  contents: read

jobs:
  test:
    name: ${{ inputs.name }}
    runs-on: ${{ inputs.runner }}
    continue-on-error: ${{ inputs.allow-failure }} # Used to avoid blocking PRs in case of flakiness
    env:
      COMPOSE_PROJECT_NAME: ghactions
    steps:
      - name: buildenv/docker-login
        # Only FIPS requires login for private build container. (Forks won't have credentials.)
        if: inputs.fips-enabled
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Restore test timing data
        if: inputs.shard-total > 1
        id: timing-cache
        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: |
            server/prev-report.xml
            server/prev-gotestsum.json            
          # Always restore from master — timing is only saved on the default
          # branch and is stable enough for shard balancing.
          # NOTE: the v2 prefix invalidates pre-existing caches that were
          # poisoned by shard failures (a killed shard loses its gotestsum.json,
          # so the merged report was missing those packages' timings; on the
          # next run they all defaulted to 1ms and bin-packed onto the lightest
          # shard, overloading it and perpetuating the cycle). See also the
          # all-shards-passed guard in server-test-merge-template.yml.
          key: server-test-timing-v2-master
          restore-keys: |
            server-test-timing-v2-            

      - name: Setup BUILD_IMAGE
        id: build
        run: |
          if [[ ${{ inputs.fips-enabled }} == 'true' ]]; then
            echo "BUILD_IMAGE=mattermost/mattermost-build-server-fips:${{ inputs.go-version }}" >> "${GITHUB_OUTPUT}"
            echo "LOG_ARTIFACT_NAME=${{ inputs.logsartifact }}-fips" >> "${GITHUB_OUTPUT}"
          else
            echo "BUILD_IMAGE=mattermost/mattermost-build-server:${{ inputs.go-version }}" >> "${GITHUB_OUTPUT}"
            echo "LOG_ARTIFACT_NAME=${{ inputs.logsartifact }}" >> "${GITHUB_OUTPUT}"
          fi          

      - name: Store required variables for publishing results
        run: |
          echo "${{ inputs.name }}" > server/test-name
          echo "${{ github.event.pull_request.number }}" > server/pr-number          

      - name: Run docker compose
        env:
          ELASTICSEARCH_VERSION: ${{ inputs.elasticsearch-version }}
          OPENSEARCH_VERSION: ${{ inputs.opensearch-version }}
          POSTGRES_PASSWORD: ${{ inputs.fips-enabled && 'mostest-fips-test' || 'mostest' }}
        run: |
          cd server/build
          docker compose --ansi never run --rm start_dependencies
          cat ../tests/custom-schema-objectID.ldif | docker compose --ansi never exec -T openldap bash -c 'ldapadd -Y EXTERNAL -H ldapi:/// -w mostest || true';
          cat ../tests/custom-schema-cpa.ldif | docker compose --ansi never exec -T openldap bash -c 'ldapadd -Y EXTERNAL -H ldapi:/// -w mostest || true';
          cat ../tests/test-data.ldif | docker compose --ansi never exec -T openldap bash -c 'ldapadd -x -D "cn=admin,dc=mm,dc=test,dc=com" -w mostest';
          docker compose --ansi never exec -T minio sh -c 'mkdir -p /data/mattermost-test';
          docker compose --ansi never ps          

      # ── Test-level sharding ────────────────────────────────────────────
      # When shard-total > 1, we split tests across N parallel runners.
      #
      # Two-tier splitting strategy:
      #   - "Light" packages (< 5 min): assigned whole to a shard
      #   - "Heavy" packages (≥ 5 min, e.g. api4, app): individual tests
      #     are distributed across shards using -run regex filters
      #
      # See server/scripts/shard-split.js for the full algorithm.
      # ─────────────────────────────────────────────────────────────────────

      - name: Setup Go for test discovery
        if: inputs.shard-total > 1
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: ${{ inputs.go-version }}

      - name: Split tests across shards
        if: inputs.shard-total > 1
        id: test_split
        working-directory: server
        env:
          SHARD_INDEX: ${{ inputs.shard-index }}
          SHARD_TOTAL: ${{ inputs.shard-total }}
        run: |
          set -euo pipefail

          # ── List all test packages ──
          echo "::group::Listing test packages"
          TE_PKGS=$(find ./public/ ./ -name '*_test.go' -not -path './enterprise/*' -not -path './cmd/mmctl/*' 2>/dev/null \
            | sed 's|/[^/]*$||' | sort -u \
            | sed 's|^\./|github.com/mattermost/mattermost/server/v8/|' \
            | sed 's|github.com/mattermost/mattermost/server/v8/public/|github.com/mattermost/mattermost/server/public/|')
          EE_PKGS=$(find ./enterprise/ -name '*_test.go' 2>/dev/null \
            | sed 's|/[^/]*$||' | sort -u \
            | sed 's|^\./|github.com/mattermost/mattermost/server/v8/|')
          ALL_PKGS=$(printf '%s\n%s' "$TE_PKGS" "$EE_PKGS" | grep -v '^$' | sort -u)
          TOTAL_PKGS=$(echo "$ALL_PKGS" | wc -l)
          echo "Found $TOTAL_PKGS test packages"
          echo "::endgroup::"

          if [[ "$TOTAL_PKGS" -eq 0 ]]; then
            echo "WARNING: No test packages found"
            echo "has_packages=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          echo "$ALL_PKGS" > all-packages.txt

          # ── Create go.work for test discovery ──
          # Without it, `go test -list` in shard-split.js resolves
          # github.com/mattermost/mattermost/server/public against the published
          # module version from server/go.mod, which lags HEAD and causes build
          # failures when heavy packages reference new symbols in ./public.
          go work init
          go work use . ./public

          # ── Run shard solver ──
          node scripts/shard-split.js

          echo "has_packages=true" >> "$GITHUB_OUTPUT"          

      - name: Run Tests
        env:
          BUILD_IMAGE: ${{ steps.build.outputs.BUILD_IMAGE }}
        run: |
          if [[ "${{ inputs.race-enabled }}" == "true" ]]; then
            export RACE_MODE="-race"
          fi

          TEST_TARGET="${{ inputs.test-target }}${RACE_MODE}"
          BUILD_NUMBER="${GITHUB_HEAD_REF}-${GITHUB_RUN_ID}"
          DOCKER_CMD="make ${TEST_TARGET}"

          # When sharding is active, use the multi-run wrapper script.
          # run-shard-tests.sh detects heavy runs itself and falls back to
          # light-only mode when shard-heavy-runs.txt is absent or empty.
          if [[ "${{ inputs.shard-total }}" -gt 1 && -f server/shard-te-packages.txt ]]; then
            cp server/scripts/run-shard-tests.sh server/run-shard-tests.sh
            chmod +x server/run-shard-tests.sh
            DOCKER_CMD="/mattermost/server/run-shard-tests.sh"
          fi

          docker run --net ghactions_mm-test \
            --ulimit nofile=8096:8096 \
            --env-file=server/build/dotenv/test.env \
            --env MM_SQLSETTINGS_DRIVERNAME="${{ inputs.drivername }}" \
            --env MM_SQLSETTINGS_DATASOURCE="${{ inputs.datasource }}" \
            --env TEST_DATABASE_POSTGRESQL_DSN="${{ inputs.datasource }}" \
            --env ENABLE_FULLY_PARALLEL_TESTS="${{ inputs.fullyparallel }}" \
            --env ENABLE_COVERAGE="${{ inputs.enablecoverage }}" \
            --env FIPS_ENABLED="${{ inputs.fips-enabled }}" \
            --env RACE_MODE \
            --env TEST_TARGET \
            --env BUILD_NUMBER \
            -v $PWD:/mattermost \
            -w /mattermost/server \
            $BUILD_IMAGE \
            $DOCKER_CMD          
      - name: Upload coverage to Codecov
        if: ${{ inputs.enablecoverage }}
        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          disable_search: true
          files: server/cover.out
          flags: server

      - name: Stop docker compose
        run: |
          cd server/build
          docker compose --ansi never stop          

      - name: Archive logs
        if: ${{ always() }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ${{ steps.build.outputs.LOG_ARTIFACT_NAME }}
          path: |
            server/gotestsum.json
            server/report.xml
            server/cover.out
            server/test-name
            server/pr-number