mattermost/.github/workflows/server-ci.yml

# NOTE: This workflow name is referenced by other workflows:
# - server-ci-artifacts.yml
# - server-ci-report.yml
# - sentry.yaml
# If you rename this workflow, be sure to update those workflows as well.
name: Server CI
on:
  push:
    branches:
      - master
      - release-*
  pull_request:
    paths:
      - "server/**"
      - ".github/workflows/server-ci.yml"
      - ".github/workflows/server-test-template.yml"
      - ".github/workflows/mmctl-test-template.yml"
      - "!server/build/Dockerfile.buildenv"
      - "!server/build/Dockerfile.buildenv-fips"
      - "tools/mattermost-govet/**"
      - "!server/**/*.md"
      - "!server/NOTICE.txt"
      - "!server/CHANGELOG.md"

concurrency:
  group: ${{ github.event_name == 'pull_request' && format('{0}-{1}', github.workflow, github.ref) || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  go:
    name: Compute Go Version
    runs-on: ubuntu-22.04
    outputs:
      version: ${{ steps.calculate.outputs.GO_VERSION }}
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Calculate version
        id: calculate
        working-directory: server/
        run: echo GO_VERSION=$(cat .go-version) >> "${GITHUB_OUTPUT}"
  check-mocks:
    name: Check mocks
    needs: go
    runs-on: ubuntu-22.04
    container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
    defaults:
      run:
        working-directory: server
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Run setup-go-work
        run: make setup-go-work
      - name: Generate mocks
        run: make mocks
      - name: Check mocks
        run: if [[ -n $(git status --porcelain) ]]; then echo "Please update the mocks using `make mocks`"; exit 1; fi
  check-go-mod-tidy:
    name: Check go mod tidy
    needs: go
    runs-on: ubuntu-22.04
    container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
    defaults:
      run:
        working-directory: server
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Run setup-go-work
        run: make setup-go-work
      - name: Run go mod tidy
        run: make modules-tidy
      - name: Check modules
        run: if [[ -n $(git status --porcelain) ]]; then echo "Please tidy up the Go modules using make modules-tidy"; git diff; exit 1; fi
  check-style:
    name: check-style
    needs: go
    runs-on: ubuntu-22.04
    container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
    defaults:
      run:
        working-directory: server
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Run setup-go-work
        run: make setup-go-work
      - name: Run golangci
        run: make check-style
  check-gen-serialized:
    name: Check serialization methods for hot structs
    needs: go
    runs-on: ubuntu-22.04
    container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
    defaults:
      run:
        working-directory: server
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Run setup-go-work
        run: make setup-go-work
      - name: Run make-gen-serialized
        run: make gen-serialized
      - name: Check serialized
        run: if [[ -n $(git status --porcelain) ]]; then echo "Please update the serialized files using 'make gen-serialized'"; exit 1; fi
  check-mattermost-vet-api:
    name: Vet API
    needs: go
    runs-on: ubuntu-22.04
    container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
    defaults:
      run:
        working-directory: server
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Run setup-go-work
        run: make setup-go-work
      - name: Run mattermost-vet-api
        run: make vet-api
  check-migrations:
    name: Check migration files
    needs: go
    runs-on: ubuntu-22.04
    container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
    defaults:
      run:
        working-directory: server
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Extract migrations files
        run: make migrations-extract
      - name: Check migration files
        run: if [[ -n $(git status --porcelain) ]]; then echo "Please update the migrations using make migrations-extract"; exit 1; fi
  check-email-templates:
    name: Generate email templates
    needs: go
    runs-on: ubuntu-22.04
    container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
    defaults:
      run:
        working-directory: server
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Generate email templates
        run: |
          npm install -g mjml@4.9.0
          make build-templates          
      - name: Check generated email templates
        run: if [[ -n $(git status --porcelain) ]]; then echo "Please update the email templates using `make build-templates`"; exit 1; fi
  check-store-layers:
    name: Check store layers
    needs: go
    runs-on: ubuntu-22.04
    container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
    defaults:
      run:
        working-directory: server
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Run setup-go-work
        run: make setup-go-work
      - name: Generate store layers
        run: make store-layers
      - name: Check generated code
        run: if [[ -n $(git status --porcelain) ]]; then echo "Please update the store layers using make store-layers"; exit 1; fi
  check-mmctl-docs:
    name: Check mmctl docs
    needs: go
    runs-on: ubuntu-22.04
    container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
    defaults:
      run:
        working-directory: server
    steps:
      - name: Checkout mattermost-server
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Run setup-go-work
        run: make setup-go-work
      - name: Check docs
        run: |
          echo "Making sure docs are updated"
          make mmctl-docs
          if [[ -n $(git status --porcelain) ]]; then echo "Please update the mmctl docs using make mmctl-docs"; exit 1; fi          
  test-postgres-binary:
    if: github.event_name == 'push' # Only run postgres binary tests on master/release pushes: odds are low this regresses, so save the cycles for pull requests.
    name: Postgres with binary parameters
    needs: go
    uses: ./.github/workflows/server-test-template.yml
    secrets: inherit
    with:
      name: Postgres with binary parameters
      datasource: postgres://mmuser:mostest@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10&binary_parameters=yes
      drivername: postgres
      logsartifact: postgres-binary-server-test-logs
      go-version: ${{ needs.go.outputs.version }}
      fips-enabled: false
  # -- Sharded into 4 parallel runners for ~88% wall-time improvement --
  test-postgres-normal:
    name: Postgres (shard ${{ matrix.shard }})
    needs: go
    strategy:
      fail-fast: false # Let all shards complete so we get full test results
      matrix:
        shard: [0, 1, 2, 3]
    uses: ./.github/workflows/server-test-template.yml
    secrets: inherit
    with:
      name: "Postgres (shard ${{ matrix.shard }})"
      datasource: postgres://mmuser:mostest@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
      drivername: postgres
      # Each shard gets a unique artifact name so they don't collide
      logsartifact: "postgres-server-test-logs-shard-${{ matrix.shard }}"
      go-version: ${{ needs.go.outputs.version }}
      fips-enabled: false
      shard-index: ${{ matrix.shard }}
      shard-total: 4
  # -- Merge test results (handles both single-run and future sharded runs) --
  merge-postgres-test-results:
    name: Merge Postgres Test Results
    needs: test-postgres-normal
    if: always()
    runs-on: ubuntu-22.04
    steps:
      - name: Download all shard artifacts
        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
        with:
          pattern: postgres-server-test-logs-shard-*
          path: shards

      - name: Setup Node for junit-report-merger
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: 20

      - name: Merge JUnit reports
        run: |
          npx junit-report-merger@7.0.0 merged-report.xml "shards/*/report.xml"          

      # Prepare files with expected names for the report workflow
      - name: Prepare merged artifact
        run: |
          mkdir -p merged
          cp merged-report.xml merged/report.xml
          # Find the first shard artifact that has test-name and pr-number
          for dir in shards/postgres-server-test-logs-shard-*/; do
            if [[ -f "${dir}test-name" ]]; then
              cp "${dir}test-name" merged/test-name
              cp "${dir}pr-number" merged/pr-number
              break
            fi
          done          

      # Upload merged artifact with the name the report workflow expects
      - name: Upload merged test logs
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: postgres-server-test-logs
          path: merged/

      # Save merged timing data for future shard balancing.
      # Includes both JUnit XML (package-level) and gotestsum.json (per-test).
      - name: Prepare timing cache
        id: timing-prep
        run: |
          mkdir -p server
          # Only save timing cache if we have real data (merged report > 1KB).
          # Failed runs produce tiny/empty files that would overwrite good data.
          if [[ -f merged-report.xml && $(stat -c%s merged-report.xml) -gt 1024 ]]; then
            cp merged-report.xml server/prev-report.xml
            # Merge gotestsum.json (JSONL) from all shards for per-test timing
            cat shards/*/gotestsum.json > server/prev-gotestsum.json 2>/dev/null || true
            echo "has_timing=true" >> "$GITHUB_OUTPUT"
          else
            echo "Skipping timing cache — merged report too small or missing"
            echo "has_timing=false" >> "$GITHUB_OUTPUT"
          fi          

      - name: Save test timing cache
        # Only save timing on the default branch. PR branches restore from
        # master via restore-keys prefix match. Timing data is stable day-to-day
        # so this eliminates cache misses on first PR runs.
        if: steps.timing-prep.outputs.has_timing == 'true' && github.ref_name == github.event.repository.default_branch
        uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: |
            server/prev-report.xml
            server/prev-gotestsum.json            
          key: server-test-timing-master-${{ github.run_id }}

  test-postgres-normal-fips:
    # FIPS compile check already runs in enterprise CI for PRs.
    # Only run full FIPS tests on pushes to the default branch.
    if: github.event_name == 'push'
    name: Postgres (FIPS)
    needs: go
    uses: ./.github/workflows/server-test-template.yml
    secrets: inherit
    with:
      name: Postgres
      datasource: postgres://mmuser:mostest-fips-test@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
      drivername: postgres
      logsartifact: postgres-server-test-logs
      go-version: ${{ needs.go.outputs.version }}
      fips-enabled: true
  test-coverage:
    name: Generate Test Coverage
    # Disabled: Running out of memory and causing spurious failures.
    # Old condition: ${{ github.event_name != 'pull_request' || !startsWith(github.event.pull_request.base.ref, 'release-') }}
    if: false
    needs: go
    uses: ./.github/workflows/server-test-template.yml
    secrets: inherit
    with:
      name: Generate Test Coverage
      datasource: postgres://mmuser:mostest@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
      drivername: postgres
      logsartifact: coverage-server-test-logs
      fullyparallel: true
      enablecoverage: true
      go-version: ${{ needs.go.outputs.version }}
  test-mmctl:
    name: Run mmctl tests
    needs: go
    uses: ./.github/workflows/mmctl-test-template.yml
    secrets: inherit
    with:
      name: mmctl
      datasource: postgres://mmuser:mostest@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
      drivername: postgres
      logsartifact: mmctl-test-logs
      go-version: ${{ needs.go.outputs.version }}
      fips-enabled: false
  test-mmctl-fips:
    name: Run mmctl tests (FIPS)
    # Skip FIPS testing for forks, which won't have docker login credentials.
    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
    needs: go
    uses: ./.github/workflows/mmctl-test-template.yml
    secrets: inherit
    with:
      name: mmctl
      datasource: postgres://mmuser:mostest-fips-test@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
      drivername: postgres
      logsartifact: mmctl-test-logs
      go-version: ${{ needs.go.outputs.version }}
      fips-enabled: true
  build-mattermost-server:
    name: Build mattermost server app
    needs: go
    runs-on: ubuntu-22.04
    container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
    defaults:
      run:
        working-directory: server
    env:
      BUILD_NUMBER: "${GITHUB_HEAD_REF}-${GITHUB_RUN_ID}"
      FIPS_ENABLED: false
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: ci/setup-node
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version-file: ".nvmrc"
          cache: "npm"
          cache-dependency-path: "webapp/package-lock.json"
      - name: Run setup-go-work
        run: make setup-go-work
      - name: Build
        run: |
          make config-reset
          make build-cmd
          make package          
      - name: Persist dist artifacts
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: server-dist-artifact
          path: server/dist/
          if-no-files-found: error
          compression-level: 0
          retention-days: 2
      - name: Persist build artifacts
        if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: server-build-artifact
          path: server/build/
          retention-days: 2