snapshot of https://github.com/mattermost/mattermost.git (master, 2026-09-16; blobs > 131072B omitted)

.github/workflows/server-ci.yml

@@ -0,0 +1,479 @@
+# NOTE: This workflow name is referenced by other workflows:
+# - server-ci-artifacts.yml
+# - server-ci-report.yml
+# - sentry.yaml
+# If you rename this workflow, be sure to update those workflows as well.
+name: Server CI
+on:
+  workflow_dispatch:  # Allow manual/API triggering for linked plugin CI
+  push:
+    branches:
+      - master
+      - release-*
+  pull_request:
+
+concurrency:
+  group: ${{ github.event_name == 'pull_request' && format('{0}-{1}', github.workflow, github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
+jobs:
+  buildenv:
+    name: Build Environment
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+      pull-requests: read
+      actions: write
+      id-token: write  # for chainguard (FIPS base image pull)
+    outputs:
+      build-server-tag: ${{ steps.calculate.outputs.BUILD_SERVER_TAG }}
+      gomod-changed: ${{ steps.changed-files.outputs.any_changed }}
+      # Individual jobs below use this to skip via `if:` rather
+      # than the workflow being skipped entirely,
+      # so required status checks always get reported.
+      relevant-changed: ${{ github.event_name != 'pull_request' || steps.changed-relevant.outputs.any_changed == 'true' }}
+    steps:
+      - name: Checkout mattermost project
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Calculate build image tag
+        id: calculate
+        working-directory: server/
+        run: |
+          tag=$(./build/buildenv-tag.sh)
+          echo "BUILD_SERVER_TAG=${tag}" >> "${GITHUB_OUTPUT}"
+      - name: Check for go.mod changes
+        id: changed-files
+        uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323  # v47.0.5
+        with:
+          files: |
+            **/go.mod
+      - name: Check for relevant Server CI path changes
+        id: changed-relevant
+        if: github.event_name == 'pull_request'
+        uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323  # v47.0.5
+        with:
+          files: |
+            server/**
+            .github/workflows/server-ci.yml
+            .github/workflows/server-test-template.yml
+            .github/workflows/server-test-merge-template.yml
+            .github/workflows/mmctl-test-template.yml
+            .github/actions/setup-buildenv/**
+            .github/actions/load-buildenv/**
+            .github/actions/run-in-buildenv/**
+            tools/mattermost-govet/**
+          files_ignore: |
+            server/**/*.md
+            server/NOTICE.txt
+            server/CHANGELOG.md
+      - name: Setup build environment
+        env:
+          CHAINCTL_IDENTITY: ee399b4c72dd4e58e3d617f78fc47b74733c9557/922f2d48307d6f5f
+          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+        uses: ./.github/actions/setup-buildenv
+        with:
+          build-server-tag: ${{ steps.calculate.outputs.BUILD_SERVER_TAG }}
+  check-generated:
+    name: Check generated files
+    needs: buildenv
+    if: needs.buildenv.outputs.relevant-changed == 'true'
+    runs-on: ubuntu-22.04
+    services:
+      # make default-roles-permissions snapshots a live database.
+      postgres:
+        image: postgres:15
+        env:
+          POSTGRES_USER: mmuser
+          POSTGRES_PASSWORD: mostest_password
+          POSTGRES_DB: mattermost_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 5
+    steps:
+      - name: Checkout mattermost project
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Restore Go cache
+        uses: ./.github/actions/restore-go-cache
+      - uses: ./.github/actions/run-in-buildenv
+        with:
+          run: |
+            export IS_CI=true
+            export TEST_DATABASE_POSTGRESQL_DSN="postgres://mmuser:mostest_password@localhost:5432/mattermost_test?sslmode=disable&connect_timeout=10"
+            make generated
+      - name: Check generated files
+        run: |
+          if [ -n "$(git status --porcelain)" ]; then
+            echo "Generated files are out of date. Please run 'make generated' and commit the result."
+            git status --porcelain
+            git diff
+            exit 1
+          fi
+  check-backport-migrations:
+    name: Check backport migrations
+    needs: buildenv
+    # Only backports (release-* base) must keep a migration's version+name; new master migrations are expected.
+    if: needs.buildenv.outputs.relevant-changed == 'true' && startsWith(github.base_ref, 'release-')
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout mattermost project
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Restore Go cache
+        uses: ./.github/actions/restore-go-cache
+      - name: Check for renumbered or renamed migrations
+        uses: ./.github/actions/run-in-buildenv
+        with:
+          run: |
+            git fetch --no-tags --depth=1 origin master "${{ github.base_ref }}"
+            export MM_MIGRATION_CHECK_BASE_REF="origin/${{ github.base_ref }}"
+            export MM_MIGRATION_CHECK_CANONICAL_REF="origin/master"
+            make check-backport-migrations
+  check-style:
+    name: check-style
+    needs: buildenv
+    if: needs.buildenv.outputs.relevant-changed == 'true'
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout mattermost project
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Restore Go cache
+        uses: ./.github/actions/restore-go-cache
+      - uses: ./.github/actions/run-in-buildenv
+        with:
+          run: make check-style
+  check-mattermost-vet-api:
+    name: Vet API
+    needs: buildenv
+    if: needs.buildenv.outputs.relevant-changed == 'true'
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout mattermost project
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Restore Go cache
+        uses: ./.github/actions/restore-go-cache
+      - uses: ./.github/actions/run-in-buildenv
+        with:
+          run: make vet-api
+  # NOTE: Postgres with binary parameters has been moved to server-ci-weekly.yml
+  # (runs Monday 1am EST / 5am UTC). Low regression risk doesn't justify
+  # consuming 8-core runners on every push.
+
+  # -- Sharded into 4 parallel runners for ~88% wall-time improvement --
+  test-postgres-normal:
+    name: Postgres (shard ${{ matrix.shard }})
+    needs: buildenv
+    if: needs.buildenv.outputs.relevant-changed == 'true'
+    strategy:
+      fail-fast: false  # Let all shards complete so we get full test results
+      matrix:
+        shard: [0, 1, 2, 3]
+    permissions:
+      contents: read
+      actions: write
+    uses: ./.github/workflows/server-test-template.yml
+    secrets:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+    with:
+      name: "Postgres (shard ${{ matrix.shard }})"
+      datasource: postgres://mmuser:mostest_password@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
+      drivername: postgres
+      # Each shard gets a unique artifact name so they don't collide
+      logsartifact: "postgres-server-test-logs-shard-${{ matrix.shard }}"
+      enablecoverage: ${{ github.event_name != 'pull_request' || !startsWith(github.event.pull_request.base.ref, 'release-') }}
+      build-server-tag: ${{ needs.buildenv.outputs.build-server-tag }}
+      fips-enabled: false
+      shard-index: ${{ matrix.shard }}
+      shard-total: 4
+  # -- Merge test results (handles both single-run and future sharded runs) --
+  merge-postgres-test-results:
+    name: Merge Postgres Test Results
+    needs: test-postgres-normal
+    if: always() && needs.test-postgres-normal.result != 'skipped'
+    permissions:
+      contents: read
+      actions: write
+    uses: ./.github/workflows/server-test-merge-template.yml
+    with:
+      artifact-pattern: postgres-server-test-logs-shard-*
+      artifact-name: postgres-server-test-logs
+      save-timing-cache: true
+      all-shards-passed: ${{ needs.test-postgres-normal.result == 'success' }}
+
+  test-elasticsearch-v8:
+    name: Elasticsearch v8 Compatibility
+    needs: buildenv
+    if: needs.buildenv.outputs.relevant-changed == 'true'
+    permissions:
+      contents: read
+      actions: write
+    uses: ./.github/workflows/server-test-template.yml
+    with:
+      name: Elasticsearch v8 Compatibility
+      datasource: postgres://mmuser:mostest_password@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
+      drivername: postgres
+      logsartifact: elasticsearch-v8-server-test-logs
+      build-server-tag: ${{ needs.buildenv.outputs.build-server-tag }}
+      fips-enabled: false
+      elasticsearch-version: "8.9.0"
+      test-target: "test-server-elasticsearch"
+
+  test-opensearch-v2:
+    name: OpenSearch v2 Compatibility
+    needs: buildenv
+    if: needs.buildenv.outputs.relevant-changed == 'true'
+    permissions:
+      contents: read
+      actions: write
+    uses: ./.github/workflows/server-test-template.yml
+    with:
+      name: OpenSearch v2 Compatibility
+      datasource: postgres://mmuser:mostest_password@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
+      drivername: postgres
+      logsartifact: opensearch-v2-server-test-logs
+      build-server-tag: ${{ needs.buildenv.outputs.build-server-tag }}
+      fips-enabled: false
+      opensearch-version: "2.19.0"
+      test-target: "test-server-opensearch"
+
+  # FIPS tests: run on PRs when go.mod changed or branch name contains "fips".
+  # Sharded for fast iteration. Weekly workflow provides regular full coverage.
+  test-postgres-normal-fips:
+    if: >-
+      needs.buildenv.outputs.relevant-changed == 'true' &&
+      (contains(github.head_ref, 'fips') || needs.buildenv.outputs.gomod-changed == 'true')
+    name: "Postgres FIPS (shard ${{ matrix.shard }})"
+    needs: buildenv
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [0, 1, 2, 3]
+    permissions:
+      contents: read
+      actions: write
+    uses: ./.github/workflows/server-test-template.yml
+    secrets:
+      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+    with:
+      name: "Postgres FIPS (shard ${{ matrix.shard }})"
+      datasource: postgres://mmuser:mostest_password@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
+      drivername: postgres
+      logsartifact: "postgres-server-fips-test-logs-shard-${{ matrix.shard }}"
+      build-server-tag: ${{ needs.buildenv.outputs.build-server-tag }}
+      fips-enabled: true
+      shard-index: ${{ matrix.shard }}
+      shard-total: 4
+  merge-postgres-fips-test-results:
+    name: Merge Postgres FIPS Test Results
+    needs: test-postgres-normal-fips
+    if: needs.test-postgres-normal-fips.result != 'skipped'
+    permissions:
+      contents: read
+      actions: write
+    uses: ./.github/workflows/server-test-merge-template.yml
+    with:
+      artifact-pattern: postgres-server-fips-test-logs-shard-*
+      artifact-name: postgres-server-fips-test-logs
+
+  test-mmctl:
+    name: Run mmctl tests
+    needs: buildenv
+    if: needs.buildenv.outputs.relevant-changed == 'true'
+    permissions:
+      contents: read
+      actions: write
+    uses: ./.github/workflows/mmctl-test-template.yml
+    secrets:
+      MM_E2E_ZEPHYR_API_KEY: ${{ secrets.MM_E2E_ZEPHYR_API_KEY }}
+    with:
+      name: mmctl
+      datasource: postgres://mmuser:mostest_password@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
+      drivername: postgres
+      logsartifact: mmctl-test-logs
+      build-server-tag: ${{ needs.buildenv.outputs.build-server-tag }}
+      fips-enabled: false
+  test-mmctl-fips:
+    if: >-
+      needs.buildenv.outputs.relevant-changed == 'true' &&
+      (contains(github.head_ref, 'fips') || needs.buildenv.outputs.gomod-changed == 'true')
+    name: Run mmctl tests (FIPS)
+    needs: buildenv
+    permissions:
+      contents: read
+      actions: write
+    uses: ./.github/workflows/mmctl-test-template.yml
+    secrets:
+      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+      MM_E2E_ZEPHYR_API_KEY: ${{ secrets.MM_E2E_ZEPHYR_API_KEY }}
+    with:
+      name: mmctl
+      datasource: postgres://mmuser:mostest_password@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
+      drivername: postgres
+      logsartifact: mmctl-fips-test-logs
+      build-server-tag: ${{ needs.buildenv.outputs.build-server-tag }}
+      fips-enabled: true
+
+  build-mattermost-server:
+    name: Build mattermost server app
+    needs: buildenv
+    if: needs.buildenv.outputs.relevant-changed == 'true'
+    permissions:
+      contents: read
+      actions: write
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout mattermost project
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Restore Go cache
+        uses: ./.github/actions/restore-go-cache
+      - name: Build
+        uses: ./.github/actions/run-in-buildenv
+        with:
+          run: |
+            export BUILD_NUMBER="$(printf '%s' "${HEAD_REF:-${REF_NAME}}" | tr -c 'A-Za-z0-9._-' '-')-${RUN_ID}"
+            export FIPS_ENABLED=false
+            make config-reset
+            make build-cmd
+            make package
+      - name: Persist dist artifacts
+        if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
+        with:
+          name: server-dist-artifact
+          path: server/dist/
+          if-no-files-found: error
+          compression-level: 0
+          retention-days: 2
+      - name: Persist build artifacts
+        if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
+        with:
+          name: server-build-artifact
+          path: server/build/
+          retention-days: 2
+
+  # ci-complete is used to determine if the Server CI is complete since
+  # fips steps are optional and can be skipped. When we build with fips,
+  # we want to ensure that the Server CI is complete before running the
+  # artifacts upload workflow.
+  ci-complete:
+    name: Server CI Complete
+    if: >-
+      always() &&
+      (needs.test-mmctl-fips.result == 'success' || needs.test-mmctl-fips.result == 'skipped' || needs.test-mmctl-fips.result == 'failure') &&
+      (needs.merge-postgres-fips-test-results.result == 'success' || needs.merge-postgres-fips-test-results.result == 'skipped' || needs.merge-postgres-fips-test-results.result == 'failure')
+    permissions: {}
+    runs-on: ubuntu-22.04
+    needs:
+      - buildenv
+      - merge-postgres-test-results
+      - test-elasticsearch-v8
+      - test-opensearch-v2
+      - test-mmctl
+      - test-mmctl-fips
+      - build-mattermost-server
+      - merge-postgres-fips-test-results
+    steps:
+      - name: Server CI Complete
+        run: |
+          # Explicitly fail here rather than relying on `if:`, since a job
+          # skipped via `if:` is reported as "Success" by GitHub.
+          if [ "${{ needs.buildenv.result }}" != "success" ]; then
+            echo "::error::'buildenv' job did not succeed (result: ${{ needs.buildenv.result }}); relevant-changed could not be computed reliably. Failing Server CI Complete."
+            exit 1
+          fi
+          echo "Server CI Complete"
+
+  ci-report:
+    name: Server CI Report
+    # Skip cleanly (rather than fail) when no relevant Server CI paths
+    # changed, since none of the test jobs it reports on will have run.
+    if: always() && needs.buildenv.outputs.relevant-changed == 'true'
+    permissions:
+      contents: read
+      actions: read
+      checks: write
+      pull-requests: write
+      issues: write
+    needs:
+      - buildenv
+      - ci-complete
+    uses: ./.github/workflows/server-ci-report.yml
+    secrets:
+      WEBHOOK_URL_FLAKY_TEST: ${{ secrets.WEBHOOK_URL_FLAKY_TEST }}
+      WEBHOOK_AUTH_TOKEN_FLAKY_TEST: ${{ secrets.WEBHOOK_AUTH_TOKEN_FLAKY_TEST }}
+      WEBHOOK_URL_FLAKY_TEST_MM: ${{ secrets.WEBHOOK_URL_FLAKY_TEST_MM }}
+    with:
+      source-run-id: ${{ github.run_id }}
+      source-event: ${{ github.event_name }}
+      head-commit-id: ${{ github.event.pull_request.head.sha || github.sha }}
+      head-repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
+      workflow-url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+
+  ci-artifacts:
+    name: Server CI Artifacts
+    # Skip when no relevant Server CI paths changed, since build-mattermost-server
+    # (and thus server-dist-artifact) will not have run.
+    if: >-
+      success('ci-complete') &&
+      needs.buildenv.outputs.relevant-changed == 'true' &&
+      github.repository_owner == 'mattermost' &&
+      github.event_name == 'pull_request' &&
+      github.event.pull_request.head.repo.full_name == github.repository
+    permissions:
+      contents: read
+      actions: read
+      statuses: write
+    needs:
+      - buildenv
+      - ci-complete
+    uses: ./.github/workflows/server-ci-artifacts.yml
+    secrets:
+      PR_BUILDS_BUCKET_AWS_ACCESS_KEY_ID: ${{ secrets.PR_BUILDS_BUCKET_AWS_ACCESS_KEY_ID }}
+      PR_BUILDS_BUCKET_AWS_SECRET_ACCESS_KEY: ${{ secrets.PR_BUILDS_BUCKET_AWS_SECRET_ACCESS_KEY }}
+      DOCKERHUB_DEV_TOKEN: ${{ secrets.DOCKERHUB_DEV_TOKEN }}
+      WIZ_DEVOPS_CLIENT_ID: ${{ secrets.WIZ_DEVOPS_CLIENT_ID }}
+      WIZ_DEVOPS_CLIENT_SECRET: ${{ secrets.WIZ_DEVOPS_CLIENT_SECRET }}
+    with:
+      source-run-id: ${{ github.run_id }}
+      source-event: ${{ github.event_name }}
+      head-sha: ${{ github.event.pull_request.head.sha }}
+      head-repository: ${{ github.event.pull_request.head.repo.full_name }}
+
+  ci-sentry:
+    name: Sentry Upload
+    # Only run Sentry upload for master branch as mentioned in old workflow title.
+    if: >-
+      always() &&
+      github.repository_owner == 'mattermost' &&
+      github.event_name == 'push' &&
+      github.ref == 'refs/heads/master'
+    permissions:
+      contents: read
+    needs:
+      - ci-complete
+    uses: ./.github/workflows/sentry.yaml
+    secrets:
+      SENTRY_AUTH_TOKEN: ${{ secrets.MM_SERVER_SENTRY_AUTH_TOKEN }}
+      SENTRY_ORG: ${{ secrets.MM_SERVER_SENTRY_ORG }}
+      SENTRY_PROJECT: ${{ secrets.MM_SERVER_SENTRY_PROJECT }}