# Weekly Server CI jobs that don't need to run on every push/PR.
# These are important for compliance and compatibility but have low
# regression rates, so running them weekly saves significant 8-core
# runner capacity (9 fewer concurrent 8-core jobs per master push).
#
# Schedule: Monday ~1am ET (5am UTC)
#
# Jobs moved here from server-ci.yml:
# - Postgres with binary parameters (1x 8-core)
# - Postgres FIPS unsharded (1x 8-core) — sharded runs stay in server-ci.yml for PR iteration
# - mmctl FIPS tests (1x 8-core)
name: Server CI Weekly
on:
  schedule:
    - cron: "0 5 * * 1" # Monday 5am UTC (~1am ET)
  push:
    branches:
      - "release-*"
  workflow_dispatch: # Allow manual trigger for urgent FIPS/binary verification

permissions:
  contents: read

jobs:
  buildenv:
    name: Build Environment
    runs-on: ubuntu-22.04
    outputs:
      build-server-tag: ${{ steps.calculate.outputs.BUILD_SERVER_TAG }}
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Calculate build image tag
        id: calculate
        working-directory: server/
        run: |
          tag=$(./build/buildenv-tag.sh)
          echo "BUILD_SERVER_TAG=${tag}" >> "${GITHUB_OUTPUT}"

  test-postgres-binary:
    name: Postgres with binary parameters
    needs: buildenv
    permissions:
      contents: read
      actions: write
    uses: ./.github/workflows/server-test-template.yml
    with:
      name: Postgres with binary parameters
      datasource: postgres://mmuser:mostest_password@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10&binary_parameters=yes
      drivername: postgres
      logsartifact: postgres-binary-server-test-logs
      build-server-tag: ${{ needs.buildenv.outputs.build-server-tag }}
      fips-enabled: false
      # Unsharded run on a single 8-core runner: fullyparallel=true causes
      # resource exhaustion (too many server instances, WebSocket hubs, and
      # DB connections) and crashes the hosted runner. See #35995.
      fullyparallel: false

  test-postgres-normal-fips:
    name: Postgres FIPS
    needs: buildenv
    permissions:
      contents: read
      actions: write
    uses: ./.github/workflows/server-test-template.yml
    secrets:
      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
    with:
      name: Postgres FIPS
      datasource: postgres://mmuser:mostest_password@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
      drivername: postgres
      logsartifact: postgres-server-fips-test-logs
      build-server-tag: ${{ needs.buildenv.outputs.build-server-tag }}
      fips-enabled: true
      # Unsharded run on a single 8-core runner: see note on test-postgres-binary.
      fullyparallel: false

  test-mmctl-fips:
    name: Run mmctl tests (FIPS)
    needs: buildenv
    permissions:
      contents: read
      actions: write
    uses: ./.github/workflows/mmctl-test-template.yml
    secrets:
      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
      MM_E2E_ZEPHYR_API_KEY: ${{ secrets.MM_E2E_ZEPHYR_API_KEY }}
    with:
      name: mmctl
      datasource: postgres://mmuser:mostest_password@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
      drivername: postgres
      logsartifact: mmctl-fips-test-logs
      build-server-tag: ${{ needs.buildenv.outputs.build-server-tag }}
      fips-enabled: true