snapshot of https://github.com/nats-io/nats-server.git (main, 2026-09-15; blobs > 131072B omitted)

.github/workflows/claude.yml

@@ -0,0 +1,64 @@
+name: Claude Code
+
+# GITHUB_TOKEN needs contents:read and actions:read — required by
+# claude-code-action for restoring trusted config files from the base branch.
+# All other GitHub API access uses the App token.
+permissions:
+  contents: read
+  actions: read
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  pull_request_target:
+    types: [opened, reopened]
+
+jobs:
+  claude:
+    name: Claude Review
+    uses: synadia-io/ai-workflows/.github/workflows/claude.yml@v2
+    if: contains(
+      fromJson('["OWNER","MEMBER","COLLABORATOR"]'),
+      github.event.comment.author_association || github.event.pull_request.author_association
+      )
+    with:
+      gh_app_id: ${{ vars.CLAUDE_GH_APP_ID }}
+      checkout_mode: "base"
+      # review_focus is used only by the auto-review job (pull_request_target), not the
+      # interactive @claude job — so the check below only needs github.event.pull_request,
+      # which pull_request_target populates. On issue_comment events that field is absent,
+      # so this evaluates to startsWith(null, 'backports/') -> false; harmless, since the
+      # interactive job ignores review_focus. Can't be fixed in-expression: issue_comment
+      # payloads carry no head ref at all.
+      review_focus: |
+        ${{ startsWith(github.event.pull_request.head.ref, 'backports/') && '
+        This is a BACKPORT / RELEASE pull request. Every cherry-picked commit
+        originates from a PR that was already independently reviewed and approved
+        on the source branch. Do NOT re-review the individual code changes and do
+        NOT comment on the implementation of cherry-picked hunks — assume they are
+        correct.
+
+        Instead, focus exclusively on:
+        - Cherry-pick completeness. Inspect the PRs/commits included in this
+          backport. For each source PR, check its milestone, labels, and target
+          branch to decide whether it belongs in this release line. Flag any PR
+          that targets this release but is MISSING here, and any included PR that
+          does not belong.
+        - Non-clean picks. Call out commits that appear to have been modified
+          during the cherry-pick (conflict resolution, adapted context) — those
+          are the only changes that warrant a closer look.
+        - Release overview. Produce a concise summary of what this release ships,
+          grouped by area (JetStream, Raft/NRG, leafnodes, security, etc.), so
+          reviewers can sanity-check the scope at a glance.
+        ' || '
+        Additionally focus on:
+        - Performance implications (hot paths, allocations, lock contention)
+        - Concurrency safety (goroutine leaks, race conditions, deadlocks)
+        - Raft consensus and JetStream clustering correctness
+        - Security boundaries (authentication, authorization, TLS handling)
+        ' }}
+    secrets:
+      claude_oauth_token: ${{ secrets.CLAUDE_OAUTH_TOKEN }}
+      gh_app_private_key: ${{ secrets.CLAUDE_GH_APP_PRIVATE_KEY }}

.github/workflows/cov.yaml

@@ -0,0 +1,53 @@
+name: NATS Server Code Coverage
+on:
+  workflow_dispatch: {}
+
+  schedule:
+    - cron: "40 4 * * *"
+
+permissions:
+  contents: read
+
+jobs:
+  nightly_coverage:
+    runs-on: ubuntu-latest
+
+    env:
+      GOPATH: /home/runner/work/nats-server
+      GO111MODULE: "on"
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          path: src/github.com/nats-io/nats-server
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: stable
+          cache-dependency-path: src/github.com/nats-io/nats-server/go.sum
+
+      - name: Run code coverage
+        shell: bash --noprofile --norc -x -eo pipefail {0}
+        run: |
+          set -e
+          cd src/github.com/nats-io/nats-server
+          ./scripts/cov.sh upload
+          set +e
+
+      - name: Convert coverage.out to coverage.lcov
+        # Use commit hash here to avoid a re-tagging attack, as this is a third-party action
+        # Commit e4612787670fc5b5f49026b8c29c5569921de1db = tag v1.2.0
+        uses: jandelgado/gcov2lcov-action@e4612787670fc5b5f49026b8c29c5569921de1db
+        with:
+          infile: acc.out
+          working-directory: src/github.com/nats-io/nats-server
+
+      - name: Coveralls
+        # Use commit hash here to avoid a re-tagging attack, as this is a third-party action
+        # Commit 5cbfd81b66ca5d10c19b062c04de0199c215fb6e = tag v2.3.7
+        uses: coverallsapp/github-action@5cbfd81b66ca5d10c19b062c04de0199c215fb6e
+        with:
+          github-token: ${{ secrets.github_token }}
+          file: src/github.com/nats-io/nats-server/coverage.lcov

.github/workflows/long-tests.yaml

@@ -0,0 +1,33 @@
+name: NATS Server Long Tests
+
+on:
+  # Allow manual trigger (any branch)
+  workflow_dispatch:
+  # Run daily at 12:30 on default branch
+  schedule:
+    - cron: "30 12 * * *"
+
+permissions:
+  contents: read
+
+concurrency:
+  # At most one of these workflow per ref running
+  group: ${{ github.workflow }}-${{ github.ref }}
+  # New one cancels in-progress one
+  cancel-in-progress: true
+
+jobs:
+  js-long:
+    name: Long JetStream tests
+    runs-on: ${{ vars.GHA_WORKER_MEDIUM || 'ubuntu-latest' }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: stable
+
+      - name: Run tests
+        run: go test -race -v -run='^TestLong.*' ./server -tags=include_js_long_tests -count=1 -vet=off -timeout=60m -shuffle on -p 1 -failfast

.github/workflows/mqtt-test.yaml

@@ -0,0 +1,53 @@
+name: MQTT External Tests
+on: [pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    env:
+      GOPATH: /home/runner/work/nats-server
+      GO111MODULE: "on"
+    runs-on: ${{ vars.GHA_WORKER_SMALL || 'ubuntu-latest' }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          path: src/github.com/nats-io/nats-server
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: stable
+          cache-dependency-path: src/github.com/nats-io/nats-server/go.sum
+
+      - name: Set up testing tools and environment
+        shell: bash --noprofile --norc -eo pipefail {0}
+        id: setup
+        run: |
+          wget https://github.com/hivemq/mqtt-cli/releases/download/v4.20.0/mqtt-cli-4.20.0.deb
+          sudo apt install ./mqtt-cli-4.20.0.deb
+          # Pinned to the mqtt-test commit that adds --pipeline (PR #5);
+          # bump to @v0.2.0 once it is tagged.
+          go install github.com/ConnectEverything/mqtt-test@6138352776422dfd16eeb3333d078358d8b85fea
+
+      - name: Run tests (3 times to detect flappers)
+        shell: bash --noprofile --norc -eo pipefail {0}
+        run: |
+          cd src/github.com/nats-io/nats-server
+          go test -v --count=3 --run='TestXMQTT' ./server
+
+      - name: Run tests with --race
+        shell: bash --noprofile --norc -eo pipefail {0}
+        run: |
+          cd src/github.com/nats-io/nats-server
+          go test -v --race --failfast --run='TestXMQTT' ./server
+
+      - name: Run benchmarks
+        shell: bash --noprofile --norc -eo pipefail {0}
+        run: |
+          cd src/github.com/nats-io/nats-server
+          go test --run='-' --count=3 --bench 'BenchmarkXMQTT' --benchtime=100x ./server
+
+      # TODO: compare benchmarks

.github/workflows/nightly.yaml

@@ -0,0 +1,51 @@
+name: Docker Nightly
+on:
+  workflow_dispatch:
+    inputs:
+      target:
+        description: "Override source branch (optional)"
+        type: string
+        required: false
+
+  schedule:
+    - cron: "40 4 * * *"
+
+permissions:
+  contents: read
+
+jobs:
+  run:
+    runs-on: ${{ vars.GHA_WORKER_RELEASE || 'ubuntu-latest' }}
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout NATS
+        uses: actions/checkout@v6
+        with:
+          path: src/github.com/nats-io/nats-server
+          ref: ${{ inputs.target || 'main' }}
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Checkout NSC
+        uses: actions/checkout@v6
+        with:
+          repository: nats-io/nsc
+          path: src/github.com/nats-io/nsc
+          fetch-depth: 1
+          fetch-tags: true
+
+      - name: Checkout NATS CLI
+        uses: actions/checkout@v6
+        with:
+          repository: nats-io/natscli
+          path: src/github.com/nats-io/natscli
+          fetch-depth: 1
+          fetch-tags: true
+
+      - name: Build Docker nightly
+        uses: ./src/github.com/nats-io/nats-server/.github/actions/nightly-release
+        with:
+          name: ${{ inputs.target || 'nightly' }}
+          hub_username: "${{ secrets.DOCKER_USERNAME }}"
+          hub_password: "${{ secrets.DOCKER_PASSWORD }}"

.github/workflows/pull-requests.yml

@@ -0,0 +1,59 @@
+name: NATS Server PRs
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened, ready_for_review]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pull-requests: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  signoffs:
+    name: Sign-offs
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      PR_NUMBER: ${{ github.event.pull_request.number }}
+      BASE_SHA: ${{ github.event.pull_request.base.sha }}
+    steps:
+      - name: Checkout base repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Fetch PR head
+        run: |
+          set -euo pipefail
+          git fetch --no-tags origin "$BASE_SHA" "pull/${PR_NUMBER}/head:pr-head"
+
+      - name: Check all PR commits are signed off
+        run: |
+          set -euo pipefail
+
+          range="${BASE_SHA}..pr-head"
+          missing=0
+          missing_list=""
+
+          while read -r c; do
+            msg="$(git log -1 --pretty=%B "$c")"
+            if ! printf '%s\n' "$msg" | grep -q '^Signed-off-by:'; then
+              echo "::error ::Commit $c has not been signed off"
+              missing=1
+              missing_list+=$'\n- '"$c"
+            fi
+          done < <(git rev-list --no-merges "$range")
+
+          if [ "$missing" -ne 0 ]; then
+            body="$(printf 'Please review the `CONTRIBUTING.md` guide as some commits are missing `Signed-off-by:` in their commit messages.\n\nTo correct, please amend the following commits and force-push:\n\n%s' "$missing_list")"
+            gh pr comment "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" --body "$body"
+            exit 1
+          fi

.github/workflows/release.yaml

@@ -0,0 +1,54 @@
+name: NATS Server Releases
+on:
+  push:
+    tags:
+      - v*
+
+permissions:
+  contents: read
+
+jobs:
+  run:
+    name: GitHub Release
+    runs-on: ${{ vars.GHA_WORKER_RELEASE || 'ubuntu-latest' }}
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: "stable"
+
+      - name: Check version matches tag
+        env:
+          TRAVIS_TAG: ${{ github.ref_name }}
+        run: |
+          go test -race -v -run=TestVersionMatchesTag ./server -ldflags="-X=github.com/nats-io/nats-server/v2/server.serverVersion=$TRAVIS_TAG" -count=1 -vet=off
+
+      - name: Install cosign
+        # Use commit hash here to avoid a re-tagging attack, as this is a third-party action
+        # Commit 6f9f17788090df1f26f669e9d70d6ae9567deba6 = tag v4.1.2
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6
+
+      - name: Install syft
+        # Use commit hash here to avoid a re-tagging attack, as this is a third-party action
+        # Commit e22c389904149dbc22b58101806040fa8d37a610 = tag v0.24.0
+        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610
+        with:
+          syft-version: "v1.42.3"
+
+      - name: Create release
+        uses: goreleaser/goreleaser-action@v7
+        with:
+          distribution: goreleaser
+          version: "~> v2"
+          args: release --clean
+        env:
+          GITHUB_REPOSITORY_NAME: ${{ github.event.repository.name }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/stale-issues.yaml

@@ -0,0 +1,21 @@
+name: Stale Issues
+on:
+  schedule:
+    - cron: "30 1 * * *"
+
+permissions:
+  issues: write
+  pull-requests: write
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/stale@v10
+        with:
+          stale-issue-label: stale
+          stale-pr-label: stale
+          days-before-stale: 56 # Mark stale after 8 weeks (56 days) of inactivity
+          days-before-close: -1 # Disable auto-closing
+          exempt-all-milestones: true # Any issue/PR within a milestone will be omitted

.github/workflows/tests.yaml

@@ -0,0 +1,372 @@
+name: NATS Server Tests
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  RACE: ${{ (github.ref != 'refs/heads/main' && !startsWith(github.ref, 'refs/heads/release/') && github.event_name != 'pull_request') && '-race' || '' }}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && !startsWith(github.ref, 'refs/heads/release/') }}
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: "go.mod"
+
+      - name: Run golangci-lint
+        # Use commit hash here to avoid a re-tagging attack, as this is a third-party action
+        # Commit 82606bf257cbaff209d206a39f5134f0cfbfd2ee = tag v9.2.1
+        uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee
+        with:
+          version: v2.13.0
+          skip-cache: true
+          skip-save-cache: true
+          args: --timeout=5m --config=.golangci.yml
+
+  build-latest:
+    name: Build (Latest Go)
+    needs: [lint]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: stable
+
+      - name: Build NATS Server 64-bit
+        run: GOARCH=amd64 GOOS=linux go build
+
+      - name: Build NATS Server 32-bit
+        run: GOARCH=386 GOOS=linux go build
+
+  build-supported:
+    name: Build (Minimum Go)
+    needs: [lint]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: "go.mod"
+
+      - name: Build NATS Server 64-bit
+        run: GOARCH=amd64 GOOS=linux go build
+
+      - name: Build NATS Server 32-bit
+        run: GOARCH=386 GOOS=linux go build
+
+  # Using GitHub-supplied workers for Windows for now.
+  # Note that the below testing steps depend on the Linux build
+  # only, as the Windows builds take a fair bit longer to set up.
+  build-windows:
+    name: Build (Minimum Go, ${{ matrix.os }})
+    needs: [lint]
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-2022, windows-2025]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: "go.mod"
+
+      - name: Build NATS Server
+        run: go build
+
+  store:
+    name: Test Stores
+    needs: [build-latest, build-supported, lint]
+    runs-on: ${{ vars.GHA_WORKER_MEDIUM || 'ubuntu-latest' }}
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: stable
+
+      - name: Run unit tests
+        run: ./scripts/runTestsOnTravis.sh store_tests
+
+  js-no-cluster:
+    name: Test JetStream
+    needs: [build-latest, build-supported, lint]
+    runs-on: ${{ vars.GHA_WORKER_LARGE || 'ubuntu-latest' }}
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: stable
+
+      - name: Run unit tests
+        run: ./scripts/runTestsOnTravis.sh js_tests
+
+  raft:
+    name: Test Raft
+    needs: [build-latest, build-supported, lint]
+    runs-on: ${{ vars.GHA_WORKER_LARGE || 'ubuntu-latest' }}
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: stable
+
+      - name: Run unit tests
+        run: ./scripts/runTestsOnTravis.sh raft_tests
+
+  js-consumers:
+    name: Test JetStream Consumers
+    needs: [build-latest, build-supported, lint]
+    runs-on: ${{ vars.GHA_WORKER_LARGE || 'ubuntu-latest' }}
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: stable
+
+      - name: Run unit tests
+        run: ./scripts/runTestsOnTravis.sh js_consumer_tests
+
+  js-cluster-1:
+    name: Test JetStream Cluster 1
+    needs: [build-latest, build-supported, lint]
+    runs-on: ${{ vars.GHA_WORKER_LARGE || 'ubuntu-latest' }}
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: stable
+
+      - name: Run unit tests
+        run: ./scripts/runTestsOnTravis.sh js_cluster_tests_1
+
+  js-cluster-2:
+    name: Test JetStream Cluster 2
+    needs: [build-latest, build-supported, lint]
+    runs-on: ${{ vars.GHA_WORKER_LARGE || 'ubuntu-latest' }}
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: stable
+
+      - name: Run unit tests
+        run: ./scripts/runTestsOnTravis.sh js_cluster_tests_2
+
+  js-cluster-3:
+    name: Test JetStream Cluster 3
+    needs: [build-latest, build-supported, lint]
+    runs-on: ${{ vars.GHA_WORKER_LARGE || 'ubuntu-latest' }}
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: stable
+
+      - name: Run unit tests
+        run: ./scripts/runTestsOnTravis.sh js_cluster_tests_3
+
+  js-cluster-4:
+    name: Test JetStream Cluster 4
+    needs: [build-latest, build-supported, lint]
+    runs-on: ${{ vars.GHA_WORKER_LARGE || 'ubuntu-latest' }}
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: stable
+
+      - name: Run unit tests
+        run: ./scripts/runTestsOnTravis.sh js_cluster_tests_4
+
+  js-supercluster:
+    name: Test JetStream Supercluster
+    needs: [build-latest, build-supported, lint]
+    runs-on: ${{ vars.GHA_WORKER_LARGE || 'ubuntu-latest' }}
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: stable
+
+      - name: Run unit tests
+        run: ./scripts/runTestsOnTravis.sh js_super_cluster_tests
+
+  no-race-1:
+    name: Test No-Race 1
+    needs: [build-latest, build-supported, lint]
+    runs-on: ${{ vars.GHA_WORKER_LARGE || 'ubuntu-latest' }}
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: stable
+
+      - name: Run unit tests
+        run: ./scripts/runTestsOnTravis.sh no_race_1_tests
+
+  no-race-2:
+    name: Test No-Race 2
+    needs: [build-latest, build-supported, lint]
+    runs-on: ${{ vars.GHA_WORKER_LARGE || 'ubuntu-latest' }}
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: stable
+
+      - name: Run unit tests
+        run: ./scripts/runTestsOnTravis.sh no_race_2_tests
+
+  mqtt:
+    name: Test MQTT
+    needs: [build-latest, build-supported, lint]
+    runs-on: ${{ vars.GHA_WORKER_MEDIUM || 'ubuntu-latest' }}
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: stable
+
+      - name: Run unit tests
+        run: ./scripts/runTestsOnTravis.sh mqtt_tests
+
+  msgtrace:
+    name: Test Message Tracing
+    needs: [build-latest, build-supported, lint]
+    runs-on: ${{ vars.GHA_WORKER_MEDIUM || 'ubuntu-latest' }}
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: stable
+
+      - name: Run unit tests
+        run: ./scripts/runTestsOnTravis.sh msgtrace_tests
+
+  jwt:
+    name: Test JWT
+    needs: [build-latest, build-supported, lint]
+    runs-on: ${{ vars.GHA_WORKER_LARGE || 'ubuntu-latest' }}
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: stable
+
+      - name: Run unit tests
+        run: ./scripts/runTestsOnTravis.sh jwt_tests
+
+  server-pkg-non-js:
+    name: Test Remaining Server Tests
+    needs: [build-latest, build-supported, lint]
+    runs-on: ${{ vars.GHA_WORKER_LARGE || 'ubuntu-latest' }}
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: stable
+
+      - name: Run unit tests
+        run: ./scripts/runTestsOnTravis.sh srv_pkg_non_js_tests
+
+  non-server-pkg:
+    name: Test Other Packages
+    needs: [build-latest, build-supported, lint]
+    runs-on: ${{ vars.GHA_WORKER_MEDIUM || 'ubuntu-latest' }}
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: stable
+
+      - name: Run unit tests
+        run: ./scripts/runTestsOnTravis.sh non_srv_pkg_tests

.github/workflows/vuln.yaml

@@ -0,0 +1,33 @@
+name: Vulnerability Scan
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "0 6 * * *"
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  govulncheck:
+    runs-on: ${{ vars.GHA_WORKER_SMALL || 'ubuntu-latest' }}
+
+    steps:
+      - name: Run govulncheck
+        # Use commit hash here to avoid a re-tagging attack, as this is a third-party action
+        # Commit b625fbe08f3bccbe446d94fbf87fcc875a4f50ee = tag v1.0.4
+        uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee
+        with:
+          go-package: ./...
+          output-format: sarif
+          output-file: govulncheck.sarif
+
+      - name: Upload SARIF results
+        if: github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: govulncheck.sarif