* ci: bump test-system-io-summary action for missed-spec status
Placeholder bump pending merge of mattermost-test-system-io summary fix.
* ci: re-pin test-system-io-summary to main e2d5032
Replace the pre-merge placeholder SHA with the latest
mattermost-test-system-io main commit, which includes the
squash-merged missed-spec summary fix from #96.
---------
(cherry picked from commit 020e9dabdd)
Co-authored-by: sabril <5334504+saturninoabril@users.noreply.github.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: saturnino <saturnino@mattermost.com>
server-ci.yml always triggers now, but ci-report and ci-artifacts were
missed when #37557 gated the other jobs on needs.go.outputs.relevant-changed.
On PRs that don't touch server code, build-mattermost-server and the test
jobs are skipped, so ci-artifacts fails trying to download a
server-dist-artifact that was never uploaded, and ci-report fails trying
to validate test logs that don't exist. Skip both cleanly instead.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Make server-ci.yml always trigger so required checks never get stuck pending
Required status checks (e.g. "Server CI Complete") never get reported for a
commit whose workflow run was skipped by the top-level `paths` filter, which
leaves them stuck "Pending" forever and blocks merging PRs that don't touch
server code. Move the path filtering into a job-level `if:` gated on a new
`relevant-changed` output instead, so the workflow always runs and always
reports a status.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Fail ci-complete explicitly when the go job doesn't succeed
Previously ci-complete ran unconditionally (if: always()) and its step just
echoed a success message, so if the go job failed (e.g. the new
relevant-changed detection step erroring out), all downstream jobs would be
silently skipped due to unset outputs, yet ci-complete would still report
"Server CI Complete" as green. Add go to needs and explicitly fail the step
when needs.go.result != 'success', while keeping the existing always()/FIPS
skip-tolerance behavior so the check still always gets reported.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* add testcontainers to playwright-lib
* include retry mechanism for transient failures
* - Introduced a new command `testcontainers:up` in package.json to run Playwright tests with Testcontainers.
- Created a standalone Playwright configuration file `playwright.testcontainers-up.config.ts` for managing Testcontainers.
- Added a no-op test `testcontainers_up.spec.ts` to ensure the Testcontainers stack is up during the test run.
- Implemented a global setup script `testcontainers_up_global_setup.ts` to start and stop the Testcontainers stack.
- Updated dependencies in package.json, including adding `chalk` for logging.
* fix package-lock
* fix tsc and restore waiting for all migrations to complete
---------
Co-authored-by: Mattermost Build <build@mattermost.com>
* docs: mark scale partial pages as unlisted with proper titles
These MDX files are content partials imported into the scale-to-*-users
pages, mirroring the :orphan:/:nosearch: Sphinx pages they were migrated
from. Without frontmatter, Docusaurus rendered them as full standalone
pages with an ugly slug-derived title, breadcrumbs, and pagination.
unlisted: true keeps their routes alive (needed by the PDF book builder
and legacy redirects) while hiding them from the sidebar, breadcrumbs,
pagination, and search indexing.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(docs-preview): set commit status via gh api for correct target_url
The shared mattermost/actions/delivery/update-commit-status action accepts
a target_url input but ignores it, hardcoding the Actions run URL instead.
This made the docs-preview PR check's Details link point at the workflow
run rather than the S3-hosted preview site.
Switch docs-preview-template.yml and docs-preview-fork.yml to call the
GitHub Statuses API directly via `gh api repos/.../statuses/{sha}`, matching
the pattern in e2e-tests-playwright.yml, so the success status's target_url
points at the actual preview URL.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* docs: vendor and stage Mattermost Agents docs for Docusaurus build
The migration plan externalized Agents links, but the Docusaurus sidebar
generator already declares an `agents` TOP_LEVEL category and stub pages
link to `/agents/docs/*` paths with no content behind them. Vendor the
mattermost-plugin-agents docs/ folder as a submodule and stage it into
main/agents/docs/ at build time (mirroring how Sphinx handles the same
submodule via conf.py excludes), so the Agents sidebar category and
internal links resolve to real, versioned content instead of dead ends.
Co-authored-by: Cursor <cursoragent@cursor.com>
* docs: strip leading license comment before MDX-staging Agents docs
Three feature pages (channel_summaries.md, custom_prompts.md,
managing_agents.md) lead with a raw <!-- Copyright ... --> HTML comment
before the # Title line, which broke both title extraction (regex only
matched a title at the very start of the file) and the Docusaurus build
(MDX doesn't parse bare HTML comments the way Markdown does, so it failed
to compile with "Unexpected character '!'"). Strip the license comment
before further processing instead of trying to convert it.
Co-authored-by: Cursor <cursoragent@cursor.com>
* docs: fail loudly on missing Agents submodule, fix usage comment path
- A missing/uninitialized vendor/mattermost-plugin-agents submodule
previously logged a warning and returned a successful zero-count
result, letting CI/prestart/prebuild continue with an empty (or, on a
reused workspace, stale) Agents section instead of failing. Now it
clears any previously staged output first, then throws so the build
fails clearly when the submodule isn't present.
- Fixed the usage comment referencing the nonexistent docs-site/scripts
path instead of the actual docs/site/scripts.
Co-authored-by: Cursor <cursoragent@cursor.com>
* docs: checkout submodules in docs-ci.yaml build check
This is the third docs-building workflow (alongside docs-cd.yml and
docs-preview-template.yml) that runs npm run build on docs/site, and it
was missed when submodules: true was added to the other two — its
"Build docs site" step failed on this PR because
vendor/mattermost-plugin-agents wasn't checked out, which
stage-agents-docs.mjs now correctly treats as a hard failure.
Co-authored-by: Cursor <cursoragent@cursor.com>
* docs: inline Agents content instead of a separate top-level LHS section
Sphinx never gives Agents its own top-level nav entry: it `.. include::`s
admin_guide.md/user_guide.md directly into the existing curated pages
(administration-guide/configure/agents-admin-guide.rst and
end-user-guide/agents.rst), and only nests a handful of files
(providers, aws_bedrock_setup, sovereign_ai, usage_tips) as small hidden-
toctree children of those same two pages. load-testing.md,
upgrading_to_2.0.md, and all of features/*.md are never referenced in any
Sphinx toctree at all.
The previous vendoring approach staged all 12 files as a brand-new,
disconnected top-level "Agents" category, so reaching the actual guide
meant leaving the curated page, opening an unrelated top-level section,
and drilling into "Docs" — the opposite of what Sphinx does today.
This reproduces Sphinx's structure instead:
- stage-agents-docs.mjs now categorizes the 12 vendored files: admin_guide/
user_guide are staged twice — once as a normal (but `unlisted: true`)
doc for direct-link parity with Sphinx's orphan pages, and once as a
Docusaurus Markdown partial (leading underscore, auto-excluded from
routing/sidebars) for inline import. providers/aws_bedrock_setup/
sovereign_ai/usage_tips are staged as normal listed docs. Everything
else is staged unlisted, matching Sphinx never surfacing them in nav.
- Added generic relative-markdown-link rewriting (mirroring the existing
image-path rewriting) so cross-links between vendored files
(`../admin_guide.md#anchor`, `features/channel_summaries.md`, etc.)
resolve correctly regardless of nesting depth or where the linking
content ends up rendered.
- agents-admin-guide.mdx and end-user-guide/agents.mdx now `import` and
render the partials inline instead of linking out, and no longer link
to a separate "Docs" section.
- gen-documentation-sidebar.mjs: removed the standalone `agents`
TOP_LEVEL category. Added `{doc: '<full id>'}` support to
buildAdminConfigureItem for cross-directory group items, and a new
ADMIN_CONFIGURE_GROUPS.agents group nesting providers/aws_bedrock_setup/
sovereign_ai under agents-admin-guide. Added a standalone
promoteDocToCategory helper (End User Guide has no full manual-grouping
override) to nest usage_tips under end-user-guide/agents.
- Documented both patterns (cross-directory group items, Markdown-partial
inlining) in docs/site/README.md's "Manual grouping overrides" section.
Validated: stage-agents-docs.mjs + gen-documentation-sidebar.mjs both run
clean with zero warnings; a scoped @mdx-js/mdx compile check across all
16 affected files (2 curated pages + 12 staged docs + 2 partials) passes
with zero failures. Full `docusaurus build` still needs the OpenAPI
prebuild's Go toolchain, unavailable in this sandbox — already covered by
docs-ci.yaml in CI.
Co-authored-by: Cursor <cursoragent@cursor.com>
* docs(agents): self-host the plugin-v2 upgrade guide link
Now that mattermost-plugin-agents/docs is vendored and staged into
/agents/docs/*, point the two "how to upgrade to Agents v2" references
(v11 changelog, important upgrade notes) at our own
/agents/docs/upgrading_to_2.0 page instead of an external GitHub blob
link — the same self-hosting fix already applied to the old dangling
sample-file links.
Co-authored-by: Cursor <cursoragent@cursor.com>
* docs(agents): tighten stage-agents-docs.mjs header comment
Same explanation, fewer words — trims the file-level comment from ~45
to ~33 lines without dropping the rationale (why staging instead of a
direct submodule checkout, and how the three-way listed/unlisted/
inline-partial split reproduces Sphinx's nav).
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* ci: consolidate docs-preview checks into one status with preview URL
Drop the same-repo status-update jobs that cluttered the PR checks list,
and post a single docs-preview commit status whose Details link opens the
preview environment.
Co-authored-by: Cursor <cursoragent@cursor.com>
* remove comment
* Remove duplicate failure status update in docs-preview-fork workflow
The deploy job already posts a failure commit status via the shared
template, making the separate update-failure-status job redundant.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Docs preview cleanup and build workflows no longer post PR comments.
The build workflows now surface the preview URL via the commit status's
target_url instead, so the status check links directly to the preview.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Remove deprecated Playwright/Cypress v1 e2e CI dispatch
Deletes the legacy in-job execution templates and their calculate-results
actions, and unconditionally routes both wrappers to the v2 (Test System IO)
templates. Test suites and local-dev tooling are untouched.
* remove v2 references
* remove aws dependencies in e2e tests, remove deprecated workflows
* ci: add docs PR preview workflows (P10)
Adds preview builds for PRs touching docs/** or api/**, deployed to the
existing mattermost-docs-preview-pulls S3 bucket under a repo-scoped
mattermost/pr-<N>/ prefix so they don't collide with mattermost/docs's
own previews of the same bucket. Fork PRs are handled via a manual
workflow_dispatch since they can't access secrets; previews are cleaned
up automatically on PR close for both same-repo and fork PRs.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: use PR author for docs preview TRIGGERING_ACTOR
pull_request.head.user.login is the owner of the head repo/branch, not
the PR author -- for same-repo PRs (head repo == base repo) this
resolves to the org name instead of the contributor who opened the PR.
pull_request.user.login is always the actual PR author.
Co-authored-by: Cursor <cursoragent@cursor.com>
* docs: reword docs preview PR comment
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: harden docs preview workflows
- docs-preview-fork: add explicit permissions (statuses/pull-requests
write, contents read) instead of relying on default token scope.
- docs-preview-template: validate PR_NUMBER is digits-only and quote
the S3 destination before use in the upload step, guarding against
script injection via the fork dispatch's free-text input.
- docs-preview-template: add a per-PR concurrency group so an older,
slower build can't overwrite a newer upload.
- docs-preview/docs-preview-fork: replace secrets: inherit with an
explicit secrets mapping, and declare the secrets contract on the
reusable template, so only the two AWS preview credentials are
passed instead of every repo/org secret.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: align docs preview build/permissions with docs-ci, drop 3rd-party comment action
- docs-preview-template: add Set up Go (api/server/go.mod), matching
docs-ci -- make -C api build shells out to `go run .` for code
sample extraction and needs a pinned toolchain, not whatever happens
to be preinstalled on the runner.
- docs-preview-template: drop the explicit "Build OpenAPI spec" step;
npm run build's prebuild lifecycle script already runs
make -C api build, so it was running twice.
- docs-preview-template: replace peter-evans/create-or-update-comment
with plain `gh pr comment`, dropping a third-party action pin;
behavior is unchanged (posts a new comment every run).
- docs-preview: add explicit permissions (contents: read,
pull-requests: write) so the reusable workflow's requested
pull-requests: write isn't silently downgraded by a restrictive
default token policy.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: use gh pr comment in docs-preview-cleanup, drop 3rd-party action
Same swap already made in docs-preview-template.yml -- gh is
preinstalled on the runner, so this drops another third-party action
pin. Also quotes the S3 URI via env vars for consistency with the
template's upload step.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: replace pull_request_target with pull_request in docs-preview-cleanup
zizmor flags pull_request_target as a dangerous trigger by default.
Switch to plain pull_request, guarded to skip fork PRs (which don't
get secrets on this event) -- fork preview cleanup will be handled by
a separate scheduled sweep instead. Also fixes a stray '=' character
that had crept into the file.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* Converge generated-file CI checks on a single make generated target
The server-ci.yml workflow had many separate "run a make target, then fail
on any git diff" jobs, but make generated only covered a few of them, so the
target and CI drifted apart.
Expand make generated to regenerate every committed asset, adding
gen-serialized, migrations-extract, build-templates, mmctl-docs, and
modules-tidy, and collapse the per-asset check jobs into a single
check-generated job.
Split the backport migration guard into its own check-backport-migrations
job and make target, renaming the script to match.
* git status --porcelain
* simplify permissions block given defaults
The e2e npm registry cache keyed on node-cache-<os>-<arch>-npm-e2e-,
sharing the node-cache- prefix that actions/setup-node generates
automatically for its built-in npm cache (node-cache-<os>-<arch>-npm-).
Because the arch segment differs only by case (setup-node uses Node's
process.arch 'x64'; this action uses runner.arch 'X64') and GitHub matches
restore-key prefixes case-insensitively, the two buckets share a common
prefix. A future broad restore-key such as node-cache-<os>-<arch>-npm-
could then cross-restore one bucket's ~/.npm into the other.
Rename the key to e2e-npm-registry-<os>-<arch>-, giving it a distinct
namespace that is not a prefix of node-cache- in either direction and
matches the repo's content-descriptive e2e cache keys (e2e-cypress-deps-,
e2e-playwright-deps-, e2e-platform-pkgs-). Existing entries orphan and
age out; the daily warm job repopulates under the new key on next run.
* ci: add docs CD workflow (P9)
Builds the Docusaurus site and deploys to S3 on every push to master
touching docs/** or api/**, then invalidates CloudFront. Splits the S3
sync into two passes so content-hashed build assets get long-lived
immutable caching while unhashed HTML stays no-cache for near-instant
propagation.
Co-authored-by: Cursor <cursoragent@cursor.com>
* ci: remove workflow_dispatch trigger from docs-cd
Deploys should only happen via push to master, not manual trigger.
Co-authored-by: Cursor <cursoragent@cursor.com>
* ci: typecheck before building docs in CD
docusaurus build strips TypeScript types via babel without validating
them, so a type error could still deploy. docs-ci.yaml typechecks the
same commit, but as an uncoupled parallel workflow it doesn't gate CD —
this catches it if CI fails or a required check is bypassed on master.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* Align Docusaurus config for monorepo, wire Algolia DocSearch (P6)
Fixes projectName/editUrl/path references left over from the docs-unified
repo split, adds trailingSlash for predictable CloudFront 404 handling, and
wires an Algolia search block into themeConfig that's only included when
credentials are present (Docusaurus's schema rejects an empty appId/apiKey,
so this keeps builds green with or without them). Also fixes the
sidebar/redirect generator scripts, which still pointed at the pre-rename
docs/ directory instead of main/, and adds docs/Makefile,
.env.local.example, and an updated README for local dev.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Wire OpenAPI generation to api/v4/source and add docs-ci.yaml (P7)
Replaces build-openapi.mjs's custom YAML-merge implementation with a thin
wrapper around the canonical `make -C api build` target, keeping only the
MDX sanitization step (quote/autolink fixes) that docusaurus-plugin-openapi-docs
needs. Adds a "prebuild" npm script so `npm run build` regenerates the spec
automatically, and ignores the generated api/v4/html artifacts (narrow form,
since ssr_template.hbs and static/favicon.ico under that path are committed).
Also adds docs-ci.yaml as a path-scoped PR/master build+typecheck gate for
the docs site, replacing the legacy `docs` repo's Sphinx-based ci.yml now
that docs live in this monorepo.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Rename OpenAPI prebuild script for clarity
"prebuild" is an npm lifecycle hook name (auto-runs before "npm run build"),
not a descriptive name, so `npm run prebuild` didn't signal it's specifically
about OpenAPI generation. Split it into "build:openapi" (the actual script,
runnable directly and self-explanatory) with "prebuild" now just delegating
to it, preserving the automatic pre-build trigger.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Regenerate sidebars automatically before dev/build (P7 fixup)
documentation.generated.json and developers.generated.json are gitignored
and nothing produced them on a fresh checkout, so both `npm start` and
`npm run build` failed with MODULE_NOT_FOUND outside a working tree that
happened to have stale copies lying around. Wire the sidebar generators
into `prestart`/`prebuild` so they're always regenerated first.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Remove docs/site/.env.local.example
There's a single Algolia DocSearch app for docs.mattermost.com; credentials
aren't distributed to individual developers, so a per-dev .env.local
workflow doesn't apply. Credentials are only ever injected in CI/CD via
repository variables. Local builds/dev server run fine without them (the
Algolia block in docusaurus.config.ts is conditional).
Co-authored-by: Cursor <cursoragent@cursor.com>
* Wire OpenAPI doc generation into prestart/prebuild, drop unused Makefile
docusaurus-plugin-openapi-docs requires a separate `docusaurus gen-api-docs`
CLI step to populate docs/api/reference/ (gitignored) — nothing was
invoking it, so a fresh checkout's npm start/build failed the same way the
sidebar JSONs did. Split build:openapi into build:openapi:spec (slow, runs
make -C api build) and build:openapi:docs (fast, generates MDX from the
existing spec), and wire prestart to reuse an existing spec instead of
rebuilding it every dev-server start.
Also drops docs/Makefile: four of its five targets were pure passthroughs
to npm scripts, unreferenced by CI or anything else, and there's no
repo-wide `make -C <dir>` convention to fit into.
Note: a duplicate-doc-id build failure (operationId `status` in the
Playbooks OpenAPI spec colliding with the main API's `status` tag) is
being fixed separately in mattermost-plugin-playbooks.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Fix stale docs/ reference in sidebar generator's error message
The existence check still hardcoded "docs/" in its error text after SRC
was repointed to main/. Use the SRC constant in the message so it can't
drift out of sync with the actual path again.
Co-authored-by: Cursor <cursoragent@cursor.com>
* remove code comment
* Drop unused artifact upload from docs-ci.yaml
Nothing consumes it: P9's docs-cd.yml will rebuild independently on push
to master rather than downloading it via workflow_run (avoids workflow_run
trigger footguns for an infrequent, cheap-enough rebuild), and P10's
preview build always needs its own independent build anyway (bakes a
per-PR BASE_URL). This was carried over from the old docs repo's ci.yml
out of habit; that repo's own PR-time uploads had the same unused-artifact
issue (only cd.yml's post-merge run ever consumed it).
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* chore(ci): warm node and npm caches daily; make CI jobs restore read-only
Add daily scheduled workflows on master that warm two independent caches,
each in its own workflow mirroring its consumers:
- webapp-ci-cache-warm.yml warms the webapp node_modules cache
(keyed on webapp/package-lock.json)
- e2e-ci-cache-warm.yml warms the E2E ~/.npm registry cache
(keyed on the cypress/playwright/api lockfiles)
Webapp CI and the E2E/api CI jobs now restore these caches read-only instead
of writing them, so the daily jobs keep the caches warm. The E2E ~/.npm
restore is factored into a reusable restore-e2e-npm-cache composite action,
and webapp-setup gains a read-only mode for the node_modules cache.
* chore(ci): guard cache-warm workflows with a concurrency group
* chore(ci): drop unused node-cache-dependency-path output
* chore(ci): reuse webapp-setup for node_modules in e2e-tests-check
* Update docs-impact-review workflow with improved configuration
- Include PR head SHA in concurrency group to avoid cancelling concurrent runs on different commits
- Move permissions to workflow level
- Remove Docs/Not Needed label skip condition from job if clause
- Upgrade model to claude-sonnet-4-20250514 with increased max-turns (30→50)
- Add Bash(ls*) to allowedTools
- Add bug-fix pattern to no-docs-needed list
- Refine security fix rule to skip docs unless externally observable contract change
- Guard label addition behind !analysisFailed check
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Revert structural changes from #37084, keep prompt improvements
Reverts the concurrency group SHA addition, permissions restructure,
model/max-turns/tool changes, and label guard from #37084 as they are
not needed.
Keeps only the meaningful prompt changes:
- Remove Docs/Not Needed label skip from job if condition
- Add bug-fix pattern to no-docs-needed list
- Refine security fix rule to skip docs unless externally observable contract change
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Restore Docs/Not Needed label skip condition
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Update docs-impact-review workflow
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* Add CI check to prevent renumbering or renaming existing DB migrations
Backporting or rebasing a PR can accidentally change the sequence number
or description of a migration that already shipped on master, which
corrupts the upgrade path for existing installations (see MM-68848).
This adds a migration_check tool that compares the working tree's
migration files against the base branch and fails when an existing
migration's version or name differs. Brand new migrations are ignored.
It is wired into the existing "Check migration files" CI job via a new
`make check-migration-changes` target.
Co-authored-by: mattermost-code <matty-code@mattermost.com>
* Apply go fix strings.SplitSeq in migration_check
Co-authored-by: mattermost-code <matty-code@mattermost.com>
* Retrigger CI after transient Enterprise npm failure
Co-authored-by: mattermost-code <matty-code@mattermost.com>
* Use github.ref_name as migration check base ref fallback on push
Co-authored-by: mattermost-code <matty-code@mattermost.com>
* Flag shipped migrations missing from branch by version and name
Add reverse comparison so deletions and simultaneous renumber+rename are
caught, per CodeRabbit review feedback.
Co-authored-by: mattermost-code <matty-code@mattermost.com>
* Address PR feedback: 0 answered, 2 resolved, 0 declined
* Address PR feedback: 2 answered, 1 resolved, 1 declined
* Fix migration check direction and scope to release branches
Address isacikgoz review feedback:
- Reverse the comparison so it flags migration files the branch HAS that
the base branch (origin/master) does NOT, instead of flagging base
migrations missing from the branch. A backport branch is an older subset
of master, so the old direction reported every newer master migration as
an error.
- Include the up/down kind in the comparison key so a one-sided rename of
only the .up or .down file is no longer masked by its surviving partner.
- Restrict the CI step to PRs targeting release-* branches, where the head
is expected to be a subset of master; on master-targeted PRs new
migrations are normal and would otherwise be flagged as stray.
* Scope migration check to PR-added Postgres migrations
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: mattermost-code <matty-code@mattermost.com>
* Skip docs impact review when Docs/Not Needed label is present
Add a gate job that checks for the Docs/Not Needed label before running
the Claude analysis, so maintainers can opt out without the workflow
re-adding Docs/Needed on subsequent CI runs.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Simplify docs/not-needed gate using contains() expression
Replace the dedicated check-docs-not-needed job with a contains() check
on github.event.pull_request.labels in the docs-impact-review job's if:
condition. This avoids spinning up a separate runner and an extra API
call to achieve the same opt-out behavior.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* Fix flaky table conversion for colspan section rows
The mikepenz flaky_summary HTML contains per-suite section-header rows
(<td colspan="2"><strong>...</strong></td>) that markdown tables cannot
represent. The sed pipeline only matched bare <td>/<th> with text-only
content, so those rows leaked raw HTML and broke the rendered table in
Mattermost.
Replace the sed/awk conversion with an inline python3 HTML parser that keeps
only rows matching the header column count (dropping the section-header
rows), unescapes HTML entities, escapes in-cell pipes, and emits a flat
markdown table.
Co-authored-by: Maria A Nunez <maria.nunez@mattermost.com>
* Collapse whitespace in flaky table cells
str.strip() only trims leading/trailing whitespace, so an embedded newline
(including one decoded from an entity like ) would remain and break the
single-line markdown table row. Collapse all internal whitespace to single
spaces when rendering each cell.
Co-authored-by: Maria A Nunez <maria.nunez@mattermost.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* Fix broken migration/codegen CI self-checks
The git status self-checks in server-ci.yml became silent no-ops once
these jobs moved into the build container (#33679): the resolved shell
is sh, where the bash-only [[ ]] errors out, and git rejects the
checkout with "dubious ownership". Switch to POSIX [ ], mark the
workspace safe so git status runs, and print the diff on failure across
all affected checks.
* Regenerate stale migrations.list
The broken check-migrations step let an outdated migrations.list ship.
Regenerate it with make migrations-extract to add migration 000193.
* make mocks
* make gen-serialized
* make mmctl-docs
* Switch Cypress to use shared ESLint config
* Run --fix in Cypress
* Manually fix remaining lint issues in Cypress
* Switch Playwright to use shared ESLint config
* Run --fix in Playwright
* Manually fix remaining lint issues in Playwright
* Install and cache web app deps during Cypress CI builds
This also caches the types and client package. That isn't needed currently
since it uses prepackaged versions of those, but I imagine we might change
that at some point.
* Run e2e-tests-check when ESLint plugin is updated
* Change E2E test GHA caching to cache all of web app node_modules
* Fix mismatch between cache save and restore
* Try bumping cache keys
* Copy step to install dependencies to server.run_cypress.sh
I don't know how this must've worked before, but if this fixes the issue,
it seems like neither Cypress nor Playwright actually use the cached
depenendencies.
* Try disabling caching entirely for Cypress tests
* Try bypassing makefile?
* Try also manually building dependencies in run_specs.sh
I don't know why this appears to duplicate run_cypress.sh and
run_playwright.sh, both of which are called run_test.sh which
might not be used any more as best I can tell.
* Try installing the web app dependencies in yet another place
* Disable the extra steps in server.prepare.sh specifically for Cypress
* Revert changes to update cache key and disable web app depenedency cache on Cypress builds
* Move flaky test report from PR comment to Mattermost channel
Replace the github-script step that posted the flaky test summary as a PR
comment with a step that posts the summary to a Mattermost channel via a new
Mattermost incoming webhook (WEBHOOK_URL_FLAKY_TEST_MM). The HTML <table>
summary is converted to a Markdown table, with content pipes escaped and HTML
entities decoded. The existing custom flaky-test hub webhook is left untouched.
Co-authored-by: Maria A Nunez <maria.nunez@mattermost.com>
* Hoist github.server_url into SERVER_URL env var
Keep all GitHub Actions context expressions in the step's env block for
consistency, and build PR_URL purely from shell variables.
Co-authored-by: Maria A Nunez <maria.nunez@mattermost.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* Generate default_roles_permissions.js from a live server snapshot
Replace the hand-maintained default_roles_permissions.js with a
generated file. The generator (scripts/default_permissions_generator/)
boots a real app.NewServer() against a temporary database created by
storetest.MakeSqlSettings, lets all schema and app-level migrations run
naturally, then snapshots the resulting Roles table into the JS file.
This eliminates the drift risk of the previous hand-maintained map:
new migrations are picked up automatically because the same server
initialization path is used here as in production.
The CI job gets a postgres service and sets IS_CI=true so the generator
uses the same host-switching logic as the rest of the test suite.
Locally, make start-docker provides the postgres instance.
* Address CodeRabbit feedback: pin checkout SHA, add permissions, add .PHONY entries
* Remove build-opensearch-image.yml -- the published image is unused
* MM-68248: Support OpenSearch v3
* MM-68248: Add CI job to test OpenSearch v2 backwards compatibility
* MM-68248: Handle missing indexes gracefully before reindex
OpenSearch v3 rejects _update_by_query and _delete_by_query with no index
argument (405), and returns index_not_found_exception (404) when querying
an exact index name that hasn't been created yet. Both arise before any
reindex has run, since indexes are created on first document write.
Return nil/empty instead of an error from all affected operations, and add
test coverage for each in the no-indexes state.
* MM-68248: Fix copy-paste operation names in DeleteFilesBatch
* MM-68248: Add i18n string for delete_files_batch error
* Revert "MM-68248: Add i18n string for delete_files_batch error"
This reverts commit e885678088.
* Revert "MM-68248: Fix copy-paste operation names in DeleteFilesBatch"
This reverts commit 4b7caacf59.
* Revert "MM-68248: Handle missing indexes gracefully before reindex"
This reverts commit 2d2d522f86.
mattermost-code
Eva SarafianouandCursor
Nuno Simões
Jesse Hallam
Maria A NunezandCursor Agent
Alejandro García Montoro
Harrison Healey
edgarbellot