mattermost/.github/workflows/server-ci.yml

# NOTE: This workflow name is referenced by other workflows:
# - server-ci-artifacts.yml
# - server-ci-report.yml
# - sentry.yaml
# If you rename this workflow, be sure to update those workflows as well.
name: Server CI
on:
  workflow_dispatch:  # Allow manual/API triggering for linked plugin CI
  push:
    branches:
      - master
      - release-*
  pull_request:
    paths:
      - "server/**"
      - ".github/workflows/server-ci.yml"
      - ".github/workflows/server-test-template.yml"
      - ".github/workflows/server-test-merge-template.yml"
      - ".github/workflows/mmctl-test-template.yml"
      - "!server/build/Dockerfile.buildenv"
      - "!server/build/Dockerfile.buildenv-fips"
      - "tools/mattermost-govet/**"
      - "!server/**/*.md"
      - "!server/NOTICE.txt"
      - "!server/CHANGELOG.md"

concurrency:
  group: ${{ github.event_name == 'pull_request' && format('{0}-{1}', github.workflow, github.ref) || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read

jobs:
  go:
    name: Compute Go Version
    runs-on: ubuntu-22.04
    permissions:
      contents: read
      pull-requests: read
    outputs:
      version: ${{ steps.calculate.outputs.GO_VERSION }}
      gomod-changed: ${{ steps.changed-files.outputs.any_changed }}
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Calculate version
        id: calculate
        working-directory: server/
        run: echo GO_VERSION=$(cat .go-version) >> "${GITHUB_OUTPUT}"
      - name: Check for go.mod changes
        id: changed-files
        uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323 # v47.0.5
        with:
          files: |
            **/go.mod
  check-mocks:
    name: Check mocks
    needs: go
    runs-on: ubuntu-22.04
    container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
    defaults:
      run:
        working-directory: server
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Run setup-go-work
        run: make setup-go-work
      - name: Generate mocks
        run: make mocks
      - name: Check mocks
        run: |
          git config --global --add safe.directory "$GITHUB_WORKSPACE"
          if [ -n "$(git status --porcelain)" ]; then
            echo "Please update the mocks using 'make mocks'"
            git diff
            exit 1
          fi
  check-go-mod-tidy:
    name: Check go mod tidy
    needs: go
    runs-on: ubuntu-22.04
    container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
    defaults:
      run:
        working-directory: server
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Run setup-go-work
        run: make setup-go-work
      - name: Run go mod tidy
        run: make modules-tidy
      - name: Check modules
        run: |
          git config --global --add safe.directory "$GITHUB_WORKSPACE"
          if [ -n "$(git status --porcelain)" ]; then
            echo "Please tidy up the Go modules using make modules-tidy"
            git diff
            exit 1
          fi
  check-go-fix:
    name: Check go fix
    needs: go
    runs-on: ubuntu-22.04
    container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
    defaults:
      run:
        working-directory: server
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Run setup-go-work
        run: make setup-go-work
      - name: Run go fix
        run: go fix ./...
      - name: Check go fix
        run: |
          git config --global --add safe.directory "$GITHUB_WORKSPACE"
          if [ -n "$(git status --porcelain)" ]; then
            echo "Please run 'go fix ./...' and commit the changes"
            git diff
            exit 1
          fi
  check-style:
    name: check-style
    needs: go
    runs-on: ubuntu-22.04
    container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
    defaults:
      run:
        working-directory: server
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Run setup-go-work
        run: make setup-go-work
      - name: Run golangci
        run: make check-style
  check-gen-serialized:
    name: Check serialization methods for hot structs
    needs: go
    runs-on: ubuntu-22.04
    container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
    defaults:
      run:
        working-directory: server
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Run setup-go-work
        run: make setup-go-work
      - name: Run make-gen-serialized
        run: make gen-serialized
      - name: Check serialized
        run: |
          git config --global --add safe.directory "$GITHUB_WORKSPACE"
          if [ -n "$(git status --porcelain)" ]; then
            echo "Please update the serialized files using 'make gen-serialized'"
            git diff
            exit 1
          fi
  check-mattermost-vet-api:
    name: Vet API
    needs: go
    runs-on: ubuntu-22.04
    container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
    defaults:
      run:
        working-directory: server
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Run setup-go-work
        run: make setup-go-work
      - name: Run mattermost-vet-api
        run: make vet-api
  check-migrations:
    name: Check migration files
    needs: go
    runs-on: ubuntu-22.04
    container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
    defaults:
      run:
        working-directory: server
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Extract migrations files
        run: make migrations-extract
      - name: Check migration files
        run: |
          git config --global --add safe.directory "$GITHUB_WORKSPACE"
          if [ -n "$(git status --porcelain)" ]; then
            echo "Please update the migrations using make migrations-extract"
            git diff
            exit 1
          fi
  check-email-templates:
    name: Generate email templates
    needs: go
    runs-on: ubuntu-22.04
    container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
    defaults:
      run:
        working-directory: server
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Generate email templates
        run: |
          npm install -g mjml@4.9.0
          make build-templates
      - name: Check generated email templates
        run: |
          git config --global --add safe.directory "$GITHUB_WORKSPACE"
          if [ -n "$(git status --porcelain)" ]; then
            echo "Please update the email templates using 'make build-templates'"
            git diff
            exit 1
          fi
  check-store-layers:
    name: Check store layers
    needs: go
    runs-on: ubuntu-22.04
    container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
    defaults:
      run:
        working-directory: server
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Run setup-go-work
        run: make setup-go-work
      - name: Generate store layers
        run: make store-layers
      - name: Check generated code
        run: |
          git config --global --add safe.directory "$GITHUB_WORKSPACE"
          if [ -n "$(git status --porcelain)" ]; then
            echo "Please update the store layers using make store-layers"
            git diff
            exit 1
          fi
  check-default-roles-permissions:
    name: Check default roles permissions
    needs: go
    runs-on: ubuntu-22.04
    container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
    permissions:
      contents: read
    services:
      postgres:
        image: postgres:14
        env:
          POSTGRES_USER: mmuser
          POSTGRES_PASSWORD: mostest
        options: >-
          --health-cmd pg_isready
          --health-interval 5s
          --health-timeout 5s
          --health-retries 5
    defaults:
      run:
        working-directory: server
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Run setup-go-work
        run: make setup-go-work
      - name: Generate default roles permissions
        env:
          IS_CI: "true"
        run: make default-roles-permissions
      - name: Check generated code
        run: |
          git config --global --add safe.directory "$GITHUB_WORKSPACE"
          if [ -n "$(git status --porcelain)" ]; then
            echo "Please update the default roles permissions using make default-roles-permissions"
            git diff
            exit 1
          fi
  check-mmctl-docs:
    name: Check mmctl docs
    needs: go
    runs-on: ubuntu-22.04
    container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
    defaults:
      run:
        working-directory: server
    steps:
      - name: Checkout mattermost-server
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Run setup-go-work
        run: make setup-go-work
      - name: Check docs
        run: |
          echo "Making sure docs are updated"
          make mmctl-docs
          git config --global --add safe.directory "$GITHUB_WORKSPACE"
          if [ -n "$(git status --porcelain)" ]; then
            echo "Please update the mmctl docs using make mmctl-docs"
            git diff
            exit 1
          fi
  # NOTE: Postgres with binary parameters has been moved to server-ci-weekly.yml
  # (runs Monday 1am EST / 5am UTC). Low regression risk doesn't justify
  # consuming 8-core runners on every push.

  # -- Sharded into 4 parallel runners for ~88% wall-time improvement --
  test-postgres-normal:
    name: Postgres (shard ${{ matrix.shard }})
    needs: go
    strategy:
      fail-fast: false # Let all shards complete so we get full test results
      matrix:
        shard: [0, 1, 2, 3]
    permissions:
      contents: read
      actions: write
    uses: ./.github/workflows/server-test-template.yml
    secrets:
      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
    with:
      name: "Postgres (shard ${{ matrix.shard }})"
      datasource: postgres://mmuser:mostest@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
      drivername: postgres
      # Each shard gets a unique artifact name so they don't collide
      logsartifact: "postgres-server-test-logs-shard-${{ matrix.shard }}"
      enablecoverage: ${{ github.event_name != 'pull_request' || !startsWith(github.event.pull_request.base.ref, 'release-') }}
      go-version: ${{ needs.go.outputs.version }}
      fips-enabled: false
      shard-index: ${{ matrix.shard }}
      shard-total: 4
  # -- Merge test results (handles both single-run and future sharded runs) --
  merge-postgres-test-results:
    name: Merge Postgres Test Results
    needs: test-postgres-normal
    if: always()
    permissions:
      contents: read
      actions: write
    uses: ./.github/workflows/server-test-merge-template.yml
    with:
      artifact-pattern: postgres-server-test-logs-shard-*
      artifact-name: postgres-server-test-logs
      save-timing-cache: true
      all-shards-passed: ${{ needs.test-postgres-normal.result == 'success' }}

  test-elasticsearch-v8:
    name: Elasticsearch v8 Compatibility
    needs: go
    permissions:
      contents: read
      actions: write
    uses: ./.github/workflows/server-test-template.yml
    with:
      name: Elasticsearch v8 Compatibility
      datasource: postgres://mmuser:mostest@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
      drivername: postgres
      logsartifact: elasticsearch-v8-server-test-logs
      go-version: ${{ needs.go.outputs.version }}
      fips-enabled: false
      elasticsearch-version: "8.9.0"
      test-target: "test-server-elasticsearch"

  test-opensearch-v2:
    name: OpenSearch v2 Compatibility
    needs: go
    permissions:
      contents: read
      actions: write
    uses: ./.github/workflows/server-test-template.yml
    with:
      name: OpenSearch v2 Compatibility
      datasource: postgres://mmuser:mostest@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
      drivername: postgres
      logsartifact: opensearch-v2-server-test-logs
      go-version: ${{ needs.go.outputs.version }}
      fips-enabled: false
      opensearch-version: "2.19.0"
      test-target: "test-server-opensearch"

  # FIPS tests: run on PRs when go.mod changed or branch name contains "fips".
  # Sharded for fast iteration. Weekly workflow provides regular full coverage.
  test-postgres-normal-fips:
    if: contains(github.head_ref, 'fips') || needs.go.outputs.gomod-changed == 'true'
    name: "Postgres FIPS (shard ${{ matrix.shard }})"
    needs: go
    strategy:
      fail-fast: false
      matrix:
        shard: [0, 1, 2, 3]
    permissions:
      contents: read
      actions: write
    uses: ./.github/workflows/server-test-template.yml
    secrets:
      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
    with:
      name: "Postgres FIPS (shard ${{ matrix.shard }})"
      datasource: postgres://mmuser:mostest-fips-test@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
      drivername: postgres
      logsartifact: "postgres-server-fips-test-logs-shard-${{ matrix.shard }}"
      go-version: ${{ needs.go.outputs.version }}
      fips-enabled: true
      shard-index: ${{ matrix.shard }}
      shard-total: 4
  merge-postgres-fips-test-results:
    name: Merge Postgres FIPS Test Results
    needs: test-postgres-normal-fips
    if: needs.test-postgres-normal-fips.result != 'skipped'
    permissions:
      contents: read
      actions: write
    uses: ./.github/workflows/server-test-merge-template.yml
    with:
      artifact-pattern: postgres-server-fips-test-logs-shard-*
      artifact-name: postgres-server-fips-test-logs

  test-mmctl:
    name: Run mmctl tests
    needs: go
    permissions:
      contents: read
      actions: write
    uses: ./.github/workflows/mmctl-test-template.yml
    secrets:
      MM_E2E_ZEPHYR_API_KEY: ${{ secrets.MM_E2E_ZEPHYR_API_KEY }}
    with:
      name: mmctl
      datasource: postgres://mmuser:mostest@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
      drivername: postgres
      logsartifact: mmctl-test-logs
      go-version: ${{ needs.go.outputs.version }}
      fips-enabled: false
  test-mmctl-fips:
    if: contains(github.head_ref, 'fips') || needs.go.outputs.gomod-changed == 'true'
    name: Run mmctl tests (FIPS)
    needs: go
    permissions:
      contents: read
      actions: write
    uses: ./.github/workflows/mmctl-test-template.yml
    secrets:
      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
      MM_E2E_ZEPHYR_API_KEY: ${{ secrets.MM_E2E_ZEPHYR_API_KEY }}
    with:
      name: mmctl
      datasource: postgres://mmuser:mostest-fips-test@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
      drivername: postgres
      logsartifact: mmctl-fips-test-logs
      go-version: ${{ needs.go.outputs.version }}
      fips-enabled: true

  build-mattermost-server:
    name: Build mattermost server app
    needs: go
    permissions:
      contents: read
      actions: write
    runs-on: ubuntu-22.04
    container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
    defaults:
      run:
        working-directory: server
    env:
      BUILD_NUMBER: "${GITHUB_HEAD_REF}-${GITHUB_RUN_ID}"
      FIPS_ENABLED: false
    steps:
      - name: Checkout mattermost project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: ci/setup-node
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version-file: ".nvmrc"
          cache: "npm"
          cache-dependency-path: "webapp/package-lock.json"
      - name: Run setup-go-work
        run: make setup-go-work
      - name: Build
        run: |
          make config-reset
          make build-cmd
          make package
      - name: Persist dist artifacts
        if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: server-dist-artifact
          path: server/dist/
          if-no-files-found: error
          compression-level: 0
          retention-days: 2
      - name: Persist build artifacts
        if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: server-build-artifact
          path: server/build/
          retention-days: 2

  # ci-complete is used to determine if the Server CI is complete since
  # fips steps are optional and can be skipped. When we build with fips,
  # we want to ensure that the Server CI is complete before running the
  # artifacts upload workflow.
  ci-complete:
    name: Server CI Complete
    if: >-
      always() &&
      (needs.test-mmctl-fips.result == 'success' || needs.test-mmctl-fips.result == 'skipped' || needs.test-mmctl-fips.result == 'failure') &&
      (needs.merge-postgres-fips-test-results.result == 'success' || needs.merge-postgres-fips-test-results.result == 'skipped' || needs.merge-postgres-fips-test-results.result == 'failure')
    permissions: {}
    runs-on: ubuntu-22.04
    needs:
      - merge-postgres-test-results
      - test-elasticsearch-v8
      - test-opensearch-v2
      - test-mmctl
      - test-mmctl-fips
      - build-mattermost-server
      - merge-postgres-fips-test-results
    steps:
      - name: Server CI Complete
        run: echo "Server CI Complete"

  ci-report:
    name: Server CI Report
    if: always()
    permissions:
      contents: read
      actions: read
      checks: write
      pull-requests: write
      issues: write
    needs:
      - ci-complete
    uses: ./.github/workflows/server-ci-report.yml
    secrets:
      WEBHOOK_URL_FLAKY_TEST: ${{ secrets.WEBHOOK_URL_FLAKY_TEST }}
      WEBHOOK_AUTH_TOKEN_FLAKY_TEST: ${{ secrets.WEBHOOK_AUTH_TOKEN_FLAKY_TEST }}
      WEBHOOK_URL_FLAKY_TEST_MM: ${{ secrets.WEBHOOK_URL_FLAKY_TEST_MM }}
    with:
      source-run-id: ${{ github.run_id }}
      source-event: ${{ github.event_name }}
      head-commit-id: ${{ github.event.pull_request.head.sha || github.sha }}
      head-repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
      workflow-url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}

  ci-artifacts:
    name: Server CI Artifacts
    if: >-
      success('ci-complete') &&
      github.repository_owner == 'mattermost' &&
      github.event_name == 'pull_request' &&
      github.event.pull_request.head.repo.full_name == github.repository
    permissions:
      contents: read
      actions: read
      statuses: write
    needs:
      - ci-complete
    uses: ./.github/workflows/server-ci-artifacts.yml
    secrets:
      PR_BUILDS_BUCKET_AWS_ACCESS_KEY_ID: ${{ secrets.PR_BUILDS_BUCKET_AWS_ACCESS_KEY_ID }}
      PR_BUILDS_BUCKET_AWS_SECRET_ACCESS_KEY: ${{ secrets.PR_BUILDS_BUCKET_AWS_SECRET_ACCESS_KEY }}
      DOCKERHUB_DEV_TOKEN: ${{ secrets.DOCKERHUB_DEV_TOKEN }}
      WIZ_DEVOPS_CLIENT_ID: ${{ secrets.WIZ_DEVOPS_CLIENT_ID }}
      WIZ_DEVOPS_CLIENT_SECRET: ${{ secrets.WIZ_DEVOPS_CLIENT_SECRET }}
    with:
      source-run-id: ${{ github.run_id }}
      source-event: ${{ github.event_name }}
      head-sha: ${{ github.event.pull_request.head.sha }}
      head-repository: ${{ github.event.pull_request.head.repo.full_name }}

  ci-sentry:
    name: Sentry Upload
    # Only run Sentry upload for master branch as mentioned in old workflow title.
    if: >-
      always() &&
      github.repository_owner == 'mattermost' &&
      github.event_name == 'push' &&
      github.ref == 'refs/heads/master'
    permissions:
      contents: read
    needs:
      - ci-complete
    uses: ./.github/workflows/sentry.yaml
    secrets:
      SENTRY_AUTH_TOKEN: ${{ secrets.MM_SERVER_SENTRY_AUTH_TOKEN }}
      SENTRY_ORG: ${{ secrets.MM_SERVER_SENTRY_ORG }}
      SENTRY_PROJECT: ${{ secrets.MM_SERVER_SENTRY_PROJECT }}