[pull] master from mattermost:master #1068

Workflow file for this run

.github/workflows/server-ci.yml at d90ea34

	# NOTE: This workflow name is referenced by other workflows:
	# - server-ci-artifacts.yml
	# - server-ci-report.yml
	# - sentry.yaml
	# If you rename this workflow, be sure to update those workflows as well.
	name: Server CI
	on:
	workflow_dispatch: # Allow manual/API triggering for linked plugin CI
	push:
	branches:
	- master
	- release-*
	pull_request:
	paths:
	- "server/**"
	- ".github/workflows/server-ci.yml"
	- ".github/workflows/server-test-template.yml"
	- ".github/workflows/server-test-merge-template.yml"
	- ".github/workflows/mmctl-test-template.yml"
	- "!server/build/Dockerfile.buildenv"
	- "!server/build/Dockerfile.buildenv-fips"
	- "tools/mattermost-govet/**"
	- "!server/*/.md"
	- "!server/NOTICE.txt"
	- "!server/CHANGELOG.md"

	concurrency:
	group: ${{ github.event_name == 'pull_request' && format('{0}-{1}', github.workflow, github.ref) \|\| github.run_id }}
	cancel-in-progress: ${{ github.event_name == 'pull_request' }}

	permissions:
	contents: read

	jobs:
	go:
	name: Compute Go Version
	runs-on: ubuntu-22.04
	permissions:
	contents: read
	pull-requests: read
	outputs:
	version: ${{ steps.calculate.outputs.GO_VERSION }}
	gomod-changed: ${{ steps.changed-files.outputs.any_changed }}
	steps:
	- name: Checkout mattermost project
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false
	- name: Calculate version
	id: calculate
	working-directory: server/
	run: echo GO_VERSION=$(cat .go-version) >> "${GITHUB_OUTPUT}"
	- name: Check for go.mod changes
	id: changed-files
	uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323 # v47.0.5
	with:
	files: \|
	**/go.mod
	check-mocks:
	name: Check mocks
	needs: go
	runs-on: ubuntu-22.04
	container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
	defaults:
	run:
	working-directory: server
	steps:
	- name: Checkout mattermost project
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false
	- name: Run setup-go-work
	run: make setup-go-work
	- name: Generate mocks
	run: make mocks
	- name: Check mocks
	run: \|
	git config --global --add safe.directory "$GITHUB_WORKSPACE"
	if [ -n "$(git status --porcelain)" ]; then
	echo "Please update the mocks using 'make mocks'"
	git diff
	exit 1
	fi
	check-go-mod-tidy:
	name: Check go mod tidy
	needs: go
	runs-on: ubuntu-22.04
	container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
	defaults:
	run:
	working-directory: server
	steps:
	- name: Checkout mattermost project
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false
	- name: Run setup-go-work
	run: make setup-go-work
	- name: Run go mod tidy
	run: make modules-tidy
	- name: Check modules
	run: \|
	git config --global --add safe.directory "$GITHUB_WORKSPACE"
	if [ -n "$(git status --porcelain)" ]; then
	echo "Please tidy up the Go modules using make modules-tidy"
	git diff
	exit 1
	fi
	check-go-fix:
	name: Check go fix
	needs: go
	runs-on: ubuntu-22.04
	container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
	defaults:
	run:
	working-directory: server
	steps:
	- name: Checkout mattermost project
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false
	- name: Run setup-go-work
	run: make setup-go-work
	- name: Run go fix
	run: go fix ./...
	- name: Check go fix
	run: \|
	git config --global --add safe.directory "$GITHUB_WORKSPACE"
	if [ -n "$(git status --porcelain)" ]; then
	echo "Please run 'go fix ./...' and commit the changes"
	git diff
	exit 1
	fi
	check-style:
	name: check-style
	needs: go
	runs-on: ubuntu-22.04
	container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
	defaults:
	run:
	working-directory: server
	steps:
	- name: Checkout mattermost project
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false
	- name: Run setup-go-work
	run: make setup-go-work
	- name: Run golangci
	run: make check-style
	check-gen-serialized:
	name: Check serialization methods for hot structs
	needs: go
	runs-on: ubuntu-22.04
	container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
	defaults:
	run:
	working-directory: server
	steps:
	- name: Checkout mattermost project
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false
	- name: Run setup-go-work
	run: make setup-go-work
	- name: Run make-gen-serialized
	run: make gen-serialized
	- name: Check serialized
	run: \|
	git config --global --add safe.directory "$GITHUB_WORKSPACE"
	if [ -n "$(git status --porcelain)" ]; then
	echo "Please update the serialized files using 'make gen-serialized'"
	git diff
	exit 1
	fi
	check-mattermost-vet-api:
	name: Vet API
	needs: go
	runs-on: ubuntu-22.04
	container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
	defaults:
	run:
	working-directory: server
	steps:
	- name: Checkout mattermost project
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false
	- name: Run setup-go-work
	run: make setup-go-work
	- name: Run mattermost-vet-api
	run: make vet-api
	check-migrations:
	name: Check migration files
	needs: go
	runs-on: ubuntu-22.04
	container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
	defaults:
	run:
	working-directory: server
	steps:
	- name: Checkout mattermost project
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false
	- name: Extract migrations files
	run: make migrations-extract
	- name: Check migration files
	run: \|
	git config --global --add safe.directory "$GITHUB_WORKSPACE"
	if [ -n "$(git status --porcelain)" ]; then
	echo "Please update the migrations using make migrations-extract"
	git diff
	exit 1
	fi
	check-email-templates:
	name: Generate email templates
	needs: go
	runs-on: ubuntu-22.04
	container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
	defaults:
	run:
	working-directory: server
	steps:
	- name: Checkout mattermost project
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false
	- name: Generate email templates
	run: \|
	npm install -g mjml@4.9.0
	make build-templates
	- name: Check generated email templates
	run: \|
	git config --global --add safe.directory "$GITHUB_WORKSPACE"
	if [ -n "$(git status --porcelain)" ]; then
	echo "Please update the email templates using 'make build-templates'"
	git diff
	exit 1
	fi
	check-store-layers:
	name: Check store layers
	needs: go
	runs-on: ubuntu-22.04
	container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
	defaults:
	run:
	working-directory: server
	steps:
	- name: Checkout mattermost project
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false
	- name: Run setup-go-work
	run: make setup-go-work
	- name: Generate store layers
	run: make store-layers
	- name: Check generated code
	run: \|
	git config --global --add safe.directory "$GITHUB_WORKSPACE"
	if [ -n "$(git status --porcelain)" ]; then
	echo "Please update the store layers using make store-layers"
	git diff
	exit 1
	fi
	check-default-roles-permissions:
	name: Check default roles permissions
	needs: go
	runs-on: ubuntu-22.04
	container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
	permissions:
	contents: read
	services:
	postgres:
	image: postgres:14
	env:
	POSTGRES_USER: mmuser
	POSTGRES_PASSWORD: mostest
	options: >-
	--health-cmd pg_isready
	--health-interval 5s
	--health-timeout 5s
	--health-retries 5
	defaults:
	run:
	working-directory: server
	steps:
	- name: Checkout mattermost project
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false
	- name: Run setup-go-work
	run: make setup-go-work
	- name: Generate default roles permissions
	env:
	IS_CI: "true"
	run: make default-roles-permissions
	- name: Check generated code
	run: \|
	git config --global --add safe.directory "$GITHUB_WORKSPACE"
	if [ -n "$(git status --porcelain)" ]; then
	echo "Please update the default roles permissions using make default-roles-permissions"
	git diff
	exit 1
	fi
	check-mmctl-docs:
	name: Check mmctl docs
	needs: go
	runs-on: ubuntu-22.04
	container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
	defaults:
	run:
	working-directory: server
	steps:
	- name: Checkout mattermost-server
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false
	- name: Run setup-go-work
	run: make setup-go-work
	- name: Check docs
	run: \|
	echo "Making sure docs are updated"
	make mmctl-docs
	git config --global --add safe.directory "$GITHUB_WORKSPACE"
	if [ -n "$(git status --porcelain)" ]; then
	echo "Please update the mmctl docs using make mmctl-docs"
	git diff
	exit 1
	fi
	# NOTE: Postgres with binary parameters has been moved to server-ci-weekly.yml
	# (runs Monday 1am EST / 5am UTC). Low regression risk doesn't justify
	# consuming 8-core runners on every push.

	# -- Sharded into 4 parallel runners for ~88% wall-time improvement --
	test-postgres-normal:
	name: Postgres (shard ${{ matrix.shard }})
	needs: go
	strategy:
	fail-fast: false # Let all shards complete so we get full test results
	matrix:
	shard: [0, 1, 2, 3]
	permissions:
	contents: read
	actions: write
	uses: ./.github/workflows/server-test-template.yml
	secrets:
	CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
	with:
	name: "Postgres (shard ${{ matrix.shard }})"
	datasource: postgres://mmuser:mostest@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
	drivername: postgres
	# Each shard gets a unique artifact name so they don't collide
	logsartifact: "postgres-server-test-logs-shard-${{ matrix.shard }}"
	enablecoverage: ${{ github.event_name != 'pull_request' \|\| !startsWith(github.event.pull_request.base.ref, 'release-') }}
	go-version: ${{ needs.go.outputs.version }}
	fips-enabled: false
	shard-index: ${{ matrix.shard }}
	shard-total: 4
	# -- Merge test results (handles both single-run and future sharded runs) --
	merge-postgres-test-results:
	name: Merge Postgres Test Results
	needs: test-postgres-normal
	if: always()
	permissions:
	contents: read
	actions: write
	uses: ./.github/workflows/server-test-merge-template.yml
	with:
	artifact-pattern: postgres-server-test-logs-shard-*
	artifact-name: postgres-server-test-logs
	save-timing-cache: true
	all-shards-passed: ${{ needs.test-postgres-normal.result == 'success' }}

	test-elasticsearch-v8:
	name: Elasticsearch v8 Compatibility
	needs: go
	permissions:
	contents: read
	actions: write
	uses: ./.github/workflows/server-test-template.yml
	with:
	name: Elasticsearch v8 Compatibility
	datasource: postgres://mmuser:mostest@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
	drivername: postgres
	logsartifact: elasticsearch-v8-server-test-logs
	go-version: ${{ needs.go.outputs.version }}
	fips-enabled: false
	elasticsearch-version: "8.9.0"
	test-target: "test-server-elasticsearch"

	test-opensearch-v2:
	name: OpenSearch v2 Compatibility
	needs: go
	permissions:
	contents: read
	actions: write
	uses: ./.github/workflows/server-test-template.yml
	with:
	name: OpenSearch v2 Compatibility
	datasource: postgres://mmuser:mostest@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
	drivername: postgres
	logsartifact: opensearch-v2-server-test-logs
	go-version: ${{ needs.go.outputs.version }}
	fips-enabled: false
	opensearch-version: "2.19.0"
	test-target: "test-server-opensearch"

	# FIPS tests: run on PRs when go.mod changed or branch name contains "fips".
	# Sharded for fast iteration. Weekly workflow provides regular full coverage.
	test-postgres-normal-fips:
	if: contains(github.head_ref, 'fips') \|\| needs.go.outputs.gomod-changed == 'true'
	name: "Postgres FIPS (shard ${{ matrix.shard }})"
	needs: go
	strategy:
	fail-fast: false
	matrix:
	shard: [0, 1, 2, 3]
	permissions:
	contents: read
	actions: write
	uses: ./.github/workflows/server-test-template.yml
	secrets:
	DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
	DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
	with:
	name: "Postgres FIPS (shard ${{ matrix.shard }})"
	datasource: postgres://mmuser:mostest-fips-test@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
	drivername: postgres
	logsartifact: "postgres-server-fips-test-logs-shard-${{ matrix.shard }}"
	go-version: ${{ needs.go.outputs.version }}
	fips-enabled: true
	shard-index: ${{ matrix.shard }}
	shard-total: 4
	merge-postgres-fips-test-results:
	name: Merge Postgres FIPS Test Results
	needs: test-postgres-normal-fips
	if: needs.test-postgres-normal-fips.result != 'skipped'
	permissions:
	contents: read
	actions: write
	uses: ./.github/workflows/server-test-merge-template.yml
	with:
	artifact-pattern: postgres-server-fips-test-logs-shard-*
	artifact-name: postgres-server-fips-test-logs

	test-mmctl:
	name: Run mmctl tests
	needs: go
	permissions:
	contents: read
	actions: write
	uses: ./.github/workflows/mmctl-test-template.yml
	secrets:
	MM_E2E_ZEPHYR_API_KEY: ${{ secrets.MM_E2E_ZEPHYR_API_KEY }}
	with:
	name: mmctl
	datasource: postgres://mmuser:mostest@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
	drivername: postgres
	logsartifact: mmctl-test-logs
	go-version: ${{ needs.go.outputs.version }}
	fips-enabled: false
	test-mmctl-fips:
	if: contains(github.head_ref, 'fips') \|\| needs.go.outputs.gomod-changed == 'true'
	name: Run mmctl tests (FIPS)
	needs: go
	permissions:
	contents: read
	actions: write
	uses: ./.github/workflows/mmctl-test-template.yml
	secrets:
	DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
	DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
	MM_E2E_ZEPHYR_API_KEY: ${{ secrets.MM_E2E_ZEPHYR_API_KEY }}
	with:
	name: mmctl
	datasource: postgres://mmuser:mostest-fips-test@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
	drivername: postgres
	logsartifact: mmctl-fips-test-logs
	go-version: ${{ needs.go.outputs.version }}
	fips-enabled: true

	build-mattermost-server:
	name: Build mattermost server app
	needs: go
	permissions:
	contents: read
	actions: write
	runs-on: ubuntu-22.04
	container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }}
	defaults:
	run:
	working-directory: server
	env:
	BUILD_NUMBER: "${GITHUB_HEAD_REF}-${GITHUB_RUN_ID}"
	FIPS_ENABLED: false
	steps:
	- name: Checkout mattermost project
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false
	- name: ci/setup-node
	uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
	with:
	node-version-file: ".nvmrc"
	cache: "npm"
	cache-dependency-path: "webapp/package-lock.json"
	- name: Run setup-go-work
	run: make setup-go-work
	- name: Build
	run: \|
	make config-reset
	make build-cmd
	make package
	- name: Persist dist artifacts
	if: github.event_name == 'push' \|\| github.event.pull_request.head.repo.full_name == github.repository
	uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
	with:
	name: server-dist-artifact
	path: server/dist/
	if-no-files-found: error
	compression-level: 0
	retention-days: 2
	- name: Persist build artifacts
	if: github.event_name == 'push' \|\| github.event.pull_request.head.repo.full_name == github.repository
	uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
	with:
	name: server-build-artifact
	path: server/build/
	retention-days: 2

	# ci-complete is used to determine if the Server CI is complete since
	# fips steps are optional and can be skipped. When we build with fips,
	# we want to ensure that the Server CI is complete before running the
	# artifacts upload workflow.
	ci-complete:
	name: Server CI Complete
	if: >-
	always() &&
	(needs.test-mmctl-fips.result == 'success' \|\| needs.test-mmctl-fips.result == 'skipped' \|\| needs.test-mmctl-fips.result == 'failure') &&
	(needs.merge-postgres-fips-test-results.result == 'success' \|\| needs.merge-postgres-fips-test-results.result == 'skipped' \|\| needs.merge-postgres-fips-test-results.result == 'failure')
	permissions: {}
	runs-on: ubuntu-22.04
	needs:
	- merge-postgres-test-results
	- test-elasticsearch-v8
	- test-opensearch-v2
	- test-mmctl
	- test-mmctl-fips
	- build-mattermost-server
	- merge-postgres-fips-test-results
	steps:
	- name: Server CI Complete
	run: echo "Server CI Complete"

	ci-report:
	name: Server CI Report
	if: always()
	permissions:
	contents: read
	actions: read
	checks: write
	pull-requests: write
	issues: write
	needs:
	- ci-complete
	uses: ./.github/workflows/server-ci-report.yml
	secrets:
	WEBHOOK_URL_FLAKY_TEST: ${{ secrets.WEBHOOK_URL_FLAKY_TEST }}
	WEBHOOK_AUTH_TOKEN_FLAKY_TEST: ${{ secrets.WEBHOOK_AUTH_TOKEN_FLAKY_TEST }}
	WEBHOOK_URL_FLAKY_TEST_MM: ${{ secrets.WEBHOOK_URL_FLAKY_TEST_MM }}
	with:
	source-run-id: ${{ github.run_id }}
	source-event: ${{ github.event_name }}
	head-commit-id: ${{ github.event.pull_request.head.sha \|\| github.sha }}
	head-repository: ${{ github.event.pull_request.head.repo.full_name \|\| github.repository }}
	workflow-url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}

	ci-artifacts:
	name: Server CI Artifacts
	if: >-
	success('ci-complete') &&
	github.repository_owner == 'mattermost' &&
	github.event_name == 'pull_request' &&
	github.event.pull_request.head.repo.full_name == github.repository
	permissions:
	contents: read
	actions: read
	statuses: write
	needs:
	- ci-complete
	uses: ./.github/workflows/server-ci-artifacts.yml
	secrets:
	PR_BUILDS_BUCKET_AWS_ACCESS_KEY_ID: ${{ secrets.PR_BUILDS_BUCKET_AWS_ACCESS_KEY_ID }}
	PR_BUILDS_BUCKET_AWS_SECRET_ACCESS_KEY: ${{ secrets.PR_BUILDS_BUCKET_AWS_SECRET_ACCESS_KEY }}
	DOCKERHUB_DEV_TOKEN: ${{ secrets.DOCKERHUB_DEV_TOKEN }}
	WIZ_DEVOPS_CLIENT_ID: ${{ secrets.WIZ_DEVOPS_CLIENT_ID }}
	WIZ_DEVOPS_CLIENT_SECRET: ${{ secrets.WIZ_DEVOPS_CLIENT_SECRET }}
	with:
	source-run-id: ${{ github.run_id }}
	source-event: ${{ github.event_name }}
	head-sha: ${{ github.event.pull_request.head.sha }}
	head-repository: ${{ github.event.pull_request.head.repo.full_name }}

	ci-sentry:
	name: Sentry Upload
	# Only run Sentry upload for master branch as mentioned in old workflow title.
	if: >-
	always() &&
	github.repository_owner == 'mattermost' &&
	github.event_name == 'push' &&
	github.ref == 'refs/heads/master'
	permissions:
	contents: read
	needs:
	- ci-complete
	uses: ./.github/workflows/sentry.yaml
	secrets:
	SENTRY_AUTH_TOKEN: ${{ secrets.MM_SERVER_SENTRY_AUTH_TOKEN }}
	SENTRY_ORG: ${{ secrets.MM_SERVER_SENTRY_ORG }}
	SENTRY_PROJECT: ${{ secrets.MM_SERVER_SENTRY_PROJECT }}

Navigation Menu

[pull] master from mattermost:master #1068

Workflow file

[pull] master from mattermost:master #1068

Uh oh!

Workflow file for this run