[pull] master from mattermost:master

.github/workflows/server-ci-nightly-race.yml

@@ -0,0 +1,52 @@
+# Nightly race detector run.
+#
+# Runs all server tests with Go's -race detector enabled to catch
+# data races. Runs sequentially (fullyparallel: false) on a 2-core
+# runner to minimize resource usage — race detection adds significant
+# overhead that makes parallel execution impractical.
+#
+# Schedule: Nightly at ~2am ET (6am UTC)
+#
+# Previously, -race was implicitly bundled with the binary params job
+# via the fullyparallel=false → RACE_MODE coupling. This decouples
+# the two concerns: binary params tests the Postgres driver encoding;
+# this workflow tests for data races.
+name: Server CI Nightly Race
+on:
+  schedule:
+    - cron: "0 6 * * *" # Daily 6am UTC (~2am ET)
+  workflow_dispatch: # Manual trigger for on-demand race detection
+
+permissions:
+  contents: read
+
+jobs:
+  go:
+    name: Compute Go Version
+    runs-on: ubuntu-22.04
+    outputs:
+      version: ${{ steps.calculate.outputs.GO_VERSION }}
+    steps:
+      - name: Checkout mattermost project
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Calculate version
+        id: calculate
+        working-directory: server/
+        run: echo GO_VERSION=$(cat .go-version) >> "${GITHUB_OUTPUT}"
+
+  test-race:
+    name: Race Detector
+    needs: go
+    uses: ./.github/workflows/server-test-template.yml
+    secrets: inherit
+    with:
+      name: Race Detector
+      datasource: postgres://mmuser:mostest@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
+      drivername: postgres
+      logsartifact: race-detector-server-test-logs
+      go-version: ${{ needs.go.outputs.version }}
+      fips-enabled: false
+      fullyparallel: false
+      race-enabled: true
+      runner: ubuntu-22.04
+      allow-failure: true

.github/workflows/server-ci-weekly.yml

@@ -0,0 +1,75 @@
+# Weekly Server CI jobs that don't need to run on every push/PR.
+# These are important for compliance and compatibility but have low
+# regression rates, so running them weekly saves significant 8-core
+# runner capacity (9 fewer concurrent 8-core jobs per master push).
+#
+# Schedule: Monday ~1am ET (5am UTC)
+#
+# Jobs moved here from server-ci.yml:
+# - Postgres with binary parameters (1x 8-core)
+# - Postgres FIPS unsharded (1x 8-core) — sharded runs stay in server-ci.yml for PR iteration
+# - mmctl FIPS tests (1x 8-core)
+name: Server CI Weekly
+on:
+  schedule:
+    - cron: "0 5 * * 1" # Monday 5am UTC (~1am ET)
+  push:
+    branches:
+      - 'release-*'
+  workflow_dispatch: # Allow manual trigger for urgent FIPS/binary verification
+
+permissions:
+  contents: read
+
+jobs:
+  go:
+    name: Compute Go Version
+    runs-on: ubuntu-22.04
+    outputs:
+      version: ${{ steps.calculate.outputs.GO_VERSION }}
+    steps:
+      - name: Checkout mattermost project
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Calculate version
+        id: calculate
+        working-directory: server/
+        run: echo GO_VERSION=$(cat .go-version) >> "${GITHUB_OUTPUT}"
+
+  test-postgres-binary:
+    name: Postgres with binary parameters
+    needs: go
+    uses: ./.github/workflows/server-test-template.yml
+    secrets: inherit
+    with:
+      name: Postgres with binary parameters
+      datasource: postgres://mmuser:mostest@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10&binary_parameters=yes
+      drivername: postgres
+      logsartifact: postgres-binary-server-test-logs
+      go-version: ${{ needs.go.outputs.version }}
+      fips-enabled: false
+
+  test-postgres-normal-fips:
+    name: Postgres FIPS
+    needs: go
+    uses: ./.github/workflows/server-test-template.yml
+    secrets: inherit
+    with:
+      name: Postgres FIPS
+      datasource: postgres://mmuser:mostest-fips-test@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
+      drivername: postgres
+      logsartifact: postgres-server-fips-test-logs
+      go-version: ${{ needs.go.outputs.version }}
+      fips-enabled: true
+
+  test-mmctl-fips:
+    name: Run mmctl tests (FIPS)
+    needs: go
+    uses: ./.github/workflows/mmctl-test-template.yml
+    secrets: inherit
+    with:
+      name: mmctl
+      datasource: postgres://mmuser:mostest-fips-test@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
+      drivername: postgres
+      logsartifact: mmctl-fips-test-logs
+      go-version: ${{ needs.go.outputs.version }}
+      fips-enabled: true

.github/workflows/server-ci.yml

@@ -3,8 +3,8 @@
 # - server-ci-report.yml
 # - sentry.yaml
 # If you rename this workflow, be sure to update those workflows as well.
 name: Server CI
 on:
   push:
     branches:
       - master
@@ -36,14 +36,14 @@
       gomod-changed: ${{ steps.changed-files.outputs.any_changed }}
     steps:
       - name: Checkout mattermost project
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Calculate version
         id: calculate
         working-directory: server/
         run: echo GO_VERSION=$(cat .go-version) >> "${GITHUB_OUTPUT}"
       - name: Check for go.mod changes
         id: changed-files
         uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323 # v47.0.5
         with:
           files: |
             **/go.mod
@@ -57,7 +57,7 @@
         working-directory: server
     steps:
       - name: Checkout mattermost project
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Run setup-go-work
         run: make setup-go-work
       - name: Generate mocks
@@ -74,7 +74,7 @@
         working-directory: server
     steps:
       - name: Checkout mattermost project
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Run setup-go-work
         run: make setup-go-work
       - name: Run go mod tidy
@@ -91,7 +91,7 @@
         working-directory: server
     steps:
       - name: Checkout mattermost project
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Run setup-go-work
         run: make setup-go-work
       - name: Run golangci
@@ -106,7 +106,7 @@
         working-directory: server
     steps:
       - name: Checkout mattermost project
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Run setup-go-work
         run: make setup-go-work
       - name: Run make-gen-serialized
@@ -123,7 +123,7 @@
         working-directory: server
     steps:
       - name: Checkout mattermost project
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Run setup-go-work
         run: make setup-go-work
       - name: Run mattermost-vet-api
@@ -138,7 +138,7 @@
         working-directory: server
     steps:
       - name: Checkout mattermost project
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Extract migrations files
         run: make migrations-extract
       - name: Check migration files
@@ -195,20 +195,10 @@
           echo "Making sure docs are updated"
           make mmctl-docs
           if [[ -n $(git status --porcelain) ]]; then echo "Please update the mmctl docs using make mmctl-docs"; exit 1; fi
-  test-postgres-binary:
-    if: github.event_name == 'push' # Only run postgres binary tests on master/release pushes: odds are low this regresses, so save the cycles for pull requests.
-    name: Postgres with binary parameters
-    needs: go
-    uses: ./.github/workflows/server-test-template.yml
-    secrets: inherit
-    with:
-      name: Postgres with binary parameters
-      datasource: postgres://mmuser:mostest@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10&binary_parameters=yes
-      drivername: postgres
-      logsartifact: postgres-binary-server-test-logs
-      go-version: ${{ needs.go.outputs.version }}
-      fips-enabled: false
-      fullyparallel: false
+  # NOTE: Postgres with binary parameters has been moved to server-ci-weekly.yml
+  # (runs Monday 1am EST / 5am UTC). Low regression risk doesn't justify
+  # consuming 8-core runners on every push.
+
   # -- Sharded into 4 parallel runners for ~88% wall-time improvement --
   test-postgres-normal:
     name: Postgres (shard ${{ matrix.shard }})
@@ -255,11 +245,11 @@
       elasticsearch-version: "8.9.0"
       test-target: "test-server-elasticsearch"
 
+  # FIPS tests: run on PRs when go.mod changed or branch name contains "fips".
+  # Sharded for fast iteration. Weekly workflow provides regular full coverage.
   test-postgres-normal-fips:
-    # Always run on pushes to master/release branches.
-    # For PRs, run when the branch name contains "fips" or any go.mod was changed.
-    if: github.event_name == 'push' || contains(github.head_ref, 'fips') || needs.go.outputs.gomod-changed == 'true'
-    name: Postgres FIPS (shard ${{ matrix.shard }})
+    if: contains(github.head_ref, 'fips') || needs.go.outputs.gomod-changed == 'true'
+    name: "Postgres FIPS (shard ${{ matrix.shard }})"
     needs: go
     strategy:
       fail-fast: false
@@ -305,6 +295,7 @@
       enablecoverage: true
       go-version: ${{ needs.go.outputs.version }}
       fips-enabled: false
+      # runner: ubuntu-22.04 # Coverage is non-blocking (allow-failure), no need for 8-core
       shard-index: ${{ matrix.shard }}
       shard-total: 4
   test-mmctl:
@@ -320,19 +311,19 @@
       go-version: ${{ needs.go.outputs.version }}
       fips-enabled: false
   test-mmctl-fips:
+    if: contains(github.head_ref, 'fips') || needs.go.outputs.gomod-changed == 'true'
     name: Run mmctl tests (FIPS)
-    # Skip FIPS testing for forks, which won't have docker login credentials.
-    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
     needs: go
     uses: ./.github/workflows/mmctl-test-template.yml
     secrets: inherit
     with:
       name: mmctl
       datasource: postgres://mmuser:mostest-fips-test@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
       drivername: postgres
-      logsartifact: mmctl-test-logs
+      logsartifact: mmctl-fips-test-logs
       go-version: ${{ needs.go.outputs.version }}
       fips-enabled: true
+
   build-mattermost-server:
     name: Build mattermost server app
     needs: go

.github/workflows/server-test-template.yml

@@ -50,6 +50,16 @@ on:
         required: false
         type: number
         default: 1
+      runner:
+        description: "GitHub-hosted runner label (default: ubuntu-latest-8-cores)"
+        required: false
+        type: string
+        default: "ubuntu-latest-8-cores"
+      race-enabled:
+        description: "Run tests with Go race detector (-race)"
+        required: false
+        type: boolean
+        default: false
 
 permissions:
   id-token: write
@@ -58,7 +68,7 @@ permissions:
 jobs:
   test:
     name: ${{ inputs.name }}
-    runs-on: ubuntu-latest-8-cores
+    runs-on: ${{ inputs.runner }}
     continue-on-error: ${{ inputs.allow-failure }} # Used to avoid blocking PRs in case of flakiness
     env:
       COMPOSE_PROJECT_NAME: ghactions
@@ -175,7 +185,7 @@ jobs:
         env:
           BUILD_IMAGE: ${{ steps.build.outputs.BUILD_IMAGE }}
         run: |
-          if [[ ${{ github.ref_name }} == 'master' && ${{ inputs.fullyparallel }} != true && "${{ inputs.test-target }}" == "test-server" ]]; then
+          if [[ "${{ inputs.race-enabled }}" == "true" ]]; then
             export RACE_MODE="-race"
           fi
 

.github/workflows/yamllint.yml

@@ -0,0 +1,28 @@
+name: YAML Lint
+
+on:
+  push:
+    branches:
+      - master
+      - release-*
+  pull_request:
+    paths:
+      - ".github/workflows/**"
+      - ".yamllint"
+
+concurrency:
+  group: ${{ github.event_name == 'pull_request' && format('{0}-{1}', github.workflow, github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
+jobs:
+  yamllint:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Lint workflow YAML files
+        run: yamllint .github/workflows/

.yamllint

@@ -0,0 +1,7 @@
+extends: default
+
+rules:
+  key-duplicates: enable
+  empty-lines: disable
+  line-length: disable
+  trailing-spaces: disable

server/channels/api4/channel_test.go

@@ -5141,7 +5141,6 @@ func TestAddChannelMembers(t *testing.T) {
 
 func TestAddChannelMemberFromThread(t *testing.T) {
 	mainHelper.Parallel(t)
-	t.Skip("MM-41285")
 	th := Setup(t).InitBasic(t)
 	team := th.BasicTeam
 	user := th.BasicUser
@@ -5191,12 +5190,11 @@ func TestAddChannelMemberFromThread(t *testing.T) {
 	_, _, err = th.SystemAdminClient.AddChannelMemberWithRootId(context.Background(), publicChannel.Id, user.Id, rpost.Id)
 	require.NoError(t, err)
 
-	// Threadmembership should exist for added user
-	ut, _, err := th.Client.GetUserThread(context.Background(), user.Id, team.Id, rpost.Id, false)
-	require.NoError(t, err)
-	// Should have two mentions. There might be a race condition
-	// here between the "added user to the channel" message and the GetUserThread call
-	require.LessOrEqual(t, int64(2), ut.UnreadMentions)
+	// Thread membership and mention counts may take a moment to propagate (MM-41285).
+	require.Eventually(t, func() bool {
+		ut, _, getErr := th.Client.GetUserThread(context.Background(), user.Id, team.Id, rpost.Id, false)
+		return getErr == nil && ut.UnreadMentions >= 2
+	}, 10*time.Second, 200*time.Millisecond, "expected at least 2 unread mentions in thread")
 
 	var caught bool
 	func() {
@@ -5215,7 +5213,7 @@ func TestAddChannelMemberFromThread(t *testing.T) {
 					require.EqualValues(t, float64(0), data["previous_unread_replies"])
 					require.EqualValues(t, float64(0), data["previous_unread_mentions"])
 				}
-			case <-time.After(2 * time.Second):
+			case <-time.After(15 * time.Second):
 				return
 			}
 		}

server/channels/api4/oauth_test.go

@@ -85,7 +85,7 @@ func TestCreateOAuthApp(t *testing.T) {
 }
 
 func TestUpdateOAuthApp(t *testing.T) {
-	t.Skip("https://mattermost.atlassian.net/browse/MM-62895")
+	// MM-62895: re-enabled to collect failure data (14mo, empty Jira description).
 
 	mainHelper.Parallel(t)
 

server/channels/api4/post_test.go

@@ -4614,25 +4614,29 @@ func TestSearchPostsWithDateFlags(t *testing.T) {
 }
 
 func TestGetFileInfosForPost(t *testing.T) {
-	t.Skip("MM-46902")
 	th := Setup(t).InitBasic(t)
 	client := th.Client
 
 	fileIds := make([]string, 3)
 	data, err := testutils.ReadTestFile("test.png")
 	require.NoError(t, err)
 	for i := range 3 {
-		fileResp, _, _ := client.UploadFile(context.Background(), data, th.BasicChannel.Id, "test.png")
+		fileResp, _, uploadErr := client.UploadFile(context.Background(), data, th.BasicChannel.Id, "test.png")
+		require.NoError(t, uploadErr, "failed to upload file %d", i)
 		fileIds[i] = fileResp.FileInfos[0].Id
 	}
 
 	post := &model.Post{ChannelId: th.BasicChannel.Id, Message: "zz" + model.NewId() + "a", FileIds: fileIds}
-	post, _, _ = client.CreatePost(context.Background(), post)
-
-	infos, resp, err := client.GetFileInfosForPost(context.Background(), post.Id, "")
+	post, _, err = client.CreatePost(context.Background(), post)
 	require.NoError(t, err)
 
-	require.Len(t, infos, 3, "missing file infos")
+	// File info association can be async; poll until all 3 are visible (MM-46902).
+	var infos []*model.FileInfo
+	var resp *model.Response
+	require.Eventually(t, func() bool {
+		infos, resp, err = client.GetFileInfosForPost(context.Background(), post.Id, "")
+		return err == nil && len(infos) == 3
+	}, 10*time.Second, 200*time.Millisecond, "expected 3 file infos")
 
 	found := false
 	for _, info := range infos {
@@ -5326,14 +5330,14 @@ func TestGetPostStripActionIntegrations(t *testing.T) {
 }
 
 func TestPostReminder(t *testing.T) {
-	t.Skip("MM-60329")
-
 	th := Setup(t).InitBasic(t)
 
 	client := th.Client
 	userWSClient := th.CreateConnectedWebSocketClient(t)
 
-	targetTime := time.Now().UTC().Unix()
+	// Set target time 1s in the future so the reminder processor picks it up
+	// on its next tick rather than relying on it already being in the past (MM-60329).
+	targetTime := time.Now().UTC().Unix() + 1
 	resp, err := client.SetPostReminder(context.Background(), &model.PostReminder{
 		TargetTime: targetTime,
 		PostId:     th.BasicPost.Id,
@@ -5374,7 +5378,7 @@ func TestPostReminder(t *testing.T) {
 					require.Equal(t, th.BasicTeam.Name, parsedPost.GetProp("team_name").(string))
 					return
 				}
-			case <-time.After(5 * time.Second):
+			case <-time.After(15 * time.Second):
 				return
 			}
 		}