* ci: standardize checkout action inputs across workflows (#36876)
* ci: standardize checkout action inputs across workflows
* ci: checkout in claude pipeline use default
* ci: make setup-go-work a Makefile prereq, remove explicit CI steps (#37268)
* ci: auto-build missing buildenv images for in-flight Go version bumps (#37286)
* ci: replace volatile e2e-platform-pkgs cache with shared webapp-setup (#37182)
* ci: replace volatile e2e-platform-pkgs cache with shared webapp-setup
* ci: replace volatile e2e-platform-pkgs cache in cypress template v2
* ci: tighten prep-deps comments
* fix: typo in webapp-setup comment
* chore(ci): warm node and npm caches daily; make CI jobs restore read-only (#37393)
* chore(ci): warm node and npm caches daily; make CI jobs restore read-only
Add daily scheduled workflows on master that warm two independent caches,
each in its own workflow mirroring its consumers:
- webapp-ci-cache-warm.yml warms the webapp node_modules cache
(keyed on webapp/package-lock.json)
- e2e-ci-cache-warm.yml warms the E2E ~/.npm registry cache
(keyed on the cypress/playwright/api lockfiles)
Webapp CI and the E2E/api CI jobs now restore these caches read-only instead
of writing them, so the daily jobs keep the caches warm. The E2E ~/.npm
restore is factored into a reusable restore-e2e-npm-cache composite action,
and webapp-setup gains a read-only mode for the node_modules cache.
* chore(ci): guard cache-warm workflows with a concurrency group
* chore(ci): drop unused node-cache-dependency-path output
* chore(ci): reuse webapp-setup for node_modules in e2e-tests-check
* Move e2e npm registry cache out of the node-cache- namespace (#37427)
The e2e npm registry cache keyed on node-cache-<os>-<arch>-npm-e2e-,
sharing the node-cache- prefix that actions/setup-node generates
automatically for its built-in npm cache (node-cache-<os>-<arch>-npm-).
Because the arch segment differs only by case (setup-node uses Node's
process.arch 'x64'; this action uses runner.arch 'X64') and GitHub matches
restore-key prefixes case-insensitively, the two buckets share a common
prefix. A future broad restore-key such as node-cache-<os>-<arch>-npm-
could then cross-restore one bucket's ~/.npm into the other.
Rename the key to e2e-npm-registry-<os>-<arch>-, giving it a distinct
namespace that is not a prefix of node-cache- in either direction and
matches the repo's content-descriptive e2e cache keys (e2e-cypress-deps-,
e2e-playwright-deps-, e2e-platform-pkgs-). Existing entries orphan and
age out; the daily warm job repopulates under the new key on next run.
* Adopt per-target .PHONY directives in server Makefiles (#37447)
* Converge generated-file CI checks on a single make generated target
The server-ci.yml workflow had many separate "run a make target, then fail
on any git diff" jobs, but make generated only covered a few of them, so the
target and CI drifted apart.
Expand make generated to regenerate every committed asset, adding
gen-serialized, migrations-extract, build-templates, mmctl-docs, and
modules-tidy, and collapse the per-asset check jobs into a single
check-generated job.
Split the backport migration guard into its own check-backport-migrations
job and make target, renaming the script to match.
* make generated
* git status --porcelain
* simplify permissions block given defaults
---------
Co-authored-by: Nuno Simões <nuno.simoes@mattermost.com>
Wire Microsoft's local Azure Blob Storage emulator into the dev/CI
docker-compose stack so an upcoming Azure FileBackend driver and its
tests have a target to run against, without requiring an Azure
account.
* Define the azurite service in docker-compose.common.yml (used by
both the local-dev and CI compose files).
* Add azurite to the makefile + main docker-compose.yml service maps,
and to docker-compose-generator so callers can include it via
ENABLED_DOCKER_SERVICES.
* Auto-include azurite in `make start-docker` (mirrors how minio is
auto-included today), so existing local workflows keep working
without any per-developer config change.
* Add azurite to the CI start_dependencies wait set so CI brings it up
alongside postgres/minio.
* Set CI_AZURITE_HOST / CI_AZURITE_PORT in dotenv/test.env, mirroring
the CI_MINIO_* pattern.
No production filestore changes — this PR is mergeable in isolation
with no user-visible behavior.
------
AI assisted commit
* updated go to version 1.25.8
* updated gotestsum version to work with go 1.25.8
go 1.25 does not work with indirect tools 0.11 dependency pulled by
gotestsum.
* Use sync.WaitGroup.Go to simplify goroutine creation
Replace the wg.Add(1) + go func() { defer wg.Done() }() pattern with
wg.Go(), which was introduced in Go 1.25.
* pushes fips image on workflow dispatch to allow fips test to run on go version update
* fix new requirements for FIPS compliance imposed on updating to go 1.25.8
* updates openssl symbol check for library shipped with FIPS new versions
go-openssl v2 shipped with FIPS versions starting from 1.25 uses mkcgo to generate
bindings causing symbol names to be different.
* removes temp workflow-dispatch condition
* keep versions out of agents md file
* automate setup-go-work
It's all to easy to forget to `make setup-go-work`, only to run into mysterious build failures. Let's default to doing this automatically, unless `SKIP_SETUP_GO_WORK` is true (or the legacy `IGNORE_GO_WORK_IF_EXISTS`, which was oddly named, since we can't actually ignore it.)
* Make setup-go-work recipe fail-fast with set -e
* Add container name to Docker logs
This will allow for querying Loki by container's name:
{job="docker",container_name="mattermost-postgres"}
* Configue Loki to prepare for OTLP ingestion
- Add a volume to Loki container to get the config
- Configure Loki with the expected labels so that we can query by job,
app, container.name...
* Add OpenTelemetry collector configuration
There are three pipelines:
1. logs/mattermost scrapes the logs from mattermost.log, parsing the
timestamp and severity, and pushes them to Loki.
2. logs/docker scrapes the Docker logs from *-json.log, parsing the
timestamp, the log itself and the container name, and pushes them to Loki.
3. metrics/docker scrapes the Docker socket to retrieve the containers'
uptime values and pushes them to Prometheus.
* Replace Promtail with OpenTelemetry collector
* Update build tooling for OpenTelemetry collector
1. Make sure that the logs directory is created
2. Swap Promtail with OpenTelemetry collector
* Scrape collector to get Docker stats
Prometheus needs to scrape the OpenTelemetry collector in the exposed
port to get the Docker stats, so that we can query the uptime with
metric container_uptime_seconds, which has a container_name label to
filter by container.
* Update Grafana dashboard for Docker health checks
1. Use Prometheus as the datasource in all queries
2. Simplify the mappings to either 0 (offline, red) or 1 (online,
green).
3. Unify all queries on container_uptime_seconds, filtering by
container_name, and making sure that the latest value we got is at most
15 seconds old, so that it does not show stale data.
4. Add Redis health check, that was missing
5. Update the dashboard title to Docker containers
* Tune Loki and OTel collector configs for local dev
- Switch filelog receivers to start_at: beginning so existing logs are
ingested on collector startup, not just new entries.
- Fix Docker log timestamp layout to use 9s (variable-length nanos)
instead of 0s (fixed-width), matching actual Docker JSON log format.
- Add ingester max_chunk_age to keep chunks open longer in the
single-instance dev setup, so that we can ingest older logs (the
window is max_chunk_age/2).
- Relax Loki limits for local development: allow unordered writes,
disable old-sample rejection, and raise ingestion rate/burst to 64 MB
to avoid throttling during bulk ingest.
The generation of notice-file is failing with
```
2026/02/16 10:20:39 NPM load failed @mattermost/shared
2026/02/16 10:20:39 Error occured while generating notice.txt @mattermost/shared:http status code 404 when downloading "https://registry.npmjs.org/@mattermost/shared"
```
This relates with https://github.com/mattermost/mattermost/pull/35065 because
the package is still local and isn't yet published in npm
So, this is ignores the shared package while it isn't published.
* support for Elastic(Open)search CJK analysis plugins
* addresses PR review comments
* addresses PR comments
* moves CJK based tests to own file and adds some more
Dockerfile for open and elasticsearch are changed to install required
plugins for testing or running locally.
* properly sort error messages
* fix style issues
* removes trailing space
* Initial Implementation of Push Proxy Authentication
* Include Config Listener for Leader plus delete startup function as job scheduler runs on initialization
* Remove push proxy auth from local imports
* Add push proxy auth to external imports
* Add push proxy auth error messages
* Update error codes
* Fix enterprise dep definition
* make i18n-extract
* Mock System store Get
* m
* m
* m
* m
* Update serverID header
* Add install type env var to docker
* Update Push Proxy config with new options
Global, US, Germany and Japan. Previous configurations will keep working
* use model.SafeDereference
* Delete token when new push proxy URL is empty
* ServerID header only if auth token is available
---------
Co-authored-by: Daniel Schalla <daniel@mattermost.com>
Co-authored-by: Nick Misasi <nick.misasi@mattermost.com>
Co-authored-by: Mattermost Build <build@mattermost.com>
* Enabling Prometheus, Grafana, Loki and Promtail running as containers by default in local dev environments
* Updating the Grafana dashboards available in the local dev environment
* Revert "Enabling Prometheus, Grafana, Loki and Promtail running as containers by default in local dev environments"
This reverts commit 3a252a8383.
* this config change is not needed anymore
* pin to ubuntu-24.04
* always use FIPS compatible Postgres settings
* use sha256 for remote cluster IDs
* use sha256 for client config hash
* rework S3 backend to be FIPS compatible
* skip setup-node during build, since already in container
* support FIPS builds
* Dockerfile for FIPS image, using glibc-openssl-fips
* workaround entrypoint inconsistencies
* authenticate to DockerHub
* fix FIPS_ENABLED, add test-mmctl-fips
* decouple check-mattermost-vet from test/build steps
* fixup! decouple check-mattermost-vet from test/build steps
* only build-linux-amd64 for fips
* rm entrypoint workaround
* tweak comment grammar
* rm unused Dockerfile.fips (for now)
* ignore gpg import errors, since would fail later anyway
* for fips, only make package-linux-amd64
* set FIPS_ENABLED for build step
* Add a FIPS-specific list of prepackaged plugins
Note that the names are still temporary, since they are not uploaded to
S3 yet. We may need to tweak them when that happens.
* s/golangci-lint/check-style/
This ensures we run all the `check-style` checks: previously,
`modernize` was missing.
* pin go-vet to @v2, remove annoying comment
* add -fips to linux-amd64.tz.gz package
* rm unused setup-chainctl
* use BUILD_TYPE_NAME instead
* mv fips build to enterprise-only
* fixup! use BUILD_TYPE_NAME instead
* temporarily pre-package no plugins for FIPS
* split package-cleanup
* undo package-cleanup, just skip ARM, also test
* skip arm for FIPS in second target too
* fmt Makefile
* Revert "rm unused Dockerfile.fips (for now)"
This reverts commit 601e37e0ff.
* reintroduce Dockerfile.fips and align with existing Dockerfile
* s/IMAGE/BUILD_IMAGE/
* bump the glibc-openssl-fips version
* rm redundant comment
* fix FIPS checks
* set PLUGIN_PACKAGES empty until prepackaged plugins ready
* upgrade glibc-openssl-fips, use non-dev version for final stage
* another BUILD_IMAGE case
* Prepackage the FIPS versions of plugins
* relocate FIPS_ENABLED initialization before use
* s/Config File MD5/Config File Hash/
* Update the FIPS plugin names and encode the + sign
* add /var/tmp for local socket manipulation
---------
Co-authored-by: Alejandro García Montoro <alejandro.garciamontoro@gmail.com>
Co-authored-by: Mattermost Build <build@mattermost.com>
Resets the entrypoint to both build environment Dockerfiles (Dockerfile.buildenv and Dockerfile.buildenv-fips) to unify invoking either a shell or running a command without jumping through hoops.
With glibc 2.34 and the [removal of libpthread](https://developers.redhat.com/articles/2021/12/17/why-glibc-234-removed-libpthread), binaries built using [Debian bookworm](https://www.debian.org/releases/bookworm/) aren't compatible with older but still supported operating systems like RHEL8. In those environments, Mattermost fails to start with errors like:
```
mattermost/bin/mattermost: /lib64/libc.so.6: version `GLIBC_2.32' not found (required by mattermost/bin/mattermost)
mattermost/bin/mattermost: /lib64/libc.so.6: version `GLIBC_2.34' not found (required by mattermost/bin/mattermost)
```
One option might be to generate a static build and avoid the glibc dependency, but this kind of change is out of scope for now. Let's just revert back to using [Debian bullseye](https://www.debian.org/releases/bullseye/), which remains supported until at least August 2026.
* Upgrade Go to 1.24.3
Updates the following files:
- server/.go-version: 1.23.9 → 1.24.3
- server/build/Dockerfile.buildenv: golang:1.23.9-bullseye → golang:1.24.3-bullseye
- server/go.mod: go 1.23.0 → go 1.24.3, toolchain go1.23.9 → go1.24.3
- server/public/go.mod: go 1.23.0 → go 1.24.3, toolchain go1.23.9 → go1.24.3
Also fixes non-constant format string errors introduced by Go 1.24.3's stricter format string checking:
- Added response() helper function in slashcommands/util.go for simple string responses
- Removed unused responsef() function from slashcommands/util.go
- Replaced responsef() with response() for translated strings that don't need formatting
- Fixed fmt.Errorf and fmt.Fprintf calls to use proper format verbs instead of string concatenation
- Updated marketplace buildURL to handle format strings conditionally
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Update generated mocks for Go 1.24.3
Regenerated mocks using mockery v2.53.4 to ensure compatibility with Go 1.24.3.
This addresses mock generation failures that occurred with the Go upgrade.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Update to bookworm and fix non-existent sha
Signed-off-by: Stavros Foteinopoulos <stafot@gmail.com>
* fix non-constant format string
---------
Signed-off-by: Stavros Foteinopoulos <stafot@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Stavros Foteinopoulos <stafot@gmail.com>
* Move from ubuntu to distroless image
* Update updated ubunty image for first stage
* Update server/build/Dockerfile
Co-authored-by: Daniel Schalla <daniel@mattermost.com>
* Update server/build/Dockerfile
Co-authored-by: Daniel Schalla <daniel@mattermost.com>
* Add mising env var for health check
* Add mattermost user in /etc/passwd
* Fix e2e userId
* use cypress in place of server. Wget and not curl
* Simplify e2e changes
---------
Co-authored-by: Daniel Schalla <daniel@mattermost.com>
* TestPool
* Store infra
* Store tests updates
* Bump maximum concurrent postgres connections
* More infra
* channels/jobs
* channels/app
* channels/api4
* Protect i18n from concurrent access
* Replace some use of os.Setenv
* Remove debug
* Lint fixes
* Fix more linting
* Fix test
* Remove use of Setenv in drafts tests
* Fix flaky TestWebHubCloseConnOnDBFail
* Fix merge
* [MM-62408] Add CI job to generate test coverage (#30284)
* Add CI job to generate test coverage
* Remove use of Setenv in drafts tests
* Fix flaky TestWebHubCloseConnOnDBFail
* Fix more Setenv usage
* Fix more potential flakyness
* Remove parallelism from flaky test
* Remove conflicting env var
* Fix
* Disable parallelism
* Test atomic covermode
* Disable parallelism
* Enable parallelism
* Add upload coverage step
* Fix codecov.yml
* Add codecov.yml
* Remove redundant workspace field
* Add Parallel() util methods and refactor
* Fix formatting
* More formatting fixes
* Fix reporting
As part of https://github.com/mattermost/mattermost/pull/29932, we
stopped packaging Windows for releases. Let's go one step further and
stop building it too (saves build time!). And while we're in here, stop
doing this for OSX as well.
Both these targets remain buildable on demand, but we don't support
these platforms for production deployments.
* Update Go version to v1.23.7
* Bump golangci-lint to a version supporting Go 1.23
* Fix golangci-lint warnings
Several rules from gosimple, revive and staticcheck linters were
failing:
- Redefinition of built-in identifiers (max, min, new, recover...)
- Use of printf-like functions with simple strings
- Check for nil slices, when len already takes it into account
* Trigger Build
* Trigger Build
---------
Co-authored-by: Mattermost Build <build@mattermost.com>
* Bump Go version to 1.23.6
* Update CodeQL Github action as well
* Use server's Go version for CodeQL action
Co-authored-by: Antonis Stamatiou <stamatiou.antonis@gmail.com>
* Empty commit to trigger CI
* Bump golangci-lint to a version supporting Go 1.23
* Fix golangci-lint warnings
Several rules from gosimple, revive and staticcheck linters were
failing:
- Redefinition of built-in identifiers (max, min, new, recover...)
- Use of printf-like functions with simple strings
- Check for nil slices, when len already takes it into account
---------
Co-authored-by: Antonis Stamatiou <stamatiou.antonis@gmail.com>
Co-authored-by: Mattermost Build <build@mattermost.com>
* Remove uneeded hack in docker-compose now that problem is solved
* Remove obsolete attribute `version` in docker compose configuration files
---------
Co-authored-by: Mattermost Build <build@mattermost.com>
