* ci: standardize checkout action inputs across workflows (#36876)
* ci: standardize checkout action inputs across workflows
* ci: checkout in claude pipeline use default
* ci: make setup-go-work a Makefile prereq, remove explicit CI steps (#37268)
* ci: auto-build missing buildenv images for in-flight Go version bumps (#37286)
* ci: replace volatile e2e-platform-pkgs cache with shared webapp-setup (#37182)
* ci: replace volatile e2e-platform-pkgs cache with shared webapp-setup
* ci: replace volatile e2e-platform-pkgs cache in cypress template v2
* ci: tighten prep-deps comments
* fix: typo in webapp-setup comment
* chore(ci): warm node and npm caches daily; make CI jobs restore read-only (#37393)
* chore(ci): warm node and npm caches daily; make CI jobs restore read-only
Add daily scheduled workflows on master that warm two independent caches,
each in its own workflow mirroring its consumers:
- webapp-ci-cache-warm.yml warms the webapp node_modules cache
(keyed on webapp/package-lock.json)
- e2e-ci-cache-warm.yml warms the E2E ~/.npm registry cache
(keyed on the cypress/playwright/api lockfiles)
Webapp CI and the E2E/api CI jobs now restore these caches read-only instead
of writing them, so the daily jobs keep the caches warm. The E2E ~/.npm
restore is factored into a reusable restore-e2e-npm-cache composite action,
and webapp-setup gains a read-only mode for the node_modules cache.
* chore(ci): guard cache-warm workflows with a concurrency group
* chore(ci): drop unused node-cache-dependency-path output
* chore(ci): reuse webapp-setup for node_modules in e2e-tests-check
* Move e2e npm registry cache out of the node-cache- namespace (#37427)
The e2e npm registry cache keyed on node-cache-<os>-<arch>-npm-e2e-,
sharing the node-cache- prefix that actions/setup-node generates
automatically for its built-in npm cache (node-cache-<os>-<arch>-npm-).
Because the arch segment differs only by case (setup-node uses Node's
process.arch 'x64'; this action uses runner.arch 'X64') and GitHub matches
restore-key prefixes case-insensitively, the two buckets share a common
prefix. A future broad restore-key such as node-cache-<os>-<arch>-npm-
could then cross-restore one bucket's ~/.npm into the other.
Rename the key to e2e-npm-registry-<os>-<arch>-, giving it a distinct
namespace that is not a prefix of node-cache- in either direction and
matches the repo's content-descriptive e2e cache keys (e2e-cypress-deps-,
e2e-playwright-deps-, e2e-platform-pkgs-). Existing entries orphan and
age out; the daily warm job repopulates under the new key on next run.
* Adopt per-target .PHONY directives in server Makefiles (#37447)
* Converge generated-file CI checks on a single make generated target
The server-ci.yml workflow had many separate "run a make target, then fail
on any git diff" jobs, but make generated only covered a few of them, so the
target and CI drifted apart.
Expand make generated to regenerate every committed asset, adding
gen-serialized, migrations-extract, build-templates, mmctl-docs, and
modules-tidy, and collapse the per-asset check jobs into a single
check-generated job.
Split the backport migration guard into its own check-backport-migrations
job and make target, renaming the script to match.
* make generated
* git status --porcelain
* simplify permissions block given defaults
---------
Co-authored-by: Nuno Simões <nuno.simoes@mattermost.com>
* Add a new ClusterReliableFallbackLength metric
This metric tracks the length of the cluster messages that are meant to
be sent via UDP but that result in a UDP datagram larger than the
maximum length allowed.
* make mocks
* Use 8 exponential buckets: from 32KiB to 4MiB
The GET /api/v4/limits/server endpoint ran expensive active-user and
single-channel-guest count queries for every user on login and app
refresh, even though non-admins never receive those counts. The
single-channel-guest count is a full ChannelMembers scan, so this put a
full-table-scan query on a high-frequency hot path.
Add an includeUserCounts parameter to App.GetServerLimits so the user
and guest count queries only run when the caller needs them. The api4
handler passes the existing admin check, keeping the cheap
license-derived and post-history fields for all users while skipping the
expensive queries for non-admins. Internal callers that genuinely need
the counts (isAtUserLimit, user creation/activation) pass true.
(cherry picked from commit 08c3f6faa9)
Co-authored-by: Ben Schumacher <ben.schumacher@mattermost.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Allow syncing any CPA field with LDAP/SAML and disable editable toggle when synced
A custom profile attribute field could only be linked to LDAP/SAML sync
when it was user-editable, and the editable toggle stayed enabled for
synced fields. Toggling editable off silently stripped the link on save.
Allow admin-managed fields to be synced (sync and admin-managed are no
longer mutually exclusive on the server) and disable the editable toggle
in the dot menu while a field is synced, since synced values come from
the IdP and are never user-editable.
* Add tests for syncable admin-managed CPA fields and disabled editable toggle
* Strengthen sync test coverage: combined admin-managed+synced and SAML update path
* ci: re-trigger Enterprise CI after transient npm network failure
* Address PR feedback: 1 answered, 1 resolved, 0 declined
---------
Co-authored-by: cursor[bot] <206951365+cursor[bot]@users.noreply.github.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: mattermost-code <matty-code@mattermost.com>
Co-authored-by: Mattermost Build <build@mattermost.com>
Bump the default prepackaged Playbooks plugin from 2.9.0 to 2.9.1 (non-FIPS).
FIPS prepackaged plugin package list is unchanged.
Co-authored-by: Cursor <cursoragent@cursor.com>
* MM-68952: Resolve public channel mentions for non-members under Compliance
Channel mention name resolution reused HasPermissionToReadChannel, a
content-read check that returns false for non-members of a public channel
when Compliance Monitoring is enabled (MM-45272) or when the channel is on
another team (MM-66791). As a result, the channel_mentions post prop was
stripped per-viewer (since #34235), and the webapp fell back to rendering the
raw (anonymized) channel slug instead of a clickable link.
Introduce HasPermissionToResolveChannelMention, which exposes only a public
channel display name and link (not content) and is therefore independent of
ComplianceSettings, while still requiring team membership for public channels
(blocks cross-team disclosure) and channel membership for private/DM/GM
channels. Switch the three mention call sites (FillInPostProps,
sanitizeChannelMentionsForUser, channelMentionsBroadcastHook) to the new
helper. HasPermissionToReadChannel and all content-read paths are unchanged.
* MM-68952: Add author-side and E2E coverage for channel mention resolution
Add a Go test (TestFillInPostPropsChannelMentionResolution) that exercises the
author-side persistence of the channel_mentions prop in FillInPostProps. It
locks in the new behavior: an author who is a team member but not a member of a
referenced public channel now persists the mention prop even when Compliance
Monitoring is enabled, while public channels on other teams and private
channels the author is not in are still dropped.
Add a Playwright spec (channel_mention_resolution.spec.ts) with a license-free
cross-team case (a public channel mention stays unresolved for a viewer not on
the channel's team) and a license-gated case (with Compliance enabled, a team
member who is not in the channel sees the resolved mention link).
* MM-68952: Tighten channel mention test assertions and fix lint
Use strings.Builder when assembling the test message to avoid the
golangci-lint stringsbuilder (modernize) warning about string += string
in a loop. Tighten the cross-team public and private non-member cases to
assert.Nil on the resolved mentions so the contract requires no persisted
channel_mentions map rather than merely an empty one.
---------
(cherry picked from commit 61643e1066)
Co-authored-by: Maria A Nunez <maria.nunez@mattermost.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Apply CheckUserAllAuthenticationCriteria after guest magic-link token
authentication in POST /api/v4/users/login, matching the web one-time-link
handler and password login paths.
Add regression test ensuring deactivated guests receive 401 inactive while
active guests can still log in via magic_link_token.
(cherry picked from commit 5c360d8077)
Co-authored-by: Julien Tant <785518+JulienTant@users.noreply.github.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Julien Tant <JulienTant@users.noreply.github.com>
The plugin API was silently redirecting calls using the old
"custom_profile_attributes" group name to the new "access_control" group.
Replace the silent alias with an explicit error so plugin developers get
a clear message telling them what to change.
(cherry picked from commit 159ed5ad96)
Co-authored-by: David Krauser <david@krauser.org>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* [MM-68693] Resource level permission policies and new simulation (#36472)
(cherry picked from commit ba1cec51a5)
---------
Co-authored-by: Ibrahim Serdar Acikgoz <serdaracikgoz86@gmail.com>
* Add TestDesanitizeRemovesAllFakeSettings to catch future omissions
Walks every string field in the config after a Sanitize+desanitize
round-trip and fails if any still holds FakeSetting. This catches the
case where a field is added to Sanitize without a corresponding
desanitize entry.
* Fix ElasticsearchSettings.ClientKey being incorrectly masked as a secret
ClientKey is a file path, not a secret value. Masking it caused the
asterisk string to be persisted to the database on config writes, which
broke TLS client auth on restart.
* Fix desanitize missing entries for fields added in 504fb96fdd504fb96fdd masked five fields in Sanitize without adding the
corresponding desanitize entries, meaning a config save through the
API would permanently overwrite those fields with FakeSetting:
- FileSettings.ExportAmazonS3SecretAccessKey
- ServiceSettings.GoogleDeveloperKey
- ServiceSettings.GiphySdkKey
- CacheSettings.RedisPassword
- AutoTranslationSettings.LibreTranslate.APIKey
* fixup! Add TestDesanitizeRemovesAllFakeSettings to catch future omissions
* fixup! Fix desanitize missing entries for fields added in 504fb96fdd
---------
Co-authored-by: Mattermost Build <build@mattermost.com>
