Files
mattermost/.github/workflows
Pavel ZemanandClaude c8f0a31425 ci: move FIPS and binary params tests to weekly schedule (#36036)
* ci: move FIPS and binary params tests to weekly schedule

Move low-regression-risk test suites out of the per-push/PR Server CI
workflow into a new weekly scheduled workflow (Monday 1am EST / 5am UTC):

- Postgres with binary parameters (1x 8-core runner)
- Postgres FIPS sharded tests (4x 8-core runners + merge job)
- mmctl FIPS tests (1x 8-core runner)

This reduces the per-push 8-core runner demand from 14 concurrent jobs
to 5 (4 Postgres shards + 1 ES), which should significantly reduce
queue times that currently reach 90+ minutes during peak hours.

The weekly workflow also supports workflow_dispatch for manual triggering
when urgent FIPS or binary parameter verification is needed.

#### Release Note
```release-note
NONE
```

Co-authored-by: Claude <claude@anthropic.com>

* ci: move coverage shards to 2-core runners

Add a 'runner' input to server-test-template.yml (defaults to
ubuntu-latest-8-cores for backward compatibility) and set coverage
shards to ubuntu-22.04 (2-core).

Coverage is non-blocking (allow-failure: true) so longer runtime
doesn't impact PR feedback. Estimated ~20-30 min per shard on 2-core
vs ~7-9 min on 8-core, but frees 4 more 8-core slots per push.

Combined with the FIPS/binary-params weekly move, per-push 8-core
demand drops from 14 → 4 (just the Postgres test shards + ES v8).

Co-authored-by: Claude <claude@anthropic.com>

* ci: decouple race detector from binary params, add nightly race job

The race detector was accidentally bundled with binary params via
the fullyparallel=false → RACE_MODE coupling in the test template.
These test different things:
- Binary params: Postgres driver binary encoding mode
- Race detector: Go data race detection

Changes:
- Add explicit 'race-enabled' input to server-test-template.yml
- Remove implicit fullyparallel→race coupling from template
- Binary params now runs with fullyparallel: true (default)
- New server-ci-nightly-race.yml runs -race nightly at 2am EST
  on ubuntu-22.04 (2-core) to avoid 8-core contention

Co-authored-by: Claude <claude@anthropic.com>

* ci: add push trigger for release-* branches to weekly workflow

FIPS and binary params validation must run automatically on release
branch pushes, not just on the weekly schedule. Without this trigger,
release branches would lose FIPS/binary coverage entirely.

Co-authored-by: Claude <claude@anthropic.com>

* ci: use ET instead of EST in schedule comments

Cron runs at fixed UTC times regardless of DST. Use ~ET to avoid
implying exact EST/EDT correspondence.

Co-authored-by: Claude <claude@anthropic.com>

* ci: restore conditional FIPS on per-push, unshard weekly FIPS

Per review feedback from @lieut-data:

1. Restore FIPS jobs in server-ci.yml with conditional execution:
   run on all pushes (master/release) and on PRs when go.mod changed
   or branch name contains 'fips'. This ensures Go upgrades and
   explicit FIPS work get immediate feedback.

2. Remove sharding from weekly FIPS — no speed pressure on a weekly
   schedule, so a single unsharded job is simpler (eliminates the
   4-shard matrix + merge job).

3. Restore gomod-changed detection step in the go job.

Both per-push (conditional, unsharded) and weekly (unconditional,
unsharded) FIPS runs use single jobs now, reducing complexity.

Co-authored-by: Claude <claude@anthropic.com>

* ci: restore FIPS sharding for PR runs, remove from push events

FIPS tests in server-ci.yml now only trigger on PRs where the branch
name contains 'fips' or go.mod changed. Sharding (4 shards + merge)
restored for fast iteration on FIPS-related PRs. Regular FIPS coverage
provided by the weekly workflow (unsharded).

This addresses lieut-data's review feedback to restore sharding where
it matters most: during active PR iteration.

Co-authored-by: Claude <claude@anthropic.com>

* ci: add explicit permissions to weekly and nightly workflows

Set minimum required permissions (contents: read) on both new workflow
files per review feedback. Reusable workflows called via 'uses' inherit
the caller's permissions.

Co-authored-by: Claude <claude@anthropic.com>

* ci: keep coverage shards on 8-core runners

Comment out the 2-core runner override for coverage shards per
Eva's feedback. Coverage stays on the default 8-core runners.

Co-authored-by: Claude <claude@anthropic.com>

---------

Co-authored-by: Claude <claude@anthropic.com>
2026-04-20 16:38:46 -04:00
..