ci.yml

# Merge gate for coder/openstorage (issue #7): lint, build, and the full
# uncached race test suite. Postgres-dependent tests (river jobs, pg ref CAS,
# githttp e2e pg lane) boot their own postgres/seaweedfs containers via
# testcontainers, so they only need Docker on the runner — no service
# containers. The local lane covers the zero-container sqlite+fileblob e2e
# tests that are skipped in the default pg lane; the s3wal lane covers the
# zero-infra serve path (bucket-only authority) that was nightly-only before
# issue #193.
#
# merge_group: a merge queue on main waits for every required check (lint,
# test, test-local, test-s3wal, plus pr-title from pr-title.yml) to report
# on the queue's combined commit, and a check that never reports leaves the
# queue entry pending until it times out. So every job runs, unconditionally,
# on merge_group as well. Each queue entry gets its own temporary
# gh-readonly-queue/main/... ref, so the concurrency group below never
# cancels one entry's run for another's.
name: ci

on:
  pull_request:
  merge_group:
  push:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  lint:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      # mise.toml is the single source of truth for the Go and golangci-lint
      # pins; install both here so CI lints with exactly the local toolchain.
      - uses: jdx/mise-action@f5be966e4a917d54244728e6a5fdcd1d93a35e6c # v5.2.6
      - run: golangci-lint run
      - run: python3 -B -m unittest discover -s scripts -p 'test_*.py' -v
      - run: python3 scripts/check-doc-links.py

  terraform:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: jdx/mise-action@f5be966e4a917d54244728e6a5fdcd1d93a35e6c # v5.2.6
      # Offline/mock gates only. This job has no AWS credentials and never applies.
      - run: terraform -chdir=deploy/terraform/aws fmt -check -recursive
      - run: terraform -chdir=deploy/terraform/aws init -backend=false -lockfile=readonly -input=false
      - run: terraform -chdir=deploy/terraform/aws validate
      - run: terraform -chdir=deploy/terraform/aws test
      - run: python3 -m unittest discover -s deploy/terraform/aws/bootstrap -p 'test_*.py' -v
      - run: docker build -t openstorage-bootstrap:test -f deploy/terraform/aws/bootstrap/Dockerfile.test deploy/terraform/aws/bootstrap
      - run: docker run --rm --network=none openstorage-bootstrap:test
      - run: python3 -m unittest discover -s deploy/terraform/aws/tests -p 'test_*.py' -v
      - run: bash -n deploy/terraform/aws/scripts/smoke.sh

  test:
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
      # The LFS e2e tests silently skip when git-lfs is missing; assert it is
      # installed so the suite cannot quietly lose coverage.
      - run: git lfs version
      - run: go build ./...
      # Cross-compile every release target so platform-specific syscall
      # types (e.g. Stat_t.Dev: int32 on darwin, uint64 on linux) break PR
      # CI instead of the tag-time release asset build (v0.14.4 incident).
      - name: Cross-compile release targets
        run: |
          for os in darwin linux; do
            for arch in amd64 arm64; do
              echo "building $os/$arch"
              GOOS=$os GOARCH=$arch CGO_ENABLED=0 go build -o /dev/null ./...
            done
          done
      # openstorage_viewcheck: S3WAL stores assert that no caller wrote
      # into the shared metadata view (internal/meta, issue #497).
      - run: go test ./... -tags=openstorage_viewcheck -count=1 -race -timeout=30m

  # Build locally, never push. Check runtime tools and exercise the unchanged
  # single-node Compose reference with this exact candidate image ID, natively
  # on both platforms that .github/workflows/image.yml builds and publishes.
  image:
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: amd64
            runner: ubuntu-latest
          - arch: arm64
            runner: ubuntu-24.04-arm
    name: image (${{ matrix.arch }})
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Build candidate image without publication
        run: |
          docker build --iidfile "$RUNNER_TEMP/openstorage-image.id" \
            --build-arg VERSION=v0.0.0-ci --build-arg COMMIT="$GITHUB_SHA" .
          echo "OPENSTORAGE_IMAGE=$(cat "$RUNNER_TEMP/openstorage-image.id")" >> "$GITHUB_ENV"
      - name: Check platform and version stamp
        env:
          ARCH: ${{ matrix.arch }}
        run: |
          [ "$(docker image inspect --format '{{.Os}}/{{.Architecture}}' "$OPENSTORAGE_IMAGE")" = "linux/$ARCH" ]
          out=$(docker run --rm "$OPENSTORAGE_IMAGE" --version)
          echo "$out"
          grep -F "openstorage v0.0.0-ci (commit $GITHUB_SHA," <<<"$out"
      - name: Check runtime Git and signature tools
        run: docker run --rm --entrypoint /bin/sh "$OPENSTORAGE_IMAGE" -c 'command -v git && command -v gpg && command -v ssh-keygen'
      # The image's Git is Alpine's. internal/api reads its patch refusals by
      # their words, so a reworded message must fail here, not answer 500.
      - name: Check the words of the image's Git patch refusals
        run: |
          docker run --rm --entrypoint /bin/sh \
            -v "$PWD/scripts/check-apply-messages.sh:/check-apply-messages.sh:ro" \
            -v "$PWD/internal/api/testdata/applymsg:/cases:ro" \
            "$OPENSTORAGE_IMAGE" /check-apply-messages.sh /cases
      # Use the published-image reference form. The tag exists only in this
      # runner's daemon, and the smoke refuses to start unless the image is local.
      - name: Smoke the exact Compose quickstart
        run: |
          bash -n scripts/smoke-compose-quickstart.sh
          docker tag "$OPENSTORAGE_IMAGE" ghcr.io/coder/openstorage:0.0.0-ci
          OPENSTORAGE_IMAGE=ghcr.io/coder/openstorage:0.0.0-ci bash scripts/smoke-compose-quickstart.sh

  test-local:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
      - run: git lfs version
      - run: go test ./internal/githttp -count=1 -race -timeout=15m
        env:
          OPENSTORAGE_TEST_BACKEND: local

  # The s3wal serve/e2e lane (issue #193; promotion tracking #192, item B1):
  # internal/githttp's TestMain boots the zero-infra topology — one SeaweedFS
  # bucket (testcontainer) carrying the s3wal ref+meta authority (_wal/) AND
  # the packs/LFS blobs — and drives real `git` against child serve
  # processes: the full shared e2e suite plus the lane-only drills
  # (restart-from-bucket, SIGTERM lease release, dual-serve refusal).
  # Scoped to ./internal/githttp and the worker-level local-schedule tests
  # in ./internal/sync deliberately: they are the only consumers of
  # OPENSTORAGE_TEST_BACKEND, so a full ./... run under this lane would
  # replay every other package byte-identically with the `test` job above
  # (the s3wal CAS/qualification suites in internal/ref/s3wal and the
  # MemCAS-backed s3wal meta suite in internal/meta already run there
  # unconditionally). The sync step runs the worker-level controls of the
  # #266 design note (C1 to C9 and C11) on S3WAL metadata in a SeaweedFS
  # bucket (ADR-51 test plan item 5); C10 is the githttp hook e2e test
  # TestLocalHookLivePullClaimSuppressesPullIntent.
  # The githttp harness itself exports OPENSTORAGE_S3WAL_LEASE_TTL=0
  # to its serve children (many serve processes legitimately share the one
  # lane bucket); the job only selects the lane.
  test-s3wal:
    runs-on: ubuntu-latest
    # The two test budgets (25 + 10 min) plus setup.
    timeout-minutes: 40
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
      - run: git lfs version
      - run: go test ./internal/githttp -tags=openstorage_viewcheck -count=1 -race -timeout=25m
        env:
          OPENSTORAGE_TEST_BACKEND: s3wal
      - run: go test ./internal/sync -tags=openstorage_viewcheck -run 'TestLocalSchedule' -count=1 -race -timeout=10m
        env:
          OPENSTORAGE_TEST_BACKEND: s3wal

  orphan-sweep-fingerprints:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
      - run: .agents/skills/verify-orphan-sweep/check.sh --fingerprints-only

  lane-schedule-fingerprints:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
      - run: .agents/skills/verify-lane-schedule/check.sh --fingerprints-only