server-ci.yml

name: "HugeGraph-Server CI"

on:
  push:
    branches:
      - master
      - 'release-*'
      - 'test-*'
  pull_request:

jobs:
  wait-storage-shell-test:
    permissions:
      contents: read
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Run wait-storage.sh peer failover tests
        run: hugegraph-server/hugegraph-dist/src/assembly/travis/test-wait-storage.sh

  build-server:
    # TODO: we need test & replace it to ubuntu-24.04 or ubuntu-latest
    runs-on: ubuntu-22.04
    env:
      USE_STAGE: 'false' # Whether to include the stage repository.
      TRAVIS_DIR: hugegraph-server/hugegraph-dist/src/assembly/travis
      REPORT_DIR: target/site/jacoco
      BACKEND: ${{ matrix.BACKEND }}
      TRIGGER_BRANCH_NAME: ${{ github.ref_name }}
      HEAD_BRANCH_NAME: ${{ github.head_ref }}
      BASE_BRANCH_NAME: ${{ github.base_ref }}
      TARGET_BRANCH_NAME: ${{ github.base_ref != '' && github.base_ref || github.ref_name }}
      RELEASE_BRANCH: ${{ startsWith(github.ref_name, 'release-') || startsWith(github.ref_name, 'test-') }}
      RAFT_MODE: ${{ startsWith(github.head_ref, 'test') || startsWith(github.head_ref, 'raft') }}

    strategy:
      fail-fast: false
      matrix:
        BACKEND: [ memory, rocksdb, hbase ]
        JAVA_VERSION: [ '11' ]

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 5

      # TODO: Remove this step after install-backend.sh updated
      - name: Install Java8 for backend
        uses: actions/setup-java@v4
        with:
          java-version: '8'
          distribution: 'zulu'

      - name: Prepare backend environment
        run: |
          $TRAVIS_DIR/install-backend.sh $BACKEND && jps -l

      - name: Install Java ${{ matrix.JAVA_VERSION }}
        uses: actions/setup-java@v4
        with:
          java-version: ${{ matrix.JAVA_VERSION }}
          distribution: 'zulu'

      - name: Cache Maven packages
        uses: actions/cache@v4
        with:
          path: ~/.m2
          key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
          restore-keys: ${{ runner.os }}-m2

      - name: Use staged maven repo settings
        if: ${{ env.USE_STAGE == 'true' }}
        run: |
          cp $HOME/.m2/settings.xml /tmp/settings.xml
          cp -vf .github/configs/settings.xml $HOME/.m2/settings.xml && cat $HOME/.m2/settings.xml

      - name: Compile
        run: |
          mvn clean compile -U -Dmaven.javadoc.skip=true -ntp

      - name: Validate Docker integration
        if: ${{ env.BACKEND == 'rocksdb' }}
        run: |
          bash hugegraph-server/hugegraph-dist/docker/docker-entrypoint-test.sh
          check_compose() {
            local file="$1"
            local server_policy="$2"
            local hubble_policy="$3"
            local rendered
            rendered="$(mktemp)"

            if env -u HUGEGRAPH_ADMIN_PASSWORD \
                 docker compose -f "$file" config -q >/dev/null 2>&1; then
              echo "$file accepted an unset admin password" >&2
              return 1
            fi
            if HUGEGRAPH_ADMIN_PASSWORD= \
                 docker compose -f "$file" config -q >/dev/null 2>&1; then
              echo "$file accepted an empty admin password" >&2
              return 1
            fi

            HUGEGRAPH_ADMIN_PASSWORD=ci-test-password \
              docker compose -f "$file" config --format json > "$rendered"
            jq -e \
              --arg server_policy "$server_policy" \
              --arg hubble_policy "$hubble_policy" '
                .services.server.pull_policy == $server_policy and
                .services.hubble.pull_policy == $hubble_policy and
                .services.server.environment.HG_SERVER_USE_PD == "true" and
                .services.server.environment.HG_SERVER_CLUSTER == "hg" and
                .services.server.environment.HG_SERVER_REST_URL ==
                  "http://server:8080" and
                .services.server.environment.HG_SERVER_INIT_STORE_ENABLED ==
                  "false" and
                .services.server.environment.PASSWORD ==
                  "ci-test-password" and
                (.services.server.environment.HG_SERVER_AUTH_TOKEN_SECRET !=
                  null) and
                .services.hubble.depends_on.server.condition ==
                  "service_healthy" and
                (.services.hubble.healthcheck.test[1] |
                  contains("http://127.0.0.1:8088/about") and
                  contains("\"status\":200") and
                  contains("\"name\":\"hugegraph-hubble\"")) and
                any(.services.hubble.ports[];
                    .target == 8088 and .published == "8088" and
                    .host_ip == "127.0.0.1")
              ' "$rendered" >/dev/null
            rm -f "$rendered"
          }

          check_compose docker/docker-compose.yml always always
          check_compose docker/docker-compose.dev.yml build missing

      - name: Run check_port unit tests
        if: ${{ env.BACKEND == 'rocksdb' }}
        run: |
          # Validates the ss/netstat port preflight that replaced lsof
          $TRAVIS_DIR/test-check-port.sh \
            hugegraph-server/hugegraph-dist/src/assembly/static \
            hugegraph-store/hg-store-dist/src/assembly/static/bin/util.sh

      - name: Run Java security properties tests
        if: ${{ env.BACKEND == 'rocksdb' }}
        run: |
          mvn package -Dmaven.test.skip=true -pl hugegraph-server/hugegraph-dist -am -ntp
          VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)
          SERVER_DIR=hugegraph-server/apache-hugegraph-server-$VERSION/
          $TRAVIS_DIR/test-java-security-properties.sh $SERVER_DIR

      - name: Check startup test prerequisites
        id: server-preflight
        if: ${{ env.BACKEND == 'rocksdb' }}
        run: |
          # Note: lsof removed from prerequisites; check_port now uses ss, falling back
          # to netstat, and warns without blocking when neither can answer.
          # This job always runs on Linux (ubuntu-22.04), which uses fuser for port cleanup.
          for tool in crontab curl java; do
            if ! command -v "$tool" >/dev/null 2>&1; then
              echo "can_run=false" >> "$GITHUB_OUTPUT"
              echo "skip_reason=missing tool: $tool" >> "$GITHUB_OUTPUT"
              exit 0
            fi
          done
          if ! command -v fuser >/dev/null 2>&1; then
            echo "can_run=false" >> "$GITHUB_OUTPUT"
            echo "skip_reason=missing tool: fuser (required for Linux port cleanup)" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          echo "can_run=true" >> "$GITHUB_OUTPUT"

      - name: Run start-hugegraph.sh foreground mode tests
        if: ${{ env.BACKEND == 'rocksdb' && steps.server-preflight.outputs.can_run == 'true' }}
        run: |
          VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)
          SERVER_DIR=hugegraph-server/apache-hugegraph-server-$VERSION/
          $TRAVIS_DIR/test-start-hugegraph.sh $SERVER_DIR

      - name: Startup tests skipped (missing prerequisites)
        if: ${{ env.BACKEND == 'rocksdb' && steps.server-preflight.outputs.can_run == 'false' }}
        run: |
          echo "::notice::Server startup tests skipped — ${{ steps.server-preflight.outputs.skip_reason }}"

      - name: Run unit test
        run: |
          $TRAVIS_DIR/run-unit-test.sh $BACKEND

      - name: Run core test
        run: |
          $TRAVIS_DIR/run-core-test.sh $BACKEND

      - name: Run api test
        run: |
          if [ "$BACKEND" = "rocksdb" ]; then
            $TRAVIS_DIR/run-api-test.sh $BACKEND $REPORT_DIR true
          else
            $TRAVIS_DIR/run-api-test.sh $BACKEND $REPORT_DIR
          fi

      # TODO: disable raft test in normal PR due to the always timeout problem
      - name: Run raft test
        if: ${{ env.RAFT_MODE == 'true' && env.BACKEND == 'rocksdb' }}
        run: |
          $TRAVIS_DIR/run-api-test-for-raft.sh $BACKEND $REPORT_DIR

      - name: Run TinkerPop test
        if: ${{ env.RELEASE_BRANCH == 'true' }}
        run: |
          echo "[WARNING] Enter Tinkerpop Test, current 'github.ref_name' is ${{ github.ref_name }}"
          $TRAVIS_DIR/run-tinkerpop-test.sh $BACKEND tinkerpop

      - name: Upload coverage to Codecov
        # TODO: update to v5 later
        uses: codecov/codecov-action@v3
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          file: ${{ env.REPORT_DIR }}/*.xml

  build-server-macos-rocksdb:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-15-intel
            server_java_options: ''
          - os: macos-15
            server_java_options: '-Xms512m -Xmx2g'
    env:
      USE_STAGE: 'false' # Whether to include the stage repository.
      TRAVIS_DIR: hugegraph-server/hugegraph-dist/src/assembly/travis
      REPORT_DIR: target/site/jacoco
      BACKEND: rocksdb
      JAVA_VERSION: '11'
      SERVER_JAVA_OPTIONS: ${{ matrix.server_java_options }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 5

      - name: Install Java ${{ env.JAVA_VERSION }}
        uses: actions/setup-java@v4
        with:
          java-version: ${{ env.JAVA_VERSION }}
          distribution: 'zulu'

      - name: Cache Maven packages
        uses: actions/cache@v4
        with:
          path: ~/.m2
          key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
          restore-keys: ${{ runner.os }}-m2

      - name: Use staged maven repo settings
        if: ${{ env.USE_STAGE == 'true' }}
        run: |
          cp $HOME/.m2/settings.xml /tmp/settings.xml
          cp -vf .github/configs/settings.xml $HOME/.m2/settings.xml && cat $HOME/.m2/settings.xml

      - name: Compile
        run: |
          mvn clean compile -pl hugegraph-server/hugegraph-test -am -U -Dmaven.javadoc.skip=true -ntp

      - name: Run check_port unit tests
        # Validates the ss/netstat port preflight that replaced lsof
        run: |
          $TRAVIS_DIR/test-check-port.sh \
            hugegraph-server/hugegraph-dist/src/assembly/static \
            hugegraph-store/hg-store-dist/src/assembly/static/bin/util.sh

      - name: Run RocksDB core test
        run: |
          $TRAVIS_DIR/run-core-test.sh $BACKEND

      - name: Run RocksDB API test
        run: |
          $TRAVIS_DIR/run-api-test.sh $BACKEND $REPORT_DIR true

      - name: Show server log on failure
        if: failure()
        run: |
          VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)
          SERVER_DIR=hugegraph-server/apache-hugegraph-server-$VERSION/
          if [ -f "$SERVER_DIR/logs/hugegraph-server.log" ]; then
            tail -n 200 "$SERVER_DIR/logs/hugegraph-server.log"
          fi

      - name: Stop RocksDB server
        if: always()
        run: |
          VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)
          SERVER_DIR=hugegraph-server/apache-hugegraph-server-$VERSION/
          if [ -f "$SERVER_DIR/bin/pid" ]; then
            $TRAVIS_DIR/stop-server.sh $SERVER_DIR || true
          fi

  build-server-riscv64:
    uses: ./.github/workflows/riscv64-ci.yml
    permissions:
      contents: read