name: "HugeGraph-Server CI"

on:
  push:
    branches:
      - master
      - 'release-*'
      - 'test-*'
  pull_request:

jobs:
  java-runtime:
    uses: ./.github/workflows/java-runtime.yml
    permissions:
      contents: read

  wait-storage-shell-test:
    permissions:
      contents: read
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Run wait-storage.sh peer failover tests
        run: hugegraph-server/hugegraph-dist/src/assembly/travis/test-wait-storage.sh

  # Required coverage: memory on the project runtime and any additional test JDKs.
  # The shared runtime comes from .github/workflows/.java-version, independent of bytecode targets.
  # Keep the job ID for the Codecov configuration validator.
  # The old required check name is provided by the temporary result job below.
  build-server:
    needs: java-runtime
    name: Server memory (Java ${{ matrix.JAVA_VERSION }})
    runs-on: ubuntu-24.04
    env: &linux-server-env
      USE_STAGE: 'false' # Whether to include the stage repository.
      TRAVIS_DIR: hugegraph-server/hugegraph-dist/src/assembly/travis
      REPORT_DIR: target/site/jacoco
      BACKEND: ${{ matrix.BACKEND }}
      TRIGGER_BRANCH_NAME: ${{ github.ref_name }}
      HEAD_BRANCH_NAME: ${{ github.head_ref }}
      BASE_BRANCH_NAME: ${{ github.base_ref }}
      TARGET_BRANCH_NAME: ${{ github.base_ref != '' && github.base_ref || github.ref_name }}
      RELEASE_BRANCH: ${{ startsWith(github.ref_name, 'release-') || startsWith(github.ref_name, 'test-') }}
      RAFT_MODE: ${{ startsWith(github.head_ref, 'test') || startsWith(github.head_ref, 'raft') }}

    strategy:
      fail-fast: false
      matrix:
        BACKEND: [ memory ]
        # Keep the graph evaluable when the reader fails; result checks still reject skips.
        JAVA_VERSION: ${{ fromJSON(needs.java-runtime.outputs.versions || '["unavailable"]') }}

    # YAML & defines shared configuration; * reuses it in the optional backend job below.
    steps: &linux-server-steps
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 5

      # TODO: Remove this step after install-backend.sh updated
      - name: Install Java8 for backend
        uses: actions/setup-java@v6
        with:
          java-version: '8'
          distribution: 'zulu'

      - name: Prepare backend environment
        run: |
          $TRAVIS_DIR/install-backend.sh $BACKEND && jps -l

      - name: Install Java ${{ matrix.JAVA_VERSION }}
        uses: actions/setup-java@v6
        with:
          java-version: ${{ matrix.JAVA_VERSION }}
          distribution: 'zulu'
          cache: maven
          cache-jdk: false

      - name: Use staged maven repo settings
        if: ${{ env.USE_STAGE == 'true' }}
        run: |
          cp $HOME/.m2/settings.xml /tmp/settings.xml
          cp -vf .github/configs/settings.xml $HOME/.m2/settings.xml && cat $HOME/.m2/settings.xml

      - name: Compile
        run: |
          mvn clean compile -U -Dmaven.javadoc.skip=true -ntp

      - name: Validate Docker integration
        if: ${{ env.BACKEND == 'rocksdb' }}
        run: |
          bash hugegraph-server/hugegraph-dist/docker/docker-entrypoint-test.sh
          bash docker/test-compose.sh render

      - name: Run Compose auth-on smoke tests
        if: ${{ env.BACKEND == 'rocksdb' }}
        run: bash docker/test-compose.sh smoke

      - name: Run check_port unit tests
        if: ${{ env.BACKEND == 'rocksdb' }}
        run: |
          # Validates the ss/netstat port preflight that replaced lsof
          $TRAVIS_DIR/test-check-port.sh \
            hugegraph-server/hugegraph-dist/src/assembly/static \
            hugegraph-store/hg-store-dist/src/assembly/static/bin/util.sh

      - name: Run Java security properties tests
        if: ${{ env.BACKEND == 'rocksdb' }}
        run: |
          mvn package -Dmaven.test.skip=true -pl hugegraph-server/hugegraph-dist -am -ntp
          VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)
          SERVER_DIR=hugegraph-server/apache-hugegraph-server-$VERSION/
          $TRAVIS_DIR/test-java-security-properties.sh $SERVER_DIR

      - name: Check startup test prerequisites
        id: server-preflight
        if: ${{ env.BACKEND == 'rocksdb' }}
        run: |
          # Note: lsof removed from prerequisites; check_port now uses ss, falling back
          # to netstat, and warns without blocking when neither can answer.
          # This job always runs on Linux (ubuntu-24.04), which uses fuser for port cleanup.
          for tool in crontab curl java; do
            if ! command -v "$tool" >/dev/null 2>&1; then
              echo "can_run=false" >> "$GITHUB_OUTPUT"
              echo "skip_reason=missing tool: $tool" >> "$GITHUB_OUTPUT"
              exit 0
            fi
          done
          if ! command -v fuser >/dev/null 2>&1; then
            echo "can_run=false" >> "$GITHUB_OUTPUT"
            echo "skip_reason=missing tool: fuser (required for Linux port cleanup)" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          echo "can_run=true" >> "$GITHUB_OUTPUT"

      - name: Run start-hugegraph.sh foreground mode tests
        if: ${{ env.BACKEND == 'rocksdb' && steps.server-preflight.outputs.can_run == 'true' }}
        run: |
          VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)
          SERVER_DIR=hugegraph-server/apache-hugegraph-server-$VERSION/
          $TRAVIS_DIR/test-start-hugegraph.sh $SERVER_DIR

      - name: Startup tests skipped (missing prerequisites)
        if: ${{ env.BACKEND == 'rocksdb' && steps.server-preflight.outputs.can_run == 'false' }}
        run: |
          echo "::notice::Server startup tests skipped — ${{ steps.server-preflight.outputs.skip_reason }}"

      - name: Run unit test
        run: |
          $TRAVIS_DIR/run-unit-test.sh $BACKEND

      - name: Run core test
        run: |
          $TRAVIS_DIR/run-core-test.sh $BACKEND

      - name: Run api test
        run: |
          if [ "$BACKEND" = "rocksdb" ]; then
            $TRAVIS_DIR/run-api-test.sh $BACKEND $REPORT_DIR true
          else
            $TRAVIS_DIR/run-api-test.sh $BACKEND $REPORT_DIR
          fi

      # TODO: disable raft test in normal PR due to the always timeout problem
      - name: Run raft test
        if: ${{ env.RAFT_MODE == 'true' && env.BACKEND == 'rocksdb' }}
        run: |
          $TRAVIS_DIR/run-api-test-for-raft.sh $BACKEND $REPORT_DIR

      - name: Run TinkerPop test
        if: ${{ env.RELEASE_BRANCH == 'true' }}
        run: |
          echo "[WARNING] Enter Tinkerpop Test, current 'github.ref_name' is ${{ github.ref_name }}"
          $TRAVIS_DIR/run-tinkerpop-test.sh $BACKEND tinkerpop

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v7
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: ${{ env.REPORT_DIR }}/*.xml
          disable_search: true
          fail_ci_if_error: false

  server-memory-required:
    # This is the only Server check referenced by .asf.yaml; keep its name stable.
    name: Server memory tests
    needs: [ java-runtime, build-server ]
    # Always evaluate results, including dependency failures and unexpected skips.
    if: ${{ always() }}
    runs-on: ubuntu-24.04
    permissions: {}
    env: &memory-results
      RUNTIME_RESULT: ${{ needs.java-runtime.result }}
      MEMORY_RESULT: ${{ needs.build-server.result }}
    steps: &require-memory-success
      - name: Require the runtime configuration and all memory tests to pass
        run: |
          if [ "$RUNTIME_RESULT" != "success" ] || [ "$MEMORY_RESULT" != "success" ]; then
            echo "::error::Runtime configuration: $RUNTIME_RESULT; memory tests: $MEMORY_RESULT"
            exit 1
          fi

  # Temporary alias for live protection. Remove after ASF activates the stable context.
  # Reuse the real result check so a skipped matrix cannot satisfy the old requirement.
  legacy-server-memory-required:
    name: build-server (memory, 11)
    needs: [ java-runtime, build-server ]
    if: ${{ always() }}
    runs-on: ubuntu-24.04
    permissions: {}
    env: *memory-results
    steps: *require-memory-success

  # Optional coverage uses the same Linux environment, resolved JDKs and test steps.
  # Keep it separate so backend failures do not become required memory failures.
  build-server-backends:
    needs: java-runtime
    name: build-server (${{ matrix.BACKEND }}, ${{ matrix.JAVA_VERSION }})
    runs-on: ubuntu-24.04
    env: *linux-server-env
    strategy:
      fail-fast: false
      matrix:
        BACKEND: [ rocksdb, hbase ]
        JAVA_VERSION: ${{ fromJSON(needs.java-runtime.outputs.versions || '["unavailable"]') }}
    steps: *linux-server-steps

  build-server-macos-rocksdb:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-15-intel
            server_java_options: ''
          - os: macos-15
            server_java_options: '-Xms512m -Xmx2g'
    env:
      USE_STAGE: 'false' # Whether to include the stage repository.
      TRAVIS_DIR: hugegraph-server/hugegraph-dist/src/assembly/travis
      REPORT_DIR: target/site/jacoco
      BACKEND: rocksdb
      SERVER_JAVA_OPTIONS: ${{ matrix.server_java_options }}

    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 5

      - name: Install project JDK
        uses: actions/setup-java@v6
        with:
          java-version-file: .github/workflows/.java-version
          distribution: 'zulu'
          cache: maven
          cache-jdk: false

      - name: Use staged maven repo settings
        if: ${{ env.USE_STAGE == 'true' }}
        run: |
          cp $HOME/.m2/settings.xml /tmp/settings.xml
          cp -vf .github/configs/settings.xml $HOME/.m2/settings.xml && cat $HOME/.m2/settings.xml

      - name: Compile
        run: |
          mvn clean compile -pl hugegraph-server/hugegraph-test -am -U -Dmaven.javadoc.skip=true -ntp

      - name: Run check_port unit tests
        # Validates the ss/netstat port preflight that replaced lsof
        run: |
          $TRAVIS_DIR/test-check-port.sh \
            hugegraph-server/hugegraph-dist/src/assembly/static \
            hugegraph-store/hg-store-dist/src/assembly/static/bin/util.sh

      - name: Run RocksDB core test
        run: |
          $TRAVIS_DIR/run-core-test.sh $BACKEND

      - name: Run RocksDB API test
        run: |
          $TRAVIS_DIR/run-api-test.sh $BACKEND $REPORT_DIR true

      - name: Show server log on failure
        if: failure()
        run: |
          VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)
          SERVER_DIR=hugegraph-server/apache-hugegraph-server-$VERSION/
          if [ -f "$SERVER_DIR/logs/hugegraph-server.log" ]; then
            tail -n 200 "$SERVER_DIR/logs/hugegraph-server.log"
          fi

      - name: Stop RocksDB server
        if: always()
        run: |
          VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)
          SERVER_DIR=hugegraph-server/apache-hugegraph-server-$VERSION/
          if [ -f "$SERVER_DIR/bin/pid" ]; then
            $TRAVIS_DIR/stop-server.sh $SERVER_DIR || true
          fi

  build-server-riscv64:
    uses: ./.github/workflows/riscv64-ci.yml
    permissions:
      contents: read