check.yml

name: Arkvory gates

on:
  push:
    branches: [main]
    tags: ['v*']
  pull_request:
  merge_group:
    types: [checks_requested]
  schedule:
    - cron: '20 2 * * 1'
  workflow_dispatch:
    inputs:
      large_transfers:
        description: Require both real 5 GiB transfer scenarios
        type: boolean
        default: false

permissions:
  contents: read

concurrency:
  group: arkvory-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  native:
    name: Native installer (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 40
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-24.04, windows-2022]
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
        with:
          persist-credentials: false
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
        with:
          node-version: '24'
          cache: npm
      - run: npm ci --ignore-scripts
      - name: Cache verified native dependency archives
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: .cache/native-downloads
          key: native-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('scripts/native-dependencies.mjs') }}
        env:
          SEGMENT_DOWNLOAD_TIMEOUT_MINS: '2'
      - if: runner.os == 'Linux'
        run: sudo apt-get update && sudo apt-get -o DPkg::Lock::Timeout=600 install -y rpm postgresql
      - run: npm run gate -- native-install
      - name: Publish gate report
        if: ${{ always() }}
        run: node scripts/ci-report.mjs
  check:
    name: Quality (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-22.04, ubuntu-24.04, windows-2022, windows-2025]
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          persist-credentials: false
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: '24'
          cache: npm
      - run: npm ci --ignore-scripts
      - run: npm run gate -- quick module-data-scan
      - name: Publish gate report to logs and job summary
        if: ${{ always() }}
        run: node scripts/ci-report.mjs
      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        if: ${{ always() && vars.ARKVORY_UPLOAD_ARTIFACTS == 'true' }}
        with:
          name: quality-${{ matrix.os }}
          path: test-results/
          retention-days: 7
          if-no-files-found: warn

  deployment:
    name: Deployment package (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-22.04, ubuntu-24.04, windows-2022, windows-2025]
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
        with:
          persist-credentials: false
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
        with:
          node-version: '24'
          cache: npm
      - run: npm ci --ignore-scripts
      - run: npm run gate -- deployment
      - name: Publish gate report
        if: ${{ always() }}
        run: node scripts/ci-report.mjs

  deployment-services:
    name: Deployment services (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-22.04, ubuntu-24.04, windows-2022, windows-2025]
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
        with:
          persist-credentials: false
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
        with:
          node-version: '24'
          cache: npm
      - run: npm ci --ignore-scripts
      - run: npm run gate -- deployment-services
      - name: Publish gate report
        if: ${{ always() }}
        run: node scripts/ci-report.mjs

  integration:
    name: PostgreSQL integration
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    services:
      postgres:
        image: postgres:18.4
        env:
          POSTGRES_USER: arkvory_test
          POSTGRES_PASSWORD: arkvory_test
          POSTGRES_DB: arkvory_test
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U arkvory_test -d arkvory_test"
          --health-interval 3s --health-timeout 3s --health-retries 20
    env:
      ARKVORY_TEST_DATABASE_URL: postgresql://arkvory_test:arkvory_test@127.0.0.1:5432/arkvory_test
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          persist-credentials: false
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: '24'
          cache: npm
      - run: npm ci --ignore-scripts
      - run: npm run gate -- module-data-recovery
      - run: npm run gate -- resource-catalog integration
      - name: Publish gate report to logs and job summary
        if: ${{ always() }}
        run: node scripts/ci-report.mjs
      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        if: ${{ always() && vars.ARKVORY_UPLOAD_ARTIFACTS == 'true' }}
        with:
          name: integration
          path: test-results/
          retention-days: 7
          if-no-files-found: warn

  browser:
    name: Browser acceptance
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    services:
      postgres:
        image: postgres:18.4
        env:
          POSTGRES_USER: arkvory_test
          POSTGRES_PASSWORD: arkvory_test
          POSTGRES_DB: arkvory_test
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U arkvory_test -d arkvory_test"
          --health-interval 3s --health-timeout 3s --health-retries 20
    env:
      ARKVORY_TEST_DATABASE_URL: postgresql://arkvory_test:arkvory_test@127.0.0.1:5432/arkvory_test
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          persist-credentials: false
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: '24'
          cache: npm
      - run: npm ci --ignore-scripts
      - run: npm run test:browser:install
      - run: npm run gate -- browser
      - name: Publish gate report to logs and job summary
        if: ${{ always() }}
        run: node scripts/ci-report.mjs
      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        if: ${{ always() && vars.ARKVORY_UPLOAD_ARTIFACTS == 'true' }}
        with:
          name: browser
          path: test-results/
          retention-days: 7
          if-no-files-found: warn

  large:
    name: Release 5 GiB (${{ matrix.gate }})
    if: ${{ github.event_name == 'push' || github.event_name == 'merge_group' || github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.large_transfers) }}
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    strategy:
      fail-fast: false
      max-parallel: 2
      matrix:
        gate: [large-full, large-multipart]
    services:
      postgres:
        image: postgres:18.4
        env:
          POSTGRES_USER: arkvory_test
          POSTGRES_PASSWORD: arkvory_test
          POSTGRES_DB: arkvory_test
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U arkvory_test -d arkvory_test"
          --health-interval 3s --health-timeout 3s --health-retries 20
    env:
      ARKVORY_TEST_DATABASE_URL: postgresql://arkvory_test:arkvory_test@127.0.0.1:5432/arkvory_test
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          persist-credentials: false
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: '24'
          cache: npm
      - run: npm ci --ignore-scripts
      - run: npm run gate -- ${{ matrix.gate }}
      - name: Publish gate report to logs and job summary
        if: ${{ always() }}
        run: node scripts/ci-report.mjs
      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        if: ${{ always() && vars.ARKVORY_UPLOAD_ARTIFACTS == 'true' }}
        with:
          name: ${{ matrix.gate }}
          path: test-results/
          retention-days: 7
          if-no-files-found: warn

  security:
    name: Dependency audit
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          persist-credentials: false
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: '24'
          cache: npm
      - run: npm ci --ignore-scripts
      - run: npm run gate -- security
      - name: Publish gate report to logs and job summary
        if: ${{ always() }}
        run: node scripts/ci-report.mjs
      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        if: ${{ always() && vars.ARKVORY_UPLOAD_ARTIFACTS == 'true' }}
        with:
          name: security
          path: test-results/
          retention-days: 7
          if-no-files-found: warn

  docs:
    name: Documentation site
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          persist-credentials: false
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: '24'
          cache: npm
      - run: npm ci --ignore-scripts
      - run: npm run gate -- docs
      - name: Publish gate report to logs and job summary
        if: ${{ always() }}
        run: node scripts/ci-report.mjs
      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        if: ${{ always() && vars.ARKVORY_UPLOAD_ARTIFACTS == 'true' }}
        with:
          name: docs
          path: test-results/
          retention-days: 7
          if-no-files-found: warn

  deployment-containers:
    name: Container deployment and update
    runs-on: ubuntu-24.04
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
        with:
          persist-credentials: false
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
        with:
          node-version: '24'
          cache: npm
      - run: npm ci --ignore-scripts
      - run: npm run gate -- deployment-containers
      - name: Publish gate report
        if: ${{ always() }}
        run: node scripts/ci-report.mjs

  stand:
    name: Stands (two sites with mirror and failover, upgrade from the latest release)
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
        with:
          persist-credentials: false
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
        with:
          node-version: '24'
          cache: npm
      - run: npm ci --ignore-scripts
      - name: Cache verified native dependency archives
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: .cache/native-downloads
          key: native-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('scripts/native-dependencies.mjs') }}
        env:
          SEGMENT_DOWNLOAD_TIMEOUT_MINS: '2'
      - run: sudo apt-get update && sudo apt-get -o DPkg::Lock::Timeout=600 install -y rpm postgresql
      - run: npm run gate -- deployment-stand
      - name: Publish gate report
        if: ${{ always() }}
        run: node scripts/ci-report.mjs

  nas:
    name: NAS stand (backup vault on SMB and NFS)
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
        with:
          persist-credentials: false
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
        with:
          node-version: '24'
          cache: npm
      - run: npm ci --ignore-scripts
      - name: Cache verified native dependency archives
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: .cache/native-downloads
          key: native-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('scripts/native-dependencies.mjs') }}
        env:
          SEGMENT_DOWNLOAD_TIMEOUT_MINS: '2'
      - run: sudo apt-get update && sudo apt-get -o DPkg::Lock::Timeout=600 install -y rpm postgresql
      # The runner is disposable: the stand's SMB and NFS mounts need these kernel modules.
      - run: sudo modprobe cifs && sudo modprobe nfs && sudo modprobe nfsd
      - run: npm run gate -- deployment-nas
      - name: Publish gate report
        if: ${{ always() }}
        run: node scripts/ci-report.mjs

  ha-base:
    name: HA guest base image (DRBD 9, Pacemaker)
    runs-on: ubuntu-24.04
    timeout-minutes: 40
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
        with:
          persist-credentials: false
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
        with:
          node-version: '24'
          cache: npm
      # The runner is disposable: the stand needs a hypervisor, libvirt and SSH for fence_virsh.
      - run: |
          sudo apt-get update
          sudo apt-get -o DPkg::Lock::Timeout=600 install -y rpm postgresql qemu-system-x86 qemu-utils libvirt-daemon-system virtinst cloud-image-utils openssh-server
          sudo chmod 666 /dev/kvm
          sudo virsh net-start default || true
      # The guest base image (packages and the DRBD 9 module), rebuilt only when ha-base.mjs changes.
      - name: Cache the HA guest base image
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: .cache/ha-stand/base-*.qcow2
          key: ha-base-v1-${{ hashFiles('scripts/ha-base-image.mjs') }}
      - run: node scripts/ha-base-image.mjs

  ha-failures:
    name: HA stand - lost standby, single copy, network partition (ADR 0072)
    needs: [ha-base]
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
        with:
          persist-credentials: false
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
        with:
          node-version: '24'
          cache: npm
      - run: npm ci --ignore-scripts
      - name: Cache verified native dependency archives
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: .cache/native-downloads
          key: native-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('scripts/native-dependencies.mjs') }}
        env:
          SEGMENT_DOWNLOAD_TIMEOUT_MINS: '2'
      # The runner is disposable: the stand needs a hypervisor, libvirt and SSH for fence_virsh.
      - run: |
          sudo apt-get update
          sudo apt-get -o DPkg::Lock::Timeout=600 install -y rpm postgresql qemu-system-x86 qemu-utils libvirt-daemon-system virtinst cloud-image-utils openssh-server
          sudo chmod 666 /dev/kvm
          sudo virsh net-start default || true
      # The guest base image (packages and the DRBD 9 module), rebuilt only when ha-base.mjs changes.
      - name: Cache the HA guest base image
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: .cache/ha-stand/base-*.qcow2
          key: ha-base-v1-${{ hashFiles('scripts/ha-base-image.mjs') }}
      - run: npm run gate -- deployment-ha
        env:
          ARKVORY_HA_IMAGES: /mnt/arkvory-ha
      - name: Publish gate report
        if: ${{ always() }}
        run: node scripts/ci-report.mjs

  ha-power:
    name: HA stand - power loss during a large upload, failed fencing (ADR 0072)
    needs: [ha-base]
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
        with:
          persist-credentials: false
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
        with:
          node-version: '24'
          cache: npm
      - run: npm ci --ignore-scripts
      - name: Cache verified native dependency archives
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: .cache/native-downloads
          key: native-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('scripts/native-dependencies.mjs') }}
        env:
          SEGMENT_DOWNLOAD_TIMEOUT_MINS: '2'
      # The runner is disposable: the stand needs a hypervisor, libvirt and SSH for fence_virsh.
      - run: |
          sudo apt-get update
          sudo apt-get -o DPkg::Lock::Timeout=600 install -y rpm postgresql qemu-system-x86 qemu-utils libvirt-daemon-system virtinst cloud-image-utils openssh-server
          sudo chmod 666 /dev/kvm
          sudo virsh net-start default || true
      # The guest base image (packages and the DRBD 9 module), rebuilt only when ha-base.mjs changes.
      - name: Cache the HA guest base image
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: .cache/ha-stand/base-*.qcow2
          key: ha-base-v1-${{ hashFiles('scripts/ha-base-image.mjs') }}
      - run: npm run gate -- deployment-ha-power
        env:
          ARKVORY_HA_IMAGES: /mnt/arkvory-ha
      - name: Publish gate report
        if: ${{ always() }}
        run: node scripts/ci-report.mjs

  ha-operations:
    name: HA stand - update, switchover, full resynchronization (ADR 0072)
    needs: [ha-base]
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
        with:
          persist-credentials: false
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
        with:
          node-version: '24'
          cache: npm
      - run: npm ci --ignore-scripts
      - name: Cache verified native dependency archives
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: .cache/native-downloads
          key: native-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('scripts/native-dependencies.mjs') }}
        env:
          SEGMENT_DOWNLOAD_TIMEOUT_MINS: '2'
      # The runner is disposable: the stand needs a hypervisor, libvirt and SSH for fence_virsh.
      - run: |
          sudo apt-get update
          sudo apt-get -o DPkg::Lock::Timeout=600 install -y rpm postgresql qemu-system-x86 qemu-utils libvirt-daemon-system virtinst cloud-image-utils openssh-server
          sudo chmod 666 /dev/kvm
          sudo virsh net-start default || true
      # The guest base image (packages and the DRBD 9 module), rebuilt only when ha-base.mjs changes.
      - name: Cache the HA guest base image
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: .cache/ha-stand/base-*.qcow2
          key: ha-base-v1-${{ hashFiles('scripts/ha-base-image.mjs') }}
      - run: npm run gate -- deployment-ha-operations
        env:
          ARKVORY_HA_IMAGES: /mnt/arkvory-ha
      - name: Publish gate report
        if: ${{ always() }}
        run: node scripts/ci-report.mjs

  ha-three:
    name: HA stand - three data nodes (ADR 0072)
    needs: [ha-base]
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
        with:
          persist-credentials: false
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
        with:
          node-version: '24'
          cache: npm
      - run: npm ci --ignore-scripts
      - name: Cache verified native dependency archives
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: .cache/native-downloads
          key: native-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('scripts/native-dependencies.mjs') }}
        env:
          SEGMENT_DOWNLOAD_TIMEOUT_MINS: '2'
      # The runner is disposable: the stand needs a hypervisor, libvirt and SSH for fence_virsh.
      - run: |
          sudo apt-get update
          sudo apt-get -o DPkg::Lock::Timeout=600 install -y rpm postgresql qemu-system-x86 qemu-utils libvirt-daemon-system virtinst cloud-image-utils openssh-server
          sudo chmod 666 /dev/kvm
          sudo virsh net-start default || true
      # The guest base image (packages and the DRBD 9 module), rebuilt only when ha-base.mjs changes.
      - name: Cache the HA guest base image
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: .cache/ha-stand/base-*.qcow2
          key: ha-base-v1-${{ hashFiles('scripts/ha-base-image.mjs') }}
      - run: npm run gate -- deployment-ha-three
        env:
          ARKVORY_HA_IMAGES: /mnt/arkvory-ha
      - name: Publish gate report
        if: ${{ always() }}
        run: node scripts/ci-report.mjs

  verdict:
    name: Arkvory merge gate
    if: ${{ always() }}
    needs:
      [
        check,
        deployment,
        deployment-services,
        integration,
        browser,
        security,
        docs,
        large,
        deployment-containers,
        native,
        stand,
        nas,
        ha-base,
        ha-failures,
        ha-power,
        ha-operations,
        ha-three,
      ]
    runs-on: ubuntu-24.04
    timeout-minutes: 2
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          persist-credentials: false
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: '24'
      - name: Require every applicable gate to pass
        env:
          ARKVORY_CI_NEEDS: ${{ toJSON(needs) }}
          ARKVORY_RELEASE_REQUIRED: ${{ github.event_name == 'push' || github.event_name == 'merge_group' || github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.large_transfers) }}
        run: node scripts/ci-verdict.mjs