chore: migrate workflows to Blacksmith runners (#9524)

blacksmith-sh[bot] · matthewmcneely · web-flow · commit ea1c7fec12c3 · 2025-11-20T14:36:50.000-05:00
To whomever may be reviewing this PR, **[Blacksmith](https://www.blacksmith.sh/) is the fastest way to run your GitHub Actions.** ## What does this PR change? This PR has been automatically generated by a team member in your GitHub organization using Blacksmith's [Migration Wizard](https://docs.blacksmith.sh/introduction/quickstart), or MigWiz for short. This PR changes the following: 1. Your selected workflows will now run on Blacksmith's 2x faster hardware (e.g., `runs-on: blacksmith-4vcpu-ubuntu-2204`). Learn more about the [different instances available to choose from](https://docs.blacksmith.sh/blacksmith-runners/config). 2. Your jobs running on Blacksmith will now have all official GitHub and popular third-party cache actions automatically interact with our 4x faster, colocated cache. Learn more about [Blacksmith's actions cache](https://docs.blacksmith.sh/blacksmith-caching/dependencies-actions). 3. Your GitHub Actions will now actually be observable. Learn more about Blacksmith's [logging](https://docs.blacksmith.sh/blacksmith-observability/logs) and other [observability](https://docs.blacksmith.sh/blacksmith-observability/dashboard) features. 4. Your Docker builds will now automatically share their Docker layer cache, resulting in up to 40x faster builds. Learn more about [Blacksmith's Docker layer caching](https://docs.blacksmith.sh/blacksmith-caching/docker-builds). ## FAQ - Is this free? The first 3,000 minutes per month are free. - Who uses Blacksmith? Clerk, Ashby, VEED, and 600+ others. - What's the catch? There is none. Merge this thing already. --------- Co-authored-by: blacksmith-sh[bot] <157653362+blacksmith-sh[bot]@users.noreply.github.com> Co-authored-by: mattthew <matthew.mcneely@gmail.com>
diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
@@ -0,0 +1,27 @@
+self-hosted-runner:
+  # Define custom labels for Blacksmith runners
+  # Ubuntu 24.04 x64 runners
+  labels:
+    - blacksmith-2vcpu-ubuntu-2404
+    - blacksmith-4vcpu-ubuntu-2404
+    - blacksmith-8vcpu-ubuntu-2404
+    - blacksmith-16vcpu-ubuntu-2404
+    - blacksmith-32vcpu-ubuntu-2404
+    # Ubuntu 24.04 ARM runners
+    - blacksmith-2vcpu-ubuntu-2404-arm
+    - blacksmith-4vcpu-ubuntu-2404-arm
+    - blacksmith-8vcpu-ubuntu-2404-arm
+    - blacksmith-16vcpu-ubuntu-2404-arm
+    - blacksmith-32vcpu-ubuntu-2404-arm
+    # Ubuntu 22.04 x64 runners
+    - blacksmith-2vcpu-ubuntu-2204
+    - blacksmith-4vcpu-ubuntu-2204
+    - blacksmith-8vcpu-ubuntu-2204
+    - blacksmith-16vcpu-ubuntu-2204
+    - blacksmith-32vcpu-ubuntu-2204
+    # Ubuntu 22.04 ARM runners
+    - blacksmith-2vcpu-ubuntu-2204-arm
+    - blacksmith-4vcpu-ubuntu-2204-arm
+    - blacksmith-8vcpu-ubuntu-2204-arm
+    - blacksmith-16vcpu-ubuntu-2204-arm
+    - blacksmith-32vcpu-ubuntu-2204-arm
diff --git a/.github/workflows/cd-dgraph-nightly.yml b/.github/workflows/cd-dgraph-nightly.yml
@@ -10,9 +10,10 @@ permissions:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
-      - uses: docker/setup-buildx-action@v3.11.1
+      - name: Setup Blacksmith Builder
+        uses: useblacksmith/setup-docker-builder@v1
 
       - name: Log in to GitHub Container Registry
         uses: docker/login-action@v3.5.0
@@ -22,7 +23,7 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v6.18.0
+        uses: useblacksmith/build-push-action@v2
         with:
           push: true
           platforms: linux/amd64,linux/arm64
diff --git a/.github/workflows/cd-dgraph.yml b/.github/workflows/cd-dgraph.yml
@@ -21,7 +21,7 @@ permissions:
 
 jobs:
   dgraph-build-amd64:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v5
@@ -222,7 +222,7 @@ jobs:
 
   graph-docker-image-and-manifests-push:
     needs: [dgraph-build-amd64, dgraph-build-arm64]
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v5
diff --git a/.github/workflows/ci-dgraph-core-tests.yml b/.github/workflows/ci-dgraph-core-tests.yml
@@ -26,7 +26,7 @@ permissions:
 jobs:
   dgraph-core-tests:
     if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@v5
diff --git a/.github/workflows/ci-dgraph-core-upgrade-tests.yml b/.github/workflows/ci-dgraph-core-upgrade-tests.yml
@@ -24,7 +24,7 @@ permissions:
 jobs:
   dgraph-upgrade-tests:
     if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@v5
diff --git a/.github/workflows/ci-dgraph-fuzz.yml b/.github/workflows/ci-dgraph-fuzz.yml
@@ -23,7 +23,7 @@ permissions:
 jobs:
   fuzz-test:
     if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v5
diff --git a/.github/workflows/ci-dgraph-integration2-tests.yml b/.github/workflows/ci-dgraph-integration2-tests.yml
@@ -24,7 +24,7 @@ permissions:
 jobs:
   dgraph-integration2-tests:
     if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 90
     steps:
       - uses: actions/checkout@v5
diff --git a/.github/workflows/ci-dgraph-jepsen-tests.yml b/.github/workflows/ci-dgraph-jepsen-tests.yml
@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   dgraph-jepsen-tests:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 60
     steps:
       - name: Checkout dgraph repo
diff --git a/.github/workflows/ci-dgraph-ldbc-tests.yml b/.github/workflows/ci-dgraph-ldbc-tests.yml
@@ -24,7 +24,7 @@ permissions:
 jobs:
   dgraph-ldbc-tests:
     if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 10
     steps:
       - name: Checkout Dgraph
diff --git a/.github/workflows/ci-dgraph-load-tests.yml b/.github/workflows/ci-dgraph-load-tests.yml
@@ -24,7 +24,7 @@ permissions:
 jobs:
   dgraph-load-tests:
     if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v5
diff --git a/.github/workflows/ci-dgraph-system-upgrade-tests-mt.yml b/.github/workflows/ci-dgraph-system-upgrade-tests-mt.yml
@@ -1,4 +1,4 @@
-name: ci-dgraph-system-upgrade-tests
+name: ci-dgraph-system-upgrade-tests-multi-tenancy
 
 on:
   pull_request:
@@ -24,7 +24,7 @@ permissions:
 jobs:
   dgraph-upgrade-tests:
     if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 90
     steps:
       - uses: actions/checkout@v5
@@ -50,8 +50,6 @@ jobs:
           cp dgraph/dgraph ~/go/bin/dgraph
           # run the sytem upgrade tests
           go test -v -timeout=120m -failfast -tags=upgrade \
-            github.com/hypermodeinc/dgraph/v25/systest/mutations-and-queries \
-            github.com/hypermodeinc/dgraph/v25/systest/plugin \
             github.com/hypermodeinc/dgraph/v25/systest/multi-tenancy
           # clean up docker containers after test execution
           go clean -testcache
diff --git a/.github/workflows/ci-dgraph-system-upgrade-tests-mutations-and-queries.yml b/.github/workflows/ci-dgraph-system-upgrade-tests-mutations-and-queries.yml
@@ -0,0 +1,57 @@
+name: ci-dgraph-system-upgrade-tests-mutations-and-queries
+
+on:
+  pull_request:
+    paths:
+      - "!**/*.md"
+      - "**/*.go"
+      - "**/go.mod"
+      - "**/*.yml"
+      - "**/Dockerfile"
+      - "**/Makefile"
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - ready_for_review
+    branches:
+      - main
+      - release/**
+
+permissions:
+  contents: read
+
+jobs:
+  dgraph-upgrade-tests:
+    if: github.event.pull_request.draft == false
+    runs-on: blacksmith-8vcpu-ubuntu-2404
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+      - name: Make Linux Build and Docker Image
+        run: make docker-image
+      - name: Clean Up Environment
+        run: |
+          #!/bin/bash
+          # clean cache
+          go clean -testcache
+      - name: Run System Upgrade Tests
+        run: |
+          #!/bin/bash
+          # go env settings
+          export GOPATH=~/go
+          # move the binary
+          cp dgraph/dgraph ~/go/bin/dgraph
+          # run the sytem upgrade tests
+          go test -v -timeout=120m -failfast -tags=upgrade \
+            github.com/hypermodeinc/dgraph/v25/systest/mutations-and-queries
+          # clean up docker containers after test execution
+          go clean -testcache
+          # sleep
+          sleep 5
diff --git a/.github/workflows/ci-dgraph-system-upgrade-tests-plugin.yml b/.github/workflows/ci-dgraph-system-upgrade-tests-plugin.yml
@@ -0,0 +1,57 @@
+name: ci-dgraph-system-upgrade-tests-plugin
+
+on:
+  pull_request:
+    paths:
+      - "!**/*.md"
+      - "**/*.go"
+      - "**/go.mod"
+      - "**/*.yml"
+      - "**/Dockerfile"
+      - "**/Makefile"
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - ready_for_review
+    branches:
+      - main
+      - release/**
+
+permissions:
+  contents: read
+
+jobs:
+  dgraph-upgrade-tests:
+    if: github.event.pull_request.draft == false
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+      - name: Make Linux Build and Docker Image
+        run: make docker-image
+      - name: Clean Up Environment
+        run: |
+          #!/bin/bash
+          # clean cache
+          go clean -testcache
+      - name: Run System Upgrade Tests
+        run: |
+          #!/bin/bash
+          # go env settings
+          export GOPATH=~/go
+          # move the binary
+          cp dgraph/dgraph ~/go/bin/dgraph
+          # run the sytem upgrade tests
+          go test -v -timeout=120m -failfast -tags=upgrade \
+            github.com/hypermodeinc/dgraph/v25/systest/plugin
+          # clean up docker containers after test execution
+          go clean -testcache
+          # sleep
+          sleep 5
diff --git a/.github/workflows/ci-dgraph-systest-tests.yml b/.github/workflows/ci-dgraph-systest-tests.yml
@@ -26,7 +26,7 @@ permissions:
 jobs:
   dgraph-systest-tests:
     if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@v5
@@ -63,6 +63,7 @@ jobs:
           #!/bin/bash
           # go env settings
           export GOPATH=~/go
+          export DEBUG_SHOW_ERROR=1
           # move the binary
           cp dgraph/dgraph ~/go/bin/dgraph
           # run the unit and systests
diff --git a/.github/workflows/ci-dgraph-upgrade-fixed-versions-tests.yml b/.github/workflows/ci-dgraph-upgrade-fixed-versions-tests.yml
@@ -9,7 +9,7 @@ permissions:
 
 jobs:
   dgraph-upgrade-fixed-versions-tests:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@v5
diff --git a/.github/workflows/ci-dgraph-vector-tests.yml b/.github/workflows/ci-dgraph-vector-tests.yml
@@ -26,7 +26,7 @@ permissions:
 jobs:
   dgraph-vector-tests:
     if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@v5
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -18,7 +18,7 @@ permissions:
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 360
     permissions:
       security-events: write
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
@@ -20,7 +20,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v5
       - uses: actions/labeler@v6
diff --git a/SECURITY.md b/SECURITY.md
@@ -5,6 +5,6 @@ vulnerability in Dgraph, we encourage you to let us know right away.
 
 We will investigate all legitimate reports and do our best to quickly fix the problem. Please report
 any issues or vulnerabilities via GitHub Security Advisories instead of posting a public issue in
-GitHub. You can also send security communications to security@hypermode.com.
+GitHub. You can also send security communications to dgraph-admin@istaridigital.com.
 
 Please include the version identifier and details on how the vulnerability can be exploited.
diff --git a/dgraphtest/image.go b/dgraphtest/image.go
@@ -21,6 +21,7 @@ import (
 
 var (
 	cloneOnce sync.Once
+	gitMutex  sync.Mutex // Protects git operations on shared repoDir
 )
 
 func (c *LocalCluster) dgraphImage() string {
@@ -49,7 +50,23 @@ func (c *LocalCluster) setupBinary() error {
 		return copyBinary(fromDir, c.tempBinDir, c.conf.version)
 	}
 
-	isFileThere, err := fileExists(filepath.Join(binariesPath, fmt.Sprintf(binaryNameFmt, c.conf.version)))
+	binaryPath := filepath.Join(binariesPath, fmt.Sprintf(binaryNameFmt, c.conf.version))
+
+	// First check without lock (fast path)
+	isFileThere, err := fileExists(binaryPath)
+	if err != nil {
+		return err
+	}
+	if isFileThere {
+		return copyBinary(binariesPath, c.tempBinDir, c.conf.version)
+	}
+
+	// Lock git operations to prevent parallel tests from conflicting
+	gitMutex.Lock()
+	defer gitMutex.Unlock()
+
+	// Double-check after acquiring lock - another parallel test may have built it
+	isFileThere, err = fileExists(binaryPath)
 	if err != nil {
 		return err
 	}
@@ -199,6 +216,16 @@ func copy(src, dst string) error {
 		return errors.Errorf("%s is not a regular file", src)
 	}
 
+	// Check if destination already exists and matches source size
+	if destStat, err := os.Stat(dst); err == nil {
+		if destStat.Size() == sourceFileStat.Size() {
+			log.Printf("[INFO] destination file %s already exists with matching size, skipping copy", dst)
+			return nil
+		}
+		log.Printf("[WARNING] destination file %s exists but size mismatch (source=%d, dest=%d), will overwrite",
+			dst, sourceFileStat.Size(), destStat.Size())
+	}
+
 	// Open source file
 	source, err := os.Open(src)
 	if err != nil {
diff --git a/systest/backup/common/utils.go b/systest/backup/common/utils.go
@@ -278,5 +278,8 @@ func CopyToLocalFsFromNFS(t *testing.T, backupDst string, copyBackupDirectory st
 	// "docker cp" to create a copy that is not owned by the root user.
 	require.NoError(t, os.RemoveAll(copyBackupDirectory))
 	srcPath := testutil.DockerPrefix + "_nfs_1:/data" + backupDst
-	require.NoError(t, testutil.DockerCp(srcPath, copyBackupDirectory))
+	if err := testutil.DockerCp(srcPath, copyBackupDirectory); err != nil {
+		t.Logf("DockerCp failed: src=%s dst=%s error=%v", srcPath, copyBackupDirectory, err)
+		require.NoError(t, err)
+	}
 }
diff --git a/systest/backup/nfs-backup/backup_test.go b/systest/backup/nfs-backup/backup_test.go
diff --git a/systest/backup/nfs-backup/docker-compose.yml b/systest/backup/nfs-backup/docker-compose.yml
diff --git a/testutil/testaudit/audit.go b/testutil/testaudit/audit.go
