Merge branch 'main' into unsafe_slice

Author: matthewmcneely

.github/workflows/cd-dgraph.yml

@@ -81,12 +81,6 @@ jobs:
             badger/badger-linux-amd64.tar.gz
             dgraph/dgraph-checksum-linux-amd64.sha256
             dgraph/dgraph-linux-amd64.tar.gz
-      - name: Move Badger Binary into Linux Directory
-        run: |
-          tar -xzf badger/badger-linux-amd64.tar.gz --directory badger
-          [ -d "linux" ] || mkdir linux
-          # linux directory will be added to docker image in build step
-          cp badger/badger-linux-amd64 linux/badger
       - name: Make Dgraph Docker Image
         run: |
           set -e
@@ -181,12 +175,6 @@ jobs:
             badger/badger-linux-arm64.tar.gz
             dgraph/dgraph-checksum-linux-arm64.sha256
             dgraph/dgraph-linux-arm64.tar.gz
-      - name: Move Badger Binary into Linux Directory
-        run: |
-          tar -xzf badger/badger-linux-arm64.tar.gz --directory badger
-          [ -d "linux" ] || mkdir linux
-          # linux directory will be added to docker image in build step
-          cp badger/badger-linux-arm64 linux/badger
       - name: Make Dgraph Docker Image
         run: |
           set -e

.github/workflows/ci-dgraph-nightly-cves.yml

@@ -0,0 +1,41 @@
+name: ci-dgraph-nightly-cves
+
+on:
+  schedule:
+    - cron: 0 0 * * * # Run daily at midnight UTC
+  workflow_dispatch: # Allow manual trigger
+
+permissions:
+  contents: read
+
+jobs:
+  cve-scan:
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 30
+    steps:
+      - name: Checkout main branch
+        uses: actions/checkout@v5
+        with:
+          ref: main
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+
+      - name: Build Dgraph
+        run: make dgraph
+
+      - name: Build Docker image
+        run: |
+          mkdir -p linux
+          cp ./dgraph/dgraph ./linux/dgraph
+          docker build -f contrib/Dockerfile -t dgraph/dgraph:nightly-scan .
+
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: dgraph/dgraph:nightly-scan
+          format: table
+          exit-code: 1
+          severity: CRITICAL,HIGH

.gitignore

@@ -48,3 +48,5 @@ x/log_test/*.enc
 *.buf
 .osgrep
 .worktrees/
+AGENTS.md
+CLAUDE.md

CONTRIBUTING.md

@@ -40,7 +40,8 @@
 ```bash
 git clone https://github.com/dgraph-io/dgraph.git
 cd ./dgraph
-make install
+make setup    # auto-install tool dependencies (gotestsum, ack, etc.)
+make install  # build and install the dgraph binary
 ```
 
 This will put the source code in a Git repo under `$GOPATH/src/github.com/dgraph-io/dgraph` and
@@ -144,16 +145,26 @@ directory, providing control and flexibility beyond the standard Go testing fram
 The simplest way to run tests is via Make:
 
 ```bash
-# Run all tests
+# First-time setup: install tool dependencies
+make setup
+
+# Run default tests (~30 min): integration suite + integration2
 make test
 
+# Run every test in the repo
+make test-all
+
 # Run specific test types
-make test-unit          # Unit tests only (no Docker)
-make test-integration2  # Integration2 tests via dgraphtest
-make test-upgrade       # Upgrade tests
+make test-unit               # True unit tests only — no Docker, no build tags
+make test-integration        # Integration tests via t/ runner with Docker
+make test-integration-heavy  # All heavy tests: systest-heavy + ldbc + load
+make test-integration2       # Integration2 tests via dgraphtest
+make test-upgrade            # Upgrade tests
 
 # Use variables for more control
 make test TAGS=integration2 PKG=systest/vector
+make test SUITE=all            # All t/ runner suites
+make test TIMEOUT=90m          # Override per-package timeout (default: 30m)
 ```
 
 Run `make help` to see all available targets and variables.

Makefile

@@ -18,11 +18,20 @@ ifeq ($(GOPATH),)
     $(error GOPATH is not set. Please set it explicitly, e.g. export GOPATH=$$HOME/go)
 endif
 
-# On non-Linux systems, use a separate directory for Linux binaries
+# On non-Linux systems, use a separate directory for Linux binaries and
+# a cross-compiler so that CGO is available (required for plugin support).
 ifeq ($(GOHOSTOS),linux)
     export LINUX_GOBIN ?= $(GOPATH)/bin
+    LINUX_CC          ?= gcc
 else
     export LINUX_GOBIN ?= $(GOPATH)/linux_$(GOHOSTARCH)
+    ifeq ($(GOHOSTARCH),arm64)
+        LINUX_CC ?= aarch64-unknown-linux-gnu-gcc
+    else ifeq ($(GOHOSTARCH),amd64)
+        LINUX_CC ?= x86_64-unknown-linux-gnu-gcc
+    else
+        LINUX_CC ?= gcc
+    endif
 endif
 
 ######################
@@ -60,7 +69,7 @@ install: ## Install dgraph binary
 ifneq ($(GOHOSTOS),linux)
 	@mkdir -p $(LINUX_GOBIN)
 	@echo "Installing dgraph (linux/$(GOHOSTARCH))..."
-	@GOOS=linux GOARCH=$(GOHOSTARCH) $(MAKE) -C dgraph dgraph
+	@GOOS=linux GOARCH=$(GOHOSTARCH) CGO_ENABLED=1 CC=$(LINUX_CC) $(MAKE) -C dgraph BUILD_TAGS= EXTLDFLAGS=-fuse-ld=bfd dgraph
 	@mv dgraph/dgraph $(LINUX_GOBIN)/dgraph
 	@echo "Installed dgraph (linux/$(GOHOSTARCH)) to $(LINUX_GOBIN)/dgraph"
 endif
@@ -73,13 +82,18 @@ uninstall: ## Uninstall dgraph binary
 
 .PHONY: dgraph-installed
 dgraph-installed:
-	@if [ ! -f "$(GOPATH)/bin/dgraph" ] || [ ! -f "$(LINUX_GOBIN)/dgraph" ]; then \
-		echo "Dgraph binary missing, running make install..."; \
-		$(MAKE) install; \
-	fi
+	$(MAKE) install
+
+.PHONY: check-deps
+check-deps: ## Check test dependencies (pass AUTO_INSTALL=true to auto-install missing ones)
+	$(MAKE) -C t check-deps
+
+.PHONY: setup
+setup: ## Install all test dependencies automatically
+	$(MAKE) check-deps AUTO_INSTALL=true
 
 .PHONY: test
-test: dgraph-installed local-image ## Run tests (see 'make help' for options)
+test: check-deps dgraph-installed local-image ## Run tests (default: integration + integration2)
 ifdef TAGS
 	@echo "Running tests with tags: $(TAGS)"
 	go test -v --tags="$(TAGS)" \
@@ -97,62 +111,83 @@ else
 		done
 endif
 else
-	@echo "Running test suite: $(or $(SUITE),all)"
-	$(MAKE) -C t test args="--suite=$(or $(SUITE),all) $(if $(PKG),--pkg=\"$(PKG)\") $(if $(TEST),--test=\"$(TEST)\")"
+ifdef SUITE
+	@echo "Running test suite: $(SUITE)"
+	$(MAKE) -C t test args="--suite=$(SUITE) $(if $(PKG),--pkg=\"$(PKG)\") $(if $(TEST),--test=\"$(TEST)\") $(if $(TIMEOUT),--timeout=$(TIMEOUT))"
+else
+	@echo "Running test suite: integration"
+	$(MAKE) -C t test args="--suite=integration $(if $(PKG),--pkg=\"$(PKG)\") $(if $(TEST),--test=\"$(TEST)\") $(if $(TIMEOUT),--timeout=$(TIMEOUT))"
+	@echo "Running integration2 tests..."
+	go test -v --tags="integration2" \
+		$(if $(TEST),--run="$(TEST)") \
+		$(if $(PKG),./$(PKG)/...,./...)
+endif
 endif
-
-.PHONY: test-all
-test-all: ## All test suites via t/ runner (i.e. 'make test SUITE=all')
-	@SUITE=all $(MAKE) test
 
 .PHONY: test-unit
-test-unit: ## Unit tests, no Docker (i.e. 'make test SUITE=unit')
+test-unit: ## True unit tests only — no Docker, no integration build tag (i.e. 'make test SUITE=unit')
+	$(if $(filter command line,$(origin SUITE)),$(error SUITE= cannot be passed to test-unit; use 'make test SUITE=...' instead))
 	@SUITE=unit $(MAKE) test
 
+.PHONY: test-integration
+test-integration: ## Integration tests via t/ runner with Docker (i.e. 'make test SUITE=integration')
+	$(if $(filter command line,$(origin SUITE)),$(error SUITE= cannot be passed to test-integration; use 'make test SUITE=...' instead))
+	@SUITE=integration $(MAKE) test
+
 .PHONY: test-core
 test-core: ## Core tests (i.e. 'make test SUITE=core')
+	$(if $(filter command line,$(origin SUITE)),$(error SUITE= cannot be passed to test-core; use 'make test SUITE=...' instead))
 	@SUITE=core $(MAKE) test
 
-.PHONY: test-integration
-test-integration: ## Integration tests (i.e. 'make test TAGS=integration')
-	@TAGS=integration $(MAKE) test
-
 .PHONY: test-integration2
 test-integration2: ## Integration2 tests via dgraphtest (i.e. 'make test TAGS=integration2')
+	$(if $(filter command line,$(origin TAGS)),$(error TAGS= cannot be passed to test-integration2; use 'make test TAGS=...' instead))
 	@TAGS=integration2 $(MAKE) test
 
 .PHONY: test-upgrade
 test-upgrade: ## Upgrade tests (i.e. 'make test TAGS=upgrade')
+	$(if $(filter command line,$(origin TAGS)),$(error TAGS= cannot be passed to test-upgrade; use 'make test TAGS=...' instead))
 	@TAGS=upgrade $(MAKE) test
 
 .PHONY: test-systest
-test-systest: ## System integration tests (i.e. 'make test SUITE=systest')
+test-systest: ## All systest packages: systest-baseline + systest-heavy (i.e. 'make test SUITE=systest')
+	$(if $(filter command line,$(origin SUITE)),$(error SUITE= cannot be passed to test-systest; use 'make test SUITE=...' instead))
 	@SUITE=systest $(MAKE) test
 
+.PHONY: test-integration-heavy
+test-integration-heavy: ## All heavy tests: systest-heavy + ldbc + load
+	$(if $(filter command line,$(origin SUITE)),$(error SUITE= cannot be passed to test-integration-heavy; use 'make test SUITE=...' instead))
+	@SUITE=systest-heavy,ldbc,load $(MAKE) test
+
 .PHONY: test-vector
 test-vector: ## Vector search tests (i.e. 'make test SUITE=vector')
+	$(if $(filter command line,$(origin SUITE)),$(error SUITE= cannot be passed to test-vector; use 'make test SUITE=...' instead))
 	@SUITE=vector $(MAKE) test
 
 .PHONY: test-fuzz
-test-fuzz: ## Fuzz tests, auto-discovers packages (i.e. 'make test FUZZ=1')
+test-fuzz: ## Fuzz tests (i.e. 'make test FUZZ=1')
+	$(if $(filter command line,$(origin FUZZ)),$(error FUZZ= cannot be passed to test-fuzz; use 'make test FUZZ=...' instead))
 	@FUZZ=1 $(MAKE) test
 
-.PHONY: test-ldbc
-test-ldbc: ## LDBC benchmark tests (i.e. 'make test SUITE=ldbc')
-	@SUITE=ldbc $(MAKE) test
-
-.PHONY: test-load
-test-load: ## Heavy load tests (i.e. 'make test SUITE=load')
-	@SUITE=load $(MAKE) test
+.PHONY: test-all
+test-all: ## Every test: all t/ suites + integration2 + upgrade + fuzz
+	$(MAKE) test SUITE=all
+	$(MAKE) test-integration2
+	$(MAKE) test-upgrade
+	$(MAKE) test-fuzz
 
 .PHONY: test-benchmark
-test-benchmark: ## Go benchmarks (i.e. 'go test -bench')
+test-benchmark: check-deps ## Go benchmarks (i.e. 'go test -bench')
 	go test -bench=. -benchmem $(if $(PKG),./$(PKG)/...,./...)
 
 .PHONY: local-image
 local-image: ## Build local Docker image (dgraph/dgraph:local)
 	@echo building local docker image
-	@GOOS=linux GOARCH=amd64 $(MAKE) dgraph
+ifneq ($(GOHOSTOS),linux)
+	@GOOS=linux GOARCH=$(GOHOSTARCH) CGO_ENABLED=1 CC=$(LINUX_CC) $(MAKE) BUILD_TAGS= EXTLDFLAGS=-fuse-ld=bfd dgraph
+else
+	@GOOS=linux GOARCH=$(GOHOSTARCH) $(MAKE) dgraph
+endif
 	@mkdir -p linux
 	@mv ./dgraph/dgraph ./linux/dgraph
 	@docker build -f contrib/Dockerfile -t dgraph/dgraph:local .
@@ -161,6 +196,13 @@ local-image: ## Build local Docker image (dgraph/dgraph:local)
 .PHONY: image-local
 image-local: local-image ## Alias for local-image
 
+.PHONY: clean
+clean: ## Clean build artifacts
+	$(MAKE) -C dgraph clean
+	$(MAKE) -C compose clean
+	@rm -rf linux
+	@go clean -testcache
+
 .PHONY: docker-image
 docker-image: dgraph ## Build Docker image (dgraph/dgraph:$VERSION)
 	@mkdir -p linux
@@ -201,10 +243,11 @@ help: ## Show available targets and variables
 		awk 'BEGIN {FS = ":.*?## "}; {printf "  %-20s %s\n", $$1, $$2}'
 	@echo ""
 	@echo "Variables that can be passed to 'test':"
-	@echo "  SUITE     Select t/ runner suite (e.g., make test SUITE=systest)"
+	@echo "  SUITE     Select t/ runner suite (default: integration + integration2)"
 	@echo "  TAGS      Go build tags - bypasses t/ runner (e.g., make test TAGS=integration2)"
 	@echo "  PKG       Limit to specific package (e.g., make test PKG=systest/export)"
 	@echo "  TEST      Run specific test function (e.g., make test TEST=TestGQLSchema)"
+	@echo "  TIMEOUT   Per-package test timeout (e.g., make test TIMEOUT=60m). Default: 30m"
 	@echo "  FUZZ      Enable fuzz testing (e.g., make test FUZZ=1)"
 	@echo "  FUZZTIME  Fuzz duration per package (e.g., make test FUZZ=1 FUZZTIME=60s)"
 	@echo ""
@@ -215,12 +258,14 @@ help: ## Show available targets and variables
 	@printf "  Available TAGS values:  "
 	@grep -roh "//go:build [a-z0-9]*" --include="*_test.go" . 2>/dev/null | \
 		awk '{print $$2}' | \
-		grep -E '^(integration|integration2|upgrade)$$' | \
+		grep -E '^(integration2|upgrade)$$' | \
 		sort -u | tr '\n' ' ' && echo ""
+	@echo "  Note: 'integration' tests require the t/ runner (use SUITE=, not TAGS=)"
 	@echo ""
 	@echo "Examples:"
 	@echo "  make test TAGS=integration2 PKG=systest/vector        # integration2 tests for vector"
 	@echo "  make test TAGS=upgrade PKG=acl TEST=TestACL           # specific upgrade test"
 	@echo "  make test FUZZ=1 PKG=dql FUZZTIME=30s                 # fuzz dql package for 30s"
 	@echo "  make test SUITE=systest PKG=systest/backup/filesystem # systest for backup pkg"
+	@echo "  make test TIMEOUT=90m                                  # all suites with 90m timeout"
 	@echo "  make test-benchmark PKG=posting                       # benchmark posting package"