.github/workflows: Migrate workflows to Blacksmith runners

.github/actionlint.yaml

@@ -0,0 +1,27 @@
+self-hosted-runner:
+  # Define custom labels for Blacksmith runners
+  # Ubuntu 24.04 x64 runners
+  labels:
+    - blacksmith-2vcpu-ubuntu-2404
+    - blacksmith-4vcpu-ubuntu-2404
+    - blacksmith-8vcpu-ubuntu-2404
+    - blacksmith-16vcpu-ubuntu-2404
+    - blacksmith-32vcpu-ubuntu-2404
+    # Ubuntu 24.04 ARM runners
+    - blacksmith-2vcpu-ubuntu-2404-arm
+    - blacksmith-4vcpu-ubuntu-2404-arm
+    - blacksmith-8vcpu-ubuntu-2404-arm
+    - blacksmith-16vcpu-ubuntu-2404-arm
+    - blacksmith-32vcpu-ubuntu-2404-arm
+    # Ubuntu 22.04 x64 runners
+    - blacksmith-2vcpu-ubuntu-2204
+    - blacksmith-4vcpu-ubuntu-2204
+    - blacksmith-8vcpu-ubuntu-2204
+    - blacksmith-16vcpu-ubuntu-2204
+    - blacksmith-32vcpu-ubuntu-2204
+    # Ubuntu 22.04 ARM runners
+    - blacksmith-2vcpu-ubuntu-2204-arm
+    - blacksmith-4vcpu-ubuntu-2204-arm
+    - blacksmith-8vcpu-ubuntu-2204-arm
+    - blacksmith-16vcpu-ubuntu-2204-arm
+    - blacksmith-32vcpu-ubuntu-2204-arm

.github/workflows/cd-dgraph-nightly.yml

@@ -10,9 +10,10 @@ permissions:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
-      - uses: docker/[email protected]
+      - name: Setup Blacksmith Builder
+        uses: useblacksmith/setup-docker-builder@v1
 
       - name: Log in to GitHub Container Registry
         uses: docker/[email protected]
@@ -22,7 +23,7 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v6.18.0
+        uses: useblacksmith/build-push-action@v2
         with:
           push: true
           platforms: linux/amd64,linux/arm64

.github/workflows/cd-dgraph.yml

@@ -21,7 +21,7 @@ permissions:
 
 jobs:
   dgraph-build-amd64:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v5
@@ -222,7 +222,7 @@ jobs:
 
   graph-docker-image-and-manifests-push:
     needs: [dgraph-build-amd64, dgraph-build-arm64]
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v5

.github/workflows/ci-dgraph-core-tests.yml

@@ -26,7 +26,7 @@ permissions:
 jobs:
   dgraph-core-tests:
     if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@v5

.github/workflows/ci-dgraph-core-upgrade-tests.yml

@@ -24,7 +24,7 @@ permissions:
 jobs:
   dgraph-upgrade-tests:
     if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@v5

.github/workflows/ci-dgraph-fuzz.yml

@@ -23,7 +23,7 @@ permissions:
 jobs:
   fuzz-test:
     if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v5

.github/workflows/ci-dgraph-integration2-tests.yml

@@ -24,7 +24,7 @@ permissions:
 jobs:
   dgraph-integration2-tests:
     if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 90
     steps:
       - uses: actions/checkout@v5

.github/workflows/ci-dgraph-jepsen-tests.yml

@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   dgraph-jepsen-tests:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 60
     steps:
       - name: Checkout dgraph repo

.github/workflows/ci-dgraph-ldbc-tests.yml

@@ -24,7 +24,7 @@ permissions:
 jobs:
   dgraph-ldbc-tests:
     if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 10
     steps:
       - name: Checkout Dgraph

.github/workflows/ci-dgraph-load-tests.yml

@@ -24,7 +24,7 @@ permissions:
 jobs:
   dgraph-load-tests:
     if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v5

.github/workflows/ci-dgraph-system-upgrade-tests.yml → .github/workflows/ci-dgraph-system-upgrade-tests-mt.yml

@@ -1,4 +1,4 @@
-name: ci-dgraph-system-upgrade-tests
+name: ci-dgraph-system-upgrade-tests-multi-tenancy
 
 on:
   pull_request:
@@ -24,7 +24,7 @@ permissions:
 jobs:
   dgraph-upgrade-tests:
     if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 90
     steps:
       - uses: actions/checkout@v5
@@ -50,8 +50,6 @@ jobs:
           cp dgraph/dgraph ~/go/bin/dgraph
           # run the sytem upgrade tests
           go test -v -timeout=120m -failfast -tags=upgrade \
-            github.com/hypermodeinc/dgraph/v25/systest/mutations-and-queries \
-            github.com/hypermodeinc/dgraph/v25/systest/plugin \
             github.com/hypermodeinc/dgraph/v25/systest/multi-tenancy
           # clean up docker containers after test execution
           go clean -testcache

.github/workflows/ci-dgraph-system-upgrade-tests-mutations-and-queries.yml

@@ -0,0 +1,57 @@
+name: ci-dgraph-system-upgrade-tests-mutations-and-queries
+
+on:
+  pull_request:
+    paths:
+      - "!**/*.md"
+      - "**/*.go"
+      - "**/go.mod"
+      - "**/*.yml"
+      - "**/Dockerfile"
+      - "**/Makefile"
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - ready_for_review
+    branches:
+      - main
+      - release/**
+
+permissions:
+  contents: read
+
+jobs:
+  dgraph-upgrade-tests:
+    if: github.event.pull_request.draft == false
+    runs-on: blacksmith-8vcpu-ubuntu-2404
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+      - name: Make Linux Build and Docker Image
+        run: make docker-image
+      - name: Clean Up Environment
+        run: |
+          #!/bin/bash
+          # clean cache
+          go clean -testcache
+      - name: Run System Upgrade Tests
+        run: |
+          #!/bin/bash
+          # go env settings
+          export GOPATH=~/go
+          # move the binary
+          cp dgraph/dgraph ~/go/bin/dgraph
+          # run the sytem upgrade tests
+          go test -v -timeout=120m -failfast -tags=upgrade \
+            github.com/hypermodeinc/dgraph/v25/systest/mutations-and-queries
+          # clean up docker containers after test execution
+          go clean -testcache
+          # sleep
+          sleep 5

.github/workflows/ci-dgraph-system-upgrade-tests-plugin.yml

@@ -0,0 +1,57 @@
+name: ci-dgraph-system-upgrade-tests-plugin
+
+on:
+  pull_request:
+    paths:
+      - "!**/*.md"
+      - "**/*.go"
+      - "**/go.mod"
+      - "**/*.yml"
+      - "**/Dockerfile"
+      - "**/Makefile"
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - ready_for_review
+    branches:
+      - main
+      - release/**
+
+permissions:
+  contents: read
+
+jobs:
+  dgraph-upgrade-tests:
+    if: github.event.pull_request.draft == false
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+      - name: Make Linux Build and Docker Image
+        run: make docker-image
+      - name: Clean Up Environment
+        run: |
+          #!/bin/bash
+          # clean cache
+          go clean -testcache
+      - name: Run System Upgrade Tests
+        run: |
+          #!/bin/bash
+          # go env settings
+          export GOPATH=~/go
+          # move the binary
+          cp dgraph/dgraph ~/go/bin/dgraph
+          # run the sytem upgrade tests
+          go test -v -timeout=120m -failfast -tags=upgrade \
+            github.com/hypermodeinc/dgraph/v25/systest/plugin
+          # clean up docker containers after test execution
+          go clean -testcache
+          # sleep
+          sleep 5

.github/workflows/ci-dgraph-systest-tests.yml

@@ -26,7 +26,7 @@ permissions:
 jobs:
   dgraph-systest-tests:
     if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@v5
@@ -63,6 +63,7 @@ jobs:
           #!/bin/bash
           # go env settings
           export GOPATH=~/go
+          export DEBUG_SHOW_ERROR=1
           # move the binary
           cp dgraph/dgraph ~/go/bin/dgraph
           # run the unit and systests

.github/workflows/ci-dgraph-upgrade-fixed-versions-tests.yml

@@ -9,7 +9,7 @@ permissions:
 
 jobs:
   dgraph-upgrade-fixed-versions-tests:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@v5

.github/workflows/ci-dgraph-vector-tests.yml

@@ -26,7 +26,7 @@ permissions:
 jobs:
   dgraph-vector-tests:
     if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@v5

.github/workflows/codeql.yml

@@ -18,7 +18,7 @@ permissions:
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 360
     permissions:
       security-events: write

.github/workflows/labeler.yml

@@ -20,7 +20,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v5
       - uses: actions/labeler@v6

SECURITY.md

@@ -5,6 +5,6 @@ vulnerability in Dgraph, we encourage you to let us know right away.
 
 We will investigate all legitimate reports and do our best to quickly fix the problem. Please report
 any issues or vulnerabilities via GitHub Security Advisories instead of posting a public issue in
-GitHub. You can also send security communications to security@hypermode.com.
+GitHub. You can also send security communications to dgraph-admin@istaridigital.com.
 
 Please include the version identifier and details on how the vulnerability can be exploited.

dgraphtest/image.go

@@ -21,6 +21,7 @@ import (
 
 var (
 	cloneOnce sync.Once
+	gitMutex  sync.Mutex // Protects git operations on shared repoDir
 )
 
 func (c *LocalCluster) dgraphImage() string {
@@ -49,7 +50,23 @@ func (c *LocalCluster) setupBinary() error {
 		return copyBinary(fromDir, c.tempBinDir, c.conf.version)
 	}
 
-	isFileThere, err := fileExists(filepath.Join(binariesPath, fmt.Sprintf(binaryNameFmt, c.conf.version)))
+	binaryPath := filepath.Join(binariesPath, fmt.Sprintf(binaryNameFmt, c.conf.version))
+
+	// First check without lock (fast path)
+	isFileThere, err := fileExists(binaryPath)
+	if err != nil {
+		return err
+	}
+	if isFileThere {
+		return copyBinary(binariesPath, c.tempBinDir, c.conf.version)
+	}
+
+	// Lock git operations to prevent parallel tests from conflicting
+	gitMutex.Lock()
+	defer gitMutex.Unlock()
+
+	// Double-check after acquiring lock - another parallel test may have built it
+	isFileThere, err = fileExists(binaryPath)
 	if err != nil {
 		return err
 	}
@@ -199,6 +216,16 @@ func copy(src, dst string) error {
 		return errors.Errorf("%s is not a regular file", src)
 	}
 
+	// Check if destination already exists and matches source size
+	if destStat, err := os.Stat(dst); err == nil {
+		if destStat.Size() == sourceFileStat.Size() {
+			log.Printf("[INFO] destination file %s already exists with matching size, skipping copy", dst)
+			return nil
+		}
+		log.Printf("[WARNING] destination file %s exists but size mismatch (source=%d, dest=%d), will overwrite",
+			dst, sourceFileStat.Size(), destStat.Size())
+	}
+
 	// Open source file
 	source, err := os.Open(src)
 	if err != nil {

systest/backup/common/utils.go

@@ -278,5 +278,8 @@ func CopyToLocalFsFromNFS(t *testing.T, backupDst string, copyBackupDirectory st
 	// "docker cp" to create a copy that is not owned by the root user.
 	require.NoError(t, os.RemoveAll(copyBackupDirectory))
 	srcPath := testutil.DockerPrefix + "_nfs_1:/data" + backupDst
-	require.NoError(t, testutil.DockerCp(srcPath, copyBackupDirectory))
+	if err := testutil.DockerCp(srcPath, copyBackupDirectory); err != nil {
+		t.Logf("DockerCp failed: src=%s dst=%s error=%v", srcPath, copyBackupDirectory, err)
+		require.NoError(t, err)
+	}
 }