temp disable locking

.codespellrc

@@ -1,23 +0,0 @@
-[codespell]
-# Ref: https://github.com/codespell-project/codespell#using-a-config-file
-skip = .git,.git-meta,.gitignore,.gitattributes,*.svg,go.sum,vendor,*.lock,*.css,*.min.*,.codespellrc,*_templ.go
-check-hidden = true
-# Ignore camelCase and PascalCase identifiers (very common in Go/Rust/JS
-# source, e.g. allLocations, publishErr, ReadInside, FlushInterval).
-ignore-regex = \b[a-z]+[A-Z]\w*\b|\b[A-Z][a-z]+[A-Z]\w*\b
-# visibles: variable name for VisibleInterval collections in filer/mount code
-# fo: `*FilerOptions` receiver name (e.g. `func (fo *FilerOptions) ...`)
-# te: "truncate error" local variable (e.g. `if te := w.Truncate(end); te != nil`)
-# ser: Rust serde serializer variable (`serde_json::ser`, `let mut ser = ...`)
-# bject: intentional wildcard test data (e.g. `s3:Get?bject` matching `s3:GetObject`)
-# unparseable: accepted alternate spelling used throughout the codebase
-# keep-alives: correct plural of the technical term (SSH/HTTP keep-alive)
-# tread: valid English word in the idiom "tread carefully" (help text)
-# anc: variable abbreviation for "ancestor" in tree/path tests
-# ue: appears inside JSON test fixtures with embedded escaped quotes (Bl\"ue)
-# auther: local variable meaning "authenticator" (tls.go: `auther := Authenticator{}`)
-# thirdparty: literal Maven groupId `org.apache.hadoop.thirdparty` (external, cannot rename)
-# unknwon: GitHub username / Go module path (`github.com/unknwon/goconfig`)
-# atleast: CLI mode literal string in test/benchmark/fuse_db/bin/sqlite_verify.py
-# sme: local variable for a *streamMutateError in mount tests
-ignore-words-list = visibles,fo,te,ser,bject,unparseable,keep-alives,tread,anc,ue,auther,thirdparty,unknwon,atleast,sme

.github/actions/fix-fusermount-setuid/action.yml

@@ -1,66 +0,0 @@
-name: Fix fusermount3 setuid
-description: >
-  Make sure the fusermount3 an unprivileged mount will find can actually mount.
-  Some runner images carry a second, source-built fusermount3 in /usr/local/bin
-  that shadows the distro one in PATH; it is neither setuid nor root-owned, so
-  every mount fails with "mount failed: Operation not permitted". Both the Go
-  mount and sw-fuse resolve the helper through PATH.
-  Run it after the step that apt-installs fuse3.
-
-runs:
-  using: composite
-  steps:
-    - name: Point PATH at a fusermount3 that can mount
-      shell: bash
-      run: |
-        set -euo pipefail
-
-        # setuid only grants root when root owns the file, and exec follows
-        # symlinks, so judge the target.
-        can_mount() {
-          [ -u "$1" ] && [ "$(stat -Lc %u "$1")" = 0 ]
-        }
-
-        bin=$(command -v fusermount3 || true)
-        if [ -z "$bin" ]; then
-          echo "no fusermount3 in PATH" >&2
-          exit 1
-        fi
-        if can_mount "$bin"; then
-          ls -l "$bin"
-          exit 0
-        fi
-        echo "$bin cannot mount unprivileged:"
-        ls -l "$bin"
-
-        # The distro fusermount3 is setuid root and is the one meant to be used.
-        # Reach it through a symlink earlier in PATH: exec resolves the link, so
-        # the target keeps its setuid bit, and nothing on the image is modified.
-        for distro in /usr/bin/fusermount3 /bin/fusermount3; do
-          if [ "$distro" != "$bin" ] && can_mount "$distro"; then
-            mkdir -p "$RUNNER_TEMP/fuse-bin"
-            ln -sf "$distro" "$RUNNER_TEMP/fuse-bin/fusermount3"
-            echo "$RUNNER_TEMP/fuse-bin" >> "$GITHUB_PATH"
-            echo "using $distro instead"
-            ls -l "$distro"
-            exit 0
-          fi
-        done
-
-        # No usable distro binary, so setting the bit is the only way out - but
-        # the target came from PATH: do that only for a root-owned system binary,
-        # never for anything else that happens to sit there.
-        case "$bin" in
-          /bin/*|/sbin/*|/usr/bin/*|/usr/sbin/*|/usr/local/bin/*|/usr/local/sbin/*) ;;
-          *) echo "refusing to setuid $bin: outside the system bin paths" >&2; exit 1 ;;
-        esac
-        if [ -L "$bin" ] || [ ! -f "$bin" ] || [ ! -x "$bin" ]; then
-          echo "refusing to setuid $bin: not a regular executable file" >&2
-          exit 1
-        fi
-        if [ "$(stat -c %u "$bin")" != 0 ] || [ "$(stat -c %g "$bin")" != 0 ]; then
-          echo "refusing to setuid $bin: not owned by root:root" >&2
-          exit 1
-        fi
-        sudo chmod u+s "$bin"
-        ls -l "$bin"

.github/actions/sign-image/action.yml

@@ -1,44 +0,0 @@
-name: Sign container images
-description: >
-  Keyless cosign signature on each image, then a verification pass against the
-  identity the signature should carry, so a misconfigured job fails here and not
-  on someone's cluster. That identity is the calling workflow's own,
-  https://github.com/<owner>/<repo>/.github/workflows/<file>@<ref>.
-  The calling job needs `id-token: write` and a registry login for every image.
-
-inputs:
-  images:
-    description: Image references by digest (name@sha256:...), whitespace separated.
-    required: true
-
-runs:
-  using: composite
-  steps:
-    - name: Install cosign
-      uses: sigstore/cosign-installer@v4.1.2
-
-    - name: Sign
-      shell: bash
-      env:
-        IMAGES: ${{ inputs.images }}
-      run: |
-        set -euo pipefail
-        # The .sig tag layout: the OCI-referrer bundle cosign 3 writes by default
-        # is not read by the Kyverno and policy-controller releases in use today.
-        # Cosign 3 also defaults to --use-signing-config, which insists on a
-        # bundle for its output; turning it off falls back to the default
-        # Fulcio and Rekor URLs, which is all the .sig layout ever used.
-        cosign sign --yes --recursive \
-          --new-bundle-format=false --use-signing-config=false \
-          $IMAGES
-
-    - name: Verify
-      shell: bash
-      env:
-        IMAGES: ${{ inputs.images }}
-      run: |
-        set -euo pipefail
-        cosign verify \
-          --certificate-oidc-issuer https://token.actions.githubusercontent.com \
-          --certificate-identity "https://github.com/$GITHUB_WORKFLOW_REF" \
-          $IMAGES

.github/dependabot.yml

@@ -1,9 +1,7 @@
 version: 2
 updates:
 - package-ecosystem: "github-actions"
-  directories:
-    - "/"
-    - "/.github/actions/sign-image"
+  directory: "/"
   schedule:
       interval: "weekly"
 - package-ecosystem: gomod

.github/pull_request_template.md

@@ -5,6 +5,7 @@
 # How are we solving the problem?
 
 
+
 # How is the PR tested?
 
 
@@ -12,8 +13,3 @@
 # Checks
 - [ ] I have added unit tests if possible.
 - [ ] I will add related wiki document changes and link to this PR after merging.
-- [ ] All AI code review comments have been addressed. No more comments to fix if reviewed again. Reviewer may request additional gemini and copilot reviews.
-
-# Checks for AI generated PRs
-- [ ] I have reviewed every line of code.
-- [ ] The PR is kept as minimum as possible. Large PRs would not be accepted.

.github/scripts/star_history.py

@@ -1,87 +0,0 @@
-#!/usr/bin/env python3
-"""Render the repository's star history to note/star_history.svg.
-
-Uses the GitHub REST stargazers endpoint with the starred-at accept header,
-which caps at 40,000 entries (400 pages of 100). The chart is regenerated on
-a schedule; if the repo grows past that cap the script stops at 40,000 and
-logs a warning rather than under-reporting.
-"""
-import json
-import os
-import sys
-import urllib.request
-from datetime import datetime
-
-import matplotlib
-
-matplotlib.use("Agg")
-import matplotlib.pyplot as plt  # noqa: E402
-from matplotlib.dates import AutoDateLocator, DateFormatter  # noqa: E402
-
-REPO = "seaweedfs/seaweedfs"
-TOKEN = os.environ["GITHUB_TOKEN"]
-OUT = os.environ.get("OUT", "note/star_history.svg")
-PAGE_CAP = 400  # GitHub's hard limit on stargazer pagination
-
-
-def fetch_stargazers():
-    stars = []
-    page = 1
-    while page <= PAGE_CAP:
-        url = f"https://api.github.com/repos/{REPO}/stargazers?per_page=100&page={page}"
-        req = urllib.request.Request(
-            url,
-            headers={
-                "Accept": "application/vnd.github.star+json",
-                "Authorization": f"Bearer {TOKEN}",
-                "X-GitHub-Api-Version": "2022-11-28",
-                "User-Agent": "seaweedfs-star-history",
-            },
-        )
-        with urllib.request.urlopen(req) as resp:
-            batch = json.load(resp)
-        if not batch:
-            break
-        for u in batch:
-            sa = u.get("starred_at")
-            if sa:
-                stars.append(datetime.fromisoformat(sa.replace("Z", "+00:00")))
-        if len(batch) < 100:
-            break
-        page += 1
-    if page > PAGE_CAP:
-        print(
-            f"::warning::Hit the {PAGE_CAP}-page stargazer pagination cap; "
-            "chart reflects the first 40,000 stars only."
-        )
-    return stars
-
-
-def render(stars, out):
-    stars.sort()
-    counts = list(range(1, len(stars) + 1))
-    fig, ax = plt.subplots(figsize=(10, 6), dpi=130)
-    ax.plot(stars, counts, color="#0969da", linewidth=1.6)
-    ax.set_xlabel("Date")
-    ax.set_ylabel("Stars")
-    ax.set_title(f"{REPO} star history")
-    ax.grid(True, linestyle="--", alpha=0.3)
-    ax.xaxis.set_major_locator(AutoDateLocator())
-    ax.xaxis.set_major_formatter(DateFormatter("%Y-%m"))
-    fig.autofmt_xdate()
-    fig.tight_layout()
-    fig.savefig(out, format="svg", transparent=False)
-    plt.close(fig)
-
-
-def main():
-    stars = fetch_stargazers()
-    if not stars:
-        print("::error::No stargazers fetched; not updating the chart.")
-        sys.exit(1)
-    render(stars, OUT)
-    print(f"Rendered {len(stars)} stars to {OUT}")
-
-
-if __name__ == "__main__":
-    main()

.github/workflows/binaries_dev.yml

@@ -3,15 +3,6 @@ name: "go: build dev binaries"
 on:
   push:
     branches: [ master ]
-    paths:
-      - 'weed/**'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/binaries_dev.yml'
-
-concurrency:
-  group: binaries-dev-${{ github.ref }}
-  cancel-in-progress: true
 
 permissions:
   contents: read
@@ -27,7 +18,6 @@ jobs:
 
       - name: Delete old release assets
         uses: mknejp/delete-release-assets@v1
-        continue-on-error: true
         with:
           token: ${{ github.token }}
           tag: dev
@@ -48,13 +38,13 @@ jobs:
     steps:
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v2
+        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v2
 
       - name: Set BUILD_TIME env
         run: echo BUILD_TIME=$(date -u +%Y%m%d-%H%M) >> ${GITHUB_ENV}
 
       - name: Go Release Binaries Large Disk
-        uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
+        uses: wangyoucao577/go-release-action@90da8ebfdc010a0e7d378419a76fd90230a05228 # v1.22
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           goos: ${{ matrix.goos }}
@@ -63,14 +53,14 @@ jobs:
           overwrite: true
           pre_command: export CGO_ENABLED=0 && export GODEBUG=http2client=0
           build_flags: -tags 5BytesOffset # optional, default is
-          ldflags: -s -w -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util/version.COMMIT=${{github.sha}}
+          ldflags: -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
           # Where to run `go build .`
           project_path: weed
           binary_name: weed-large-disk
           asset_name: "weed-large-disk-${{ env.BUILD_TIME }}-${{ matrix.goos }}-${{ matrix.goarch }}"
 
       - name: Go Release Binaries Normal Volume Size
-        uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
+        uses: wangyoucao577/go-release-action@90da8ebfdc010a0e7d378419a76fd90230a05228 # v1.22
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           goos: ${{ matrix.goos }}
@@ -78,7 +68,7 @@ jobs:
           release_tag: dev
           overwrite: true
           pre_command: export CGO_ENABLED=0 && export GODEBUG=http2client=0
-          ldflags: -s -w -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util/version.COMMIT=${{github.sha}}
+          ldflags: -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
           # Where to run `go build .`
           project_path: weed
           binary_name: weed-normal-disk
@@ -97,13 +87,13 @@ jobs:
     steps:
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v2
+        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v2
 
       - name: Set BUILD_TIME env
         run: echo BUILD_TIME=$(date -u +%Y%m%d-%H%M) >> ${GITHUB_ENV}
 
       - name: Go Release Binaries Large Disk
-        uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
+        uses: wangyoucao577/go-release-action@90da8ebfdc010a0e7d378419a76fd90230a05228 # v1.22
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           goos: ${{ matrix.goos }}
@@ -112,14 +102,14 @@ jobs:
           overwrite: true
           pre_command: export CGO_ENABLED=0 && export GODEBUG=http2client=0
           build_flags: -tags 5BytesOffset # optional, default is
-          ldflags: -s -w -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util/version.COMMIT=${{github.sha}}
+          ldflags: -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
           # Where to run `go build .`
           project_path: weed
           binary_name: weed-large-disk
           asset_name: "weed-large-disk-${{ env.BUILD_TIME }}-${{ matrix.goos }}-${{ matrix.goarch }}"
 
       - name: Go Release Binaries Normal Volume Size
-        uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
+        uses: wangyoucao577/go-release-action@90da8ebfdc010a0e7d378419a76fd90230a05228 # v1.22
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           goos: ${{ matrix.goos }}
@@ -127,7 +117,7 @@ jobs:
           release_tag: dev
           overwrite: true
           pre_command: export CGO_ENABLED=0 && export GODEBUG=http2client=0
-          ldflags: -s -w -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util/version.COMMIT=${{github.sha}}
+          ldflags: -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
           # Where to run `go build .`
           project_path: weed
           binary_name: weed-normal-disk

.github/workflows/binaries_release0.yml

@@ -28,9 +28,9 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v2
+      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v2
       - name: Go Release Binaries Normal Volume Size
-        uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
+        uses: wangyoucao577/go-release-action@90da8ebfdc010a0e7d378419a76fd90230a05228 # v1.22
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           goos: ${{ matrix.goos }}
@@ -38,13 +38,13 @@ jobs:
           overwrite: true
           pre_command: export CGO_ENABLED=0 && export GODEBUG=http2client=0
           # build_flags: -tags 5BytesOffset # optional, default is
-          ldflags: -s -w -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util/version.COMMIT=${{github.sha}}
+          ldflags: -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
           # Where to run `go build .`
           project_path: weed
           binary_name: weed
           asset_name: "${{ matrix.goos }}_${{ matrix.goarch }}"
       - name: Go Release Large Disk Binaries
-        uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
+        uses: wangyoucao577/go-release-action@90da8ebfdc010a0e7d378419a76fd90230a05228 # v1.22
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           goos: ${{ matrix.goos }}
@@ -52,7 +52,7 @@ jobs:
           overwrite: true
           pre_command: export CGO_ENABLED=0 && export GODEBUG=http2client=0
           build_flags: -tags 5BytesOffset # optional, default is
-          ldflags: -s -w -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util/version.COMMIT=${{github.sha}}
+          ldflags: -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
           # Where to run `go build .`
           project_path: weed
           binary_name: weed

.github/workflows/binaries_release1.yml

@@ -28,9 +28,9 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v2
+      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v2
       - name: Go Release Binaries Normal Volume Size
-        uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
+        uses: wangyoucao577/go-release-action@90da8ebfdc010a0e7d378419a76fd90230a05228 # v1.22
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           goos: ${{ matrix.goos }}
@@ -38,13 +38,13 @@ jobs:
           overwrite: true
           pre_command: export CGO_ENABLED=0 && export GODEBUG=http2client=0
           # build_flags: -tags 5BytesOffset # optional, default is
-          ldflags: -s -w -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util/version.COMMIT=${{github.sha}}
+          ldflags: -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
           # Where to run `go build .`
           project_path: weed
           binary_name: weed
           asset_name: "${{ matrix.goos }}_${{ matrix.goarch }}"
       - name: Go Release Large Disk Binaries
-        uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
+        uses: wangyoucao577/go-release-action@90da8ebfdc010a0e7d378419a76fd90230a05228 # v1.22
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           goos: ${{ matrix.goos }}
@@ -52,7 +52,7 @@ jobs:
           overwrite: true
           pre_command: export CGO_ENABLED=0 && export GODEBUG=http2client=0
           build_flags: -tags 5BytesOffset # optional, default is
-          ldflags: -s -w -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util/version.COMMIT=${{github.sha}}
+          ldflags: -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
           # Where to run `go build .`
           project_path: weed
           binary_name: weed

.github/workflows/binaries_release2.yml

@@ -28,9 +28,9 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v2
+      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v2
       - name: Go Release Binaries Normal Volume Size
-        uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
+        uses: wangyoucao577/go-release-action@90da8ebfdc010a0e7d378419a76fd90230a05228 # v1.22
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           goos: ${{ matrix.goos }}
@@ -38,13 +38,13 @@ jobs:
           overwrite: true
           pre_command: export CGO_ENABLED=0 && export GODEBUG=http2client=0
           # build_flags: -tags 5BytesOffset # optional, default is
-          ldflags: -s -w -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util/version.COMMIT=${{github.sha}}
+          ldflags: -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
           # Where to run `go build .`
           project_path: weed
           binary_name: weed
           asset_name: "${{ matrix.goos }}_${{ matrix.goarch }}"
       - name: Go Release Large Disk Binaries
-        uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
+        uses: wangyoucao577/go-release-action@90da8ebfdc010a0e7d378419a76fd90230a05228 # v1.22
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           goos: ${{ matrix.goos }}
@@ -52,7 +52,7 @@ jobs:
           overwrite: true
           pre_command: export CGO_ENABLED=0 && export GODEBUG=http2client=0
           build_flags: -tags 5BytesOffset # optional, default is
-          ldflags: -s -w -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util/version.COMMIT=${{github.sha}}
+          ldflags: -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
           # Where to run `go build .`
           project_path: weed
           binary_name: weed

.github/workflows/binaries_release3.yml

@@ -28,9 +28,9 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v2
+      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v2
       - name: Go Release Binaries Normal Volume Size
-        uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
+        uses: wangyoucao577/go-release-action@90da8ebfdc010a0e7d378419a76fd90230a05228 # v1.22
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           goos: ${{ matrix.goos }}
@@ -38,13 +38,13 @@ jobs:
           overwrite: true
           pre_command: export CGO_ENABLED=0 && export GODEBUG=http2client=0
           # build_flags: -tags 5BytesOffset # optional, default is
-          ldflags: -s -w -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util/version.COMMIT=${{github.sha}}
+          ldflags: -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
           # Where to run `go build .`
           project_path: weed
           binary_name: weed
           asset_name: "${{ matrix.goos }}_${{ matrix.goarch }}"
       - name: Go Release Large Disk Binaries
-        uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
+        uses: wangyoucao577/go-release-action@90da8ebfdc010a0e7d378419a76fd90230a05228 # v1.22
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           goos: ${{ matrix.goos }}
@@ -52,7 +52,7 @@ jobs:
           overwrite: true
           pre_command: export CGO_ENABLED=0 && export GODEBUG=http2client=0
           build_flags: -tags 5BytesOffset # optional, default is
-          ldflags: -s -w -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util/version.COMMIT=${{github.sha}}
+          ldflags: -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
           # Where to run `go build .`
           project_path: weed
           binary_name: weed

.github/workflows/binaries_release4.yml

@@ -28,32 +28,32 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v2
+      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v2
       - name: Go Release Binaries Normal Volume Size
-        uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
+        uses: wangyoucao577/go-release-action@90da8ebfdc010a0e7d378419a76fd90230a05228 # v1.22
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           goos: ${{ matrix.goos }}
           goarch: ${{ matrix.goarch }}
           overwrite: true
-          build_flags: -tags elastic,gocdk,rclone,sqlite,tarantool,tikv,ydb
+          build_flags: -tags elastic,ydb,gocdk,tikv
           pre_command: export CGO_ENABLED=0 && export GODEBUG=http2client=0
           # build_flags: -tags 5BytesOffset # optional, default is
-          ldflags: -s -w -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util/version.COMMIT=${{github.sha}}
+          ldflags: -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
           # Where to run `go build .`
           project_path: weed
           binary_name: weed
           asset_name: "${{ matrix.goos }}_${{ matrix.goarch }}_full"
       - name: Go Release Large Disk Binaries
-        uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
+        uses: wangyoucao577/go-release-action@90da8ebfdc010a0e7d378419a76fd90230a05228 # v1.22
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           goos: ${{ matrix.goos }}
           goarch: ${{ matrix.goarch }}
           overwrite: true
           pre_command: export CGO_ENABLED=0 && export GODEBUG=http2client=0
-          build_flags: -tags 5BytesOffset,elastic,gocdk,rclone,sqlite,tarantool,tikv,ydb
-          ldflags: -s -w -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util/version.COMMIT=${{github.sha}}
+          build_flags: -tags 5BytesOffset,elastic,ydb,gocdk,tikv
+          ldflags: -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util.COMMIT=${{github.sha}}
           # Where to run `go build .`
           project_path: weed
           binary_name: weed

.github/workflows/binaries_release5.yml

@@ -1,59 +0,0 @@
-# This is a basic workflow to help you get started with Actions
-
-name: "go: build versioned binaries for openbsd"
-
-on:
-  push:
-    tags:
-      - '*'
-
-  # Allows you to run this workflow manually from the Actions tab
-  workflow_dispatch:
-
-# A workflow run is made up of one or more jobs that can run sequentially or in parallel
-permissions:
-  contents: read
-
-jobs:
-
-  build-release-binaries_openbsd:
-    permissions:
-      contents: write  # for wangyoucao577/go-release-action to upload release assets
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        goos: [openbsd]
-        goarch: [amd64, arm, arm64]
-
-    # Steps represent a sequence of tasks that will be executed as part of the job
-    steps:
-      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v2
-      - name: Go Release Binaries Normal Volume Size
-        uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          goos: ${{ matrix.goos }}
-          goarch: ${{ matrix.goarch }}
-          overwrite: true
-          pre_command: export CGO_ENABLED=0 && export GODEBUG=http2client=0
-          # build_flags: -tags 5BytesOffset # optional, default is
-          ldflags: -s -w -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util/version.COMMIT=${{github.sha}}
-          # Where to run `go build .`
-          project_path: weed
-          binary_name: weed
-          asset_name: "${{ matrix.goos }}_${{ matrix.goarch }}"
-      - name: Go Release Large Disk Binaries
-        uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.22
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          goos: ${{ matrix.goos }}
-          goarch: ${{ matrix.goarch }}
-          overwrite: true
-          pre_command: export CGO_ENABLED=0 && export GODEBUG=http2client=0
-          build_flags: -tags 5BytesOffset # optional, default is
-          ldflags: -s -w -extldflags -static -X github.com/seaweedfs/seaweedfs/weed/util/version.COMMIT=${{github.sha}}
-          # Where to run `go build .`
-          project_path: weed
-          binary_name: weed
-          asset_name: "${{ matrix.goos }}_${{ matrix.goarch }}_large_disk"

.github/workflows/codeql.yml

@@ -2,11 +2,6 @@ name: "Code Scanning - Action"
 
 on:
   pull_request:
-    paths:
-      - '**/*.go'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/codeql.yml'
 
 concurrency:
   group: ${{ github.head_ref }}/codeql
@@ -23,11 +18,11 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.38.2
+        uses: github/codeql-action/init@v2
         # Override language selection by uncommenting this and choosing your languages
         with:
           languages: go
@@ -35,7 +30,7 @@ jobs:
       # Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below).
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v4.38.2
+        uses: github/codeql-action/autobuild@v2
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -49,4 +44,4 @@ jobs:
       #     make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4.38.2
+        uses: github/codeql-action/analyze@v2

.github/workflows/codespell.yml

@@ -1,23 +0,0 @@
-# Codespell configuration is within .codespellrc
----
-name: Codespell
-
-on:
-  push:
-    branches: [master]
-  pull_request:
-    branches: [master]
-
-permissions:
-  contents: read
-
-jobs:
-  codespell:
-    name: Check for spelling errors
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-      - name: Codespell
-        uses: codespell-project/actions-codespell@8f01853be192eb0f849a5c7d721450e7a467c579  # v2.2

.github/workflows/container_dev.yml

@@ -3,144 +3,24 @@ name: "docker: build dev containers"
 on:
   push:
     branches: [ master ]
-    paths:
-      - 'weed/**'
-      - 'seaweed-volume/**'
-      - 'seaweed-common/**'
-      - 'seaweed-worker/**'
-      - 'docker/**'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/container_dev.yml'
+  workflow_dispatch: {}
 
 permissions:
   contents: read
 
 jobs:
 
-  # ── Pre-build the Rust binaries natively ────────────────────────────
-  build-rust-binaries:
-    runs-on: ubuntu-22.04
-    strategy:
-      matrix:
-        include:
-          - target: x86_64-unknown-linux-musl
-            arch: amd64
-          - target: aarch64-unknown-linux-musl
-            arch: arm64
-            cross: true
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: ${{ matrix.target }}
-
-      - name: Install musl tools (amd64)
-        if: ${{ !matrix.cross }}
-        run: sudo apt-get install -y musl-tools
-
-      - name: Install cross-compilation tools (arm64)
-        if: matrix.cross
-        run: |
-          sudo apt-get install -y gcc-aarch64-linux-gnu
-          echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER=aarch64-linux-gnu-gcc" >> "$GITHUB_ENV"
-          # Disable glibc fortify source — its __memcpy_chk etc. symbols don't exist in musl
-          echo "CFLAGS_aarch64_unknown_linux_musl=-U_FORTIFY_SOURCE" >> "$GITHUB_ENV"
-
-      - name: Cache cargo registry and target
-        uses: actions/cache@v6
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            seaweed-volume/target
-            seaweed-worker/target/${{ matrix.target }}/release
-          key: rust-docker-dev-${{ matrix.target }}-${{ hashFiles('seaweed-volume/Cargo.lock', 'seaweed-worker/Cargo.lock') }}
-          restore-keys: |
-            rust-docker-dev-${{ matrix.target }}-
-
-      # lance's build scripts compile their own protos and look for a protoc.
-      # Point them at the one protoc-bin-vendored ships, which seaweed-worker's
-      # own build already uses, so no job depends on a system package and every
-      # build sees the same version.
-      - name: Use the vendored protoc
-        run: |
-          cd seaweed-worker
-          cargo fetch
-          # The version from the lock, not whatever else a restored cache holds.
-          version=$(awk '/^name = "protoc-bin-vendored-linux-x86_64"$/{found=1; next} found && /^version = /{gsub(/"/,"",$3); print $3; exit}' Cargo.lock)
-          test -n "$version" || { echo "protoc-bin-vendored-linux-x86_64 is not in Cargo.lock" >&2; exit 1; }
-          protoc=$(find ~/.cargo/registry/src -path "*protoc-bin-vendored-linux-x86_64-$version/bin/protoc" | head -1)
-          test -x "$protoc" || { echo "no vendored protoc $version in the registry" >&2; exit 1; }
-          echo "PROTOC=$protoc" >> "$GITHUB_ENV"
-
-      - name: Build normal variant
-        env:
-          SEAWEEDFS_COMMIT: ${{ github.sha }}
-        run: |
-          cd seaweed-volume
-          cargo build --release --target ${{ matrix.target }} --no-default-features
-          cp target/${{ matrix.target }}/release/weed-volume ../weed-volume-normal-${{ matrix.arch }}
-
-      - name: Build the Rust maintenance worker
-        run: |
-          cd seaweed-worker
-          cargo build --release -p weed-lance-worker --target ${{ matrix.target }}
-          cp target/${{ matrix.target }}/release/weed-worker ../weed-worker-${{ matrix.arch }}
-
-      - name: Upload artifacts
-        uses: actions/upload-artifact@v7
-        with:
-          name: rust-bins-${{ matrix.arch }}
-          path: |
-            weed-volume-normal-${{ matrix.arch }}
-            weed-worker-${{ matrix.arch }}
-
   build-dev-containers:
-    needs: [build-rust-binaries]
     runs-on: [ubuntu-latest]
-    permissions:
-      contents: read
-      id-token: write
 
     steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-
-      - name: Download pre-built Rust binaries
-        uses: actions/download-artifact@v8
-        with:
-          pattern: rust-bins-*
-          merge-multiple: true
-          path: ./rust-bins
-
-      - name: Place Rust binaries in Docker context
-        run: |
-          mkdir -p docker/weed-volume-prebuilt
-          for arch in amd64 arm64; do
-            src="./rust-bins/weed-volume-normal-${arch}"
-            if [ -f "$src" ]; then
-              cp "$src" "docker/weed-volume-prebuilt/weed-volume-${arch}"
-              echo "Placed pre-built Rust binary for ${arch}"
-            fi
-          done
-          mkdir -p docker/weed-worker-prebuilt
-          for arch in amd64 arm64; do
-            src="./rust-bins/weed-worker-${arch}"
-            if [ -f "$src" ]; then
-              cp "$src" "docker/weed-worker-prebuilt/weed-worker-${arch}"
-              echo "Placed pre-built Rust worker for ${arch}"
-            fi
-          done
-          ls -la docker/weed-volume-prebuilt/
-          ls -la docker/weed-worker-prebuilt/
-
-      - name: Docker meta
+      -
+        name: Checkout
+        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v2
+      -
+        name: Docker meta
         id: docker_meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@57396166ad8aefe6098280995947635806a0e6ea # v3
         with:
           images: |
             chrislusf/seaweedfs
@@ -151,41 +31,32 @@ jobs:
             org.opencontainers.image.title=seaweedfs
             org.opencontainers.image.description=SeaweedFS is a distributed storage system for blobs, objects, files, and data lake, to store and serve billions of files fast!
             org.opencontainers.image.vendor=Chris Lu
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4.4.0
-
-      - name: Create BuildKit config
-        run: |
-          cat > /tmp/buildkitd.toml <<EOF
-          [registry."docker.io"]
-            mirrors = ["https://mirror.gcr.io"]
-          EOF
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # v1
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8c0edbc76e98fa90f69d9a2c020dcb50019dc325 # v1
         with:
           buildkitd-flags: "--debug"
-          buildkitd-config: /tmp/buildkitd.toml
-
-      - name: Login to Docker Hub
+      -
+        name: Login to Docker Hub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v1
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Login to GHCR
+      -
+        name: Login to GHCR
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v1
         with:
           registry: ghcr.io
           username: ${{ secrets.GHCR_USERNAME }}
           password: ${{ secrets.GHCR_TOKEN }}
-
-      - name: Build
-        id: build
-        uses: docker/build-push-action@v7
+      -
+        name: Build
+        uses: docker/build-push-action@c56af957549030174b10d6867f20e78cfd7debc5 # v2
         with:
           context: ./docker
           push: ${{ github.event_name != 'pull_request' }}
@@ -193,11 +64,3 @@ jobs:
           platforms: linux/amd64, linux/arm64
           tags: ${{ steps.docker_meta.outputs.tags }}
           labels: ${{ steps.docker_meta.outputs.labels }}
-
-      - name: Sign
-        if: github.event_name != 'pull_request'
-        uses: ./.github/actions/sign-image
-        with:
-          images: >-
-            chrislusf/seaweedfs@${{ steps.build.outputs.digest }}
-            ghcr.io/chrislusf/seaweedfs@${{ steps.build.outputs.digest }}

.github/workflows/container_foundationdb_version.yml

@@ -1,182 +0,0 @@
-name: "docker: build foundationdb image by version"
-
-on:
-  pull_request:
-    branches: [ master, main ]
-    paths:
-      - 'weed/filer/foundationdb/**'
-      - 'test/foundationdb/**'
-      - 'docker/Dockerfile.foundationdb_large'
-      - 'docker/filer_foundationdb.toml'
-      - '.github/workflows/container_foundationdb_version.yml'
-  workflow_dispatch:
-    inputs:
-      fdb_version:
-        description: 'FoundationDB version to build (e.g. 7.4.5)'
-        required: true
-        default: '7.4.5'
-      seaweedfs_ref:
-        description: 'SeaweedFS git tag, branch, or commit to build'
-        required: true
-        default: 'master'
-      image_tag:
-        description: 'Optional Docker tag suffix (defaults to foundationdb_<fdb>_seaweedfs_<ref>)'
-        required: false
-        default: ''
-
-permissions:
-  contents: read
-
-jobs:
-  build-foundationdb-image:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-
-      - name: Install FoundationDB client libraries
-        run: |
-          set -euo pipefail
-          sudo apt-get update
-          sudo apt-get install -y ca-certificates wget
-          FDB_VERSION="${{ inputs.fdb_version || '7.4.5' }}"
-          case "${FDB_VERSION}_amd64" in
-            "7.4.5_amd64") EXPECTED_SHA256="eea6b98cf386a0848655b2e196d18633662a7440a7ee061c10e32153c7e7e112" ;;
-            "7.3.43_amd64") EXPECTED_SHA256="c3fa0a59c7355b914a1455dac909238d5ea3b6c6bc7b530af8597e6487c1651a" ;;
-            *)
-              echo "Unsupported FoundationDB version ${FDB_VERSION} for CI client install" >&2
-              exit 1 ;;
-          esac
-          PACKAGE="foundationdb-clients_${FDB_VERSION}-1_amd64.deb"
-          wget --timeout=30 --tries=3 -O "${PACKAGE}" "https://github.com/apple/foundationdb/releases/download/${FDB_VERSION}/${PACKAGE}"
-          echo "${EXPECTED_SHA256}  ${PACKAGE}" | sha256sum -c -
-          sudo dpkg -i "${PACKAGE}"
-          rm "${PACKAGE}"
-          sudo ldconfig
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: go.mod
-
-      - name: Run FoundationDB tagged tests
-        env:
-          CGO_ENABLED: 1
-        run: |
-          go test ./weed/filer/foundationdb -tags foundationdb -count=1
-
-      - name: Prepare Docker tag
-        id: tag
-        env:
-          FDB_VERSION_INPUT: ${{ inputs.fdb_version }}
-          SEAWEEDFS_REF_INPUT: ${{ inputs.seaweedfs_ref }}
-          CUSTOM_TAG_INPUT: ${{ inputs.image_tag }}
-          EVENT_NAME: ${{ github.event_name }}
-          HEAD_REF: ${{ github.head_ref }}
-          REF_NAME: ${{ github.ref_name }}
-        run: |
-          set -euo pipefail
-          sanitize() {
-            local value="$1"
-            value="${value,,}"
-            value="${value// /-}"
-            value="${value//[^a-z0-9_.-]/-}"
-            value="${value#-}"
-            value="${value%-}"
-            printf '%s' "$value"
-          }
-          version="${FDB_VERSION_INPUT}"
-          seaweed="${SEAWEEDFS_REF_INPUT}"
-          tag="${CUSTOM_TAG_INPUT}"
-          # Use defaults for PR builds
-          if [ -z "$version" ]; then
-            version="7.4.5"
-          fi
-          if [ -z "$seaweed" ]; then
-            if [ "$EVENT_NAME" = "pull_request" ]; then
-              seaweed="${HEAD_REF}"
-            else
-              seaweed="${REF_NAME}"
-            fi
-          fi
-          sanitized_version="$(sanitize "$version")"
-          if [ -z "$sanitized_version" ]; then
-            echo "Unable to sanitize FoundationDB version '$version'." >&2
-            exit 1
-          fi
-          sanitized_seaweed="$(sanitize "$seaweed")"
-          if [ -z "$sanitized_seaweed" ]; then
-            echo "Unable to sanitize SeaweedFS ref '$seaweed'." >&2
-            exit 1
-          fi
-          if [ -z "$tag" ]; then
-            tag="foundationdb_${sanitized_version}_seaweedfs_${sanitized_seaweed}"
-          else
-            tag="$(sanitize "$tag")"
-          fi
-          if [ -z "$tag" ]; then
-            echo "Resulting Docker tag is empty." >&2
-            exit 1
-          fi
-          echo "docker_tag=$tag" >> "$GITHUB_OUTPUT"
-          echo "full_image=chrislusf/seaweedfs:$tag" >> "$GITHUB_OUTPUT"
-          echo "seaweedfs_ref=$seaweed" >> "$GITHUB_OUTPUT"
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4.4.0
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-
-      - name: Login to Docker Hub
-        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v4.6.0
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Determine branch to build
-        id: branch
-        env:
-          INPUT_REF: ${{ inputs.seaweedfs_ref }}
-          HEAD_REF: ${{ github.head_ref }}
-          REF_NAME: ${{ github.ref_name }}
-        run: |
-          if [ -n "$INPUT_REF" ]; then
-            echo "branch=$INPUT_REF" >> "$GITHUB_OUTPUT"
-          elif [ "${{ github.event_name }}" = "pull_request" ]; then
-            echo "branch=$HEAD_REF" >> "$GITHUB_OUTPUT"
-          else
-            echo "branch=$REF_NAME" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Build and push image
-        id: build
-        uses: docker/build-push-action@v7
-        with:
-          context: ./docker
-          push: ${{ github.event_name != 'pull_request' }}
-          file: ./docker/Dockerfile.foundationdb_large
-          build-args: |
-            FDB_VERSION=${{ inputs.fdb_version || '7.4.5' }}
-            BRANCH=${{ steps.branch.outputs.branch }}
-          # Note: ARM64 support requires FoundationDB ARM64 packages which are not available for all versions
-          # Currently only building for amd64. To enable ARM64, verify package availability and add checksums.
-          platforms: linux/amd64
-          tags: ${{ steps.tag.outputs.full_image || 'seaweedfs:foundationdb-test' }}
-          labels: |
-            org.opencontainers.image.title=seaweedfs
-            org.opencontainers.image.description=SeaweedFS is a distributed storage system for blobs, objects, files, and data lake, to store and serve billions of files fast!
-            org.opencontainers.image.vendor=Chris Lu
-
-      - name: Sign
-        if: github.event_name != 'pull_request'
-        uses: ./.github/actions/sign-image
-        with:
-          images: chrislusf/seaweedfs@${{ steps.build.outputs.digest }}

.github/workflows/container_latest.yml

@@ -1,570 +1,67 @@
 name: "docker: build latest container"
 
-# Manual fallback only. On tag push, container_release_unified.yml already
-# re-tags the released versioned image as `latest` / `latest_large_disk`,
-# so a full rebuild here is unnecessary. Run this manually if you need to
-# rebuild `latest` from an arbitrary ref.
 on:
-  workflow_dispatch:
-    inputs:
-      source_ref:
-        description: 'Git ref to build (branch, tag, or commit SHA)'
-        required: true
-        default: 'master'
-      image_tag:
-        description: 'Docker tag to publish (without variant suffix)'
-        required: true
-        default: 'latest'
-      variant:
-        description: 'Variant to build manually'
-        required: true
-        type: choice
-        default: all
-        options:
-          - all
-          - standard
-          - large_disk
-      publish:
-        description: 'Publish images and manifests'
-        required: true
-        type: boolean
-        default: false
+  push:
+    tags:
+      - '*'
+  workflow_dispatch: {}
 
 permissions:
   contents: read
-  security-events: write
 
 jobs:
-  setup:
-    runs-on: ubuntu-latest
-    outputs:
-      variants: ${{ steps.set-variants.outputs.variants }}
-      publish: ${{ steps.set-publish.outputs.publish }}
-    steps:
-      - name: Select variants for this run
-        id: set-variants
-        run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ "${{ github.event.inputs.variant }}" != "all" ]; then
-            variants="[\"${{ github.event.inputs.variant }}\"]"
-          else
-            variants='["standard","large_disk"]'
-          fi
-          echo "variants=$variants" >> "$GITHUB_OUTPUT"
-      - name: Select publish mode
-        id: set-publish
-        run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            echo "publish=${{ github.event.inputs.publish }}" >> "$GITHUB_OUTPUT"
-          else
-            echo "publish=true" >> "$GITHUB_OUTPUT"
-          fi
 
-  # ── Pre-build the Rust binaries natively ────────────────────────────
-  build-rust-binaries:
-    runs-on: ubuntu-22.04
-    strategy:
-      matrix:
-        include:
-          - target: x86_64-unknown-linux-musl
-            arch: amd64
-          - target: aarch64-unknown-linux-musl
-            arch: arm64
-            cross: true
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.source_ref || github.ref }}
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: ${{ matrix.target }}
-
-      - name: Install musl tools (amd64)
-        if: ${{ !matrix.cross }}
-        run: sudo apt-get install -y musl-tools
-
-      - name: Install cross-compilation tools (arm64)
-        if: matrix.cross
-        run: |
-          sudo apt-get install -y gcc-aarch64-linux-gnu
-          echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER=aarch64-linux-gnu-gcc" >> "$GITHUB_ENV"
-          # Disable glibc fortify source — its __memcpy_chk etc. symbols don't exist in musl
-          echo "CFLAGS_aarch64_unknown_linux_musl=-U_FORTIFY_SOURCE" >> "$GITHUB_ENV"
-
-      - name: Cache cargo registry and target
-        uses: actions/cache@v6
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            seaweed-volume/target
-            seaweed-worker/target/${{ matrix.target }}/release
-          key: rust-docker-${{ matrix.target }}-${{ hashFiles('seaweed-volume/Cargo.lock', 'seaweed-worker/Cargo.lock') }}
-          restore-keys: |
-            rust-docker-${{ matrix.target }}-
-
-      # lance's build scripts compile their own protos and look for a protoc.
-      # Point them at the one protoc-bin-vendored ships, which seaweed-worker's
-      # own build already uses, so no job depends on a system package and every
-      # build sees the same version.
-      - name: Use the vendored protoc
-        run: |
-          cd seaweed-worker
-          cargo fetch
-          # The version from the lock, not whatever else a restored cache holds.
-          version=$(awk '/^name = "protoc-bin-vendored-linux-x86_64"$/{found=1; next} found && /^version = /{gsub(/"/,"",$3); print $3; exit}' Cargo.lock)
-          test -n "$version" || { echo "protoc-bin-vendored-linux-x86_64 is not in Cargo.lock" >&2; exit 1; }
-          protoc=$(find ~/.cargo/registry/src -path "*protoc-bin-vendored-linux-x86_64-$version/bin/protoc" | head -1)
-          test -x "$protoc" || { echo "no vendored protoc $version in the registry" >&2; exit 1; }
-          echo "PROTOC=$protoc" >> "$GITHUB_ENV"
-
-      - name: Build large-disk variant
-        env:
-          SEAWEEDFS_COMMIT: ${{ github.sha }}
-        run: |
-          cd seaweed-volume
-          cargo build --release --target ${{ matrix.target }}
-          cp target/${{ matrix.target }}/release/weed-volume ../weed-volume-large-disk-${{ matrix.arch }}
-
-      - name: Build normal variant
-        env:
-          SEAWEEDFS_COMMIT: ${{ github.sha }}
-        run: |
-          cd seaweed-volume
-          cargo build --release --target ${{ matrix.target }} --no-default-features
-          cp target/${{ matrix.target }}/release/weed-volume ../weed-volume-normal-${{ matrix.arch }}
-
-      - name: Build the Rust maintenance worker
-        run: |
-          cd seaweed-worker
-          cargo build --release -p weed-lance-worker --target ${{ matrix.target }}
-          cp target/${{ matrix.target }}/release/weed-worker ../weed-worker-${{ matrix.arch }}
-
-      - name: Upload artifacts
-        uses: actions/upload-artifact@v7
-        with:
-          name: rust-bins-${{ matrix.arch }}
-          path: |
-            weed-volume-large-disk-${{ matrix.arch }}
-            weed-volume-normal-${{ matrix.arch }}
-            weed-worker-${{ matrix.arch }}
-
-  build:
-    needs: [setup, build-rust-binaries]
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        platform: [amd64, arm64, arm, 386, ppc64le, s390x]
-        variant: ${{ fromJSON(needs.setup.outputs.variants) }}
+  build-latest-container:
+    runs-on: [ubuntu-latest]
 
     steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.source_ref || github.ref }}
-      - name: Free Disk Space
-        run: |
-          echo "Available disk space before cleanup:"
-          df -h
-          # Remove pre-installed tools
-          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL
-          # Clean package managers
-          sudo apt-get clean
-          sudo rm -rf /var/lib/apt/lists/*
-          # Clean Docker aggressively
-          sudo docker system prune -af --volumes
-          # Clean Go cache if it exists
-          [ -d ~/.cache/go-build ] && rm -rf ~/.cache/go-build || true
-          [ -d /go/pkg ] && rm -rf /go/pkg || true
-          echo "Available disk space after cleanup:"
-          df -h
-      
-      - name: Configure variant
-        id: config
-        run: |
-          if [ "${{ matrix.variant }}" == "large_disk" ]; then
-            echo "tag_suffix=_large_disk" >> $GITHUB_OUTPUT
-            echo "build_args=TAGS=5BytesOffset" >> $GITHUB_OUTPUT
-            echo "rust_variant=large-disk" >> $GITHUB_OUTPUT
-          else
-            echo "tag_suffix=" >> $GITHUB_OUTPUT
-            echo "build_args=" >> $GITHUB_OUTPUT
-            echo "rust_variant=normal" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Download pre-built Rust binaries
-        uses: actions/download-artifact@v8
-        with:
-          pattern: rust-bins-*
-          merge-multiple: true
-          path: ./rust-bins
-
-      - name: Place Rust binaries in Docker context
-        run: |
-          mkdir -p docker/weed-volume-prebuilt
-          for arch in amd64 arm64; do
-            src="./rust-bins/weed-volume-${{ steps.config.outputs.rust_variant }}-${arch}"
-            if [ -f "$src" ]; then
-              cp "$src" "docker/weed-volume-prebuilt/weed-volume-${arch}"
-              echo "Placed pre-built Rust binary for ${arch}"
-            fi
-          done
-          mkdir -p docker/weed-worker-prebuilt
-          for arch in amd64 arm64; do
-            src="./rust-bins/weed-worker-${arch}"
-            if [ -f "$src" ]; then
-              cp "$src" "docker/weed-worker-prebuilt/weed-worker-${arch}"
-              echo "Placed pre-built Rust worker for ${arch}"
-            fi
-          done
-          ls -la docker/weed-volume-prebuilt/
-          ls -la docker/weed-worker-prebuilt/
-
-      - name: Docker meta
+      -
+        name: Checkout
+        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v2
+      -
+        name: Docker meta
         id: docker_meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@57396166ad8aefe6098280995947635806a0e6ea # v3
         with:
           images: |
             chrislusf/seaweedfs
             ghcr.io/chrislusf/seaweedfs
-          tags: type=raw,value=${{ github.event_name == 'workflow_dispatch' && github.event.inputs.image_tag || 'latest' }},suffix=${{ steps.config.outputs.tag_suffix }}
+          tags: |
+            type=raw,value=latest
           labels: |
             org.opencontainers.image.title=seaweedfs
             org.opencontainers.image.description=SeaweedFS is a distributed storage system for blobs, objects, files, and data lake, to store and serve billions of files fast!
             org.opencontainers.image.vendor=Chris Lu
-      - name: Set up QEMU
-        if: matrix.platform != 'amd64'
-        uses: docker/setup-qemu-action@v4.4.0
-      - name: Create BuildKit config
-        run: |
-          cat > /tmp/buildkitd.toml <<EOF
-          [registry."docker.io"]
-            mirrors = ["https://mirror.gcr.io"]
-          EOF
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # v1
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8c0edbc76e98fa90f69d9a2c020dcb50019dc325 # v1
         with:
           buildkitd-flags: "--debug"
-          buildkitd-config: /tmp/buildkitd.toml
-      - name: Login to Docker Hub
-        if: needs.setup.outputs.publish == 'true'
-        uses: docker/login-action@v4.6.0
+      -
+        name: Login to Docker Hub
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v1
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
-      - name: Login to GHCR
-        if: needs.setup.outputs.publish == 'true'
-        uses: docker/login-action@v4.6.0
+      -
+        name: Login to GHCR
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v1
         with:
           registry: ghcr.io
           username: ${{ secrets.GHCR_USERNAME }}
           password: ${{ secrets.GHCR_TOKEN }}
-      - name: Build ${{ matrix.platform }} ${{ matrix.variant }}
-        uses: docker/build-push-action@v7
-        env:
-          DOCKER_BUILDKIT: 1
+      -
+        name: Build
+        uses: docker/build-push-action@c56af957549030174b10d6867f20e78cfd7debc5 # v2
         with:
           context: ./docker
-          push: ${{ needs.setup.outputs.publish == 'true' }}
+          push: ${{ github.event_name != 'pull_request' }}
           file: ./docker/Dockerfile.go_build
-          platforms: linux/${{ matrix.platform }}
-          # Push to GHCR only during build to avoid Docker Hub rate limits
-          tags: ghcr.io/chrislusf/seaweedfs:${{ github.event_name == 'workflow_dispatch' && github.event.inputs.image_tag || 'latest' }}${{ steps.config.outputs.tag_suffix }}-${{ matrix.platform }}
+          platforms: linux/amd64, linux/arm, linux/arm64, linux/386
+          tags: ${{ steps.docker_meta.outputs.tags }}
           labels: ${{ steps.docker_meta.outputs.labels }}
-          cache-from: type=gha,scope=${{ matrix.variant }}-${{ matrix.platform }}
-          cache-to: type=gha,mode=max,scope=${{ matrix.variant }}-${{ matrix.platform }}
-          build-args: |
-            BUILDKIT_INLINE_CACHE=1
-            BRANCH=${{ github.event_name == 'workflow_dispatch' && github.event.inputs.source_ref || github.sha }}
-            ${{ steps.config.outputs.build_args }}
-      - name: Clean up build artifacts
-        if: always()
-        run: |
-          # Clean up Docker build cache and temporary files
-          sudo docker system prune -f
-          # Remove Go build cache
-          sudo rm -rf /tmp/go-build*
-
-  trivy-scan:
-    runs-on: ubuntu-latest
-    needs: [setup, build, build-rust-binaries]
-    strategy:
-      matrix:
-        variant: ${{ fromJSON(needs.setup.outputs.variants) }}
-    steps:
-      - name: Configure variant
-        id: config
-        run: |
-          if [ "${{ matrix.variant }}" == "large_disk" ]; then
-            echo "tag_suffix=_large_disk" >> $GITHUB_OUTPUT
-          else
-            echo "tag_suffix=" >> $GITHUB_OUTPUT
-          fi
-      - name: Login to GHCR
-        if: needs.setup.outputs.publish == 'true'
-        uses: docker/login-action@v4.6.0
-        with:
-          registry: ghcr.io
-          username: ${{ secrets.GHCR_USERNAME }}
-          password: ${{ secrets.GHCR_TOKEN }}
-      - name: Checkout for local scan build
-        if: needs.setup.outputs.publish != 'true'
-        uses: actions/checkout@v7
-        with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.source_ref || github.ref }}
-      - name: Download pre-built Rust binaries for local scan
-        if: needs.setup.outputs.publish != 'true'
-        uses: actions/download-artifact@v8
-        with:
-          pattern: rust-bins-*
-          merge-multiple: true
-          path: ./rust-bins
-      - name: Place Rust binaries in Docker context for local scan
-        if: needs.setup.outputs.publish != 'true'
-        run: |
-          rust_variant="normal"
-          if [ "${{ matrix.variant }}" == "large_disk" ]; then
-            rust_variant="large-disk"
-          fi
-          mkdir -p docker/weed-volume-prebuilt
-          for arch in amd64 arm64; do
-            src="./rust-bins/weed-volume-${rust_variant}-${arch}"
-            if [ -f "$src" ]; then
-              cp "$src" "docker/weed-volume-prebuilt/weed-volume-${arch}"
-              echo "Placed pre-built Rust binary for ${arch}"
-            fi
-          done
-          mkdir -p docker/weed-worker-prebuilt
-          for arch in amd64 arm64; do
-            src="./rust-bins/weed-worker-${arch}"
-            if [ -f "$src" ]; then
-              cp "$src" "docker/weed-worker-prebuilt/weed-worker-${arch}"
-              echo "Placed pre-built Rust worker for ${arch}"
-            fi
-          done
-          ls -la docker/weed-volume-prebuilt/
-          ls -la docker/weed-worker-prebuilt/
-      - name: Create BuildKit config for local scan build
-        if: needs.setup.outputs.publish != 'true'
-        run: |
-          cat > /tmp/buildkitd.toml <<EOF
-          [registry."docker.io"]
-            mirrors = ["https://mirror.gcr.io"]
-          EOF
-      - name: Set up Docker Buildx for local scan build
-        if: needs.setup.outputs.publish != 'true'
-        uses: docker/setup-buildx-action@v4
-        with:
-          buildkitd-flags: "--debug"
-          buildkitd-config: /tmp/buildkitd.toml
-      - name: Build local scan image tarball
-        if: needs.setup.outputs.publish != 'true'
-        uses: docker/build-push-action@v7
-        env:
-          DOCKER_BUILDKIT: 1
-        with:
-          context: ./docker
-          file: ./docker/Dockerfile.go_build
-          platforms: linux/amd64
-          outputs: type=docker,dest=/tmp/seaweedfs${{ steps.config.outputs.tag_suffix }}-amd64.tar
-          build-args: |
-            BUILDKIT_INLINE_CACHE=1
-            BRANCH=${{ github.event_name == 'workflow_dispatch' && github.event.inputs.source_ref || github.sha }}
-            ${{ matrix.variant == 'large_disk' && 'TAGS=5BytesOffset' || '' }}
-      - name: Trivy report (published image)
-        if: needs.setup.outputs.publish == 'true'
-        # Pin to SHA - mutable tags were compromised (GHSA-69fq-xp46-6x23)
-        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
-        with:
-          scan-type: image
-          # Scan amd64 only - OS packages are identical across architectures
-          # since they all use the same alpine base, so a single-arch scan
-          # provides sufficient coverage without multiplying CI time.
-          image-ref: ghcr.io/chrislusf/seaweedfs:${{ github.event_name == 'workflow_dispatch' && github.event.inputs.image_tag || 'latest' }}${{ steps.config.outputs.tag_suffix }}-amd64
-          scanners: vuln
-          vuln-type: os,library
-          severity: HIGH,CRITICAL
-          ignore-unfixed: true
-          limit-severities-for-sarif: true
-          format: sarif
-          output: trivy-results.sarif
-          exit-code: '0'
-      - name: Trivy report (local tarball)
-        if: needs.setup.outputs.publish != 'true'
-        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
-        with:
-          input: /tmp/seaweedfs${{ steps.config.outputs.tag_suffix }}-amd64.tar
-          scanners: vuln
-          vuln-type: os,library
-          severity: HIGH,CRITICAL
-          ignore-unfixed: true
-          limit-severities-for-sarif: true
-          format: sarif
-          output: trivy-results.sarif
-          exit-code: '0'
-      - name: Upload Trivy scan results to GitHub Security
-        uses: github/codeql-action/upload-sarif@v4.38.2
-        if: always()
-        with:
-          sarif_file: trivy-results.sarif
-      - name: Trivy gate (published image)
-        if: needs.setup.outputs.publish == 'true'
-        # Gate only on fixable high/critical vulnerabilities. Non-fixable
-        # findings are still visible in the SARIF upload above.
-        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
-        with:
-          scan-type: image
-          image-ref: ghcr.io/chrislusf/seaweedfs:${{ github.event_name == 'workflow_dispatch' && github.event.inputs.image_tag || 'latest' }}${{ steps.config.outputs.tag_suffix }}-amd64
-          scanners: vuln
-          vuln-type: os,library
-          severity: HIGH,CRITICAL
-          ignore-unfixed: true
-          format: table
-          exit-code: '1'
-          skip-setup-trivy: true
-      - name: Trivy gate (local tarball)
-        if: needs.setup.outputs.publish != 'true'
-        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
-        with:
-          input: /tmp/seaweedfs${{ steps.config.outputs.tag_suffix }}-amd64.tar
-          scanners: vuln
-          vuln-type: os,library
-          severity: HIGH,CRITICAL
-          ignore-unfixed: true
-          format: table
-          exit-code: '1'
-          skip-setup-trivy: true
-
-  create-manifest:
-    runs-on: ubuntu-latest
-    needs: [setup, build, trivy-scan]
-    if: needs.setup.outputs.publish == 'true' && github.event_name != 'pull_request'
-    permissions:
-      contents: read
-      id-token: write
-    strategy:
-      matrix:
-        variant: ${{ fromJSON(needs.setup.outputs.variants) }}
-    steps:
-      - name: Checkout the signing action
-        uses: actions/checkout@v7
-        with:
-          sparse-checkout: .github/actions
-          persist-credentials: false
-
-      - name: Configure variant
-        id: config
-        run: |
-          if [ "${{ matrix.variant }}" == "large_disk" ]; then
-            echo "tag_suffix=_large_disk" >> $GITHUB_OUTPUT
-          else
-            echo "tag_suffix=" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Docker meta
-        id: docker_meta
-        uses: docker/metadata-action@v6
-        with:
-          images: |
-            chrislusf/seaweedfs
-            ghcr.io/chrislusf/seaweedfs
-          tags: type=raw,value=${{ github.event_name == 'workflow_dispatch' && github.event.inputs.image_tag || 'latest' }},suffix=${{ steps.config.outputs.tag_suffix }}
-      - name: Login to Docker Hub
-        uses: docker/login-action@v4.6.0
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-      - name: Login to GHCR
-        uses: docker/login-action@v4.6.0
-        with:
-          registry: ghcr.io
-          username: ${{ secrets.GHCR_USERNAME }}
-          password: ${{ secrets.GHCR_TOKEN }}
-      - name: Install crane
-        run: |
-          # Install crane for efficient multi-arch image copying
-          cd $(mktemp -d)
-          curl -sLO https://github.com/google/go-containerregistry/releases/download/v0.22.0/go-containerregistry_Linux_x86_64.tar.gz
-          echo "edb74d53fad9a596860f59d1c5d04a43dfb5f441dc71f57060dd0bf39483c833  go-containerregistry_Linux_x86_64.tar.gz" | sha256sum -c -
-          tar xzf go-containerregistry_Linux_x86_64.tar.gz crane
-          sudo mv crane /usr/local/bin/
-          crane version
-      - name: Create and push manifest
-        id: manifest
-        env:
-          BASE_TAG: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.image_tag || 'latest' }}
-        run: |
-          SUFFIX="${{ steps.config.outputs.tag_suffix }}"
-          
-          # Create manifest on GHCR first (no rate limits)
-          echo "Creating GHCR manifest (no rate limits)..."
-          docker buildx imagetools create -t ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX} \
-            --metadata-file /tmp/manifest.json \
-            ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-amd64 \
-            ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-arm64 \
-            ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-arm \
-            ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-386 \
-            ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-ppc64le \
-            ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-s390x
-          # The copy and the signature below use the digest this run pushed, not whatever the tag points at by then.
-          DIGEST=$(jq -er '."containerimage.descriptor".digest' /tmp/manifest.json)
-          echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
-          
-          # Copy the complete multi-arch image from GHCR to Docker Hub
-          # This only requires one pull from GHCR (no rate limit) and one push to Docker Hub
-          echo "Copying manifest from GHCR to Docker Hub..."
-          
-          # Function to retry with exponential backoff for Docker Hub operations
-          retry_with_backoff() {
-            local max_attempts=5
-            local timeout=1
-            local attempt=1
-            local exit_code=0
-            
-            while [ $attempt -le $max_attempts ]; do
-              if "$@"; then
-                return 0
-              else
-                exit_code=$?
-              fi
-              
-              if [ $attempt -lt $max_attempts ]; then
-                echo "Attempt $attempt failed. Retrying in ${timeout}s..." >&2
-                sleep $timeout
-                timeout=$((timeout * 2))
-              fi
-              
-              attempt=$((attempt + 1))
-            done
-            
-            echo "Command failed after $max_attempts attempts" >&2
-            return $exit_code
-          }
-          
-          # Use crane or skopeo to copy, fallback to docker if not available
-          if command -v crane &> /dev/null; then
-            echo "Using crane to copy..."
-            retry_with_backoff crane copy ghcr.io/chrislusf/seaweedfs@${DIGEST} chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}
-          elif command -v skopeo &> /dev/null; then
-            echo "Using skopeo to copy..."
-            retry_with_backoff skopeo copy --all docker://ghcr.io/chrislusf/seaweedfs@${DIGEST} docker://chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}
-          else
-            echo "Using docker buildx imagetools (pulling 6 images from Docker Hub)..."
-            # Fallback: create manifest directly on Docker Hub (pulls from Docker Hub - rate limited)
-            retry_with_backoff docker buildx imagetools create -t chrislusf/seaweedfs:${BASE_TAG}${SUFFIX} \
-              ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-amd64 \
-              ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-arm64 \
-              ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-arm \
-              ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-386 \
-              ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-ppc64le \
-              ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-s390x
-          fi
-
-      - name: Sign
-        uses: ./.github/actions/sign-image
-        with:
-          images: >-
-            ghcr.io/chrislusf/seaweedfs@${{ steps.manifest.outputs.digest }}
-            chrislusf/seaweedfs@${{ steps.manifest.outputs.digest }}

.github/workflows/container_release1.yml

@@ -0,0 +1,57 @@
+name: "docker: build release containers for normal volume"
+
+on:
+  push:
+    tags:
+      - '*'
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+jobs:
+  build-default-release-container:
+    runs-on: [ubuntu-latest]
+
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v2
+      -
+        name: Docker meta
+        id: docker_meta
+        uses: docker/metadata-action@57396166ad8aefe6098280995947635806a0e6ea # v3
+        with:
+          images: |
+            chrislusf/seaweedfs
+          tags: |
+            type=ref,event=tag
+          flavor: |
+            latest=false
+          labels: |
+            org.opencontainers.image.title=seaweedfs
+            org.opencontainers.image.description=SeaweedFS is a distributed storage system for blobs, objects, files, and data lake, to store and serve billions of files fast!
+            org.opencontainers.image.vendor=Chris Lu
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # v1
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8c0edbc76e98fa90f69d9a2c020dcb50019dc325 # v1
+      -
+        name: Login to Docker Hub
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v1
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+      -
+        name: Build
+        uses: docker/build-push-action@c56af957549030174b10d6867f20e78cfd7debc5 # v2
+        with:
+          context: ./docker
+          push: ${{ github.event_name != 'pull_request' }}
+          file: ./docker/Dockerfile.go_build
+          platforms: linux/amd64, linux/arm, linux/arm64, linux/386
+          tags: ${{ steps.docker_meta.outputs.tags }}
+          labels: ${{ steps.docker_meta.outputs.labels }}

.github/workflows/container_release2.yml

@@ -0,0 +1,59 @@
+name: "docker: build release containers for large volume"
+
+on:
+  push:
+    tags:
+      - '*'
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+jobs:
+
+  build-large-release-container:
+    runs-on: [ubuntu-latest]
+
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v2
+      -
+        name: Docker meta
+        id: docker_meta
+        uses: docker/metadata-action@57396166ad8aefe6098280995947635806a0e6ea # v3
+        with:
+          images: |
+            chrislusf/seaweedfs
+          tags: |
+            type=ref,event=tag,suffix=_large_disk
+          flavor: |
+            latest=false
+          labels: |
+            org.opencontainers.image.title=seaweedfs
+            org.opencontainers.image.description=SeaweedFS is a distributed storage system for blobs, objects, files, and data lake, to store and serve billions of files fast!
+            org.opencontainers.image.vendor=Chris Lu
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # v1
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8c0edbc76e98fa90f69d9a2c020dcb50019dc325 # v1
+      -
+        name: Login to Docker Hub
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v1
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+      -
+        name: Build
+        uses: docker/build-push-action@c56af957549030174b10d6867f20e78cfd7debc5 # v2
+        with:
+          context: ./docker
+          push: ${{ github.event_name != 'pull_request' }}
+          file: ./docker/Dockerfile.go_build
+          build-args: TAGS=5BytesOffset
+          platforms: linux/amd64, linux/arm, linux/arm64, linux/386
+          tags: ${{ steps.docker_meta.outputs.tags }}
+          labels: ${{ steps.docker_meta.outputs.labels }}

.github/workflows/container_release3.yml

@@ -0,0 +1,58 @@
+name: "docker: build release containers for rocksdb"
+
+on:
+  push:
+    tags:
+      - '*'
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+jobs:
+
+  build-large-release-container_rocksdb:
+    runs-on: [ubuntu-latest]
+
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v2
+      -
+        name: Docker meta
+        id: docker_meta
+        uses: docker/metadata-action@57396166ad8aefe6098280995947635806a0e6ea # v3
+        with:
+          images: |
+            chrislusf/seaweedfs
+          tags: |
+            type=ref,event=tag,suffix=_large_disk_rocksdb
+          flavor: |
+            latest=false
+          labels: |
+            org.opencontainers.image.title=seaweedfs
+            org.opencontainers.image.description=SeaweedFS is a distributed storage system for blobs, objects, files, and data lake, to store and serve billions of files fast!
+            org.opencontainers.image.vendor=Chris Lu
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # v1
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8c0edbc76e98fa90f69d9a2c020dcb50019dc325 # v1
+      -
+        name: Login to Docker Hub
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v1
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+      -
+        name: Build
+        uses: docker/build-push-action@c56af957549030174b10d6867f20e78cfd7debc5 # v2
+        with:
+          context: ./docker
+          push: ${{ github.event_name != 'pull_request' }}
+          file: ./docker/Dockerfile.rocksdb_large
+          platforms: linux/amd64
+          tags: ${{ steps.docker_meta.outputs.tags }}
+          labels: ${{ steps.docker_meta.outputs.labels }}

.github/workflows/container_release4.yml

@@ -0,0 +1,58 @@
+name: "docker: build release containers for all tags"
+
+on:
+  push:
+    tags:
+      - '*'
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+jobs:
+  build-default-release-container:
+    runs-on: [ubuntu-latest]
+
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v2
+      -
+        name: Docker meta
+        id: docker_meta
+        uses: docker/metadata-action@57396166ad8aefe6098280995947635806a0e6ea # v3
+        with:
+          images: |
+            chrislusf/seaweedfs
+          tags: |
+            type=ref,event=tag,suffix=_full
+          flavor: |
+            latest=false
+          labels: |
+            org.opencontainers.image.title=seaweedfs
+            org.opencontainers.image.description=SeaweedFS is a distributed storage system for blobs, objects, files, and data lake, to store and serve billions of files fast!
+            org.opencontainers.image.vendor=Chris Lu
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # v1
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8c0edbc76e98fa90f69d9a2c020dcb50019dc325 # v1
+      -
+        name: Login to Docker Hub
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v1
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+      -
+        name: Build
+        uses: docker/build-push-action@c56af957549030174b10d6867f20e78cfd7debc5 # v2
+        with:
+          context: ./docker
+          push: ${{ github.event_name != 'pull_request' }}
+          file: ./docker/Dockerfile.go_build
+          build-args: TAGS=elastic,ydb,gocdk,tikv
+          platforms: linux/amd64
+          tags: ${{ steps.docker_meta.outputs.tags }}
+          labels: ${{ steps.docker_meta.outputs.labels }}

.github/workflows/container_release5.yml

@@ -0,0 +1,58 @@
+name: "docker: build release containers for all tags and large volume"
+
+on:
+  push:
+    tags:
+      - '*'
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+jobs:
+  build-default-release-container:
+    runs-on: [ubuntu-latest]
+
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v2
+      -
+        name: Docker meta
+        id: docker_meta
+        uses: docker/metadata-action@57396166ad8aefe6098280995947635806a0e6ea # v3
+        with:
+          images: |
+            chrislusf/seaweedfs
+          tags: |
+            type=ref,event=tag,suffix=_large_disk_full
+          flavor: |
+            latest=false
+          labels: |
+            org.opencontainers.image.title=seaweedfs
+            org.opencontainers.image.description=SeaweedFS is a distributed storage system for blobs, objects, files, and data lake, to store and serve billions of files fast!
+            org.opencontainers.image.vendor=Chris Lu
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # v1
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8c0edbc76e98fa90f69d9a2c020dcb50019dc325 # v1
+      -
+        name: Login to Docker Hub
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v1
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+      -
+        name: Build
+        uses: docker/build-push-action@c56af957549030174b10d6867f20e78cfd7debc5 # v2
+        with:
+          context: ./docker
+          push: ${{ github.event_name != 'pull_request' }}
+          file: ./docker/Dockerfile.go_build
+          build-args: TAGS=5BytesOffset,elastic,ydb,gocdk,tikv
+          platforms: linux/amd64
+          tags: ${{ steps.docker_meta.outputs.tags }}
+          labels: ${{ steps.docker_meta.outputs.labels }}

.github/workflows/container_release_foundationdb.yml

@@ -1,89 +0,0 @@
-name: "docker: build release containers for foundationdb"
-
-on:
-  push:
-    tags:
-      - '*'
-  workflow_dispatch:
-    inputs:
-      release_tag:
-        description: 'Release tag to publish (e.g. 3.93)'
-        required: true
-        default: ''
-
-permissions:
-  contents: read
-
-env:
-  RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.release_tag || github.ref_name }}
-
-jobs:
-
-  build-large-release-container_foundationdb:
-    runs-on: [ubuntu-latest]
-    permissions:
-      contents: read
-      id-token: write
-
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v7
-      -
-        name: Docker meta
-        id: docker_meta
-        uses: docker/metadata-action@v6
-        with:
-          images: |
-            chrislusf/seaweedfs
-          tags: |
-            type=raw,value=${{ env.RELEASE_TAG }}_large_disk_foundationdb
-          flavor: |
-            latest=false
-          labels: |
-            org.opencontainers.image.title=seaweedfs
-            org.opencontainers.image.description=SeaweedFS is a distributed storage system for blobs, objects, files, and data lake, to store and serve billions of files fast!
-            org.opencontainers.image.vendor=Chris Lu
-      -
-        name: Set up QEMU
-        uses: docker/setup-qemu-action@v4.4.0
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-      -
-        name: Login to Docker Hub
-        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v4.6.0
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-      -
-        name: Determine branch to build
-        id: branch
-        run: |
-          if [ "${{ github.event_name }}" = "push" ] && [ -n "${{ github.ref_name }}" ]; then
-            echo "branch=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
-          else
-            echo "branch=master" >> "$GITHUB_OUTPUT"
-          fi
-      -
-        name: Build
-        id: build
-        uses: docker/build-push-action@v7
-        with:
-          context: ./docker
-          push: ${{ github.event_name != 'pull_request' }}
-          file: ./docker/Dockerfile.foundationdb_large
-          build-args: |
-            BRANCH=${{ steps.branch.outputs.branch }}
-          # Note: ARM64 support requires FoundationDB ARM64 packages which are not available for all versions
-          platforms: linux/amd64
-          tags: ${{ steps.docker_meta.outputs.tags }}
-          labels: ${{ steps.docker_meta.outputs.labels }}
-      -
-        name: Sign
-        if: github.event_name != 'pull_request'
-        uses: ./.github/actions/sign-image
-        with:
-          images: chrislusf/seaweedfs@${{ steps.build.outputs.digest }}
-

.github/workflows/container_release_unified.yml

@@ -1,557 +0,0 @@
-name: "docker: build all release containers (unified)"
-
-on:
-  push:
-    tags:
-      - '*'
-  workflow_dispatch:
-    inputs:
-      variant:
-        description: 'Variant to build manually'
-        required: true
-        type: choice
-        default: all
-        options:
-          - all
-          - normal
-          - large_disk
-          - full
-          - large_disk_full
-          - rocksdb
-      release_tag:
-        description: 'Release tag to publish (e.g. 3.93)'
-        required: true
-        default: ''
-      rocksdb_version:
-        description: 'RocksDB git tag to use when variant=rocksdb'
-        required: false
-        default: 'v10.10.1'
-
-permissions:
-  contents: read
-  security-events: write
-
-env:
-  RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.release_tag || github.ref_name }}
-  IMAGE: ghcr.io/chrislusf/seaweedfs
-
-# Limit concurrent builds to avoid rate limits
-concurrency:
-  group: release-${{ github.ref }}
-  cancel-in-progress: false
-
-jobs:
-
-  # ── Pre-build the Rust binaries natively ────────────────────────────
-  # The volume server and the Rust maintenance worker, cross-compiled for
-  # amd64 and arm64 without QEMU, turning a 5-hour emulated cargo build into
-  # ~15 minutes of native compilation.
-  build-rust-binaries:
-    runs-on: ubuntu-22.04
-    strategy:
-      matrix:
-        include:
-          - target: x86_64-unknown-linux-musl
-            arch: amd64
-          - target: aarch64-unknown-linux-musl
-            arch: arm64
-            cross: true
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: ${{ matrix.target }}
-
-      - name: Install musl tools (amd64)
-        if: ${{ !matrix.cross }}
-        run: sudo apt-get install -y musl-tools
-
-      - name: Install cross-compilation tools (arm64)
-        if: matrix.cross
-        run: |
-          sudo apt-get install -y gcc-aarch64-linux-gnu
-          echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER=aarch64-linux-gnu-gcc" >> "$GITHUB_ENV"
-          # Disable glibc fortify source — its __memcpy_chk etc. symbols don't exist in musl
-          echo "CFLAGS_aarch64_unknown_linux_musl=-U_FORTIFY_SOURCE" >> "$GITHUB_ENV"
-
-      - name: Cache cargo registry and target
-        uses: actions/cache@v6
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            seaweed-volume/target
-            seaweed-worker/target/${{ matrix.target }}/release
-          key: rust-docker-${{ matrix.target }}-${{ hashFiles('seaweed-volume/Cargo.lock', 'seaweed-worker/Cargo.lock') }}
-          restore-keys: |
-            rust-docker-${{ matrix.target }}-
-
-      # lance's build scripts compile their own protos and look for a protoc.
-      # Point them at the one protoc-bin-vendored ships, which seaweed-worker's
-      # own build already uses, so no job depends on a system package and every
-      # build sees the same version.
-      - name: Use the vendored protoc
-        run: |
-          cd seaweed-worker
-          cargo fetch
-          # The version from the lock, not whatever else a restored cache holds.
-          version=$(awk '/^name = "protoc-bin-vendored-linux-x86_64"$/{found=1; next} found && /^version = /{gsub(/"/,"",$3); print $3; exit}' Cargo.lock)
-          test -n "$version" || { echo "protoc-bin-vendored-linux-x86_64 is not in Cargo.lock" >&2; exit 1; }
-          protoc=$(find ~/.cargo/registry/src -path "*protoc-bin-vendored-linux-x86_64-$version/bin/protoc" | head -1)
-          test -x "$protoc" || { echo "no vendored protoc $version in the registry" >&2; exit 1; }
-          echo "PROTOC=$protoc" >> "$GITHUB_ENV"
-
-      - name: Build large-disk variant
-        env:
-          SEAWEEDFS_COMMIT: ${{ github.sha }}
-        run: |
-          cd seaweed-volume
-          cargo build --release --target ${{ matrix.target }}
-          cp target/${{ matrix.target }}/release/weed-volume ../weed-volume-large-disk-${{ matrix.arch }}
-
-      - name: Build normal variant
-        env:
-          SEAWEEDFS_COMMIT: ${{ github.sha }}
-        run: |
-          cd seaweed-volume
-          cargo build --release --target ${{ matrix.target }} --no-default-features
-          cp target/${{ matrix.target }}/release/weed-volume ../weed-volume-normal-${{ matrix.arch }}
-
-      - name: Build the Rust maintenance worker
-        run: |
-          cd seaweed-worker
-          cargo build --release -p weed-lance-worker --target ${{ matrix.target }}
-          cp target/${{ matrix.target }}/release/weed-worker ../weed-worker-${{ matrix.arch }}
-
-      - name: Upload artifacts
-        uses: actions/upload-artifact@v7
-        with:
-          name: rust-bins-${{ matrix.arch }}
-          path: |
-            weed-volume-large-disk-${{ matrix.arch }}
-            weed-volume-normal-${{ matrix.arch }}
-            weed-worker-${{ matrix.arch }}
-
-  # One job per (variant, platform) on a native runner, pushed by digest;
-  # the merge job stitches the digests into one multi-arch tag.
-  build:
-    needs: [build-rust-binaries]
-    runs-on: ${{ matrix.runner }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          # Normal volume - multi-arch
-          - { variant: normal, tag_suffix: "",             dockerfile: ./docker/Dockerfile.go_build, build_args: "",               rust_variant: normal,     platform: linux/amd64,  arch: amd64, runner: ubuntu-latest,    qemu: false }
-          - { variant: normal, tag_suffix: "",             dockerfile: ./docker/Dockerfile.go_build, build_args: "",               rust_variant: normal,     platform: linux/arm64,  arch: arm64, runner: ubuntu-24.04-arm, qemu: false }
-          - { variant: normal, tag_suffix: "",             dockerfile: ./docker/Dockerfile.go_build, build_args: "",               rust_variant: normal,     platform: linux/arm/v7, arch: armv7, runner: ubuntu-latest,    qemu: true }
-          - { variant: normal, tag_suffix: "",             dockerfile: ./docker/Dockerfile.go_build, build_args: "",               rust_variant: normal,     platform: linux/386,    arch: i386,  runner: ubuntu-latest,    qemu: false }
-          - { variant: normal, tag_suffix: "",             dockerfile: ./docker/Dockerfile.go_build, build_args: "",               rust_variant: normal,     platform: linux/ppc64le, arch: ppc64le, runner: ubuntu-latest,  qemu: true }
-          - { variant: normal, tag_suffix: "",             dockerfile: ./docker/Dockerfile.go_build, build_args: "",               rust_variant: normal,     platform: linux/s390x,   arch: s390x, runner: ubuntu-latest,    qemu: true }
-
-          # Large disk - multi-arch
-          - { variant: large_disk, tag_suffix: _large_disk, dockerfile: ./docker/Dockerfile.go_build, build_args: TAGS=5BytesOffset, rust_variant: large-disk, platform: linux/amd64,  arch: amd64, runner: ubuntu-latest,    qemu: false }
-          - { variant: large_disk, tag_suffix: _large_disk, dockerfile: ./docker/Dockerfile.go_build, build_args: TAGS=5BytesOffset, rust_variant: large-disk, platform: linux/arm64,  arch: arm64, runner: ubuntu-24.04-arm, qemu: false }
-          - { variant: large_disk, tag_suffix: _large_disk, dockerfile: ./docker/Dockerfile.go_build, build_args: TAGS=5BytesOffset, rust_variant: large-disk, platform: linux/arm/v7, arch: armv7, runner: ubuntu-latest,    qemu: true }
-          - { variant: large_disk, tag_suffix: _large_disk, dockerfile: ./docker/Dockerfile.go_build, build_args: TAGS=5BytesOffset, rust_variant: large-disk, platform: linux/386,    arch: i386,  runner: ubuntu-latest,    qemu: false }
-          - { variant: large_disk, tag_suffix: _large_disk, dockerfile: ./docker/Dockerfile.go_build, build_args: TAGS=5BytesOffset, rust_variant: large-disk, platform: linux/ppc64le, arch: ppc64le, runner: ubuntu-latest,  qemu: true }
-          - { variant: large_disk, tag_suffix: _large_disk, dockerfile: ./docker/Dockerfile.go_build, build_args: TAGS=5BytesOffset, rust_variant: large-disk, platform: linux/s390x,   arch: s390x, runner: ubuntu-latest,    qemu: true }
-
-          # Full tags - multi-arch
-          - { variant: full, tag_suffix: _full, dockerfile: ./docker/Dockerfile.go_build, build_args: "TAGS=elastic,gocdk,rclone,sqlite,tarantool,tikv,ydb", rust_variant: normal, platform: linux/amd64, arch: amd64, runner: ubuntu-latest,    qemu: false }
-          - { variant: full, tag_suffix: _full, dockerfile: ./docker/Dockerfile.go_build, build_args: "TAGS=elastic,gocdk,rclone,sqlite,tarantool,tikv,ydb", rust_variant: normal, platform: linux/arm64, arch: arm64, runner: ubuntu-24.04-arm, qemu: false }
-
-          # Large disk + full tags - multi-arch
-          - { variant: large_disk_full, tag_suffix: _large_disk_full, dockerfile: ./docker/Dockerfile.go_build, build_args: "TAGS=5BytesOffset,elastic,gocdk,rclone,sqlite,tarantool,tikv,ydb", rust_variant: large-disk, platform: linux/amd64, arch: amd64, runner: ubuntu-latest,    qemu: false }
-          - { variant: large_disk_full, tag_suffix: _large_disk_full, dockerfile: ./docker/Dockerfile.go_build, build_args: "TAGS=5BytesOffset,elastic,gocdk,rclone,sqlite,tarantool,tikv,ydb", rust_variant: large-disk, platform: linux/arm64, arch: arm64, runner: ubuntu-24.04-arm, qemu: false }
-
-          # RocksDB large disk - amd64 only
-          - { variant: rocksdb, tag_suffix: _large_disk_rocksdb, dockerfile: ./docker/Dockerfile.rocksdb_large, build_args: "", rust_variant: large-disk, platform: linux/amd64, arch: amd64, runner: ubuntu-latest, qemu: false }
-    steps:
-      - name: Skip unselected variant
-        if: github.event_name == 'workflow_dispatch' && github.event.inputs.variant != 'all' && github.event.inputs.variant != matrix.variant
-        run: echo "Skipping ${{ matrix.variant }} (${{ matrix.platform }})" && exit 0
-
-      - name: Checkout
-        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        uses: actions/checkout@v7
-
-      - name: Download pre-built Rust binaries
-        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        uses: actions/download-artifact@v8
-        with:
-          pattern: rust-bins-*
-          merge-multiple: true
-          path: ./rust-bins
-
-      - name: Place Rust binaries in Docker context
-        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        run: |
-          mkdir -p docker/weed-volume-prebuilt
-          for arch in amd64 arm64; do
-            src="./rust-bins/weed-volume-${{ matrix.rust_variant }}-${arch}"
-            if [ -f "$src" ]; then
-              cp "$src" "docker/weed-volume-prebuilt/weed-volume-${arch}"
-              echo "Placed pre-built Rust binary for ${arch}"
-            fi
-          done
-          mkdir -p docker/weed-worker-prebuilt
-          for arch in amd64 arm64; do
-            src="./rust-bins/weed-worker-${arch}"
-            if [ -f "$src" ]; then
-              cp "$src" "docker/weed-worker-prebuilt/weed-worker-${arch}"
-              echo "Placed pre-built Rust worker for ${arch}"
-            fi
-          done
-          ls -la docker/weed-volume-prebuilt/
-          ls -la docker/weed-worker-prebuilt/
-
-      - name: Free Disk Space
-        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        run: |
-          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL
-          sudo apt-get clean
-          sudo rm -rf /var/lib/apt/lists/*
-          sudo docker system prune -af --volumes
-          [ -d ~/.cache/go-build ] && rm -rf ~/.cache/go-build || true
-          [ -d /go/pkg ] && rm -rf /go/pkg || true
-          df -h
-
-      - name: Docker meta
-        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        id: docker_meta
-        uses: docker/metadata-action@v6
-        with:
-          images: ${{ env.IMAGE }}
-          tags: type=raw,value=${{ env.RELEASE_TAG }}${{ matrix.tag_suffix }}
-          flavor: latest=false
-          labels: |
-            org.opencontainers.image.title=seaweedfs
-            org.opencontainers.image.description=SeaweedFS is a distributed storage system for blobs, objects, files, and data lake, to store and serve billions of files fast!
-            org.opencontainers.image.vendor=Chris Lu
-
-      - name: Set up QEMU
-        if: (github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant) && matrix.qemu
-        uses: docker/setup-qemu-action@v4.4.0
-
-      - name: Create BuildKit config
-        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        run: |
-          cat > /tmp/buildkitd.toml <<EOF
-          [registry."docker.io"]
-            mirrors = ["https://mirror.gcr.io"]
-          EOF
-
-      - name: Set up Docker Buildx
-        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        uses: docker/setup-buildx-action@v4
-        with:
-          buildkitd-config: /tmp/buildkitd.toml
-
-      - name: Login to GHCR
-        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        uses: docker/login-action@v4.6.0
-        with:
-          registry: ghcr.io
-          username: ${{ secrets.GHCR_USERNAME }}
-          password: ${{ secrets.GHCR_TOKEN }}
-
-      - name: Build and push ${{ matrix.variant }} (${{ matrix.platform }})
-        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        id: build
-        uses: docker/build-push-action@v7
-        env:
-          DOCKER_BUILDKIT: 1
-        with:
-          context: ./docker
-          file: ${{ matrix.dockerfile }}
-          platforms: ${{ matrix.platform }}
-          labels: ${{ steps.docker_meta.outputs.labels }}
-          # Flat single-platform manifest so imagetools create assembles cleanly.
-          provenance: false
-          outputs: type=image,name=${{ env.IMAGE }},push-by-digest=true,name-canonical=true,push=true
-          cache-from: type=gha,scope=${{ matrix.variant }}-${{ matrix.arch }}
-          # max only for rocksdb: its RocksDB compile is sha-independent and worth
-          # keeping; go-build layers are sha-busted every release, so min elsewhere.
-          cache-to: type=gha,mode=${{ matrix.variant == 'rocksdb' && 'max' || 'min' }},scope=${{ matrix.variant }}-${{ matrix.arch }}
-          build-args: |
-            ${{ matrix.build_args }}
-            BUILDKIT_INLINE_CACHE=1
-            BRANCH=${{ github.sha }}
-            ${{ matrix.variant == 'rocksdb' && format('ROCKSDB_VERSION={0}', github.event.inputs.rocksdb_version || 'v10.10.1') || '' }}
-
-      - name: Export digest
-        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        run: |
-          mkdir -p /tmp/digests
-          digest="${{ steps.build.outputs.digest }}"
-          touch "/tmp/digests/${digest#sha256:}"
-
-      - name: Upload digest
-        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        uses: actions/upload-artifact@v7
-        with:
-          name: digest-${{ matrix.variant }}-${{ matrix.arch }}
-          path: /tmp/digests/*
-          if-no-files-found: error
-          retention-days: 1
-
-  # Assemble each variant's per-platform digests into one tag, mirror it to
-  # Docker Hub, and sign the result on both registries.
-  merge:
-    needs: [build]
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - { variant: normal,          tag_suffix: "" }
-          - { variant: large_disk,      tag_suffix: _large_disk }
-          - { variant: full,            tag_suffix: _full }
-          - { variant: large_disk_full, tag_suffix: _large_disk_full }
-          - { variant: rocksdb,         tag_suffix: _large_disk_rocksdb }
-    steps:
-      - name: Checkout the signing action
-        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        uses: actions/checkout@v7
-        with:
-          sparse-checkout: .github/actions
-          persist-credentials: false
-
-      - name: Download digests
-        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        uses: actions/download-artifact@v8
-        with:
-          pattern: digest-${{ matrix.variant }}-*
-          merge-multiple: true
-          path: /tmp/digests
-
-      - name: Set up Docker Buildx
-        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        uses: docker/setup-buildx-action@v4
-
-      - name: Login to GHCR
-        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        uses: docker/login-action@v4.6.0
-        with:
-          registry: ghcr.io
-          username: ${{ secrets.GHCR_USERNAME }}
-          password: ${{ secrets.GHCR_TOKEN }}
-
-      - name: Create multi-arch tag on GHCR
-        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        id: manifest
-        working-directory: /tmp/digests
-        run: |
-          docker buildx imagetools create \
-            -t ${{ env.IMAGE }}:${{ env.RELEASE_TAG }}${{ matrix.tag_suffix }} \
-            --metadata-file /tmp/manifest.json \
-            $(printf '${{ env.IMAGE }}@sha256:%s ' *)
-          docker buildx imagetools inspect ${{ env.IMAGE }}:${{ env.RELEASE_TAG }}${{ matrix.tag_suffix }}
-          # The copy and the signature below use the digest this run pushed, not whatever the tag points at by then.
-          digest=$(jq -er '."containerimage.descriptor".digest' /tmp/manifest.json)
-          echo "digest=${digest}" >> "$GITHUB_OUTPUT"
-
-      - name: Login to Docker Hub
-        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        uses: docker/login-action@v4.6.0
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Install crane
-        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        run: |
-          cd $(mktemp -d)
-          curl -sLO https://github.com/google/go-containerregistry/releases/download/v0.22.0/go-containerregistry_Linux_x86_64.tar.gz
-          echo "edb74d53fad9a596860f59d1c5d04a43dfb5f441dc71f57060dd0bf39483c833  go-containerregistry_Linux_x86_64.tar.gz" | sha256sum -c -
-          tar xzf go-containerregistry_Linux_x86_64.tar.gz crane
-          sudo mv crane /usr/local/bin/
-          crane version
-
-      - name: Copy ${{ matrix.variant }} to Docker Hub
-        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        run: |
-          retry_with_backoff() {
-            local max_attempts=5
-            local timeout=1
-            local attempt=1
-            local exit_code=0
-            while [ $attempt -le $max_attempts ]; do
-              if "$@"; then
-                return 0
-              else
-                exit_code=$?
-              fi
-              if [ $attempt -lt $max_attempts ]; then
-                echo "Attempt $attempt failed. Retrying in ${timeout}s..." >&2
-                sleep $timeout
-                timeout=$((timeout * 2))
-              fi
-              attempt=$((attempt + 1))
-            done
-            echo "Command failed after $max_attempts attempts" >&2
-            return $exit_code
-          }
-
-          echo "Copying ${{ matrix.variant }} from GHCR to Docker Hub..."
-          retry_with_backoff crane copy \
-            ${{ env.IMAGE }}@${{ steps.manifest.outputs.digest }} \
-            chrislusf/seaweedfs:${{ env.RELEASE_TAG }}${{ matrix.tag_suffix }}
-          echo "Copied ${{ matrix.variant }} to Docker Hub"
-
-      - name: Sign ${{ matrix.variant }}
-        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        uses: ./.github/actions/sign-image
-        with:
-          images: >-
-            ${{ env.IMAGE }}@${{ steps.manifest.outputs.digest }}
-            chrislusf/seaweedfs@${{ steps.manifest.outputs.digest }}
-
-  # Report-only trivy scan: uploads fixable HIGH/CRITICAL findings to GitHub
-  # Security for visibility, but never blocks the release. Releases (including
-  # `latest`) ship regardless — vulnerabilities are tracked, not gated, since
-  # we sometimes need to publish through known findings (e.g. unfixed upstream
-  # CVE, base-image lag).
-  trivy-scan:
-    runs-on: ubuntu-latest
-    needs: [merge]
-    if: github.event_name == 'push'
-    continue-on-error: true
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - source_suffix: ""
-            variant: normal
-          - source_suffix: _large_disk
-            variant: large_disk
-    steps:
-      - name: Login to GHCR
-        uses: docker/login-action@v4.6.0
-        with:
-          registry: ghcr.io
-          username: ${{ secrets.GHCR_USERNAME }}
-          password: ${{ secrets.GHCR_TOKEN }}
-
-      - name: Trivy report (${{ matrix.variant }})
-        # Pin to SHA - mutable tags were compromised (GHSA-69fq-xp46-6x23)
-        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
-        with:
-          scan-type: image
-          # Scan the multi-arch tag on GHCR (already pushed by the build job).
-          # Trivy scans the runner's native platform; OS packages are identical
-          # across architectures since they all share the same alpine base.
-          image-ref: ${{ env.IMAGE }}:${{ env.RELEASE_TAG }}${{ matrix.source_suffix }}
-          scanners: vuln
-          vuln-type: os,library
-          severity: HIGH,CRITICAL
-          ignore-unfixed: true
-          limit-severities-for-sarif: true
-          format: sarif
-          output: trivy-results.sarif
-          exit-code: '0'
-
-      - name: Upload Trivy scan results to GitHub Security
-        if: always()
-        uses: github/codeql-action/upload-sarif@v4.38.2
-        with:
-          sarif_file: trivy-results.sarif
-          category: trivy-${{ matrix.variant }}
-
-  # Point `latest` (and `latest_large_disk`) at the just-released versioned
-  # image. crane tag adds an extra tag to an existing manifest — no rebuild,
-  # no QEMU, no separate workflow. Replaces the old container_latest.yml
-  # rebuild that often failed or lagged behind the release. Independent of
-  # trivy-scan: vuln findings are reported but do not block `latest`. The
-  # cosign signature is attached to the digest, so `latest` carries it too.
-  tag-latest:
-    runs-on: ubuntu-latest
-    needs: [merge]
-    if: github.event_name == 'push'
-    strategy:
-      matrix:
-        include:
-          - source_suffix: ""
-            latest_tag: latest
-          - source_suffix: _large_disk
-            latest_tag: latest_large_disk
-    steps:
-      - name: Login to Docker Hub
-        uses: docker/login-action@v4.6.0
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Login to GHCR
-        uses: docker/login-action@v4.6.0
-        with:
-          registry: ghcr.io
-          username: ${{ secrets.GHCR_USERNAME }}
-          password: ${{ secrets.GHCR_TOKEN }}
-
-      - name: Install crane
-        run: |
-          cd $(mktemp -d)
-          curl -sLO https://github.com/google/go-containerregistry/releases/download/v0.22.0/go-containerregistry_Linux_x86_64.tar.gz
-          echo "edb74d53fad9a596860f59d1c5d04a43dfb5f441dc71f57060dd0bf39483c833  go-containerregistry_Linux_x86_64.tar.gz" | sha256sum -c -
-          tar xzf go-containerregistry_Linux_x86_64.tar.gz crane
-          sudo mv crane /usr/local/bin/
-          crane version
-
-      - name: Re-tag ${{ env.RELEASE_TAG }}${{ matrix.source_suffix }} as ${{ matrix.latest_tag }}
-        run: |
-          retry_with_backoff() {
-            local max_attempts=5
-            local timeout=1
-            local attempt=1
-            local exit_code=0
-            while [ $attempt -le $max_attempts ]; do
-              if "$@"; then
-                return 0
-              else
-                exit_code=$?
-              fi
-              if [ $attempt -lt $max_attempts ]; then
-                echo "Attempt $attempt failed. Retrying in ${timeout}s..." >&2
-                sleep $timeout
-                timeout=$((timeout * 2))
-              fi
-              attempt=$((attempt + 1))
-            done
-            echo "Command failed after $max_attempts attempts" >&2
-            return $exit_code
-          }
-
-          SRC_TAG="${{ env.RELEASE_TAG }}${{ matrix.source_suffix }}"
-          DST_TAG="${{ matrix.latest_tag }}"
-
-          echo "Tagging ${{ env.IMAGE }}:${SRC_TAG} as ${DST_TAG}"
-          retry_with_backoff crane tag "${{ env.IMAGE }}:${SRC_TAG}" "${DST_TAG}"
-
-          echo "Tagging chrislusf/seaweedfs:${SRC_TAG} as ${DST_TAG}"
-          retry_with_backoff crane tag "chrislusf/seaweedfs:${SRC_TAG}" "${DST_TAG}"
-
-  helm-release:
-    runs-on: ubuntu-latest
-    needs: [build]
-    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
-    permissions:
-      contents: write
-      pages: write
-    steps:
-      - uses: actions/checkout@v7
-      - name: Publish Helm charts
-        uses: stefanprodan/helm-gh-pages@v1.7.0
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          charts_dir: k8s/charts
-          target_dir: helm
-          branch: gh-pages
-          helm_version: "3.18.4"

.github/workflows/container_rocksdb_version.yml

@@ -1,119 +0,0 @@
-name: "docker: build rocksdb image by version"
-
-on:
-  workflow_dispatch:
-    inputs:
-      rocksdb_version:
-        description: 'RocksDB git tag or branch to build (e.g. v10.10.1)'
-        required: true
-        default: 'v10.10.1'
-      seaweedfs_ref:
-        description: 'SeaweedFS git tag, branch, or commit to build'
-        required: true
-        default: 'master'
-      image_tag:
-        description: 'Optional Docker tag suffix (defaults to rocksdb_<rocksdb>_seaweedfs_<ref>)'
-        required: false
-        default: ''
-
-permissions:
-  contents: read
-
-jobs:
-  build-rocksdb-image:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v2
-
-      - name: Prepare Docker tag
-        id: tag
-        env:
-          ROCKSDB_VERSION_INPUT: ${{ inputs.rocksdb_version }}
-          SEAWEEDFS_REF_INPUT: ${{ inputs.seaweedfs_ref }}
-          CUSTOM_TAG_INPUT: ${{ inputs.image_tag }}
-        run: |
-          set -euo pipefail
-          sanitize() {
-            local value="$1"
-            value="${value,,}"
-            value="${value// /-}"
-            value="${value//[^a-z0-9_.-]/-}"
-            value="${value#-}"
-            value="${value%-}"
-            printf '%s' "$value"
-          }
-          version="${ROCKSDB_VERSION_INPUT}"
-          seaweed="${SEAWEEDFS_REF_INPUT}"
-          tag="${CUSTOM_TAG_INPUT}"
-          if [ -z "$version" ]; then
-            echo "RocksDB version input is required." >&2
-            exit 1
-          fi
-          if [ -z "$seaweed" ]; then
-            echo "SeaweedFS ref input is required." >&2
-            exit 1
-          fi
-          sanitized_version="$(sanitize "$version")"
-          if [ -z "$sanitized_version" ]; then
-            echo "Unable to sanitize RocksDB version '$version'." >&2
-            exit 1
-          fi
-          sanitized_seaweed="$(sanitize "$seaweed")"
-          if [ -z "$sanitized_seaweed" ]; then
-            echo "Unable to sanitize SeaweedFS ref '$seaweed'." >&2
-            exit 1
-          fi
-          if [ -z "$tag" ]; then
-            tag="rocksdb_${sanitized_version}_seaweedfs_${sanitized_seaweed}"
-          fi
-          tag="${tag,,}"
-          tag="${tag// /-}"
-          tag="${tag//[^a-z0-9_.-]/-}"
-          tag="${tag#-}"
-          tag="${tag%-}"
-          if [ -z "$tag" ]; then
-            echo "Resulting Docker tag is empty." >&2
-            exit 1
-          fi
-          echo "docker_tag=$tag" >> "$GITHUB_OUTPUT"
-          echo "full_image=chrislusf/seaweedfs:$tag" >> "$GITHUB_OUTPUT"
-          echo "seaweedfs_ref=$seaweed" >> "$GITHUB_OUTPUT"
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v1
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v1
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v1
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Build and push image
-        id: build
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v2
-        with:
-          context: ./docker
-          push: true
-          file: ./docker/Dockerfile.rocksdb_large
-          build-args: |
-            ROCKSDB_VERSION=${{ inputs.rocksdb_version }}
-            BRANCH=${{ inputs.seaweedfs_ref }}
-          platforms: linux/amd64
-          tags: ${{ steps.tag.outputs.full_image }}
-          labels: |
-            org.opencontainers.image.title=seaweedfs
-            org.opencontainers.image.description=SeaweedFS is a distributed storage system for blobs, objects, files, and data lake, to store and serve billions of files fast!
-            org.opencontainers.image.vendor=Chris Lu
-
-      - name: Sign
-        uses: ./.github/actions/sign-image
-        with:
-          images: chrislusf/seaweedfs@${{ steps.build.outputs.digest }}

.github/workflows/deploy_telemetry.yml

@@ -1,184 +0,0 @@
-# This workflow will build and deploy the SeaweedFS telemetry server
-# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-go
-
-name: Deploy Telemetry Server
-
-on:
-  workflow_dispatch:
-    inputs:
-      setup:
-        description: 'Run first-time server setup'
-        required: true
-        type: boolean
-        default: false
-      deploy:
-        description: 'Deploy telemetry server to remote server'
-        required: true
-        type: boolean
-        default: false
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'telemetry/server/go.mod'
-
-      - name: Build Telemetry Server
-        if: github.event_name == 'workflow_dispatch' && inputs.deploy
-        run: |
-          # telemetry/server is its own Go module; build from within it
-          cd telemetry/server
-          go mod tidy
-          echo "Building telemetry server..."
-          CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o ../../telemetry-server .
-          cd ../..
-          ls -la telemetry-server
-          echo "Build completed successfully"
-
-      - name: Generate Service Configuration
-        if: github.event_name == 'workflow_dispatch' && (inputs.setup || inputs.deploy)
-        env:
-          REMOTE_USER: ${{ secrets.TELEMETRY_USER }}
-        run: |
-          # Create systemd service file
-          echo "
-          [Unit]
-          Description=SeaweedFS Telemetry Server
-          After=network.target
-
-          [Service]
-          Type=simple
-          User=$REMOTE_USER
-          WorkingDirectory=/home/$REMOTE_USER/seaweedfs-telemetry
-          ExecStart=/bin/sh -c 'exec /home/$REMOTE_USER/seaweedfs-telemetry/bin/telemetry-server -port=8353 >>/home/$REMOTE_USER/seaweedfs-telemetry/logs/telemetry.log 2>>/home/$REMOTE_USER/seaweedfs-telemetry/logs/telemetry.error.log'
-          Restart=always
-          RestartSec=5
-
-          [Install]
-          WantedBy=multi-user.target" > telemetry.service
-
-          # Setup logrotate configuration
-          echo "# SeaweedFS Telemetry service log rotation
-          /home/$REMOTE_USER/seaweedfs-telemetry/logs/*.log {
-              daily
-              rotate 30
-              compress
-              delaycompress
-              missingok
-              notifempty
-              create 644 $REMOTE_USER $REMOTE_USER
-              postrotate
-                  systemctl restart telemetry.service
-              endscript
-          }" > telemetry_logrotate
-
-      - name: First-time Server Setup
-        if: github.event_name == 'workflow_dispatch' && inputs.setup
-        env:
-          SSH_PRIVATE_KEY: ${{ secrets.TELEMETRY_SSH_PRIVATE_KEY }}
-          REMOTE_HOST: ${{ secrets.TELEMETRY_HOST }}
-          REMOTE_USER: ${{ secrets.TELEMETRY_USER }}
-        run: |
-          mkdir -p ~/.ssh
-          echo "$SSH_PRIVATE_KEY" > ~/.ssh/deploy_key
-          chmod 600 ~/.ssh/deploy_key
-          echo "Host *" > ~/.ssh/config
-          echo "  StrictHostKeyChecking no" >> ~/.ssh/config
-
-          # Create all required directories with proper permissions
-          ssh -i ~/.ssh/deploy_key $REMOTE_USER@$REMOTE_HOST "
-            mkdir -p ~/seaweedfs-telemetry/bin ~/seaweedfs-telemetry/logs ~/seaweedfs-telemetry/data ~/seaweedfs-telemetry/tmp && \
-            chmod 755 ~/seaweedfs-telemetry/logs && \
-            chmod 755 ~/seaweedfs-telemetry/data && \
-            touch ~/seaweedfs-telemetry/logs/telemetry.log ~/seaweedfs-telemetry/logs/telemetry.error.log && \
-            chmod 644 ~/seaweedfs-telemetry/logs/*.log"
-
-          # Copy configuration files
-          scp -i ~/.ssh/deploy_key telemetry/grafana-dashboard.json $REMOTE_USER@$REMOTE_HOST:~/seaweedfs-telemetry/
-          scp -i ~/.ssh/deploy_key telemetry/prometheus.yml $REMOTE_USER@$REMOTE_HOST:~/seaweedfs-telemetry/
-
-          # Copy and install service and logrotate files
-          scp -i ~/.ssh/deploy_key telemetry.service telemetry_logrotate $REMOTE_USER@$REMOTE_HOST:~/seaweedfs-telemetry/
-          ssh -i ~/.ssh/deploy_key $REMOTE_USER@$REMOTE_HOST "
-            sudo mv ~/seaweedfs-telemetry/telemetry.service /etc/systemd/system/ && \
-            sudo mv ~/seaweedfs-telemetry/telemetry_logrotate /etc/logrotate.d/seaweedfs-telemetry && \
-            sudo systemctl daemon-reload && \
-            sudo systemctl enable telemetry.service"
-
-          echo "✅ First-time setup completed successfully!"
-          echo "📋 Next step: Run the deployment to install the telemetry server binary"
-          echo "   1. Go to GitHub Actions → Deploy Telemetry Server"
-          echo "   2. Click 'Run workflow'"
-          echo "   3. Check 'Deploy telemetry server to remote server'"
-          echo "   4. Click 'Run workflow'"
-
-          rm -f ~/.ssh/deploy_key
-
-      - name: Deploy Telemetry Server to Remote Server
-        if: github.event_name == 'workflow_dispatch' && inputs.deploy
-        env:
-          SSH_PRIVATE_KEY: ${{ secrets.TELEMETRY_SSH_PRIVATE_KEY }}
-          REMOTE_HOST: ${{ secrets.TELEMETRY_HOST }}
-          REMOTE_USER: ${{ secrets.TELEMETRY_USER }}
-        run: |
-          mkdir -p ~/.ssh
-          echo "$SSH_PRIVATE_KEY" > ~/.ssh/deploy_key
-          chmod 600 ~/.ssh/deploy_key
-          echo "Host *" > ~/.ssh/config
-          echo "  StrictHostKeyChecking no" >> ~/.ssh/config
-
-          # Create temp directory and copy binary
-          ssh -i ~/.ssh/deploy_key $REMOTE_USER@$REMOTE_HOST "mkdir -p ~/seaweedfs-telemetry/tmp"
-          scp -i ~/.ssh/deploy_key telemetry-server $REMOTE_USER@$REMOTE_HOST:~/seaweedfs-telemetry/tmp/
-
-          # Copy updated configuration files
-          scp -i ~/.ssh/deploy_key telemetry/grafana-dashboard.json $REMOTE_USER@$REMOTE_HOST:~/seaweedfs-telemetry/
-          scp -i ~/.ssh/deploy_key telemetry/prometheus.yml $REMOTE_USER@$REMOTE_HOST:~/seaweedfs-telemetry/
-
-          # Copy updated service and logrotate files
-          scp -i ~/.ssh/deploy_key telemetry.service telemetry_logrotate $REMOTE_USER@$REMOTE_HOST:~/seaweedfs-telemetry/
-
-          # Check if service exists and deploy accordingly
-          ssh -i ~/.ssh/deploy_key $REMOTE_USER@$REMOTE_HOST "
-            if systemctl list-unit-files telemetry.service >/dev/null 2>&1; then
-              echo 'Service exists, performing update...'
-              set -e
-              sudo systemctl stop telemetry.service
-              sudo mv ~/seaweedfs-telemetry/telemetry.service /etc/systemd/system/
-              sudo mv ~/seaweedfs-telemetry/telemetry_logrotate /etc/logrotate.d/seaweedfs-telemetry
-              sudo systemctl daemon-reload
-              mkdir -p ~/seaweedfs-telemetry/bin
-              mv ~/seaweedfs-telemetry/tmp/telemetry-server ~/seaweedfs-telemetry/bin/
-              chmod +x ~/seaweedfs-telemetry/bin/telemetry-server
-              sudo systemctl start telemetry.service
-              sudo systemctl status telemetry.service
-            else
-              echo 'ERROR: telemetry.service not found!'
-              echo 'Please run the first-time setup before deploying.'
-              echo 'Go to GitHub Actions → Deploy Telemetry Server → Run workflow → Check \"Run first-time server setup\"'
-              exit 1
-            fi"
-
-          # Verify deployment
-          ssh -i ~/.ssh/deploy_key $REMOTE_USER@$REMOTE_HOST "
-            echo 'Waiting for service to start...'
-            sleep 5
-            curl -f http://localhost:8353/health || echo 'Health check failed'"
-
-          rm -f ~/.ssh/deploy_key
-
-      - name: Notify Deployment Status
-        if: always()
-        run: |
-          if [ "${{ job.status }}" == "success" ]; then
-            echo "✅ Telemetry server deployment successful"
-            echo "Dashboard: http://${{ secrets.TELEMETRY_HOST }}:8353"
-            echo "Metrics: http://${{ secrets.TELEMETRY_HOST }}:8353/metrics"
-          else
-            echo "❌ Telemetry server deployment failed"
-          fi 

.github/workflows/depsreview.yml

@@ -9,6 +9,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Checkout Repository'
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294
+        uses: actions/dependency-review-action@11310527b429536e263dc6cc47873e608189ba21

.github/workflows/e2e.yml

@@ -3,20 +3,8 @@ name: "End to End"
 on:
   push:
     branches: [ master ]
-    paths:
-      - 'weed/**'
-      - 'docker/**'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/e2e.yml'
   pull_request:
     branches: [ master ]
-    paths:
-      - 'weed/**'
-      - 'docker/**'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/e2e.yml'
 
 concurrency:
   group: ${{ github.head_ref }}/e2e
@@ -33,114 +21,49 @@ jobs:
   e2e:
     name: FUSE Mount
     runs-on: ubuntu-22.04
-    timeout-minutes: 30
+    timeout-minutes: 15
     steps:
+    - name: Set up Go 1.x
+      uses: actions/setup-go@d0a58c1c4d2b25278816e339b944508c875f3613 # v2
+      with:
+        go-version: ^1.13
+      id: go
+
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v7
-
-    - name: Set up Go
-      uses: actions/setup-go@v7
-      with:
-        go-version-file: 'go.mod'
-
-    - name: Configure Docker Hub mirror
-      run: |
-        echo '{"registry-mirrors": ["https://mirror.gcr.io"]}' | sudo tee /etc/docker/daemon.json
-        sudo systemctl restart docker
-
-    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v4
-      
-    - name: Cache Docker layers
-      uses: actions/cache@v6
-      with:
-        path: /tmp/.buildx-cache
-        key: ${{ runner.os }}-buildx-e2e-${{ github.sha }}
-        restore-keys: |
-          ${{ runner.os }}-buildx-e2e-
+      uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v2
 
     - name: Install dependencies
       run: |
-        sudo rm -f /etc/apt/sources.list.d/azure-cli.list /etc/apt/sources.list.d/microsoft-prod.list
-        # Same helper the e2e image installs through: the runner's own list is
-        # azure-only too, and an outage there fails this step outright.
-        sudo ./apt-install fuse
-        
-        # Verify FUSE installation
-        echo "FUSE version: $(fusermount --version 2>&1 || echo 'fusermount not found')"
-        echo "FUSE device: $(ls -la /dev/fuse 2>&1 || echo '/dev/fuse not found')"
+        sudo apt-get update
+        sudo apt-get install -y fuse
 
     - name: Start SeaweedFS
-      timeout-minutes: 15
-      run: |
-        # Enable Docker buildkit for better caching
-        export DOCKER_BUILDKIT=1
-        export COMPOSE_DOCKER_CLI_BUILD=1
+      timeout-minutes: 5
+      run: make build_e2e && docker compose -f ./compose/e2e-mount.yml up --wait
 
-        # Build with retry logic
-        for i in {1..3}; do
-          echo "Build attempt $i/3"
-          if make build_e2e; then
-            echo "Build successful on attempt $i"
-            break
-          elif [ $i -eq 3 ]; then
-            echo "Build failed after 3 attempts"
-            exit 1
-          else
-            echo "Build attempt $i failed, retrying in 30 seconds..."
-            sleep 30
-          fi
-        done
-
-        # Start services with wait
-        docker compose -f ./compose/e2e-mount.yml up --wait
-
-    - name: Rotate buildx cache
-      if: always()
-      run: |
-        # Without this, --cache-to writes to .buildx-cache-new but actions/cache only
-        # uploads .buildx-cache, so layers (notably the slow apt RUN) never persist.
-        rm -rf /tmp/.buildx-cache
-        if [ -d /tmp/.buildx-cache-new ]; then mv /tmp/.buildx-cache-new /tmp/.buildx-cache; fi
-
-    - name: Run FIO 4k
-      timeout-minutes: 15
+    - name: Run FIO
+      timeout-minutes: 5
       run: |
         echo "Starting FIO at: $(date)"
         # Concurrent r/w
         echo 'Run randrw with size=16M bs=4k'
-        docker compose -f ./compose/e2e-mount.yml exec mount timeout -k5 60 fio --name=fiotest --filename=/mnt/seaweedfs/fiotest --size=16M --rw=randrw --bs=4k --direct=1 --numjobs=8 --ioengine=libaio --group_reporting --runtime=30 --time_based=1
-
-        echo "Verify FIO at: $(date)"
+        docker compose -f ./compose/e2e-mount.yml exec mount timeout -k5 40 fio --name=fiotest --filename=/mnt/seaweedfs/fiotest --size=16M --rw=randrw --bs=4k --direct=1 --numjobs=8 --ioengine=libaio --iodepth=32 --group_reporting --runtime=30 --time_based=1
+        
+        echo 'Run randrw with size=16M bs=128k'
+        docker compose -f ./compose/e2e-mount.yml exec mount timeout -k5 40 fio --name=fiotest --filename=/mnt/seaweedfs/fiotest --size=16M --rw=randrw --bs=128k --direct=1 --numjobs=8 --ioengine=libaio --iodepth=32 --group_reporting --runtime=30 --time_based=1
+        
+        echo 'Run randrw with size=16M bs=1m'
+        docker compose -f ./compose/e2e-mount.yml exec mount timeout -k5 40 fio --name=fiotest --filename=/mnt/seaweedfs/fiotest --size=16M --rw=randrw --bs=1m --direct=1 --numjobs=8 --ioengine=libaio --iodepth=32 --group_reporting --runtime=30 --time_based=1
+        
         # Verified write
         echo 'Run randwrite with size=16M bs=4k'
-        docker compose -f ./compose/e2e-mount.yml exec mount timeout -k5 60 fio --name=fiotest --filename=/mnt/seaweedfs/fiotest --size=16M --rw=randwrite --bs=4k --direct=1 --numjobs=8 --ioengine=libaio --iodepth=32 --group_reporting --runtime=30 --time_based=1 --do_verify=0 --verify=crc32c --verify_backlog=1
-
-    - name: Run FIO 128k
-      timeout-minutes: 15
-      run: |
-        echo "Starting FIO at: $(date)"
-        # Concurrent r/w
-        echo 'Run randrw with size=16M bs=128k'
-        docker compose -f ./compose/e2e-mount.yml exec mount timeout -k5 60 fio --name=fiotest --filename=/mnt/seaweedfs/fiotest --size=16M --rw=randrw --bs=128k --direct=1 --numjobs=8 --ioengine=libaio --iodepth=32 --group_reporting --runtime=30 --time_based=1
-
-        echo "Verify FIO at: $(date)"
-        # Verified write
+        docker compose -f ./compose/e2e-mount.yml exec mount timeout -k5 40 fio --name=fiotest --filename=/mnt/seaweedfs/fiotest --size=16M --rw=randwrite --bs=4k --direct=1 --numjobs=8 --ioengine=libaio --iodepth=32 --group_reporting --runtime=30 --time_based=1 --do_verify=0 --verify=crc32c --verify_backlog=1
+        
         echo 'Run randwrite with size=16M bs=128k'
-        docker compose -f ./compose/e2e-mount.yml exec mount timeout -k5 60 fio --name=fiotest --filename=/mnt/seaweedfs/fiotest --size=16M --rw=randwrite --bs=128k --direct=1 --numjobs=8 --ioengine=libaio --iodepth=32 --group_reporting --runtime=30 --time_based=1 --do_verify=0 --verify=crc32c --verify_backlog=1
-
-    - name: Run FIO 1MB
-      timeout-minutes: 15
-      run: |
-        echo "Starting FIO at: $(date)"
-        # Concurrent r/w
-        echo 'Run randrw with size=16M bs=1m'
-        docker compose -f ./compose/e2e-mount.yml exec mount timeout -k5 60 fio --name=fiotest --filename=/mnt/seaweedfs/fiotest --size=16M --rw=randrw --bs=1m --direct=1 --numjobs=8 --ioengine=libaio --iodepth=32 --group_reporting --runtime=30 --time_based=1
+        docker compose -f ./compose/e2e-mount.yml exec mount timeout -k5 40 fio --name=fiotest --filename=/mnt/seaweedfs/fiotest --size=16M --rw=randwrite --bs=128k --direct=1 --numjobs=8 --ioengine=libaio --iodepth=32 --group_reporting --runtime=30 --time_based=1 --do_verify=0 --verify=crc32c --verify_backlog=1
         
-        echo "Verify FIO at: $(date)"
-        # Verified write
         echo 'Run randwrite with size=16M bs=1m'
-        docker compose -f ./compose/e2e-mount.yml exec mount timeout -k5 60 fio --name=fiotest --filename=/mnt/seaweedfs/fiotest --size=16M --rw=randwrite --bs=1m --direct=1 --numjobs=8 --ioengine=libaio --iodepth=32 --group_reporting --runtime=30 --time_based=1 --do_verify=0 --verify=crc32c --verify_backlog=1
+        docker compose -f ./compose/e2e-mount.yml exec mount timeout -k5 40 fio --name=fiotest --filename=/mnt/seaweedfs/fiotest --size=16M --rw=randwrite --bs=1m --direct=1 --numjobs=8 --ioengine=libaio --iodepth=32 --group_reporting --runtime=30 --time_based=1 --do_verify=0 --verify=crc32c --verify_backlog=1
 
     - name: Save logs
       if: always()
@@ -156,7 +79,7 @@ jobs:
 
     - name: Archive logs
       if: always()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@v3
       with:
         name: output-logs
         path: docker/output.log

.github/workflows/ec-integration-tests.yml

@@ -1,76 +0,0 @@
-name: "EC Integration Tests"
-
-on:
-  push:
-    branches: [ master ]
-    paths:
-      - 'weed/**'
-      - 'test/erasure_coding/**'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/ec-integration-tests.yml'
-  pull_request:
-    branches: [ master ]
-    paths:
-      - 'weed/**'
-      - 'test/erasure_coding/**'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/ec-integration-tests.yml'
-
-permissions:
-  contents: read
-
-jobs:
-  ec-integration-tests:
-    name: EC Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-    steps:
-    - name: Set up Go 1.x
-      uses: actions/setup-go@v7
-      with:
-        go-version: ^1.26
-      id: go
-
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v7
-
-    - name: Build weed binary
-      run: |
-        cd weed && go build -o weed .
-
-    - name: Run EC Integration Tests
-      working-directory: test/erasure_coding
-      run: |
-        # The suite now includes the interruption matrix and runs close to Go's
-        # default 10m binary timeout on slower runners; bound it by the job's
-        # 30m budget instead.
-        go test -v -timeout 25m
-
-    - name: Collect server logs on failure
-      if: failure()
-      run: |
-        echo "Collecting server logs from temp directories..."
-        mkdir -p /tmp/ec-test-logs
-        # Find all temp directories created by the tests (they persist on failure with t.TempDir())
-        find /tmp -maxdepth 1 -type d \( -name "TestEC*" -o -name "TestDisk*" -o -name "TestCross*" -o -name "TestEvacuation*" \) 2>/dev/null | while read dir; do
-          if [ -d "$dir" ]; then
-            echo "Found test directory: $dir"
-            # Copy the entire directory structure to preserve organization
-            cp -r "$dir" /tmp/ec-test-logs/ 2>/dev/null || true
-          fi
-        done
-        # List what we collected
-        echo "Collected logs:"
-        find /tmp/ec-test-logs -type f -name "*.log" 2>/dev/null || echo "No logs found"
-
-    - name: Archive logs
-      if: failure()
-      uses: actions/upload-artifact@v7
-      with:
-        name: ec-integration-test-logs
-        path: |
-          /tmp/ec-test-logs/
-          test/erasure_coding/
-        if-no-files-found: warn

.github/workflows/fuse-dlm-integration.yml

@@ -1,69 +0,0 @@
-name: "FUSE DLM Integration Tests"
-
-on:
-  pull_request:
-    paths:
-      - 'weed/command/mount*.go'
-      - 'weed/mount/**'
-      - 'weed/cluster/**'
-      - 'test/fuse_dlm/**'
-      - '.github/workflows/fuse-dlm-integration.yml'
-      - '.github/actions/fix-fusermount-setuid/**'
-  push:
-    branches: [master]
-    paths:
-      - 'weed/command/mount*.go'
-      - 'weed/mount/**'
-      - 'weed/cluster/**'
-      - 'test/fuse_dlm/**'
-      - '.github/actions/fix-fusermount-setuid/**'
-
-concurrency:
-  group: ${{ github.head_ref || github.ref }}/fuse-dlm-integration
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  fuse-dlm-integration:
-    name: FUSE DLM Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-
-      - name: Configure FUSE
-        run: |
-          # Nothing to install: fuse3 ships fusermount3 and is pre-installed,
-          # and go-fuse is pure Go, so the libfuse headers were never linked
-          # against.
-          echo 'user_allow_other' | sudo tee -a /etc/fuse.conf
-          sudo chmod 644 /etc/fuse.conf
-
-      - name: Repair the fusermount3 setuid bit
-        uses: ./.github/actions/fix-fusermount-setuid
-
-      - name: Build SeaweedFS
-        run: go build -o weed/weed -buildvcs=false ./weed
-
-      - name: Run DLM integration tests
-        timeout-minutes: 25
-        env:
-          WEED_BINARY: ${{ github.workspace }}/weed/weed
-        run: go test -v -count=1 -timeout=20m ./test/fuse_dlm/...
-
-      - name: Upload logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: fuse-dlm-test-logs
-          path: /tmp/seaweedfs-fuse-dlm-logs/
-          retention-days: 3

.github/workflows/fuse-failover.yml

@@ -1,76 +0,0 @@
-name: "FUSE Volume Server Failover Tests"
-
-on:
-  pull_request:
-    paths:
-      - 'weed/command/mount*.go'
-      - 'weed/mount/**'
-      - 'weed/filer/**'
-      - 'weed/wdclient/**'
-      - 'weed/operation/upload_content.go'
-      - 'test/fuse_failover/**'
-      - '.github/workflows/fuse-failover.yml'
-      - '.github/actions/fix-fusermount-setuid/**'
-  push:
-    branches: [master]
-    paths:
-      - 'weed/command/mount*.go'
-      - 'weed/mount/**'
-      - 'weed/filer/**'
-      - 'weed/wdclient/**'
-      - 'weed/operation/upload_content.go'
-      - 'test/fuse_failover/**'
-      - '.github/workflows/fuse-failover.yml'
-      - '.github/actions/fix-fusermount-setuid/**'
-
-concurrency:
-  group: ${{ github.head_ref || github.ref }}/fuse-failover
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  fuse-failover:
-    name: FUSE Volume Server Failover
-    runs-on: ubuntu-22.04
-    timeout-minutes: 40
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-
-      - name: Configure FUSE
-        run: |
-          # Nothing to install: fuse3 ships fusermount3 and is pre-installed,
-          # and go-fuse is pure Go, so the libfuse headers were never linked
-          # against.
-          echo 'user_allow_other' | sudo tee -a /etc/fuse.conf
-          sudo chmod 644 /etc/fuse.conf
-
-      - name: Repair the fusermount3 setuid bit
-        uses: ./.github/actions/fix-fusermount-setuid
-
-      - name: Build SeaweedFS
-        run: go build -o weed/weed -buildvcs=false ./weed
-
-      - name: Run failover integration tests
-        timeout-minutes: 35
-        env:
-          WEED_BINARY: ${{ github.workspace }}/weed/weed
-        run: go test -v -count=1 -timeout=30m ./test/fuse_failover/...
-
-      - name: Upload logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: fuse-failover-test-logs
-          path: /tmp/seaweedfs-fuse-failover-logs/
-          retention-days: 3

.github/workflows/fuse-integration.yml

@@ -1,84 +0,0 @@
-name: "FUSE Integration Tests"
-
-on:
-  push:
-    branches: [ master, main ]
-    paths:
-      - 'weed/**'
-      - 'test/fuse_integration/**'
-      - '.github/workflows/fuse-integration.yml'
-      - '.github/actions/fix-fusermount-setuid/**'
-  pull_request:
-    branches: [ master, main ]
-    paths:
-      - 'weed/**'
-      - 'test/fuse_integration/**'
-      - '.github/workflows/fuse-integration.yml'
-      - '.github/actions/fix-fusermount-setuid/**'
-
-concurrency:
-  group: ${{ github.head_ref }}/fuse-integration
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  fuse-integration:
-    name: FUSE Integration Testing
-    runs-on: ubuntu-22.04
-    timeout-minutes: 50
-
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v7
-
-    - name: Set up Go
-      uses: actions/setup-go@v7
-      with:
-        go-version-file: 'go.mod'
-
-    - name: Configure FUSE
-      run: |
-        # Nothing to install: fuse3 ships fusermount3 and is pre-installed, and
-        # go-fuse is pure Go, so the libfuse headers were never linked against.
-        # Allow non-root FUSE mounts with allow_other
-        echo 'user_allow_other' | sudo tee -a /etc/fuse.conf
-        sudo chmod 644 /etc/fuse.conf
-        # Verify FUSE installation
-        fusermount3 --version || fusermount --version || true
-        ls -la /dev/fuse
-
-    - name: Repair the fusermount3 setuid bit
-      uses: ./.github/actions/fix-fusermount-setuid
-
-    - name: Build SeaweedFS
-      run: |
-        cd weed
-        go build -tags "elastic gocdk sqlite ydb tarantool tikv rclone" -o weed .
-        chmod +x weed
-        ./weed version
-        # Make weed binary available in PATH for the test framework
-        sudo cp weed /usr/local/bin/weed
-
-    - name: Install test dependencies
-      run: |
-        cd test/fuse_integration
-        go mod download
-
-    - name: Run FUSE Integration Tests
-      run: |
-        set -o pipefail
-        cd test/fuse_integration
-        echo "Running full FUSE integration test suite..."
-        go test -v -count=1 -timeout=45m ./... 2>&1 | tee /tmp/fuse-test-output.log
-
-    - name: Upload Test Logs
-      if: always()
-      uses: actions/upload-artifact@v7
-      with:
-        name: fuse-integration-test-results
-        path: |
-          /tmp/fuse-test-output.log
-          /tmp/seaweedfs-fuse-logs/
-        retention-days: 7

.github/workflows/fuse-p2p-integration.yml

@@ -1,75 +0,0 @@
-name: "FUSE P2P Peer Chunk Sharing Integration Tests"
-
-on:
-  pull_request:
-    paths:
-      - 'weed/command/mount*.go'
-      - 'weed/mount/**'
-      - 'weed/filer/mount_peer_registry*.go'
-      - 'weed/server/filer_grpc_server_mount_peer.go'
-      - 'weed/pb/mount_peer.proto'
-      - 'weed/pb/filer.proto'
-      - 'test/fuse_p2p/**'
-      - '.github/workflows/fuse-p2p-integration.yml'
-      - '.github/actions/fix-fusermount-setuid/**'
-  push:
-    branches: [master]
-    paths:
-      - 'weed/command/mount*.go'
-      - 'weed/mount/**'
-      - 'weed/filer/mount_peer_registry*.go'
-      - 'weed/server/filer_grpc_server_mount_peer.go'
-      - 'weed/pb/mount_peer.proto'
-      - 'weed/pb/filer.proto'
-      - 'test/fuse_p2p/**'
-      - '.github/actions/fix-fusermount-setuid/**'
-
-concurrency:
-  group: ${{ github.head_ref || github.ref }}/fuse-p2p-integration
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  fuse-p2p-integration:
-    name: FUSE P2P Peer Chunk Sharing
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-
-      - name: Configure FUSE
-        run: |
-          # Nothing to install: fuse3 ships fusermount3 and is pre-installed,
-          # and go-fuse is pure Go, so the libfuse headers were never linked
-          # against.
-          echo 'user_allow_other' | sudo tee -a /etc/fuse.conf
-          sudo chmod 644 /etc/fuse.conf
-
-      - name: Repair the fusermount3 setuid bit
-        uses: ./.github/actions/fix-fusermount-setuid
-
-      - name: Build SeaweedFS
-        run: go build -o weed/weed -buildvcs=false ./weed
-
-      - name: Run P2P integration tests
-        timeout-minutes: 15
-        env:
-          WEED_BINARY: ${{ github.workspace }}/weed/weed
-        run: go test -v -count=1 -timeout=12m ./test/fuse_p2p/...
-
-      - name: Upload logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: fuse-p2p-test-logs
-          path: /tmp/seaweedfs-fuse-p2p-logs/
-          retention-days: 3

.github/workflows/go.yml

@@ -3,18 +3,8 @@ name: "go: build binary"
 on:
   push:
     branches: [ master ]
-    paths:
-      - '**/*.go'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/go.yml'
   pull_request:
     branches: [ master ]
-    paths:
-      - '**/*.go'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/go.yml'
 
 concurrency:
   group: ${{ github.head_ref }}/go
@@ -25,126 +15,26 @@ permissions:
 
 jobs:
 
-  vet:
-    name: Go Vet
-    runs-on: ubuntu-latest
-    steps:
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v7
-    - name: Set up Go
-      uses: actions/setup-go@v7
-      with:
-        go-version-file: 'go.mod'
-    - name: Get dependencies
-      run: |
-        cd weed; go get -v -t -d ./...
-    - name: Go Vet (excluding protobuf lock copying)
-      run: |
-        cd weed
-        # Run go vet and filter out known protobuf MessageState lock copying warnings
-        # These are expected in generated protobuf code with embedded sync.Mutex and are safe in practice
-        go vet -v ./... 2>&1 | grep -v "MessageState contains sync.Mutex" | grep -v "IdentityAccessManagement contains sync.RWMutex" | tee vet-output.txt
-        # Fail only if there are actual vet errors (not counting the filtered lock warnings)
-        if grep -q "vet:" vet-output.txt; then exit 1; fi
-
-  vet-32bit:
-    name: Go Vet 32-bit
-    runs-on: ubuntu-latest
-    steps:
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v7
-    - name: Set up Go
-      uses: actions/setup-go@v7
-      with:
-        go-version-file: 'go.mod'
-    - name: Go Vet linux/386 (type-checks code and tests for 32-bit int overflows)
-      run: |
-        GOOS=linux GOARCH=386 go vet ./... 2>&1 | grep -v "MessageState contains sync.Mutex" | grep -v "IdentityAccessManagement contains sync.RWMutex" | tee vet-32bit-output.txt
-        if grep -q "vet:" vet-32bit-output.txt; then exit 1; fi
-
   build:
     name: Build
     runs-on: ubuntu-latest
     steps:
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v7
-    - name: Set up Go
-      uses: actions/setup-go@v7
-      with:
-        go-version-file: 'go.mod'
-    - name: Build
-      run: cd weed; go build -tags "elastic gocdk sqlite ydb tarantool tikv rclone" -v .
 
-  build-cross:
-    name: Build cross-platform (${{ matrix.goos }}/${{ matrix.goarch }})
-    runs-on: ubuntu-latest
-    strategy:
-      # One target's breakage should not hide the other three.
-      fail-fast: false
-      matrix:
-        include:
-          - { goos: windows, goarch: amd64 }
-          - { goos: windows, goarch: arm64 }
-          - { goos: freebsd, goarch: amd64 }
-          - { goos: darwin, goarch: arm64 }
-    steps:
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v7
-    - name: Set up Go
-      uses: actions/setup-go@v7
+    - name: Set up Go 1.x
+      uses: actions/setup-go@d0a58c1c4d2b25278816e339b944508c875f3613 # v2
       with:
-        go-version-file: 'go.mod'
-    # Nothing else on a PR compiles these, so per-OS syscall constants creep
-    # back into shared files unnoticed and only a release build catches it.
-    - name: Cross-compile
-      env:
-        GOOS: ${{ matrix.goos }}
-        GOARCH: ${{ matrix.goarch }}
+        go-version: ^1.13
+      id: go
+
+    - name: Check out code into the Go module directory
+      uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v2
+
+    - name: Get dependencies
       run: |
-        go build ./weed/...
-        # Tests too: they reach for per-OS syscall constants the build does
-        # not, and only compiling them catches an untagged one.
-        go vet ./weed/mount/... ./weed/command/... 2>&1 |
-          grep -v "MessageState contains sync.Mutex" | tee /tmp/vet.txt
-        if grep -q "vet:" /tmp/vet.txt; then exit 1; fi
+        cd weed; go get -v -t -d ./...
+
+    - name: Build
+      run: cd weed; go build -tags "elastic gocdk sqlite ydb tikv" -v .
 
-  test:
-    name: Test
-    runs-on: ubuntu-latest
-    services:
-      redis:
-        image: redis:8
-        ports:
-          - 6379:6379
-        options: >-
-          --health-cmd "redis-cli ping"
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-    steps:
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v7
-    - name: Set up Go
-      uses: actions/setup-go@v7
-      with:
-        go-version-file: 'go.mod'
     - name: Test
-      env:
-        RUN_REDIS_TESTS: "1"
-      run: cd weed; go test -tags "elastic gocdk sqlite ydb tarantool tikv rclone" -v ./...
-
-  test-32bit:
-    name: Test 32-bit
-    runs-on: ubuntu-latest
-    steps:
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v7
-    - name: Set up Go
-      uses: actions/setup-go@v7
-      with:
-        go-version-file: 'go.mod'
-    # 386 test binaries run natively on the amd64 runner. This catches what vet
-    # can't: unaligned 64-bit atomics and arithmetic that wraps at runtime.
-    # -short skips the e2e suites already covered on amd64.
-    - name: Test linux/386
-      run: cd weed; GOOS=linux GOARCH=386 go test -short ./...
+      run: cd weed; go test -tags "elastic gocdk sqlite ydb tikv" -v ./...

.github/workflows/helm_manual_release.yml

@@ -1,41 +0,0 @@
-name: "helm: release"
-
-on:
-  push:
-    tags:
-      - '*'
-  workflow_dispatch:
-
-permissions:
-  contents: write
-  pages: write
-  packages: write
-
-jobs:
-  helm-release:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-
-      - name: Publish Helm charts to github pages
-        uses: stefanprodan/helm-gh-pages@v1.7.0
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          charts_dir: k8s/charts
-          target_dir: helm
-          branch: gh-pages
-          helm_version: "3.18.4"
-
-      - name: Publish Helm charts to github container registry (ghcr.io)
-        uses: bitdeps/helm-oci-charts-releaser@v0.1.5
-        with:
-          charts_dir: k8s/charts
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          oci_registry: ghcr.io/${{ github.repository_owner }}
-          oci_username: github-actions
-          oci_password: ${{ secrets.GITHUB_TOKEN }}
-          skip_dependencies: true
-          skip_helm_install: true
-          skip_gh_release: true

.github/workflows/java_integration_tests.yml

@@ -1,193 +0,0 @@
-name: Java Client Integration Tests
-
-on:
-  push:
-    branches: [ master ]
-    paths:
-      - 'other/java/**'
-      - 'weed/**'
-      - '.github/workflows/java_integration_tests.yml'
-  pull_request:
-    branches: [ master ]
-    paths:
-      - 'other/java/**'
-      - 'weed/**'
-      - '.github/workflows/java_integration_tests.yml'
-
-jobs:
-  test:
-    name: Java Integration Tests
-    runs-on: ubuntu-latest
-    
-    strategy:
-      matrix:
-        java: ['11', '17']
-    
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v7
-      
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-      
-      - name: Set up Java
-        uses: actions/setup-java@v6
-        with:
-          java-version: ${{ matrix.java }}
-          distribution: 'temurin'
-          cache: 'maven'
-      
-      - name: Build SeaweedFS
-        run: |
-          cd weed
-          go install -buildvcs=false
-          weed version
-      
-      - name: Start SeaweedFS Server
-        run: |
-          # Create clean data directory
-          export WEED_DATA_DIR="/tmp/seaweedfs-java-tests-$(date +%s)"
-          mkdir -p "$WEED_DATA_DIR"
-          
-          # Start SeaweedFS with optimized settings for CI
-          # Include S3 API for s3copier integration tests
-          weed server -dir="$WEED_DATA_DIR" \
-            -master.raftHashicorp \
-            -master.electionTimeout=1s \
-            -master.volumeSizeLimitMB=100 \
-            -volume.max=100 \
-            -volume.preStopSeconds=1 \
-            -master.peers=none \
-            -filer -filer.maxMB=64 \
-            -s3 -s3.port=8333 \
-            -s3.config="$GITHUB_WORKSPACE/docker/compose/s3.json" \
-            -s3.allowDeleteBucketNotEmpty=true \
-            -master.port=9333 \
-            -volume.port=8080 \
-            -filer.port=8888 \
-            -metricsPort=9324 > seaweedfs.log 2>&1 &
-          
-          SERVER_PID=$!
-          echo "SERVER_PID=$SERVER_PID" >> $GITHUB_ENV
-          echo "WEED_DATA_DIR=$WEED_DATA_DIR" >> $GITHUB_ENV
-          echo "SeaweedFS server started with PID: $SERVER_PID"
-      
-      - name: Wait for SeaweedFS Components
-        run: |
-          echo "Waiting for SeaweedFS components to start..."
-          
-          # Wait for master
-          for i in {1..30}; do
-            if curl -s http://localhost:9333/cluster/status > /dev/null 2>&1; then
-              echo "✓ Master server is ready"
-              break
-            fi
-            echo "Waiting for master server... ($i/30)"
-            sleep 2
-          done
-          
-          # Wait for volume
-          for i in {1..30}; do
-            if curl -s http://localhost:8080/status > /dev/null 2>&1; then
-              echo "✓ Volume server is ready"
-              break
-            fi
-            echo "Waiting for volume server... ($i/30)"
-            sleep 2
-          done
-          
-          # Wait for filer
-          for i in {1..30}; do
-            if curl -s http://localhost:8888/ > /dev/null 2>&1; then
-              echo "✓ Filer is ready"
-              break
-            fi
-            echo "Waiting for filer... ($i/30)"
-            sleep 2
-          done
-          
-          # Wait for S3 API
-          for i in {1..30}; do
-            if curl -s http://localhost:8333/healthz > /dev/null 2>&1; then
-              echo "✓ S3 API is ready"
-              break
-            fi
-            echo "Waiting for S3 API... ($i/30)"
-            sleep 2
-          done
-          
-          echo "✓ All SeaweedFS components are ready!"
-          
-          # Display cluster status
-          echo "Cluster status:"
-          curl -s http://localhost:9333/cluster/status | head -20
-      
-      - name: Build and Install SeaweedFS Client
-        working-directory: other/java/client
-        run: |
-          mvn clean install -DskipTests -Dmaven.javadoc.skip=true -Dgpg.skip=true
-      
-      - name: Run Client Unit Tests
-        working-directory: other/java/client
-        run: |
-          mvn test -Dtest=SeaweedReadTest,SeaweedCipherTest
-      
-      - name: Run Client Integration Tests
-        working-directory: other/java/client
-        env:
-          SEAWEEDFS_TEST_ENABLED: true
-        run: |
-          mvn test -Dtest=*IntegrationTest
-      
-      - name: Run HDFS3 Configuration Tests
-        working-directory: other/java/hdfs3
-        run: |
-          mvn test -Dtest=SeaweedFileSystemConfigTest -Dmaven.javadoc.skip=true -Dgpg.skip=true
-      
-      - name: Run S3 ETag Validation Tests (Issue #7768)
-        working-directory: other/java/s3copier
-        env:
-          S3_ENDPOINT: http://127.0.0.1:8333
-          S3_ACCESS_KEY: some_access_key1
-          S3_SECRET_KEY: some_secret_key1
-        run: |
-          echo "Running S3 ETag validation tests against $S3_ENDPOINT"
-          mvn test -Dtest=ETagValidationTest \
-            -DS3_ENDPOINT=$S3_ENDPOINT \
-            -DS3_ACCESS_KEY=$S3_ACCESS_KEY \
-            -DS3_SECRET_KEY=$S3_SECRET_KEY \
-            -Dmaven.javadoc.skip=true -Dgpg.skip=true
-      
-      - name: Display logs on failure
-        if: failure()
-        run: |
-          echo "=== SeaweedFS Server Log ==="
-          tail -100 seaweedfs.log || echo "No server log"
-          echo ""
-          echo "=== Cluster Status ==="
-          curl -s http://localhost:9333/cluster/status || echo "Cannot reach cluster"
-          echo ""
-          echo "=== Process Status ==="
-          ps aux | grep weed || echo "No weed processes"
-      
-      - name: Cleanup
-        if: always()
-        run: |
-          # Stop server using stored PID
-          if [ -n "$SERVER_PID" ]; then
-            echo "Stopping SeaweedFS server (PID: $SERVER_PID)"
-            kill -9 $SERVER_PID 2>/dev/null || true
-          fi
-          
-          # Fallback: kill any remaining weed processes
-          pkill -f "weed server" || true
-          
-          # Clean up data directory
-          if [ -n "$WEED_DATA_DIR" ]; then
-            echo "Cleaning up data directory: $WEED_DATA_DIR"
-            rm -rf "$WEED_DATA_DIR" || true
-          fi
-

.github/workflows/java_release.yml

@@ -1,183 +0,0 @@
-name: "release: java clients"
-
-# Publishes the SeaweedFS Java clients (seaweedfs-client and
-# seaweedfs-hadoop3-client) to Maven Central via the Sonatype Central Portal.
-#
-# Required repository secrets:
-#   MAVEN_CENTRAL_USERNAME  - Central Portal user token username (central.sonatype.com -> Account -> Generate User Token)
-#   MAVEN_CENTRAL_PASSWORD  - Central Portal user token password
-#   MAVEN_GPG_PRIVATE_KEY   - ASCII-armored signing key:
-#                             gpg --homedir <keyring> --armor --export-secret-keys <KEYID> > key.asc
-#   MAVEN_GPG_PASSPHRASE    - passphrase for that key
-#
-# A plain run publishes to Central. Check dry_run to exercise secrets, GPG
-# signing, and the build without committing or publishing.
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Version to publish, e.g. 4.39. Leave blank to use the current SeaweedFS version."
-        type: string
-        required: false
-      dry_run:
-        description: "Build and GPG-sign only; skip the version commit and the Central upload"
-        type: boolean
-        default: false
-
-permissions:
-  contents: write
-
-concurrency:
-  group: java-release
-  cancel-in-progress: false
-
-env:
-  # Java 17 needs these opens for the Maven publishing plugins' reflective access.
-  MAVEN_OPTS: >-
-    --add-opens=java.base/java.util=ALL-UNNAMED
-    --add-opens=java.base/java.lang.reflect=ALL-UNNAMED
-    --add-opens=java.base/java.text=ALL-UNNAMED
-    --add-opens=java.desktop/java.awt.font=ALL-UNNAMED
-
-jobs:
-  publish:
-    name: Publish to Maven Central
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          # Full history so the version-bump commit can rebase onto a moved master.
-          fetch-depth: 0
-
-      # An explicit input wins; otherwise fall back to the current SeaweedFS
-      # version (MAJOR.MINOR) from constants.go, matching its %d.%02d formatting.
-      - name: Resolve version
-        id: resolve
-        env:
-          INPUT_VERSION: ${{ inputs.version }}
-        run: |
-          set -euo pipefail
-          VERSION="$INPUT_VERSION"
-          if [ -z "$VERSION" ]; then
-            CONST=weed/util/version/constants.go
-            MAJOR=$(grep -oP 'MAJOR_VERSION\s*=\s*int32\(\K[0-9]+' "$CONST")
-            MINOR=$(grep -oP 'MINOR_VERSION\s*=\s*int32\(\K[0-9]+' "$CONST")
-            VERSION=$(printf '%d.%02d' "$MAJOR" "$MINOR")
-            echo "No version given; using current SeaweedFS version ${VERSION}."
-          fi
-          if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+$ ]]; then
-            echo "::error::version must be MAJOR.MINOR, e.g. 4.39 (got '$VERSION')"
-            exit 1
-          fi
-          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
-
-      - name: Set up JDK 17
-        uses: actions/setup-java@v6
-        with:
-          java-version: '17'
-          distribution: 'temurin'
-          cache: 'maven'
-          server-id: central
-          server-username: MAVEN_CENTRAL_USERNAME
-          server-password: MAVEN_CENTRAL_PASSWORD
-          gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
-          gpg-passphrase: MAVEN_GPG_PASSPHRASE
-
-      # client carries the version literally; hdfs3 derives its own version and
-      # its seaweedfs-client dependency from the seaweedfs.client.version property.
-      - name: Set versions in poms
-        env:
-          VERSION: ${{ steps.resolve.outputs.version }}
-        run: |
-          set -euo pipefail
-          V=org.codehaus.mojo:versions-maven-plugin:2.16.2
-          mvn -B -ntp -f other/java/client/pom.xml "${V}:set" \
-            -DnewVersion="$VERSION" -DgenerateBackupPoms=false
-          mvn -B -ntp -f other/java/hdfs3/pom.xml "${V}:set-property" \
-            -Dproperty=seaweedfs.client.version -DnewVersion="$VERSION" -DgenerateBackupPoms=false
-
-      - name: Commit version bump
-        if: ${{ !inputs.dry_run }}
-        env:
-          VERSION: ${{ steps.resolve.outputs.version }}
-        run: |
-          set -euo pipefail
-          if git diff --quiet; then
-            echo "Poms already at ${VERSION}; nothing to commit."
-            exit 0
-          fi
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add other/java/client/pom.xml other/java/hdfs3/pom.xml
-          git commit -m "java ${VERSION}"
-          # Rebase and retry so a concurrent push to master doesn't lose the bump.
-          for attempt in 1 2 3 4 5; do
-            if git push origin HEAD:master; then
-              exit 0
-            fi
-            echo "push rejected (attempt ${attempt}); rebasing onto latest master"
-            git pull --rebase origin master
-          done
-          echo "::error::could not push version bump after retries"
-          exit 1
-
-      # Tests are skipped here: the integration tests need a live filer, and the
-      # offline unit tests already run on every push in java_unit_tests.yml.
-      # dry_run stops at `install` (build + GPG sign, no upload). A real run deploys.
-      # client goes first either way so its install populates the local repo for hdfs3.
-      - name: Publish seaweedfs-client
-        working-directory: other/java/client
-        env:
-          MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
-          MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
-          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
-          DRY_RUN: ${{ inputs.dry_run }}
-        run: |
-          set -euo pipefail
-          [ "$DRY_RUN" = "true" ] && GOAL="clean install" || GOAL="clean deploy"
-          mvn -B -ntp $GOAL -DskipTests
-
-      - name: Publish seaweedfs-hadoop3-client
-        working-directory: other/java/hdfs3
-        env:
-          MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
-          MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
-          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
-          DRY_RUN: ${{ inputs.dry_run }}
-        run: |
-          set -euo pipefail
-          [ "$DRY_RUN" = "true" ] && GOAL="clean install" || GOAL="clean deploy"
-          mvn -B -ntp $GOAL -DskipTests
-
-      # Bump every version the wiki quotes for the Java clients. Runs only after
-      # a successful real publish. Uses GITHUB_TOKEN; set a WIKI_TOKEN secret if
-      # the token can't push to the wiki.
-      - name: Update wiki client versions
-        if: ${{ !inputs.dry_run }}
-        env:
-          VERSION: ${{ steps.resolve.outputs.version }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          WIKI_TOKEN: ${{ secrets.WIKI_TOKEN }}
-        run: |
-          set -euo pipefail
-          TOKEN="${WIKI_TOKEN:-$GH_TOKEN}"
-          git clone -q "https://x-access-token:${TOKEN}@github.com/${{ github.repository }}.wiki.git" wiki
-          cd wiki
-          for f in $(grep -rlE "seaweedfs-(client|hadoop3-client)" --include="*.md" .); do
-            NEWV="$VERSION" perl -0777 -i -pe '
-              my $v = $ENV{NEWV};
-              s{(<artifactId>seaweedfs-(?:client|hadoop3-client)</artifactId>\s*<version>)[0-9]+\.[0-9]+(</version>)}{$1$v$2}g;
-              s{(seaweedfs-(?:client|hadoop3-client):)[0-9]+\.[0-9]+}{$1$v}g;
-              s{(seaweedfs-(?:client|hadoop3-client)-)[0-9]+\.[0-9]+(\.jar)}{$1$v$2}g;
-              s{(seaweedfs-(?:client|hadoop3-client)/)[0-9]+\.[0-9]+(/)}{$1$v$2}g;
-            ' "$f"
-          done
-          if git diff --quiet; then
-            echo "Wiki already references ${VERSION}."
-            exit 0
-          fi
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git commit -am "java clients ${VERSION}"
-          git push

.github/workflows/java_unit_tests.yml

@@ -1,58 +0,0 @@
-name: Java Client Unit Tests
-
-on:
-  push:
-    branches: [ master ]
-    paths:
-      - 'other/java/**'
-      - '.github/workflows/java_unit_tests.yml'
-  pull_request:
-    branches: [ master ]
-    paths:
-      - 'other/java/**'
-      - '.github/workflows/java_unit_tests.yml'
-
-jobs:
-  test:
-    name: Java Unit Tests
-    runs-on: ubuntu-latest
-    
-    strategy:
-      matrix:
-        java: ['8', '11', '17', '21']
-    
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v7
-      
-      - name: Set up Java
-        uses: actions/setup-java@v6
-        with:
-          java-version: ${{ matrix.java }}
-          distribution: 'temurin'
-          cache: 'maven'
-      
-      - name: Build and Install SeaweedFS Client
-        working-directory: other/java/client
-        run: |
-          mvn clean install -DskipTests -Dmaven.javadoc.skip=true -Dgpg.skip=true
-      
-      - name: Run Client Unit Tests
-        working-directory: other/java/client
-        run: |
-          mvn test -Dtest=SeaweedReadTest,SeaweedCipherTest
-      
-      - name: Run HDFS3 Configuration Tests
-        working-directory: other/java/hdfs3
-        run: |
-          mvn test -Dtest=SeaweedFileSystemConfigTest -Dmaven.javadoc.skip=true -Dgpg.skip=true
-      
-      - name: Upload Test Reports
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: test-reports-java-${{ matrix.java }}
-          path: |
-            other/java/client/target/surefire-reports/
-            other/java/hdfs3/target/surefire-reports/
-

.github/workflows/kafka-quicktest.yml

@@ -1,145 +0,0 @@
-name: "Kafka Quick Test (Load Test with Schema Registry)"
-
-on:
-  push:
-    branches: [ master ]
-    paths:
-      - 'weed/mq/**'
-      - 'weed/pb/mq_pb/**'
-      - 'weed/pb/schema_pb/**'
-      - 'test/kafka/**'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/kafka-quicktest.yml'
-  pull_request:
-    branches: [ master ]
-    paths:
-      - 'weed/mq/**'
-      - 'weed/pb/mq_pb/**'
-      - 'weed/pb/schema_pb/**'
-      - 'test/kafka/**'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/kafka-quicktest.yml'
-  workflow_dispatch:  # Allow manual trigger
-
-concurrency:
-  group: ${{ github.head_ref }}/kafka-quicktest
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  kafka-client-quicktest:
-    name: Kafka Client Load Test (Quick)
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-    - name: Check out code
-      uses: actions/checkout@v7
-
-    - name: Set up Go 1.x
-      uses: actions/setup-go@v7
-      with:
-        go-version: ^1.26
-        cache: true
-        cache-dependency-path: |
-          **/go.sum
-      id: go
-
-    - name: Configure Docker Hub mirror
-      run: |
-        echo '{"registry-mirrors": ["https://mirror.gcr.io"]}' | sudo tee /etc/docker/daemon.json
-        sudo systemctl restart docker
-
-    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v4
-
-    - name: Install dependencies
-      run: |
-        # Ensure make is available
-        sudo apt-get update -qq
-        sudo apt-get install -y make
-
-    - name: Validate test setup
-      working-directory: test/kafka/kafka-client-loadtest
-      run: |
-        make validate-setup
-
-    - name: Run quick-test
-      working-directory: test/kafka/kafka-client-loadtest
-      run: |
-        # Run the quick-test target which includes:
-        # 1. Building the gateway
-        # 2. Starting all services (SeaweedFS, MQ broker, Schema Registry)
-        # 3. Registering Avro schemas
-        # 4. Running a 1-minute load test with Avro messages
-        # Override GOARCH to build for AMD64 (GitHub Actions runners are x86_64)
-        GOARCH=amd64 make quick-test
-      env:
-        # Docker Compose settings
-        COMPOSE_HTTP_TIMEOUT: 300
-        DOCKER_CLIENT_TIMEOUT: 300
-        # Test parameters (set by quick-test, but can override)
-        TEST_DURATION: 60s
-        PRODUCER_COUNT: 1
-        CONSUMER_COUNT: 1
-        MESSAGE_RATE: 10
-        VALUE_TYPE: avro
-
-    - name: Show test results
-      if: always()
-      working-directory: test/kafka/kafka-client-loadtest
-      run: |
-        echo "========================================="
-        echo "Test Results"
-        echo "========================================="
-        make show-results || echo "Could not retrieve results"
-
-    - name: Show service logs on failure
-      if: failure()
-      working-directory: test/kafka/kafka-client-loadtest
-      run: |
-        echo "========================================="
-        echo "Service Logs"
-        echo "========================================="
-        
-        echo "Checking running containers..."
-        docker compose ps || true
-        
-        echo "========================================="
-        echo "Master Logs"
-        echo "========================================="
-        docker compose logs --tail=100 seaweedfs-master 2>&1 || echo "No master logs available"
-        
-        echo "========================================="
-        echo "MQ Broker Logs (Last 100 lines)"
-        echo "========================================="
-        docker compose logs --tail=100 seaweedfs-mq-broker 2>&1 || echo "No broker logs available"
-        
-        echo "========================================="
-        echo "Kafka Gateway Logs (FULL - Critical for debugging)"
-        echo "========================================="
-        docker compose logs kafka-gateway 2>&1 || echo "ERROR: Could not retrieve kafka-gateway logs"
-        
-        echo "========================================="
-        echo "Schema Registry Logs (FULL)"
-        echo "========================================="
-        docker compose logs schema-registry 2>&1 || echo "ERROR: Could not retrieve schema-registry logs"
-        
-        echo "========================================="
-        echo "Load Test Logs"
-        echo "========================================="
-        docker compose logs --tail=100 kafka-client-loadtest 2>&1 || echo "No loadtest logs available"
-
-    - name: Cleanup
-      if: always()
-      working-directory: test/kafka/kafka-client-loadtest
-      run: |
-        # Stop containers first
-        docker compose --profile loadtest --profile monitoring down -v --remove-orphans || true
-        # Clean up data with sudo to handle Docker root-owned files
-        sudo rm -rf data/* || true
-        # Clean up binary
-        rm -f weed-linux-* || true

.github/workflows/kafka-tests.yml

@@ -1,841 +0,0 @@
-name: "Kafka Gateway Tests"
-
-on:
-  push:
-    branches: [ master ]
-    paths:
-      - 'weed/mq/**'
-      - 'weed/pb/mq_pb/**'
-      - 'weed/pb/schema_pb/**'
-      - 'test/kafka/**'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/kafka-tests.yml'
-  pull_request:
-    branches: [ master ]
-    paths:
-      - 'weed/mq/**'
-      - 'weed/pb/mq_pb/**'
-      - 'weed/pb/schema_pb/**'
-      - 'test/kafka/**'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/kafka-tests.yml'
-
-concurrency:
-  group: ${{ github.head_ref }}/kafka-tests
-  cancel-in-progress: true
-
-# Force different runners for better isolation
-env:
-  FORCE_RUNNER_SEPARATION: true
-
-permissions:
-  contents: read
-
-jobs:
-  kafka-unit-tests:
-    name: Kafka Unit Tests
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    strategy:
-      fail-fast: false
-      matrix:
-        container-id: [unit-tests-1]
-    container:
-      image: golang:1.26-alpine
-      options: --cpus 1.0 --memory 1g --hostname kafka-unit-${{ matrix.container-id }}
-    env:
-      GOMAXPROCS: 1
-      CGO_ENABLED: 0
-      CONTAINER_ID: ${{ matrix.container-id }}
-    steps:
-    - name: Set up Go 1.x
-      uses: actions/setup-go@v7
-      with:
-        go-version: ^1.26
-      id: go
-
-    - name: Check out code
-      uses: actions/checkout@v7
-
-    - name: Setup Container Environment
-      run: |
-        apk add --no-cache git
-        ulimit -n 1024 || echo "Warning: Could not set file descriptor limit"
-        
-    - name: Get dependencies
-      run: |
-        cd test/kafka
-        go mod download
-        go mod tidy
-
-    - name: Run Kafka Gateway Unit Tests
-      run: |
-        cd test/kafka
-        # Set process limits for container isolation
-        ulimit -n 512 || echo "Warning: Could not set file descriptor limit"
-        ulimit -u 100 || echo "Warning: Could not set process limit"
-        go test -v -timeout 10s ./unit/...
-
-  kafka-integration-tests:
-    name: Kafka Integration Tests (Critical)
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    strategy:
-      fail-fast: false
-      matrix:
-        container-id: [integration-1]
-    container:
-      image: golang:1.26-alpine
-      options: --cpus 2.0 --memory 2g --ulimit nofile=1024:1024 --hostname kafka-integration-${{ matrix.container-id }}
-    env:
-      GOMAXPROCS: 2
-      CGO_ENABLED: 0
-      KAFKA_TEST_ISOLATION: "true"
-      CONTAINER_ID: ${{ matrix.container-id }}
-    steps:
-    - name: Set up Go 1.x
-      uses: actions/setup-go@v7
-      with:
-        go-version: ^1.26
-      id: go
-
-    - name: Check out code
-      uses: actions/checkout@v7
-
-    - name: Setup Integration Container Environment
-      run: |
-        apk add --no-cache git procps
-        ulimit -n 2048 || echo "Warning: Could not set file descriptor limit"
-        
-    - name: Get dependencies
-      run: |
-        cd test/kafka
-        go mod download
-        go mod tidy
-
-    - name: Run Integration Tests
-      run: |
-        cd test/kafka
-        # Higher limits for integration tests
-        ulimit -n 1024 || echo "Warning: Could not set file descriptor limit"
-        ulimit -u 200 || echo "Warning: Could not set process limit"
-        go test -v -timeout 90s ./integration/...
-      env:
-        GOMAXPROCS: 2
-
-  kafka-e2e-tests:
-    name: Kafka End-to-End Tests (with SMQ)
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    strategy:
-      fail-fast: false
-      matrix:
-        container-id: [e2e-1]
-    container:
-      image: golang:1.26-alpine
-      options: --cpus 2.0 --memory 2g --hostname kafka-e2e-${{ matrix.container-id }}
-    env:
-      GOMAXPROCS: 2
-      CGO_ENABLED: 0
-      KAFKA_E2E_ISOLATION: "true"
-      CONTAINER_ID: ${{ matrix.container-id }}
-    steps:
-    - name: Check out code
-      uses: actions/checkout@v7
-
-    - name: Set up Go 1.x
-      uses: actions/setup-go@v7
-      with:
-        go-version: ^1.26
-        cache: true
-        cache-dependency-path: |
-          **/go.sum
-      id: go
-
-    - name: Setup E2E Container Environment
-      run: |
-        apk add --no-cache git procps curl netcat-openbsd
-        ulimit -n 2048 || echo "Warning: Could not set file descriptor limit"
-        
-    - name: Warm Go module cache
-      run: |
-        # Warm cache for root module
-        go mod download || true
-        # Warm cache for kafka test module
-        cd test/kafka
-        go mod download || true
-
-    - name: Get dependencies
-      run: |
-        cd test/kafka
-        # Use go mod download with timeout to prevent hanging
-        timeout 90s go mod download || echo "Warning: Dependency download timed out, continuing with cached modules"
-        go mod tidy
-
-    - name: Build and start SeaweedFS MQ
-      run: |
-        set -e
-        cd $GITHUB_WORKSPACE
-        # Build weed binary
-        go build -o /usr/local/bin/weed ./weed
-        # Start SeaweedFS components with MQ brokers
-        export WEED_DATA_DIR=/tmp/seaweedfs-e2e-$RANDOM
-        mkdir -p "$WEED_DATA_DIR"
-        
-        # Start SeaweedFS server (master, volume, filer) with consistent IP advertising
-        nohup weed -v 1 server \
-          -ip="127.0.0.1" \
-          -ip.bind="0.0.0.0" \
-          -dir="$WEED_DATA_DIR" \
-          -master.raftHashicorp \
-          -master.port=9333 \
-          -volume.port=8081 \
-          -filer.port=8888 \
-          -filer=true \
-          -metricsPort=9325 \
-          -master.peers=none \
-          > /tmp/weed-server.log 2>&1 &
-          
-        # Wait for master to be ready
-        for i in $(seq 1 30); do
-          if curl -s http://127.0.0.1:9333/cluster/status >/dev/null; then
-            echo "SeaweedFS master HTTP is up"; break
-          fi
-          echo "Waiting for SeaweedFS master HTTP... ($i/30)"; sleep 1
-        done
-        
-        # Wait for master gRPC to be ready (this is what broker discovery uses)
-        echo "Waiting for master gRPC port..."
-        for i in $(seq 1 30); do
-          if nc -z 127.0.0.1 19333; then
-            echo "✓ SeaweedFS master gRPC is up (port 19333)"
-            break
-          fi
-          echo "  Waiting for master gRPC... ($i/30)"; sleep 1
-        done
-        
-        # Give server time to initialize all components including gRPC services
-        echo "Waiting for SeaweedFS components to initialize..."
-        sleep 15
-        
-        # Additional wait specifically for gRPC services to be ready for streaming
-        echo "Allowing extra time for master gRPC streaming services to initialize..."
-        sleep 10
-        
-        # Start MQ broker with maximum verbosity for debugging
-        echo "Starting MQ broker..."
-        nohup weed -v 3 mq.broker \
-          -master="127.0.0.1:9333" \
-          -ip="127.0.0.1" \
-          -port=17777 \
-          -logFlushInterval=0 \
-          > /tmp/weed-mq-broker.log 2>&1 &
-        
-        # Wait for broker to be ready with better error reporting  
-        sleep 15
-        broker_ready=false
-        for i in $(seq 1 20); do
-          if nc -z 127.0.0.1 17777; then
-            echo "SeaweedFS MQ broker is up"
-            broker_ready=true
-            break
-          fi
-          echo "Waiting for MQ broker... ($i/20)"; sleep 1
-        done
-        
-        # Give broker additional time to register with master
-        if [ "$broker_ready" = true ]; then
-          echo "Allowing broker to register with master..."
-          sleep 30
-          
-          # Check if broker is properly registered by querying cluster nodes
-          echo "Cluster status after broker registration:"
-          curl -s "http://127.0.0.1:9333/cluster/status" || echo "Could not check cluster status"
-          
-          echo "Checking cluster topology (includes registered components):"
-          curl -s "http://127.0.0.1:9333/dir/status" | head -20 || echo "Could not check dir status"
-          
-          echo "Verifying broker discovery via master client debug:"
-          echo "If broker registration is successful, it should appear in dir status"
-          
-          echo "Testing gRPC connectivity with weed binary:"
-          echo "This simulates what the gateway does during broker discovery..."
-          timeout 10s weed shell -master=127.0.0.1:9333 -filer=127.0.0.1:8888 > /tmp/shell-test.log 2>&1 || echo "weed shell test completed or timed out - checking logs..."
-          echo "Shell test results:"
-          cat /tmp/shell-test.log 2>/dev/null | head -10 || echo "No shell test logs"
-        fi
-        
-        # Check if broker failed to start and show logs
-        if [ "$broker_ready" = false ]; then
-          echo "ERROR: MQ broker failed to start. Broker logs:"
-          cat /tmp/weed-mq-broker.log || echo "No broker logs found"
-          echo "Server logs:"  
-          tail -20 /tmp/weed-server.log || echo "No server logs found"
-          exit 1
-        fi
-
-    - name: Run End-to-End Tests
-      run: |
-        cd test/kafka
-        # Higher limits for E2E tests
-        ulimit -n 1024 || echo "Warning: Could not set file descriptor limit"
-        ulimit -u 200 || echo "Warning: Could not set process limit"
-        
-        # Allow additional time for all background processes to settle
-        echo "Allowing additional settlement time for SeaweedFS ecosystem..."
-        sleep 15
-        
-        # Run tests and capture result
-        if ! go test -v -timeout 180s ./e2e/...; then
-          echo "========================================="
-          echo "Tests failed! Showing debug information:"
-          echo "========================================="
-          echo "Server logs (last 50 lines):"
-          tail -50 /tmp/weed-server.log || echo "No server logs"
-          echo "========================================="
-          echo "Broker logs (last 50 lines):"
-          tail -50 /tmp/weed-mq-broker.log || echo "No broker logs"
-          echo "========================================="
-          exit 1
-        fi
-      env:
-        GOMAXPROCS: 2
-        SEAWEEDFS_MASTERS: 127.0.0.1:9333
-
-  kafka-consumer-group-tests:
-    name: Kafka Consumer Group Tests (Highly Isolated)
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    strategy:
-      fail-fast: false
-      matrix:
-        container-id: [consumer-group-1]
-    container:
-      image: golang:1.26-alpine
-      options: --cpus 1.0 --memory 2g --ulimit nofile=512:512 --hostname kafka-consumer-${{ matrix.container-id }}
-    env:
-      GOMAXPROCS: 1
-      CGO_ENABLED: 0
-      KAFKA_CONSUMER_ISOLATION: "true"
-      CONTAINER_ID: ${{ matrix.container-id }}
-    steps:
-    - name: Check out code
-      uses: actions/checkout@v7
-
-    - name: Set up Go 1.x
-      uses: actions/setup-go@v7
-      with:
-        go-version: ^1.26
-        cache: true
-        cache-dependency-path: |
-          **/go.sum
-      id: go
-
-    - name: Setup Consumer Group Container Environment
-      run: |
-        apk add --no-cache git procps curl netcat-openbsd
-        ulimit -n 256 || echo "Warning: Could not set file descriptor limit"
-        
-    - name: Warm Go module cache
-      run: |
-        # Warm cache for root module
-        go mod download || true
-        # Warm cache for kafka test module
-        cd test/kafka
-        go mod download || true
-
-    - name: Get dependencies
-      run: |
-        cd test/kafka
-        # Use go mod download with timeout to prevent hanging
-        timeout 90s go mod download || echo "Warning: Dependency download timed out, continuing with cached modules"
-        go mod tidy
-
-    - name: Build and start SeaweedFS MQ
-      run: |
-        set -e
-        cd $GITHUB_WORKSPACE
-        # Build weed binary
-        go build -o /usr/local/bin/weed ./weed
-        # Start SeaweedFS components with MQ brokers
-        export WEED_DATA_DIR=/tmp/seaweedfs-mq-$RANDOM
-        mkdir -p "$WEED_DATA_DIR"
-        
-        # Start SeaweedFS server (master, volume, filer) with consistent IP advertising
-        nohup weed -v 1 server \
-          -ip="127.0.0.1" \
-          -ip.bind="0.0.0.0" \
-          -dir="$WEED_DATA_DIR" \
-          -master.raftHashicorp \
-          -master.port=9333 \
-          -volume.port=8081 \
-          -filer.port=8888 \
-          -filer=true \
-          -metricsPort=9325 \
-          -master.peers=none \
-          > /tmp/weed-server.log 2>&1 &
-          
-        # Wait for master to be ready
-        for i in $(seq 1 30); do
-          if curl -s http://127.0.0.1:9333/cluster/status >/dev/null; then
-            echo "SeaweedFS master HTTP is up"; break
-          fi
-          echo "Waiting for SeaweedFS master HTTP... ($i/30)"; sleep 1
-        done
-        
-        # Wait for master gRPC to be ready (this is what broker discovery uses)
-        echo "Waiting for master gRPC port..."
-        for i in $(seq 1 30); do
-          if nc -z 127.0.0.1 19333; then
-            echo "✓ SeaweedFS master gRPC is up (port 19333)"
-            break
-          fi
-          echo "  Waiting for master gRPC... ($i/30)"; sleep 1
-        done
-        
-        # Give server time to initialize all components including gRPC services
-        echo "Waiting for SeaweedFS components to initialize..."
-        sleep 15
-        
-        # Additional wait specifically for gRPC services to be ready for streaming
-        echo "Allowing extra time for master gRPC streaming services to initialize..."
-        sleep 10
-        
-        # Start MQ broker with maximum verbosity for debugging
-        echo "Starting MQ broker..."
-        nohup weed -v 3 mq.broker \
-          -master="127.0.0.1:9333" \
-          -ip="127.0.0.1" \
-          -port=17777 \
-          -logFlushInterval=0 \
-          > /tmp/weed-mq-broker.log 2>&1 &
-        
-        # Wait for broker to be ready with better error reporting  
-        sleep 15
-        broker_ready=false
-        for i in $(seq 1 20); do
-          if nc -z 127.0.0.1 17777; then
-            echo "SeaweedFS MQ broker is up"
-            broker_ready=true
-            break
-          fi
-          echo "Waiting for MQ broker... ($i/20)"; sleep 1
-        done
-        
-        # Give broker additional time to register with master
-        if [ "$broker_ready" = true ]; then
-          echo "Allowing broker to register with master..."
-          sleep 30
-          
-          # Check if broker is properly registered by querying cluster nodes
-          echo "Cluster status after broker registration:"
-          curl -s "http://127.0.0.1:9333/cluster/status" || echo "Could not check cluster status"
-          
-          echo "Checking cluster topology (includes registered components):"
-          curl -s "http://127.0.0.1:9333/dir/status" | head -20 || echo "Could not check dir status"
-          
-          echo "Verifying broker discovery via master client debug:"
-          echo "If broker registration is successful, it should appear in dir status"
-          
-          echo "Testing gRPC connectivity with weed binary:"
-          echo "This simulates what the gateway does during broker discovery..."
-          timeout 10s weed shell -master=127.0.0.1:9333 -filer=127.0.0.1:8888 > /tmp/shell-test.log 2>&1 || echo "weed shell test completed or timed out - checking logs..."
-          echo "Shell test results:"
-          cat /tmp/shell-test.log 2>/dev/null | head -10 || echo "No shell test logs"
-        fi
-        
-        # Check if broker failed to start and show logs
-        if [ "$broker_ready" = false ]; then
-          echo "ERROR: MQ broker failed to start. Broker logs:"
-          cat /tmp/weed-mq-broker.log || echo "No broker logs found"
-          echo "Server logs:"  
-          tail -20 /tmp/weed-server.log || echo "No server logs found"
-          exit 1
-        fi
-
-    - name: Run Consumer Group Tests
-      run: |
-        cd test/kafka
-        # Test consumer group functionality with explicit timeout
-        ulimit -n 512 || echo "Warning: Could not set file descriptor limit"
-        ulimit -u 100 || echo "Warning: Could not set process limit"
-        timeout 240s go test -v -run "^TestConsumerGroups" -timeout 180s ./integration/...
-      env:
-        GOMAXPROCS: 1
-        SEAWEEDFS_MASTERS: 127.0.0.1:9333
-
-  kafka-client-compatibility:
-    name: Kafka Client Compatibility (with SMQ)
-    runs-on: ubuntu-latest
-    timeout-minutes: 25
-    strategy:
-      fail-fast: false
-      matrix:
-        container-id: [client-compat-1]
-    container:
-      image: golang:1.26-alpine
-      options: --cpus 1.0 --memory 1.5g --shm-size 256m --hostname kafka-client-${{ matrix.container-id }}
-    env:
-      GOMAXPROCS: 1
-      CGO_ENABLED: 0
-      KAFKA_CLIENT_ISOLATION: "true"
-      CONTAINER_ID: ${{ matrix.container-id }}
-    steps:
-    - name: Check out code
-      uses: actions/checkout@v7
-
-    - name: Set up Go 1.x
-      uses: actions/setup-go@v7
-      with:
-        go-version: ^1.26
-        cache: true
-        cache-dependency-path: |
-          **/go.sum
-      id: go
-
-    - name: Setup Client Container Environment
-      run: |
-        apk add --no-cache git procps curl netcat-openbsd
-        ulimit -n 1024 || echo "Warning: Could not set file descriptor limit"
-
-    - name: Warm Go module cache
-      run: |
-        # Warm cache for root module
-        go mod download || true
-        # Warm cache for kafka test module
-        cd test/kafka
-        go mod download || true
-
-    - name: Get dependencies
-      run: |
-        cd test/kafka
-        timeout 90s go mod download || echo "Warning: Dependency download timed out, continuing with cached modules"
-        go mod tidy
-
-    - name: Build and start SeaweedFS MQ
-      run: |
-        set -e
-        cd $GITHUB_WORKSPACE
-        # Build weed binary
-        go build -o /usr/local/bin/weed ./weed
-        # Start SeaweedFS components with MQ brokers
-        export WEED_DATA_DIR=/tmp/seaweedfs-client-$RANDOM
-        mkdir -p "$WEED_DATA_DIR"
-        
-        # Start SeaweedFS server (master, volume, filer) with consistent IP advertising
-        nohup weed -v 1 server \
-          -ip="127.0.0.1" \
-          -ip.bind="0.0.0.0" \
-          -dir="$WEED_DATA_DIR" \
-          -master.raftHashicorp \
-          -master.port=9333 \
-          -volume.port=8081 \
-          -filer.port=8888 \
-          -filer=true \
-          -metricsPort=9325 \
-          -master.peers=none \
-          > /tmp/weed-server.log 2>&1 &
-          
-        # Wait for master to be ready
-        for i in $(seq 1 30); do
-          if curl -s http://127.0.0.1:9333/cluster/status >/dev/null; then
-            echo "SeaweedFS master HTTP is up"; break
-          fi
-          echo "Waiting for SeaweedFS master HTTP... ($i/30)"; sleep 1
-        done
-        
-        # Wait for master gRPC to be ready (this is what broker discovery uses)
-        echo "Waiting for master gRPC port..."
-        for i in $(seq 1 30); do
-          if nc -z 127.0.0.1 19333; then
-            echo "✓ SeaweedFS master gRPC is up (port 19333)"
-            break
-          fi
-          echo "  Waiting for master gRPC... ($i/30)"; sleep 1
-        done
-        
-        # Give server time to initialize all components including gRPC services
-        echo "Waiting for SeaweedFS components to initialize..."
-        sleep 15
-        
-        # Additional wait specifically for gRPC services to be ready for streaming
-        echo "Allowing extra time for master gRPC streaming services to initialize..."
-        sleep 10
-        
-        # Start MQ broker with maximum verbosity for debugging
-        echo "Starting MQ broker..."
-        nohup weed -v 3 mq.broker \
-          -master="127.0.0.1:9333" \
-          -ip="127.0.0.1" \
-          -port=17777 \
-          -logFlushInterval=0 \
-          > /tmp/weed-mq-broker.log 2>&1 &
-        
-        # Wait for broker to be ready with better error reporting  
-        sleep 15
-        broker_ready=false
-        for i in $(seq 1 20); do
-          if nc -z 127.0.0.1 17777; then
-            echo "SeaweedFS MQ broker is up"
-            broker_ready=true
-            break
-          fi
-          echo "Waiting for MQ broker... ($i/20)"; sleep 1
-        done
-        
-        # Give broker additional time to register with master
-        if [ "$broker_ready" = true ]; then
-          echo "Allowing broker to register with master..."
-          sleep 30
-          
-          # Check if broker is properly registered by querying cluster nodes
-          echo "Cluster status after broker registration:"
-          curl -s "http://127.0.0.1:9333/cluster/status" || echo "Could not check cluster status"
-          
-          echo "Checking cluster topology (includes registered components):"
-          curl -s "http://127.0.0.1:9333/dir/status" | head -20 || echo "Could not check dir status"
-          
-          echo "Verifying broker discovery via master client debug:"
-          echo "If broker registration is successful, it should appear in dir status"
-          
-          echo "Testing gRPC connectivity with weed binary:"
-          echo "This simulates what the gateway does during broker discovery..."
-          timeout 10s weed shell -master=127.0.0.1:9333 -filer=127.0.0.1:8888 > /tmp/shell-test.log 2>&1 || echo "weed shell test completed or timed out - checking logs..."
-          echo "Shell test results:"
-          cat /tmp/shell-test.log 2>/dev/null | head -10 || echo "No shell test logs"
-        fi
-        
-        # Check if broker failed to start and show logs
-        if [ "$broker_ready" = false ]; then
-          echo "ERROR: MQ broker failed to start. Broker logs:"
-          cat /tmp/weed-mq-broker.log || echo "No broker logs found"
-          echo "Server logs:"  
-          tail -20 /tmp/weed-server.log || echo "No server logs found"
-          exit 1
-        fi
-
-    - name: Run Client Compatibility Tests
-      run: |
-        cd test/kafka
-        go test -v -run "^TestClientCompatibility" -timeout 180s ./integration/...
-      env:
-        GOMAXPROCS: 1
-        SEAWEEDFS_MASTERS: 127.0.0.1:9333
-
-  kafka-smq-integration-tests:
-    name: Kafka SMQ Integration Tests (Full Stack)
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    strategy:
-      fail-fast: false
-      matrix:
-        container-id: [smq-integration-1]
-    container:
-      image: golang:1.26-alpine
-      options: --cpus 1.0 --memory 2g --hostname kafka-smq-${{ matrix.container-id }}
-    env:
-      GOMAXPROCS: 1
-      CGO_ENABLED: 0
-      KAFKA_SMQ_INTEGRATION: "true"
-      CONTAINER_ID: ${{ matrix.container-id }}
-    steps:
-    - name: Check out code
-      uses: actions/checkout@v7
-
-    - name: Set up Go 1.x
-      uses: actions/setup-go@v7
-      with:
-        go-version: ^1.26
-        cache: true
-        cache-dependency-path: |
-          **/go.sum
-      id: go
-
-    - name: Setup SMQ Integration Container Environment
-      run: |
-        apk add --no-cache git procps curl netcat-openbsd
-        ulimit -n 1024 || echo "Warning: Could not set file descriptor limit"
-        
-    - name: Warm Go module cache
-      run: |
-        # Warm cache for root module
-        go mod download || true
-        # Warm cache for kafka test module
-        cd test/kafka
-        go mod download || true
-
-    - name: Get dependencies
-      run: |
-        cd test/kafka
-        timeout 90s go mod download || echo "Warning: Dependency download timed out, continuing with cached modules"
-        go mod tidy
-
-    - name: Build and start SeaweedFS MQ
-      run: |
-        set -e
-        cd $GITHUB_WORKSPACE
-        # Build weed binary
-        go build -o /usr/local/bin/weed ./weed
-        # Start SeaweedFS components with MQ brokers
-        export WEED_DATA_DIR=/tmp/seaweedfs-smq-$RANDOM
-        mkdir -p "$WEED_DATA_DIR"
-        
-        # Start SeaweedFS server (master, volume, filer) with consistent IP advertising
-        nohup weed -v 1 server \
-          -ip="127.0.0.1" \
-          -ip.bind="0.0.0.0" \
-          -dir="$WEED_DATA_DIR" \
-          -master.raftHashicorp \
-          -master.port=9333 \
-          -volume.port=8081 \
-          -filer.port=8888 \
-          -filer=true \
-          -metricsPort=9325 \
-          -master.peers=none \
-          > /tmp/weed-server.log 2>&1 &
-          
-        # Wait for master to be ready
-        for i in $(seq 1 30); do
-          if curl -s http://127.0.0.1:9333/cluster/status >/dev/null; then
-            echo "SeaweedFS master HTTP is up"; break
-          fi
-          echo "Waiting for SeaweedFS master HTTP... ($i/30)"; sleep 1
-        done
-        
-        # Wait for master gRPC to be ready (this is what broker discovery uses)
-        echo "Waiting for master gRPC port..."
-        for i in $(seq 1 30); do
-          if nc -z 127.0.0.1 19333; then
-            echo "✓ SeaweedFS master gRPC is up (port 19333)"
-            break
-          fi
-          echo "  Waiting for master gRPC... ($i/30)"; sleep 1
-        done
-        
-        # Give server time to initialize all components including gRPC services
-        echo "Waiting for SeaweedFS components to initialize..."
-        sleep 15
-        
-        # Additional wait specifically for gRPC services to be ready for streaming
-        echo "Allowing extra time for master gRPC streaming services to initialize..."
-        sleep 10
-        
-        # Start MQ broker with maximum verbosity for debugging
-        echo "Starting MQ broker..."
-        nohup weed -v 3 mq.broker \
-          -master="127.0.0.1:9333" \
-          -ip="127.0.0.1" \
-          -port=17777 \
-          -logFlushInterval=0 \
-          > /tmp/weed-mq-broker.log 2>&1 &
-        
-        # Wait for broker to be ready with better error reporting  
-        sleep 15
-        broker_ready=false
-        for i in $(seq 1 20); do
-          if nc -z 127.0.0.1 17777; then
-            echo "SeaweedFS MQ broker is up"
-            broker_ready=true
-            break
-          fi
-          echo "Waiting for MQ broker... ($i/20)"; sleep 1
-        done
-        
-        # Give broker additional time to register with master
-        if [ "$broker_ready" = true ]; then
-          echo "Allowing broker to register with master..."
-          sleep 30
-          
-          # Check if broker is properly registered by querying cluster nodes
-          echo "Cluster status after broker registration:"
-          curl -s "http://127.0.0.1:9333/cluster/status" || echo "Could not check cluster status"
-          
-          echo "Checking cluster topology (includes registered components):"
-          curl -s "http://127.0.0.1:9333/dir/status" | head -20 || echo "Could not check dir status"
-          
-          echo "Verifying broker discovery via master client debug:"
-          echo "If broker registration is successful, it should appear in dir status"
-          
-          echo "Testing gRPC connectivity with weed binary:"
-          echo "This simulates what the gateway does during broker discovery..."
-          timeout 10s weed shell -master=127.0.0.1:9333 -filer=127.0.0.1:8888 > /tmp/shell-test.log 2>&1 || echo "weed shell test completed or timed out - checking logs..."
-          echo "Shell test results:"
-          cat /tmp/shell-test.log 2>/dev/null | head -10 || echo "No shell test logs"
-        fi
-        
-        # Check if broker failed to start and show logs
-        if [ "$broker_ready" = false ]; then
-          echo "ERROR: MQ broker failed to start. Broker logs:"
-          cat /tmp/weed-mq-broker.log || echo "No broker logs found"
-          echo "Server logs:"  
-          tail -20 /tmp/weed-server.log || echo "No server logs found"
-          exit 1
-        fi
-
-    - name: Run SMQ Integration Tests
-      run: |
-        cd test/kafka
-        ulimit -n 512 || echo "Warning: Could not set file descriptor limit"
-        ulimit -u 100 || echo "Warning: Could not set process limit"
-        # Run the dedicated SMQ integration tests
-        go test -v -run "^TestSMQIntegration" -timeout 180s ./integration/...
-      env:
-        GOMAXPROCS: 1
-        SEAWEEDFS_MASTERS: 127.0.0.1:9333
-
-  kafka-protocol-tests:
-    name: Kafka Protocol Tests (Isolated)
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    strategy:
-      fail-fast: false
-      matrix:
-        container-id: [protocol-1]
-    container:
-      image: golang:1.26-alpine
-      options: --cpus 1.0 --memory 1g --tmpfs /tmp:exec --hostname kafka-protocol-${{ matrix.container-id }}
-    env:
-      GOMAXPROCS: 1
-      CGO_ENABLED: 0
-      KAFKA_PROTOCOL_ISOLATION: "true"
-      CONTAINER_ID: ${{ matrix.container-id }}
-    steps:
-    - name: Set up Go 1.x
-      uses: actions/setup-go@v7
-      with:
-        go-version: ^1.26
-      id: go
-
-    - name: Check out code
-      uses: actions/checkout@v7
-
-    - name: Setup Protocol Container Environment
-      run: |
-        apk add --no-cache git procps
-        # Ensure proper permissions for test execution
-        chmod -R 755 /tmp || true
-        export TMPDIR=/tmp
-        export GOCACHE=/tmp/go-cache
-        mkdir -p $GOCACHE
-        chmod 755 $GOCACHE
-
-    - name: Get dependencies
-      run: |
-        cd test/kafka
-        go mod download
-        go mod tidy
-
-    - name: Run Protocol Tests
-      run: |
-        cd test/kafka
-        export TMPDIR=/tmp
-        export GOCACHE=/tmp/go-cache
-        # Run protocol tests from the weed/mq/kafka directory since they test the protocol implementation
-        cd ../../weed/mq/kafka
-        go test -v -run "^Test.*" -timeout 10s ./...
-      env:
-        GOMAXPROCS: 1
-        TMPDIR: /tmp
-        GOCACHE: /tmp/go-cache

.github/workflows/kms-tests.yml

@@ -1,140 +0,0 @@
-name: "KMS Tests"
-
-on:
-  pull_request:
-    paths:
-      - 'weed/kms/**'
-      - 'weed/s3api/s3_sse_*.go'
-      - 'weed/s3api/s3api_object_handlers.go'
-      - 'weed/s3api/s3api_object_handlers_put.go'
-      - 'test/kms/**'
-      - '.github/workflows/kms-tests.yml'
-  push:
-    branches: [ master, main ]
-    paths:
-      - 'weed/kms/**'
-      - 'weed/s3api/s3_sse_*.go'
-      - 'weed/s3api/s3api_object_handlers.go'
-      - 'weed/s3api/s3api_object_handlers_put.go'
-      - 'test/kms/**'
-
-concurrency:
-  group: ${{ github.head_ref || github.ref }}-kms-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-defaults:
-  run:
-    working-directory: weed
-
-jobs:
-  kms-provider-tests:
-    name: KMS Provider Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run KMS provider integration tests
-        timeout-minutes: 15
-        working-directory: test/kms
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          docker --version
-
-          make test-provider-ci
-
-      - name: Show OpenBao logs on failure
-        if: failure()
-        run: |
-          echo "=== OpenBao Container Logs ==="
-          docker logs openbao-ci 2>&1 | tail -50 || echo "No OpenBao container found"
-          echo "=== Setup Logs ==="
-          cat /tmp/openbao-ci-setup.log 2>/dev/null || echo "No setup log found"
-
-      - name: Cleanup
-        if: always()
-        working-directory: test/kms
-        run: |
-          make stop-openbao-ci || true
-
-  s3-kms-e2e-tests:
-    name: S3 KMS End-to-End Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 25
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run S3 KMS end-to-end tests
-        timeout-minutes: 20
-        working-directory: test/kms
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          docker --version
-          aws --version
-
-          make test-s3-kms-ci
-
-      - name: Show logs on failure
-        if: failure()
-        working-directory: test/kms
-        run: |
-          echo "=== OpenBao Container Logs ==="
-          cat /tmp/openbao-ci-container.log 2>/dev/null || docker logs openbao-ci 2>&1 | tail -50 || echo "No OpenBao logs found"
-          echo "=== SeaweedFS Server Logs ==="
-          tail -100 /tmp/seaweedfs-kms-mini.log 2>/dev/null || echo "No server log found"
-          echo "=== Setup Logs ==="
-          cat /tmp/weed-kms-ci-setup.log 2>/dev/null || echo "No weed setup log"
-          echo "=== Process Information ==="
-          ps aux | grep -E "(weed|test)" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-kms-e2e-logs
-          path: |
-            /tmp/seaweedfs-kms-mini.log
-            /tmp/openbao-ci-container.log
-            /tmp/weed-kms-ci-setup.log
-          retention-days: 3
-
-      - name: Cleanup
-        if: always()
-        working-directory: test/kms
-        run: |
-          make stop-seaweedfs-ci || true
-          make stop-openbao-ci || true
-          make clean-ci || true

.github/workflows/master-cold-start-tests.yml

@@ -1,79 +0,0 @@
-name: "Master Cold Start Tests"
-
-on:
-  push:
-    branches: [ master ]
-    paths:
-      - 'weed/server/master_*.go'
-      - 'weed/topology/**'
-      - 'weed/operation/**'
-      - 'test/master_cold_start/**'
-      - 'test/testutil/**'
-      - '.github/workflows/master-cold-start-tests.yml'
-  pull_request:
-    branches: [ master ]
-    paths:
-      - 'weed/server/master_*.go'
-      - 'weed/topology/**'
-      - 'weed/operation/**'
-      - 'test/master_cold_start/**'
-      - 'test/testutil/**'
-      - '.github/workflows/master-cold-start-tests.yml'
-
-concurrency:
-  group: ${{ github.head_ref || github.ref }}/master-cold-start-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  master-cold-start-tests:
-    name: Master Cold Start Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-
-      - name: Build weed binary
-        run: |
-          cd weed && go install -buildvcs=false
-
-      - name: Run master cold start tests
-        # test/master_cold_start boots a fresh master plus empty volume
-        # servers and requires the very first assign (HTTP and gRPC, no
-        # client retries) to complete a write: the assign that triggers
-        # volume growth must wait for it instead of failing with
-        # "volume growth in progress".
-        run: |
-          export WEED_BINARY=$(go env GOPATH)/bin/weed
-          go test -v -timeout=8m ./test/master_cold_start/...
-
-      - name: Collect server logs on failure
-        if: failure()
-        run: |
-          # test/master_cold_start/cluster.go keeps failing-test dirs created
-          # via os.MkdirTemp("", "seaweedfs_master_cold_start_it_") with each
-          # process log under <baseDir>/logs/.
-          mkdir -p /tmp/master-cold-start-logs
-          find /tmp -maxdepth 1 -type d -name "seaweedfs_master_cold_start_it_*" 2>/dev/null | while read dir; do
-            echo "Found test directory: $dir"
-            cp -r "$dir" /tmp/master-cold-start-logs/ 2>/dev/null || true
-          done
-          find /tmp/master-cold-start-logs -type f -name "*.log" -print -exec tail -n 100 {} \; 2>/dev/null || echo "No logs found"
-
-      - name: Archive logs
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: master-cold-start-test-logs
-          path: /tmp/master-cold-start-logs/
-          retention-days: 7

.github/workflows/metadata-subscribe-tests.yml

@@ -1,93 +0,0 @@
-name: "Metadata Subscribe Integration Tests"
-
-on:
-  push:
-    branches: [ master ]
-    paths:
-      - 'weed/filer/**'
-      - 'weed/pb/filer_pb/**'
-      - 'weed/util/log_buffer/**'
-      - 'weed/server/filer_grpc_server_sub_meta.go'
-      - 'weed/server/master_grpc_server.go'
-      - 'weed/command/filer_backup.go'
-      - 'test/metadata_subscribe/**'
-      - '.github/workflows/metadata-subscribe-tests.yml'
-  pull_request:
-    branches: [ master ]
-    paths:
-      - 'weed/filer/**'
-      - 'weed/pb/filer_pb/**'
-      - 'weed/util/log_buffer/**'
-      - 'weed/server/filer_grpc_server_sub_meta.go'
-      - 'weed/server/master_grpc_server.go'
-      - 'weed/command/filer_backup.go'
-      - 'test/metadata_subscribe/**'
-      - '.github/workflows/metadata-subscribe-tests.yml'
-
-concurrency:
-  group: ${{ github.head_ref }}/metadata-subscribe-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-env:
-  TEST_TIMEOUT: '10m'
-
-jobs:
-  metadata-subscribe-integration:
-    name: Metadata Subscribe Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-    
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v7
-      
-    - name: Set up Go
-      uses: actions/setup-go@v7
-      with:
-        go-version-file: 'go.mod'
-        
-    - name: Build SeaweedFS
-      run: |
-        cd weed
-        go build -o weed .
-        chmod +x weed
-        ./weed version
-        
-    - name: Run Metadata Subscribe Integration Tests
-      run: |
-        cd test/metadata_subscribe
-        
-        echo "Running Metadata Subscribe integration tests..."
-        echo "============================================"
-        
-        # Run tests with verbose output
-        go test -v -timeout=${{ env.TEST_TIMEOUT }} ./...
-        
-        echo "============================================"
-        echo "Metadata Subscribe integration tests completed"
-        
-    - name: Archive logs on failure
-      if: failure()
-      uses: actions/upload-artifact@v7
-      with:
-        name: metadata-subscribe-test-logs
-        path: |
-          /tmp/seaweedfs_*
-        retention-days: 7
-        
-    - name: Test Summary
-      if: always()
-      run: |
-        echo "## Metadata Subscribe Integration Test Summary" >> $GITHUB_STEP_SUMMARY
-        echo "" >> $GITHUB_STEP_SUMMARY
-        echo "### Test Coverage" >> $GITHUB_STEP_SUMMARY
-        echo "- **Basic Subscription**: Subscribe to metadata changes and receive events" >> $GITHUB_STEP_SUMMARY
-        echo "- **Single-Filer No Stall**: Regression test for issue #4977" >> $GITHUB_STEP_SUMMARY
-        echo "- **Resume from Disk**: Verify subscription can resume from persisted logs" >> $GITHUB_STEP_SUMMARY
-        echo "" >> $GITHUB_STEP_SUMMARY
-        echo "### Related Issues" >> $GITHUB_STEP_SUMMARY
-        echo "- [#4977](https://github.com/seaweedfs/seaweedfs/issues/4977): filer.backup synchronisation stall" >> $GITHUB_STEP_SUMMARY
-

.github/workflows/mount-benchmark.yml

@@ -1,203 +0,0 @@
-name: "mount: benchmark"
-
-# Manual benchmark: native WinFsp mount vs rclone+WebDAV on the same Windows
-# runner, with a Linux FUSE mount of the same build as a reference. Numbers
-# from shared runners are noisy; this is for finding factor-of-N gaps, not
-# regressions of a few percent.
-on:
-  workflow_dispatch:
-  push:
-    branches: [ 'winfsp-bench**' ]
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  bench-windows:
-    name: Windows native vs rclone
-    runs-on: windows-latest
-    timeout-minutes: 60
-    env:
-      CGO_ENABLED: 0
-
-    steps:
-    - uses: actions/checkout@v7
-      with:
-        persist-credentials: false
-
-    - uses: actions/setup-go@v7
-      with:
-        go-version-file: 'go.mod'
-
-    - name: Install WinFsp and rclone
-      run: choco install winfsp rclone -y --no-progress
-
-    - name: Build weed.exe
-      run: go build -o weed.exe ./weed
-
-    - name: Benchmark both mounts
-      shell: pwsh
-      run: |
-        $ErrorActionPreference = 'Stop'
-
-        function Test-Port($port) {
-          $client = New-Object System.Net.Sockets.TcpClient
-          try { $client.Connect('127.0.0.1', $port); return $client.Connected }
-          catch { return $false }
-          finally { $client.Dispose() }
-        }
-
-        function Wait-Drive($drive, $what) {
-          $deadline = (Get-Date).AddMinutes(2)
-          while ((Get-Date) -lt $deadline) {
-            if (Test-Path "${drive}\") { Write-Host "$what is mounted on $drive"; return }
-            Start-Sleep -Seconds 2
-          }
-          throw "$what never appeared on $drive"
-        }
-
-        function Invoke-Bench($dir, $label, $out) {
-          Write-Host "::group::bench $label"
-          & go run ./test/mount_bench -dir $dir -label $label -filer 127.0.0.1:8888 -out $out
-          $code = $LASTEXITCODE
-          Write-Host "::endgroup::"
-          if ($code -ne 0) { throw "bench $label failed with exit $code" }
-        }
-
-        New-Item -ItemType Directory -Force -Path C:\seaweed-data | Out-Null
-        Start-Process -FilePath .\weed.exe `
-          -ArgumentList '-logtostderr','mini','-dir=C:\seaweed-data','-ip=127.0.0.1' `
-          -RedirectStandardOutput C:\seaweed-mini.log -RedirectStandardError C:\seaweed-mini.err.log
-
-        $deadline = (Get-Date).AddMinutes(3)
-        while ((Get-Date) -lt $deadline) {
-          if ((Test-Port 8888) -and (Test-Port 18888) -and (Test-Port 7333)) { break }
-          Start-Sleep -Seconds 3
-        }
-        if (-not ((Test-Port 8888) -and (Test-Port 18888) -and (Test-Port 7333))) {
-          Get-Content C:\seaweed-mini.log, C:\seaweed-mini.err.log -ErrorAction SilentlyContinue
-          throw "mini cluster never came up"
-        }
-        Write-Host "filer on 8888/18888, webdav on 7333"
-
-        # --- native WinFsp mount ---
-        Start-Process -FilePath .\weed.exe `
-          -ArgumentList '-logtostderr','mount','-filer=127.0.0.1:8888','-dir=S:' `
-          -RedirectStandardOutput C:\seaweed-mount.log -RedirectStandardError C:\seaweed-mount.err.log
-        Wait-Drive 'S:' 'weed mount'
-
-        Invoke-Bench 'S:\bench-native' 'winfsp-native' 'C:\results-native.json'
-
-        Get-CimInstance Win32_Process -Filter "Name = 'weed.exe'" |
-          Where-Object { $_.CommandLine -like '*mount*' } |
-          ForEach-Object { Stop-Process -Id $_.ProcessId -Force }
-        $deadline = (Get-Date).AddMinutes(1)
-        while ((Get-Date) -lt $deadline -and (Test-Path S:\)) { Start-Sleep -Seconds 2 }
-
-        # --- rclone + WebDAV on the same WinFsp ---
-        # rclone serves listings from a directory cache it fills lazily, so the
-        # big-listing files have to exist before it mounts or it never sees them.
-        & go run ./test/mount_bench -filer 127.0.0.1:8888 -seed bench-rclone/biglist
-        if ($LASTEXITCODE -ne 0) { throw "seeding failed" }
-
-        $env:RCLONE_CONFIG_SEAWEED_TYPE = 'webdav'
-        $env:RCLONE_CONFIG_SEAWEED_URL = 'http://127.0.0.1:7333'
-        $env:RCLONE_CONFIG_SEAWEED_VENDOR = 'other'
-        Start-Process -FilePath rclone `
-          -ArgumentList 'mount','seaweed:','T:','--vfs-cache-mode=writes','-v','--log-file=C:\rclone.log'
-        Wait-Drive 'T:' 'rclone mount'
-
-        Invoke-Bench 'T:\bench-rclone' 'rclone-webdav' 'C:\results-rclone.json'
-
-        Stop-Process -Name rclone -Force -ErrorAction SilentlyContinue
-
-        # --- comparison ---
-        $table = & go run ./test/mount_bench -compare C:\results-native.json,C:\results-rclone.json
-        $table | Write-Host
-        "## Windows: native WinFsp vs rclone+WebDAV" | Out-File -Append $env:GITHUB_STEP_SUMMARY
-        $table | Out-File -Append $env:GITHUB_STEP_SUMMARY
-
-    - name: Logs
-      if: always()
-      shell: pwsh
-      run: |
-        foreach ($f in 'C:\seaweed-mount.log','C:\seaweed-mount.err.log','C:\rclone.log','C:\seaweed-mini.log','C:\seaweed-mini.err.log') {
-          if (Test-Path $f) { Write-Host "===== $f"; Get-Content $f -Tail 100 }
-        }
-
-    - name: Results
-      if: always()
-      uses: actions/upload-artifact@v7
-      with:
-        name: results-windows
-        path: C:\results-*.json
-        if-no-files-found: ignore
-
-  bench-linux:
-    name: Linux FUSE reference
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-
-    steps:
-    - uses: actions/checkout@v7
-      with:
-        persist-credentials: false
-
-    - uses: actions/setup-go@v7
-      with:
-        go-version-file: 'go.mod'
-
-    - name: Repair the fusermount3 setuid bit
-      uses: ./.github/actions/fix-fusermount-setuid
-
-    - name: Allow non-root FUSE mounts with allow_other
-      run: |
-        echo 'user_allow_other' | sudo tee -a /etc/fuse.conf
-        sudo chmod 644 /etc/fuse.conf
-
-    - name: Build weed
-      run: go build -o /tmp/weed ./weed
-
-    - name: Benchmark FUSE mount
-      run: |
-        set -e
-        mkdir -p /tmp/seaweed-data
-        /tmp/weed -logtostderr mini -dir=/tmp/seaweed-data -ip=127.0.0.1 > /tmp/mini.log 2>&1 &
-
-        for i in $(seq 1 60); do
-          if nc -z 127.0.0.1 8888 && nc -z 127.0.0.1 18888; then break; fi
-          sleep 3
-        done
-        nc -z 127.0.0.1 8888 || { cat /tmp/mini.log; echo "filer never came up"; exit 1; }
-
-        mkdir -p "$HOME/mnt"
-        /tmp/weed -logtostderr mount -filer=127.0.0.1:8888 -dir="$HOME/mnt" > /tmp/mount.log 2>&1 &
-        for i in $(seq 1 60); do
-          if mountpoint -q "$HOME/mnt"; then break; fi
-          sleep 2
-        done
-        mountpoint -q "$HOME/mnt" || { cat /tmp/mount.log; echo "mount never appeared"; exit 1; }
-
-        go run ./test/mount_bench -dir "$HOME/mnt/bench-linux" -label linux-fuse -filer 127.0.0.1:8888 -out /tmp/results-linux.json
-
-        {
-          echo "## Linux FUSE reference"
-          go run ./test/mount_bench -compare /tmp/results-linux.json
-        } >> "$GITHUB_STEP_SUMMARY"
-
-    - name: Logs
-      if: always()
-      run: |
-        tail -n 100 /tmp/mount.log /tmp/mini.log 2>/dev/null || true
-
-    - name: Results
-      if: always()
-      uses: actions/upload-artifact@v7
-      with:
-        name: results-linux
-        path: /tmp/results-linux.json
-        if-no-files-found: ignore

.github/workflows/mount-windows-conformance.yml

@@ -1,124 +0,0 @@
-name: "mount: windows conformance"
-
-on:
-  push:
-    branches: [ master ]
-    paths:
-      - 'weed/mount/**'
-      - 'weed/command/mount*.go'
-      - 'weed/storage/volume_vacuum*.go'
-      - 'weed/storage/volume_loading.go'
-      - 'weed/storage/disk_location.go'
-      - 'test/winfsp-conformance/**'
-      - '.github/workflows/mount-windows-conformance.yml'
-  # No base branch filter: this is the only thing that runs the Windows mount,
-  # so it should cover a pull request stacked on another one too.
-  pull_request:
-    paths:
-      - 'weed/mount/**'
-      - 'weed/command/mount*.go'
-      - 'weed/storage/volume_vacuum*.go'
-      - 'weed/storage/volume_loading.go'
-      - 'weed/storage/disk_location.go'
-      - 'test/winfsp-conformance/**'
-      - '.github/workflows/mount-windows-conformance.yml'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  conformance:
-    name: WinFsp conformance
-    runs-on: windows-latest
-    timeout-minutes: 60
-    env:
-      # The runner ships MinGW, so cgo is on by default and cgofuse picks its
-      # cgo variant, which wants WinFsp's headers. The nocgo variant loads
-      # winfsp-x64.dll at run time instead, which is how weed.exe is released.
-      CGO_ENABLED: 0
-
-    steps:
-    - uses: actions/checkout@v7
-      with:
-        persist-credentials: false
-
-    - uses: actions/setup-go@v7
-      with:
-        go-version-file: 'go.mod'
-
-    # cgofuse loads winfsp-x64.dll at run time, so WinFsp is needed here but
-    # not to build.
-    - name: Install WinFsp
-      run: choco install winfsp -y --no-progress
-
-    - name: Build weed.exe
-      run: go build -o weed.exe ./weed
-
-    # The runner tears down a step's process tree when its shell exits, so a
-    # cluster started in one step is gone by the next. Everything that needs
-    # the cluster and the mount alive has to share a step.
-    - name: Mount and run winfsp-tests
-      shell: pwsh
-      run: |
-        $ErrorActionPreference = 'Stop'
-
-        function Test-Port($port) {
-          # A plain connect, because Test-NetConnection has reported success
-          # here for a port nothing was listening on.
-          $client = New-Object System.Net.Sockets.TcpClient
-          try { $client.Connect('127.0.0.1', $port); return $client.Connected }
-          catch { return $false }
-          finally { $client.Dispose() }
-        }
-
-        function Start-Mount($log) {
-          Start-Process -FilePath .\weed.exe `
-            -ArgumentList '-logtostderr','mount','-filer=127.0.0.1:8888','-dir=S:' `
-            -RedirectStandardOutput "C:\$log.log" -RedirectStandardError "C:\$log.err.log"
-          $deadline = (Get-Date).AddMinutes(2)
-          while ((Get-Date) -lt $deadline) {
-            if (Test-Path S:\) { Write-Host "S: is mounted"; return }
-            Start-Sleep -Seconds 2
-          }
-          Get-Content "C:\$log.log", "C:\$log.err.log" -ErrorAction SilentlyContinue
-          throw "S: never appeared"
-        }
-
-        New-Item -ItemType Directory -Force -Path C:\seaweed-data | Out-Null
-        # -ip pins the cluster to loopback; it otherwise advertises and binds
-        # the runner's LAN address, which 127.0.0.1 cannot reach.
-        Start-Process -FilePath .\weed.exe `
-          -ArgumentList '-logtostderr','mini','-dir=C:\seaweed-data','-ip=127.0.0.1' `
-          -RedirectStandardOutput C:\seaweed-mini.log -RedirectStandardError C:\seaweed-mini.err.log
-
-        $deadline = (Get-Date).AddMinutes(3)
-        while ((Get-Date) -lt $deadline) {
-          # The mount dials grpc, not http, so both ports have to answer.
-          if ((Test-Port 8888) -and (Test-Port 18888)) { break }
-          Start-Sleep -Seconds 3
-        }
-        if (-not ((Test-Port 8888) -and (Test-Port 18888))) {
-          Get-Content C:\seaweed-mini.log, C:\seaweed-mini.err.log -ErrorAction SilentlyContinue
-          throw "filer never came up"
-        }
-        Write-Host "filer is up on http 8888 and grpc 18888"
-
-        Start-Mount 'seaweed-mount'
-
-        Write-Host "::group::winfsp-tests"
-        & pwsh -File test/winfsp-conformance/run.ps1 -MountPoint S:\
-        $code = $LASTEXITCODE
-        Write-Host "::endgroup::"
-        if ($code -ne 0) { throw "winfsp-tests failed with exit $code" }
-
-    - name: Logs
-      if: always()
-      shell: pwsh
-      run: |
-        foreach ($f in 'C:\seaweed-mount.log','C:\seaweed-mount.err.log','C:\seaweed-mini.log','C:\seaweed-mini.err.log') {
-          if (Test-Path $f) { Write-Host "===== $f"; Get-Content $f -Tail 200 }
-        }

.github/workflows/mount-windows.yml

@@ -1,205 +0,0 @@
-name: "mount: windows"
-
-on:
-  push:
-    branches: [ master ]
-    paths:
-      - 'weed/mount/**'
-      - 'weed/command/mount*.go'
-      - 'weed/storage/volume_vacuum*.go'
-      - 'weed/storage/volume_loading.go'
-      - 'weed/storage/disk_location.go'
-      - 'test/winfsp/**'
-      - '.github/workflows/mount-windows.yml'
-  # No base branch filter: this is the only thing that runs the Windows mount,
-  # so it should cover a pull request stacked on another one too.
-  pull_request:
-    paths:
-      - 'weed/mount/**'
-      - 'weed/command/mount*.go'
-      - 'weed/storage/volume_vacuum*.go'
-      - 'weed/storage/volume_loading.go'
-      - 'weed/storage/disk_location.go'
-      - 'test/winfsp/**'
-      - '.github/workflows/mount-windows.yml'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  mount-windows:
-    name: Mount on Windows
-    runs-on: windows-latest
-    timeout-minutes: 40
-    env:
-      # The runner ships MinGW, so cgo is on by default and cgofuse picks its
-      # cgo variant, which wants WinFsp's headers. The nocgo variant loads
-      # winfsp-x64.dll at run time instead, which is how weed.exe is released.
-      CGO_ENABLED: 0
-
-    steps:
-    - uses: actions/checkout@v7
-      with:
-        persist-credentials: false
-
-    - uses: actions/setup-go@v7
-      with:
-        go-version-file: 'go.mod'
-
-    # cgofuse loads winfsp-x64.dll at run time, so WinFsp is needed here but
-    # not to build.
-    - name: Install WinFsp
-      run: choco install winfsp -y --no-progress
-
-    - name: Build weed.exe
-      run: go build -o weed.exe ./weed
-
-    # The runner tears down a step's process tree when its shell exits, so a
-    # cluster started in one step is gone by the next. Everything that needs
-    # the cluster and the mount alive has to share a step.
-    - name: Mount and exercise
-      shell: pwsh
-      run: |
-        $ErrorActionPreference = 'Stop'
-
-        function Test-Port($port) {
-          # A plain connect, because Test-NetConnection has reported success
-          # here for a port nothing was listening on.
-          $client = New-Object System.Net.Sockets.TcpClient
-          try { $client.Connect('127.0.0.1', $port); return $client.Connected }
-          catch { return $false }
-          finally { $client.Dispose() }
-        }
-
-        function Start-Mount($log) {
-          Start-Process -FilePath .\weed.exe `
-            -ArgumentList '-logtostderr','mount','-filer=127.0.0.1:8888','-dir=S:' `
-            -RedirectStandardOutput "C:\$log.log" -RedirectStandardError "C:\$log.err.log"
-          $deadline = (Get-Date).AddMinutes(2)
-          while ((Get-Date) -lt $deadline) {
-            if (Test-Path S:\) { Write-Host "S: is mounted"; return }
-            Start-Sleep -Seconds 2
-          }
-          Get-Content "C:\$log.log", "C:\$log.err.log" -ErrorAction SilentlyContinue
-          throw "S: never appeared"
-        }
-
-        function Stop-Mount {
-          Get-CimInstance Win32_Process -Filter "Name = 'weed.exe'" |
-            Where-Object { $_.CommandLine -like '*mount*' } |
-            ForEach-Object { Stop-Process -Id $_.ProcessId -Force }
-          $deadline = (Get-Date).AddMinutes(1)
-          while ((Get-Date) -lt $deadline -and (Test-Path S:\)) { Start-Sleep -Seconds 2 }
-          if (Test-Path S:\) { throw "S: still present after stopping the mount" }
-          Write-Host "unmounted"
-        }
-
-        function Invoke-Tests($label, [string[]]$goArgs) {
-          Write-Host "::group::$label"
-          & go @goArgs
-          $code = $LASTEXITCODE
-          Write-Host "::endgroup::"
-          if ($code -ne 0) { throw "$label failed with exit $code" }
-        }
-
-        New-Item -ItemType Directory -Force -Path C:\seaweed-data | Out-Null
-        # -ip pins the cluster to loopback; it otherwise advertises and binds
-        # the runner's LAN address, which 127.0.0.1 cannot reach.
-        Start-Process -FilePath .\weed.exe `
-          -ArgumentList '-logtostderr','mini','-dir=C:\seaweed-data','-ip=127.0.0.1' `
-          -RedirectStandardOutput C:\seaweed-mini.log -RedirectStandardError C:\seaweed-mini.err.log
-
-        $deadline = (Get-Date).AddMinutes(3)
-        while ((Get-Date) -lt $deadline) {
-          # The mount dials grpc, not http, so both ports have to answer.
-          if ((Test-Port 8888) -and (Test-Port 18888)) { break }
-          Start-Sleep -Seconds 3
-        }
-        if (-not ((Test-Port 8888) -and (Test-Port 18888))) {
-          Get-Content C:\seaweed-mini.log, C:\seaweed-mini.err.log -ErrorAction SilentlyContinue
-          throw "filer never came up"
-        }
-        Write-Host "filer is up on http 8888 and grpc 18888"
-
-        Start-Mount 'seaweed-mount'
-
-        Invoke-Tests 'exercise' @('test','-v','-timeout','20m','./test/winfsp','-mountpoint=S:\')
-        Invoke-Tests 'persist-write' @('test','-v','-timeout','15m','./test/winfsp','-run','TestPersistence','-mountpoint=S:\','-phase=write','-filer=127.0.0.1:8888')
-
-        Stop-Mount
-        Start-Mount 'seaweed-remount'
-
-        Invoke-Tests 'persist-verify' @('test','-v','-timeout','15m','./test/winfsp','-run','TestPersistence','-mountpoint=S:\','-phase=verify')
-
-        # WinFsp creates the mount directory itself, so the path must not
-        # exist; only its parent has to.
-        Write-Host "::group::mount over a directory"
-        Stop-Mount
-        Remove-Item C:\seaweed-mnt -Recurse -Force -ErrorAction SilentlyContinue
-        Start-Process -FilePath .\weed.exe `
-          -ArgumentList '-logtostderr','mount','-filer=127.0.0.1:8888','-dir=C:\seaweed-mnt' `
-          -RedirectStandardOutput C:\seaweed-dirmount.log -RedirectStandardError C:\seaweed-dirmount.err.log
-        $deadline = (Get-Date).AddMinutes(2)
-        $ok = $false
-        while ((Get-Date) -lt $deadline) {
-          # Listing succeeds on the plain empty directory too, so wait for the
-          # reparse point WinFsp turns it into. Otherwise this step passes
-          # without a mount and writes to local disk.
-          $item = Get-Item C:\seaweed-mnt -Force -ErrorAction SilentlyContinue
-          if ($null -ne $item -and $item.Attributes.ToString() -like '*ReparsePoint*') { $ok = $true; break }
-          Start-Sleep -Seconds 2
-        }
-        if (-not $ok) {
-          Get-Content C:\seaweed-dirmount.log, C:\seaweed-dirmount.err.log -ErrorAction SilentlyContinue
-          throw "mounting over a directory failed"
-        }
-        Set-Content -Path C:\seaweed-mnt\dirmount.txt -Value 'via directory mount'
-        if ((Get-Content C:\seaweed-mnt\dirmount.txt) -ne 'via directory mount') { throw "readback through the directory mount differs" }
-        Remove-Item C:\seaweed-mnt\dirmount.txt -Force
-        Get-CimInstance Win32_Process -Filter "Name = 'weed.exe'" |
-          Where-Object { $_.CommandLine -like '*mount*' } |
-          ForEach-Object { Stop-Process -Id $_.ProcessId -Force }
-        Start-Sleep -Seconds 5
-        Write-Host "::endgroup::"
-
-        Start-Mount 'seaweed-remount2'
-
-        Write-Host "::group::explorer-style walk"
-        New-Item -ItemType Directory -Force -Path S:\walk | Out-Null
-        1..200 | ForEach-Object { Set-Content -Path "S:\walk\f$_.txt" -Value "line $_" }
-        $names = @(Get-ChildItem S:\walk | ForEach-Object { $_.Name })
-        if ($names.Count -ne 200) {
-          # Name the strays: a dot entry surfacing here is a different problem
-          # from a missing or duplicated file.
-          $unexpected = $names | Where-Object { $_ -notmatch '^f\d+\.txt$' }
-          throw "listed $($names.Count) entries, expected 200; unexpected: $($unexpected -join ', ')"
-        }
-        $body = Get-Content S:\walk\f42.txt
-        if ($body -ne 'line 42') { throw "unexpected content: $body" }
-        Copy-Item S:\walk\f42.txt S:\walk\copy.txt
-        Remove-Item S:\walk -Recurse -Force
-        if (Test-Path S:\walk) { throw "directory survived recursive delete" }
-        Write-Host "::endgroup::"
-
-        # Tear down everything we started so the runner's later steps (Logs,
-        # post-checkout) launch into a clean environment. A WinFsp mount left
-        # active and a weed.exe holding winfsp-x64.dll have been seen to make
-        # the next step's pwsh.exe fail with STATUS_DLL_INIT_FAILED
-        # (0xC0000142), which fails a job whose actual test step passed.
-        try { Stop-Mount } catch { Write-Host "no mount to stop at teardown: $_" }
-        Get-CimInstance Win32_Process -Filter "Name = 'weed.exe'" |
-          ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }
-        Start-Sleep -Seconds 3
-
-    - name: Logs
-      if: always()
-      continue-on-error: true
-      shell: pwsh
-      run: |
-        foreach ($f in 'C:\seaweed-mount.log','C:\seaweed-mount.err.log','C:\seaweed-remount.log','C:\seaweed-remount.err.log','C:\seaweed-remount2.log','C:\seaweed-remount2.err.log','C:\seaweed-dirmount.log','C:\seaweed-dirmount.err.log','C:\seaweed-mini.log','C:\seaweed-mini.err.log') {
-          if (Test-Path $f) { Write-Host "===== $f"; Get-Content $f -Tail 200 }
-        }

.github/workflows/multi-master-tests.yml

@@ -1,77 +0,0 @@
-name: "Multi-Master Tests"
-
-on:
-  push:
-    branches: [ master ]
-    paths:
-      - 'weed/server/master_*.go'
-      - 'weed/server/raft_*.go'
-      - 'weed/topology/**'
-      - 'test/multi_master/**'
-      - 'test/testutil/**'
-      - '.github/workflows/multi-master-tests.yml'
-  pull_request:
-    branches: [ master ]
-    paths:
-      - 'weed/server/master_*.go'
-      - 'weed/server/raft_*.go'
-      - 'weed/topology/**'
-      - 'test/multi_master/**'
-      - 'test/testutil/**'
-      - '.github/workflows/multi-master-tests.yml'
-
-concurrency:
-  group: ${{ github.head_ref || github.ref }}/multi-master-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  multi-master-failover-tests:
-    name: Multi-Master Failover Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-
-      - name: Install SeaweedFS
-        run: |
-          cd weed && go install -buildvcs=false
-
-      - name: Run multi-master failover tests
-        # The tests in test/multi_master spin up their own 3-node master raft
-        # cluster (using the freshly-installed `weed` binary) and exercise
-        # leader-election, failover and recovery scenarios. The shared
-        # test/testutil port-allocator regression test runs alongside since it
-        # is a prerequisite for the cluster fixtures.
-        run: |
-          go test -v -timeout=8m ./test/multi_master/... ./test/testutil/...
-
-      - name: Collect server logs on failure
-        if: failure()
-        run: |
-          # test/multi_master/cluster.go creates per-test dirs via
-          # os.MkdirTemp("", "seaweedfs_multi_master_it_") and writes each
-          # node's log into <baseDir>/logs/master*.log.
-          echo "Collecting per-node master logs from temp directories..."
-          mkdir -p /tmp/multi-master-logs
-          find /tmp -maxdepth 1 -type d -name "seaweedfs_multi_master_it_*" 2>/dev/null | while read dir; do
-            echo "Found test directory: $dir"
-            cp -r "$dir" /tmp/multi-master-logs/ 2>/dev/null || true
-          done
-          find /tmp/multi-master-logs -type f -name "*.log" -print -exec tail -n 100 {} \; 2>/dev/null || echo "No logs found"
-
-      - name: Archive logs
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: multi-master-test-logs
-          path: /tmp/multi-master-logs/
-          retention-days: 7

.github/workflows/performance.yml

@@ -1,470 +0,0 @@
-name: "Performance"
-
-on:
-  push:
-    branches: [ master ]
-    paths:
-      - '**/*.go'
-      - 'go.mod'
-      - 'go.sum'
-      - 'seaweed-volume/**'
-      - 'seaweed-common/**'
-      - 'test/perf/**'
-      - '.github/workflows/performance.yml'
-  workflow_dispatch:
-    inputs:
-      profile_duration:
-        description: "CPU profiling duration in seconds"
-        required: false
-        default: "30"
-        type: string
-      benchmark_files:
-        description: "Number of files for the throughput benchmark"
-        required: false
-        default: "100000"
-        type: string
-      benchmark_concurrency:
-        description: "Concurrent read/write workers"
-        required: false
-        default: "16"
-        type: string
-      benchmark_size:
-        description: "Simulated file size in bytes"
-        required: false
-        default: "1024"
-        type: string
-      s3_objects:
-        description: "Number of objects for the S3 benchmark"
-        required: false
-        default: "20000"
-        type: string
-      s3_size:
-        description: "S3 object size in bytes"
-        required: false
-        default: "4096"
-        type: string
-
-concurrency:
-  group: ${{ github.head_ref || github.ref }}/performance
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-env:
-  VOL_SIZE_LIMIT: "1024"
-
-jobs:
-  performance-profile:
-    name: CPU and Heap Profile
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-
-      - name: Build weed
-        run: go build -o weed_bin ./weed
-
-      - name: Start server with profiling enabled
-        run: |
-          mkdir -p ./perfdata
-          ./weed_bin -v=1 server -debug -debug.port=6060 -dir=./perfdata \
-            -s3 -filer -volume.max=0 -master.volumeSizeLimitMB=100 \
-            -s3.port=8000 -s3.config=./docker/compose/s3.json \
-            > weed.log 2>&1 &
-          echo "WEED_PID=$!" >> "$GITHUB_ENV"
-          for i in $(seq 1 60); do
-            if curl -sf http://localhost:9333/dir/status >/dev/null 2>&1; then
-              echo "master is ready"
-              break
-            fi
-            sleep 1
-          done
-          # give the volume server a moment to register with the master
-          sleep 3
-
-      - name: Start memory sampler
-        run: |
-          bash test/perf/mem_sample.sh mem-profile.csv "server=${WEED_PID}" &
-          echo "SAMPLER_PID=$!" >> "$GITHUB_ENV"
-
-      - name: Capture profiles under load
-        run: |
-          DURATION="${{ github.event.inputs.profile_duration || '30' }}"
-          # drive write load so the sampled profile reflects real work
-          ./weed_bin benchmark -master=localhost:9333 -writeOnly \
-            -c=16 -n=5000000 -size=1024 > benchmark-load.log 2>&1 &
-          echo "Sampling CPU profile for ${DURATION}s..."
-          curl -s "http://localhost:6060/debug/pprof/profile?seconds=${DURATION}" -o cpu.pprof
-          curl -s "http://localhost:6060/debug/pprof/heap" -o heap.pprof
-          curl -s "http://localhost:6060/debug/pprof/goroutine?debug=1" -o goroutine.txt
-          go tool pprof -top -nodecount=50 cpu.pprof > cpu-top.txt 2>/dev/null || true
-          go tool pprof -top -nodecount=50 -sample_index=inuse_space heap.pprof > heap-top.txt 2>/dev/null || true
-
-      - name: Record memory usage
-        if: always()
-        run: |
-          kill -TERM "${SAMPLER_PID}" 2>/dev/null || true
-          sleep 2
-          {
-            echo "## Memory usage (peak RSS)"
-            echo '```'
-            if [ -f mem-profile.csv.peak ]; then
-              awk -F'\t' '{printf "%-10s %8d KB  (%.1f MB)\n", $1, $2, $2/1024}' mem-profile.csv.peak
-            else
-              echo "no memory samples captured"
-            fi
-            echo '```'
-          } >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Profile summary
-        if: always()
-        run: |
-          {
-            echo "## CPU profile (top functions)"
-            echo '```'
-            head -45 cpu-top.txt 2>/dev/null || echo "no cpu profile captured"
-            echo '```'
-          } >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Stop server
-        if: always()
-        run: kill "${WEED_PID}" 2>/dev/null || true
-
-      - name: Show server log on failure
-        if: failure()
-        run: tail -200 weed.log || true
-
-      - name: Upload profiles
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: performance-profile-${{ github.run_number }}
-          path: |
-            cpu.pprof
-            heap.pprof
-            cpu-top.txt
-            heap-top.txt
-            goroutine.txt
-            mem-profile.csv
-            mem-profile.csv.peak
-            weed.log
-          retention-days: 30
-
-  benchmark:
-    name: Throughput Benchmark (${{ matrix.impl }} volume)
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    strategy:
-      fail-fast: false
-      matrix:
-        impl: [go, rust]
-    env:
-      IMPL: ${{ matrix.impl }}
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-
-      - name: Install Rust toolchain
-        if: matrix.impl == 'rust'
-        uses: dtolnay/rust-toolchain@stable
-
-      - name: Cache cargo registry and target
-        if: matrix.impl == 'rust'
-        uses: actions/cache@v6
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            seaweed-volume/target
-          key: rust-${{ hashFiles('seaweed-volume/Cargo.lock') }}
-          restore-keys: |
-            rust-
-
-      - name: Build weed
-        run: go build -o weed_bin ./weed
-
-      - name: Build Rust volume server
-        if: matrix.impl == 'rust'
-        run: cd seaweed-volume && cargo build --release
-
-      - name: Start master and volume server
-        run: |
-          mkdir -p ./perfdata/master ./perfdata/vol
-          ./weed_bin -v=1 master -ip=127.0.0.1 -port=9333 \
-            -mdir=./perfdata/master -peers=none \
-            -volumeSizeLimitMB="${VOL_SIZE_LIMIT}" -defaultReplication=000 \
-            > master.log 2>&1 &
-          echo "MASTER_PID=$!" >> "$GITHUB_ENV"
-          for i in $(seq 1 60); do
-            if curl -sf http://localhost:9333/dir/status >/dev/null 2>&1; then
-              echo "master is ready"
-              break
-            fi
-            sleep 1
-          done
-          if [ "${IMPL}" = "rust" ]; then
-            ./seaweed-volume/target/release/weed-volume \
-              --master 127.0.0.1:9333 --ip 127.0.0.1 --ip.bind 127.0.0.1 \
-              --port 8080 --dir ./perfdata/vol --max 100 --preStopSeconds 0 \
-              > volume.log 2>&1 &
-          else
-            ./weed_bin -v=1 volume -master=127.0.0.1:9333 -ip=127.0.0.1 \
-              -port=8080 -dir=./perfdata/vol -max=100 \
-              > volume.log 2>&1 &
-          fi
-          echo "VOLUME_PID=$!" >> "$GITHUB_ENV"
-          for i in $(seq 1 60); do
-            if curl -sf http://localhost:8080/status >/dev/null 2>&1; then
-              echo "volume server is ready"
-              break
-            fi
-            sleep 1
-          done
-          # let the volume server register with the master via heartbeat
-          sleep 3
-
-      - name: Start memory sampler
-        run: |
-          bash test/perf/mem_sample.sh mem-benchmark.csv \
-            "master=${MASTER_PID}" "volume=${VOLUME_PID}" &
-          echo "SAMPLER_PID=$!" >> "$GITHUB_ENV"
-
-      - name: Run throughput benchmark
-        run: |
-          N="${{ github.event.inputs.benchmark_files || '100000' }}"
-          C="${{ github.event.inputs.benchmark_concurrency || '16' }}"
-          SIZE="${{ github.event.inputs.benchmark_size || '1024' }}"
-          ./weed_bin benchmark -master=localhost:9333 \
-            -c="${C}" -n="${N}" -size="${SIZE}" 2>&1 | tee benchmark-results.txt
-
-      - name: Run Go micro-benchmarks
-        if: matrix.impl == 'go'
-        continue-on-error: true
-        run: |
-          go test -run='^$' -bench=. -benchmem -benchtime=10x \
-            ./weed/topology/... ./weed/util/log_buffer/... ./weed/util/buffered_queue/... \
-            2>&1 | tee go-benchmarks.txt
-
-      - name: Record memory usage
-        if: always()
-        run: |
-          kill -TERM "${SAMPLER_PID}" 2>/dev/null || true
-          sleep 2
-          {
-            echo "## Memory usage (peak RSS, ${IMPL} volume)"
-            echo '```'
-            if [ -f mem-benchmark.csv.peak ]; then
-              awk -F'\t' '{printf "%-10s %8d KB  (%.1f MB)\n", $1, $2, $2/1024}' mem-benchmark.csv.peak
-            else
-              echo "no memory samples captured"
-            fi
-            echo '```'
-          } >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Benchmark summary
-        if: always()
-        run: |
-          {
-            echo "## Throughput benchmark (${IMPL} volume)"
-            echo '```'
-            grep -E "Concurrency Level|Time taken|Completed requests|Failed requests|Requests per second|Transfer rate" \
-              benchmark-results.txt 2>/dev/null || echo "no benchmark results captured"
-            echo '```'
-          } >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Stop processes
-        if: always()
-        run: |
-          kill "${VOLUME_PID}" "${MASTER_PID}" 2>/dev/null || true
-
-      - name: Show logs on failure
-        if: failure()
-        run: |
-          echo "=== master.log ==="; tail -100 master.log 2>/dev/null || true
-          echo "=== volume.log ==="; tail -200 volume.log 2>/dev/null || true
-
-      - name: Upload benchmark results
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: benchmark-results-${{ matrix.impl }}-${{ github.run_number }}
-          path: |
-            benchmark-results.txt
-            go-benchmarks.txt
-            mem-benchmark.csv
-            mem-benchmark.csv.peak
-            master.log
-            volume.log
-          retention-days: 7
-
-  s3-benchmark:
-    name: S3 Read/Write Benchmark (${{ matrix.impl }} volume)
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    strategy:
-      fail-fast: false
-      matrix:
-        impl: [go, rust]
-    env:
-      IMPL: ${{ matrix.impl }}
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-
-      - name: Install Rust toolchain
-        if: matrix.impl == 'rust'
-        uses: dtolnay/rust-toolchain@stable
-
-      - name: Cache cargo registry and target
-        if: matrix.impl == 'rust'
-        uses: actions/cache@v6
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            seaweed-volume/target
-          key: rust-${{ hashFiles('seaweed-volume/Cargo.lock') }}
-          restore-keys: |
-            rust-
-
-      - name: Build weed and S3 load tool
-        run: |
-          go build -o weed_bin ./weed
-          go build -o s3bench ./test/s3/benchmark
-
-      - name: Build Rust volume server
-        if: matrix.impl == 'rust'
-        run: cd seaweed-volume && cargo build --release
-
-      - name: Start cluster with S3 gateway
-        run: |
-          mkdir -p ./perfdata/master ./perfdata/vol ./perfdata/filer
-          ./weed_bin -v=1 master -ip=127.0.0.1 -port=9333 \
-            -mdir=./perfdata/master -peers=none \
-            -volumeSizeLimitMB="${VOL_SIZE_LIMIT}" -defaultReplication=000 \
-            > master.log 2>&1 &
-          echo "MASTER_PID=$!" >> "$GITHUB_ENV"
-          for i in $(seq 1 60); do
-            if curl -sf http://localhost:9333/dir/status >/dev/null 2>&1; then
-              echo "master is ready"
-              break
-            fi
-            sleep 1
-          done
-          if [ "${IMPL}" = "rust" ]; then
-            ./seaweed-volume/target/release/weed-volume \
-              --master 127.0.0.1:9333 --ip 127.0.0.1 --ip.bind 127.0.0.1 \
-              --port 8080 --dir ./perfdata/vol --max 100 --preStopSeconds 0 \
-              > volume.log 2>&1 &
-          else
-            ./weed_bin -v=1 volume -master=127.0.0.1:9333 -ip=127.0.0.1 \
-              -port=8080 -dir=./perfdata/vol -max=100 \
-              > volume.log 2>&1 &
-          fi
-          echo "VOLUME_PID=$!" >> "$GITHUB_ENV"
-          for i in $(seq 1 60); do
-            if curl -sf http://localhost:8080/status >/dev/null 2>&1; then
-              echo "volume server is ready"
-              break
-            fi
-            sleep 1
-          done
-          sleep 3
-          ./weed_bin -v=1 filer -master=127.0.0.1:9333 -ip=127.0.0.1 -port=8888 \
-            -s3 -s3.port=8000 -s3.config=./docker/compose/s3.json \
-            > filer.log 2>&1 &
-          echo "FILER_PID=$!" >> "$GITHUB_ENV"
-          for i in $(seq 1 30); do
-            if nc -z localhost 8000 2>/dev/null; then
-              echo "s3 gateway is ready"
-              break
-            fi
-            sleep 1
-          done
-          sleep 2
-
-      - name: Start memory sampler
-        run: |
-          bash test/perf/mem_sample.sh mem-s3.csv \
-            "master=${MASTER_PID}" "volume=${VOLUME_PID}" "filer=${FILER_PID}" &
-          echo "SAMPLER_PID=$!" >> "$GITHUB_ENV"
-
-      - name: Run S3 read/write benchmark
-        run: |
-          OBJECTS="${{ github.event.inputs.s3_objects || '20000' }}"
-          C="${{ github.event.inputs.benchmark_concurrency || '16' }}"
-          SIZE="${{ github.event.inputs.s3_size || '4096' }}"
-          ./s3bench -endpoint=http://localhost:8000 \
-            -access-key=some_access_key1 -secret-key=some_secret_key1 \
-            -objects="${OBJECTS}" -size="${SIZE}" -concurrency="${C}" -mode=both \
-            2>&1 | tee s3-benchmark-results.txt
-
-      - name: Record memory usage
-        if: always()
-        run: |
-          kill -TERM "${SAMPLER_PID}" 2>/dev/null || true
-          sleep 2
-          {
-            echo "## Memory usage (peak RSS, ${IMPL} volume)"
-            echo '```'
-            if [ -f mem-s3.csv.peak ]; then
-              awk -F'\t' '{printf "%-10s %8d KB  (%.1f MB)\n", $1, $2, $2/1024}' mem-s3.csv.peak
-            else
-              echo "no memory samples captured"
-            fi
-            echo '```'
-          } >> "$GITHUB_STEP_SUMMARY"
-
-      - name: S3 benchmark summary
-        if: always()
-        run: |
-          {
-            echo "## S3 read/write benchmark (${IMPL} volume)"
-            echo '```'
-            grep -E "results:|Concurrency Level|Time taken|Completed requests|Failed requests|Requests per second|Transfer rate|Latency" \
-              s3-benchmark-results.txt 2>/dev/null || echo "no S3 benchmark results captured"
-            echo '```'
-          } >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Stop processes
-        if: always()
-        run: |
-          kill "${FILER_PID}" "${VOLUME_PID}" "${MASTER_PID}" 2>/dev/null || true
-
-      - name: Show logs on failure
-        if: failure()
-        run: |
-          echo "=== master.log ==="; tail -100 master.log 2>/dev/null || true
-          echo "=== volume.log ==="; tail -200 volume.log 2>/dev/null || true
-          echo "=== filer.log ==="; tail -200 filer.log 2>/dev/null || true
-
-      - name: Upload S3 benchmark results
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-benchmark-results-${{ matrix.impl }}-${{ github.run_number }}
-          path: |
-            s3-benchmark-results.txt
-            mem-s3.csv
-            mem-s3.csv.peak
-            master.log
-            volume.log
-            filer.log
-          retention-days: 7

.github/workflows/pjdfstest.yml

@@ -1,118 +0,0 @@
-name: "pjdfstest POSIX Compliance"
-
-on:
-  push:
-    branches: [ master, main ]
-    paths:
-      - 'weed/mount/**'
-      - 'weed/filer/**'
-      - 'test/pjdfstest/**'
-      - '.github/workflows/pjdfstest.yml'
-  pull_request:
-    branches: [ master, main ]
-    paths:
-      - 'weed/mount/**'
-      - 'weed/filer/**'
-      - 'test/pjdfstest/**'
-      - '.github/workflows/pjdfstest.yml'
-  workflow_dispatch:
-
-concurrency:
-  group: pjdfstest/${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  pjdfstest:
-    name: pjdfstest
-    runs-on: ubuntu-22.04
-    timeout-minutes: 60
-
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v7
-
-    - name: Set up Go
-      uses: actions/setup-go@v7
-      with:
-        go-version-file: 'go.mod'
-
-    - name: Start local Docker registry
-      run: docker run -d --restart=always -p 5000:5000 --name registry registry:2
-
-    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v4
-      with:
-        driver-opts: network=host
-
-    - name: Build weed race binary
-      run: |
-        cd docker
-        make binary_race
-
-    - name: Build SeaweedFS e2e image
-      uses: docker/build-push-action@v7
-      with:
-        context: docker
-        file: docker/Dockerfile.e2e
-        tags: localhost:5000/chrislusf/seaweedfs:e2e
-        push: true
-        cache-from: type=gha,scope=pjdfstest-e2e
-        cache-to: type=gha,mode=max,scope=pjdfstest-e2e
-
-    - name: Tag e2e image for docker compose
-      run: |
-        docker pull localhost:5000/chrislusf/seaweedfs:e2e
-        docker tag localhost:5000/chrislusf/seaweedfs:e2e chrislusf/seaweedfs:e2e
-
-    - name: Build pjdfstest image
-      uses: docker/build-push-action@v7
-      with:
-        context: test/pjdfstest
-        build-contexts: |
-          chrislusf/seaweedfs:e2e=docker-image://localhost:5000/chrislusf/seaweedfs:e2e
-        tags: localhost:5000/chrislusf/seaweedfs:pjdfstest
-        push: true
-        cache-from: type=gha,scope=pjdfstest-harness
-        cache-to: type=gha,mode=max,scope=pjdfstest-harness
-
-    - name: Tag pjdfstest image for docker compose
-      run: |
-        docker pull localhost:5000/chrislusf/seaweedfs:pjdfstest
-        docker tag localhost:5000/chrislusf/seaweedfs:pjdfstest chrislusf/seaweedfs:pjdfstest
-
-    - name: Start SeaweedFS cluster
-      run: |
-        docker compose -f test/pjdfstest/docker-compose.yml up --wait
-
-    - name: Run pjdfstest
-      run: |
-        set -o pipefail
-        docker compose -f test/pjdfstest/docker-compose.yml exec -T mount \
-          /run.sh 2>&1 | tee /tmp/pjdfstest-output.log
-
-    - name: Collect logs
-      if: always()
-      run: |
-        mkdir -p /tmp/pjdfstest-docker-logs
-        for svc in master volume filer mount; do
-          docker compose -f test/pjdfstest/docker-compose.yml logs "$svc" \
-            > "/tmp/pjdfstest-docker-logs/${svc}.log" 2>&1 || true
-        done
-
-    - name: Tear down
-      if: always()
-      run: |
-        docker compose -f test/pjdfstest/docker-compose.yml down -v
-
-    - name: Upload logs
-      if: always()
-      uses: actions/upload-artifact@v7
-      with:
-        name: pjdfstest-results
-        path: |
-          /tmp/pjdfstest-output.log
-          /tmp/pjdfstest-docker-logs/
-        retention-days: 7

.github/workflows/plugin-workers.yml

@@ -1,51 +0,0 @@
-name: "Plugin Worker Integration Tests"
-
-on:
-  push:
-    branches: [ master ]
-    paths:
-      - 'weed/**'
-      - 'test/plugin_workers/**'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/plugin-workers.yml'
-  pull_request:
-    branches: [ master ]
-    paths:
-      - 'weed/**'
-      - 'test/plugin_workers/**'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/plugin-workers.yml'
-
-permissions:
-  contents: read
-
-jobs:
-  plugin-worker:
-    name: "Plugin Worker: ${{ matrix.worker }}"
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - worker: erasure_coding
-            path: test/plugin_workers/erasure_coding
-          - worker: vacuum
-            path: test/plugin_workers/vacuum
-          - worker: volume_balance
-            path: test/plugin_workers/volume_balance
-
-    steps:
-      - name: Set up Go 1.x
-        uses: actions/setup-go@v7
-        with:
-          go-version: ^1.26
-        id: go
-
-      - name: Check out code into the Go module directory
-        uses: actions/checkout@v7
-
-      - name: Run plugin worker tests
-        run: go test -v ./${{ matrix.path }}

.github/workflows/postgres-tests.yml

@@ -1,94 +0,0 @@
-name: "PostgreSQL Gateway Tests"
-
-on:
-  push:
-    branches: [ master ]
-    paths:
-      - 'weed/server/postgres/**'
-      - 'weed/query/**'
-      - 'weed/mq/**'
-      - 'test/postgres/**'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/postgres-tests.yml'
-  pull_request:
-    branches: [ master ]
-    paths:
-      - 'weed/server/postgres/**'
-      - 'weed/query/**'
-      - 'weed/mq/**'
-      - 'test/postgres/**'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/postgres-tests.yml'
-
-concurrency:
-  group: ${{ github.head_ref }}/postgres-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  postgres-basic-tests:
-    name: PostgreSQL Basic Tests
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    defaults:
-      run:
-        working-directory: test/postgres
-    steps:
-    - name: Set up Go 1.x
-      uses: actions/setup-go@v7
-      with:
-        go-version: ^1.26
-      id: go
-
-    - name: Check out code
-      uses: actions/checkout@v7
-
-    - name: Configure Docker Hub mirror
-      run: |
-        echo '{"registry-mirrors": ["https://mirror.gcr.io"]}' | sudo tee /etc/docker/daemon.json
-        sudo systemctl restart docker
-
-    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v4
-
-    - name: Cache Docker layers
-      uses: actions/cache@v6
-      with:
-        path: /tmp/.buildx-cache
-        key: ${{ runner.os }}-buildx-postgres-${{ github.sha }}
-        restore-keys: |
-          ${{ runner.os }}-buildx-postgres-
-
-    - name: Start PostgreSQL Gateway Services
-      run: |
-        make dev-start
-        sleep 10
-
-    - name: Run Basic Connectivity Test
-      run: |
-        make test-basic
-
-    - name: Run PostgreSQL Client Tests
-      run: |
-        make test-client
-
-    - name: Save logs
-      if: always()
-      run: |
-        docker compose logs > postgres-output.log || true
-
-    - name: Archive logs
-      if: always()
-      uses: actions/upload-artifact@v7
-      with:
-        name: postgres-logs
-        path: test/postgres/postgres-output.log
-
-    - name: Cleanup
-      if: always()
-      run: |
-        make clean || true

.github/workflows/release_version_bump.yml

@@ -1,278 +0,0 @@
-name: "release: bump version and cut the release"
-
-# One entry point for a SeaweedFS release:
-#   1. bump MAJOR/MINOR in constants.go and the Helm Chart.yaml, commit to master
-#   2. push the <appVersion> tag, which fans out to the workflows that trigger on
-#      `push: tags` (binaries_release*, container_release_unified, helm_manual_release)
-#   3. create the GitHub release, with GitHub's generated notes
-#   4. dispatch "Prepare release" in seaweedfs-csi-driver and seaweedfs-operator,
-#      which pick up the new master through `go get -u`, and wait for both
-#
-# Events raised by the default GITHUB_TOKEN do not start other workflows, and it
-# cannot reach the other two repositories at all. Add a repo secret RELEASE_PAT
-# with `contents: write` here and `actions: write` on the csi-driver and operator
-# repos. Without it the tag is still pushed, but nothing downstream of it runs.
-
-on:
-  workflow_dispatch:
-    inputs:
-      bump:
-        description: "Which part to increment (ignored when 'version' is set)"
-        type: choice
-        options:
-          - minor
-          - major
-        default: minor
-      version:
-        description: "Explicit MAJOR.MINOR to set, e.g. 4.36 (overrides 'bump')"
-        type: string
-        required: false
-      downstream:
-        description: "Also release the CSI driver and the operator"
-        type: boolean
-        default: true
-      dry_run:
-        description: "Show the version bump, but change nothing"
-        type: boolean
-        default: false
-
-jobs:
-  release:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    outputs:
-      app_version: ${{ steps.compute.outputs.app_version }}
-      sha: ${{ steps.tag.outputs.sha }}
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          ref: master
-          fetch-depth: 0
-          token: ${{ secrets.RELEASE_PAT || secrets.GITHUB_TOKEN }}
-
-      - name: Check the release token
-        env:
-          HAS_PAT: ${{ secrets.RELEASE_PAT != '' }}
-        run: |
-          if [ "$HAS_PAT" != "true" ]; then
-            echo "::warning::RELEASE_PAT is not set. The tag will be pushed with GITHUB_TOKEN, so the binary, container and helm workflows will not start on their own."
-          fi
-
-      - name: Compute new version
-        id: compute
-        env:
-          BUMP: ${{ inputs.bump }}
-          INPUT_VERSION: ${{ inputs.version }}
-        run: |
-          set -euo pipefail
-          CONST=weed/util/version/constants.go
-
-          MAJOR=$(grep -oP 'MAJOR_VERSION\s*=\s*int32\(\K[0-9]+' "$CONST")
-          MINOR=$(grep -oP 'MINOR_VERSION\s*=\s*int32\(\K[0-9]+' "$CONST")
-          echo "current: ${MAJOR}.${MINOR}"
-
-          if [ -n "$INPUT_VERSION" ]; then
-            if ! [[ "$INPUT_VERSION" =~ ^[0-9]+\.[0-9]+$ ]]; then
-              echo "::error::version must be MAJOR.MINOR, e.g. 5.01 (got '$INPUT_VERSION')"
-              exit 1
-            fi
-            # 10# forces base 10 so 08/09 are not parsed as octal.
-            MAJOR=$((10#${INPUT_VERSION%%.*}))
-            MINOR=$((10#${INPUT_VERSION##*.}))
-            if [ "$MINOR" -gt 99 ]; then
-              echo "::error::minor must be 0-99 (got $MINOR); it rolls into the next major at 99"
-              exit 1
-            fi
-          else
-            case "$BUMP" in
-              # Minor is a 2-digit field: 4.99 -> 5.00 -> 5.01.
-              major) MAJOR=$((MAJOR + 1)); MINOR=0 ;;
-              minor)
-                if [ "$MINOR" -ge 99 ]; then
-                  MAJOR=$((MAJOR + 1)); MINOR=0
-                else
-                  MINOR=$((MINOR + 1))
-                fi
-                ;;
-              *) echo "::error::unknown bump '$BUMP'"; exit 1 ;;
-            esac
-          fi
-
-          # appVersion mirrors the Go VERSION_NUMBER (zero-padded minor);
-          # chart version is plain SemVer (no leading zeros).
-          APP_VERSION=$(printf '%d.%02d' "$MAJOR" "$MINOR")
-          CHART_VERSION="${MAJOR}.${MINOR}.0"
-          echo "new: app=${APP_VERSION} chart=${CHART_VERSION}"
-
-          {
-            echo "major=${MAJOR}"
-            echo "minor=${MINOR}"
-            echo "app_version=${APP_VERSION}"
-            echo "chart_version=${CHART_VERSION}"
-          } >> "$GITHUB_OUTPUT"
-
-      - name: Apply version to constants.go
-        env:
-          MAJOR: ${{ steps.compute.outputs.major }}
-          MINOR: ${{ steps.compute.outputs.minor }}
-        run: |
-          set -euo pipefail
-          CONST=weed/util/version/constants.go
-          sed -i -E "s/(MAJOR_VERSION[[:space:]]*=[[:space:]]*int32\()[0-9]+(\))/\1${MAJOR}\2/" "$CONST"
-          sed -i -E "s/(MINOR_VERSION[[:space:]]*=[[:space:]]*int32\()[0-9]+(\))/\1${MINOR}\2/" "$CONST"
-          grep -E 'MAJOR_VERSION|MINOR_VERSION' "$CONST"
-
-      - name: Apply version to Chart.yaml
-        env:
-          APP_VERSION: ${{ steps.compute.outputs.app_version }}
-          CHART_VERSION: ${{ steps.compute.outputs.chart_version }}
-        run: |
-          set -euo pipefail
-          CHART=k8s/charts/seaweedfs/Chart.yaml
-          sed -i -E "s/^appVersion:.*/appVersion: \"${APP_VERSION}\"/" "$CHART"
-          sed -i -E "s/^version:.*/version: ${CHART_VERSION}/" "$CHART"
-          cat "$CHART"
-
-      - name: Commit, and push the tag
-        id: tag
-        env:
-          TAG: ${{ steps.compute.outputs.app_version }}
-          DRY_RUN: ${{ inputs.dry_run }}
-        run: |
-          set -euo pipefail
-          if git ls-remote --exit-code --tags origin "refs/tags/${TAG}" >/dev/null 2>&1; then
-            echo "::error::Tag ${TAG} already exists."
-            exit 1
-          fi
-          if [ "$DRY_RUN" = "true" ]; then
-            git --no-pager diff --stat
-            echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          if git diff --quiet; then
-            echo "::warning::Version files are already at ${TAG}; tagging the current HEAD."
-          else
-            git add weed/util/version/constants.go k8s/charts/seaweedfs/Chart.yaml
-            git commit -m "${TAG}"
-            git push
-          fi
-
-          # Push the tag with git so the `push: tags` triggers fire. Creating the
-          # tag through the release API alone would only emit a `create` event.
-          git tag "$TAG"
-          git push origin "$TAG"
-          echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
-
-      - name: Create the release
-        if: ${{ !inputs.dry_run }}
-        env:
-          GH_TOKEN: ${{ secrets.RELEASE_PAT || secrets.GITHUB_TOKEN }}
-          TAG: ${{ steps.compute.outputs.app_version }}
-        run: gh release create "$TAG" --title "$TAG" --generate-notes --verify-tag
-
-  downstream:
-    needs: release
-    if: ${{ inputs.downstream && !inputs.dry_run }}
-    runs-on: ubuntu-latest
-    # The wait below puts no bound of its own on runner-queue time; this does.
-    timeout-minutes: 120
-    permissions: {}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - repo: seaweedfs/seaweedfs-csi-driver
-            workflow: prepare_release.yaml
-          - repo: seaweedfs/seaweedfs-operator
-            workflow: prepare_release.yml
-    steps:
-      - name: Release ${{ matrix.repo }}
-        env:
-          GH_TOKEN: ${{ secrets.RELEASE_PAT }}
-          REPO: ${{ matrix.repo }}
-          WORKFLOW: ${{ matrix.workflow }}
-          SHA: ${{ needs.release.outputs.sha }}
-          MODULE: github.com/seaweedfs/seaweedfs
-        run: |
-          set -euo pipefail
-          if [ -z "${GH_TOKEN}" ]; then
-            echo "::error::RELEASE_PAT with actions:write on ${REPO} is required to release it"
-            exit 1
-          fi
-
-          # The dispatched workflow pins seaweedfs with `go get -u ...@latest`, so
-          # wait until the proxy serves the release commit as the tip. Asking for
-          # the commit by name is what makes the proxy fetch it. The proxy can
-          # take longer than five minutes to refresh @latest after a new tag.
-          for _ in $(seq 120); do
-            curl -sf "https://proxy.golang.org/${MODULE}/@v/${SHA}.info" >/dev/null || true
-            TIP=$(curl -sf "https://proxy.golang.org/${MODULE}/@latest" | jq -r '.Origin.Hash // ""' || true)
-            [ "$TIP" = "$SHA" ] && break
-            sleep 10
-          done
-          if [ "$TIP" != "$SHA" ]; then
-            echo "::error::the module proxy still serves ${TIP} as the tip, so ${REPO} would pin a pre-release commit. Run ${WORKFLOW} there once it catches up."
-            exit 1
-          fi
-
-          # The dispatched workflow publishes the release as its last step, so
-          # its conclusion decides success. Wait on the run, not on a wall
-          # clock: time it spends queued for a runner must not count against
-          # the budget. A dispatch does not return its run id, so take the
-          # newest workflow_dispatch run created since ours; a concurrent
-          # dispatch would be performing this same release, and waiting on it
-          # is just as good.
-          released() { gh api "repos/${REPO}/releases?per_page=30" --jq '[.[].tag_name]'; }
-
-          BEFORE=$(released)
-          # A minute early, so runner clock skew cannot hide the run.
-          DISPATCHED_AT=$(date -u -d '1 minute ago' '+%Y-%m-%dT%H:%M:%SZ')
-          gh workflow run -R "$REPO" "$WORKFLOW" --ref master -f bump=patch -f update_seaweedfs=true
-
-          RUN_ID=""
-          for _ in $(seq 12); do
-            sleep 10
-            RUN_ID=$(gh api -X GET "repos/${REPO}/actions/workflows/${WORKFLOW}/runs" \
-              -f event=workflow_dispatch -f "created=>=${DISPATCHED_AT}" \
-              --jq '(.workflow_runs | sort_by(.created_at) | last | .id) // empty' || true)
-            [ -n "$RUN_ID" ] && break
-          done
-          if [ -z "$RUN_ID" ]; then
-            echo "::error::the dispatch created no ${WORKFLOW} run in ${REPO}; see https://github.com/${REPO}/actions/workflows/${WORKFLOW}"
-            exit 1
-          fi
-          RUN_URL="https://github.com/${REPO}/actions/runs/${RUN_ID}"
-          echo "waiting on ${RUN_URL}"
-
-          # 20 minutes of execution; polls that find the run still queued do
-          # not consume it.
-          RUNNING=0
-          STATE=""
-          while :; do
-            sleep 15
-            STATE=$(gh api "repos/${REPO}/actions/runs/${RUN_ID}" \
-              --jq '.status + "/" + (.conclusion // "")' || true)
-            case "$STATE" in
-              completed/*) break ;;
-              in_progress/*) RUNNING=$((RUNNING + 1)) ;;
-            esac
-            if [ "$RUNNING" -gt 80 ]; then
-              echo "::error::${RUN_URL} has been executing for over 20 minutes; giving up on it"
-              exit 1
-            fi
-          done
-          if [ "$STATE" != "completed/success" ]; then
-            echo "::error::${RUN_URL} concluded '${STATE#completed/}'"
-            exit 1
-          fi
-
-          NEW=$(released | jq -c --argjson before "$BEFORE" '. - $before')
-          if [ "$(jq length <<<"$NEW")" -eq 0 ]; then
-            echo "::error::${RUN_URL} succeeded but ${REPO} shows no new release"
-            exit 1
-          fi
-          echo "${REPO} released $(jq -r 'join(", ")' <<<"$NEW")"

.github/workflows/rust-volume-server-tests.yml

@@ -1,323 +0,0 @@
-name: "Rust Volume Server Tests"
-
-on:
-  pull_request:
-    branches: [ master ]
-    paths:
-      - 'seaweed-volume/**'
-      - 'seaweed-common/**'
-      - 'test/volume_server/**'
-      - 'weed/pb/volume_server.proto'
-      - 'weed/pb/volume_server_pb/**'
-      - '.github/workflows/rust-volume-server-tests.yml'
-  push:
-    branches: [ master, main ]
-    paths:
-      - 'seaweed-volume/**'
-      - 'seaweed-common/**'
-      - 'test/volume_server/**'
-      - 'weed/pb/volume_server.proto'
-      - 'weed/pb/volume_server_pb/**'
-      - '.github/workflows/rust-volume-server-tests.yml'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-
-jobs:
-  changes:
-    name: Detect changed paths
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      contents: read
-    outputs:
-      rust: ${{ steps.filter.outputs.rust }}
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-
-      - name: Filter changed paths
-        id: filter
-        uses: dorny/paths-filter@v4
-        with:
-          filters: |
-            rust:
-              - 'seaweed-volume/**'
-              - '.github/workflows/rust-volume-server-tests.yml'
-
-  rust-unit-tests:
-    name: Rust Unit Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v7
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-
-      # cargo tracks its own inputs but not the runner's C toolchain, so a cached
-      # target/ can carry C objects built against a different glibc than we link against.
-      - name: Fingerprint build toolchain
-        id: toolchain
-        run: echo "fingerprint=$(getconf GNU_LIBC_VERSION | tr ' ' '-')-rustc-$(rustc -V | awk '{print $2}')" >> "$GITHUB_OUTPUT"
-
-      - name: Cache cargo registry and target
-        uses: actions/cache@v6
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            seaweed-volume/target
-          key: rust-${{ steps.toolchain.outputs.fingerprint }}-${{ hashFiles('seaweed-volume/Cargo.lock', 'seaweed-common/Cargo.lock') }}
-          restore-keys: |
-            rust-${{ steps.toolchain.outputs.fingerprint }}-
-
-      - name: Build Rust volume server
-        run: cd seaweed-volume && cargo build --release
-
-      # The crate is warning-free under clippy as of the sweep that added
-      # this step. Uncomment to make that a gate; `[lints.clippy]` in
-      # seaweed-volume/Cargo.toml is where crate-wide exceptions live.
-      # - name: Clippy
-      #   run: cd seaweed-volume && cargo clippy --all-targets -- -D warnings
-
-      # The crate is rustfmt-clean as of the PR that added this step.
-      # Uncomment to keep it that way.
-      # - name: Check formatting
-      #   run: cd seaweed-volume && cargo fmt --check
-
-      # seaweed-common is a path dependency of this crate, not a member of its
-      # workspace, so the run below does not reach its own tests. It builds into
-      # this job's cached target directory, and the cache key above covers the
-      # shared crate's lock, so the aws-lc-sys that rustls pulls in is restored
-      # with the cache instead of compiled from scratch on every run.
-      - name: Run shared-crate unit tests
-        env:
-          CARGO_TARGET_DIR: ${{ github.workspace }}/seaweed-volume/target
-        run: cd seaweed-common && cargo test
-
-      - name: Run Rust unit tests
-        run: cd seaweed-volume && cargo test
-
-      - name: Run Rust unit tests (redb experimental cursor)
-        run: cd seaweed-volume && cargo test --features redb-experimental-cursor --lib storage::needle_map
-
-  rust-unit-tests-windows:
-    name: Rust Unit Tests (Windows)
-    runs-on: windows-latest
-    timeout-minutes: 30
-    needs: [changes]
-    if: needs.changes.outputs.rust == 'true'
-    defaults:
-      run:
-        shell: bash
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v7
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-
-      # No glibc on Windows: key the cache on the toolchain and OS only.
-      - name: Fingerprint build toolchain
-        id: toolchain
-        run: echo "fingerprint=windows-rustc-$(rustc -V | awk '{print $2}')" >> "$GITHUB_OUTPUT"
-
-      - name: Cache cargo registry and target
-        uses: actions/cache@v6
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            seaweed-volume/target
-          key: rust-windows-${{ steps.toolchain.outputs.fingerprint }}-${{ hashFiles('seaweed-volume/Cargo.lock') }}
-          restore-keys: |
-            rust-windows-${{ steps.toolchain.outputs.fingerprint }}-
-
-      - name: Run Rust unit tests
-        run: cd seaweed-volume && cargo test
-
-      - name: Run Rust unit tests (redb experimental cursor)
-        run: cd seaweed-volume && cargo test --features redb-experimental-cursor --lib storage::needle_map
-
-  rust-integration-tests:
-    name: Rust Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-
-      # cargo tracks its own inputs but not the runner's C toolchain, so a cached
-      # target/ can carry C objects built against a different glibc than we link against.
-      - name: Fingerprint build toolchain
-        id: toolchain
-        run: echo "fingerprint=$(getconf GNU_LIBC_VERSION | tr ' ' '-')-rustc-$(rustc -V | awk '{print $2}')" >> "$GITHUB_OUTPUT"
-
-      - name: Cache cargo registry and target
-        uses: actions/cache@v6
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            seaweed-volume/target
-          key: rust-${{ steps.toolchain.outputs.fingerprint }}-${{ hashFiles('seaweed-volume/Cargo.lock', 'seaweed-common/Cargo.lock') }}
-          restore-keys: |
-            rust-${{ steps.toolchain.outputs.fingerprint }}-
-
-      - name: Build Go weed binary
-        run: |
-          cd weed
-          go build -tags 5BytesOffset -o weed .
-          chmod +x weed
-          ./weed version
-
-      - name: Build Rust volume binary
-        run: cd seaweed-volume && cargo build --release
-
-      - name: Run integration tests
-        env:
-          WEED_BINARY: ${{ github.workspace }}/weed/weed
-          RUST_VOLUME_BINARY: ${{ github.workspace }}/seaweed-volume/target/release/weed-volume
-        run: |
-          echo "Running Rust volume server integration tests..."
-          go test -v -count=1 -timeout=15m ./test/volume_server/rust/...
-
-      - name: Collect logs on failure
-        if: failure()
-        run: |
-          mkdir -p /tmp/rust-volume-server-it-logs
-          find /tmp -maxdepth 1 -type d -name "seaweedfs_volume_server_it_*" -print -exec cp -r {} /tmp/rust-volume-server-it-logs/ \; || true
-
-      - name: Archive logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: rust-volume-server-integration-test-logs
-          path: /tmp/rust-volume-server-it-logs/
-          if-no-files-found: warn
-          retention-days: 7
-
-      - name: Test summary
-        if: always()
-        run: |
-          echo "## Rust Volume Server Integration Test Summary" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Suite: test/volume_server/rust" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Command: go test -v -count=1 -timeout=15m ./test/volume_server/rust/..." >> "$GITHUB_STEP_SUMMARY"
-
-  rust-volume-go-tests:
-    name: Go Tests with Rust Volume (${{ matrix.test-type }} - Shard ${{ matrix.shard }})
-    runs-on: ubuntu-22.04
-    timeout-minutes: 45
-    env:
-      # Keep in step with the length of matrix.shard below.
-      SHARD_COUNT: 3
-    strategy:
-      fail-fast: false
-      matrix:
-        test-type: [grpc, http]
-        shard: [1, 2, 3]
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-
-      # cargo tracks its own inputs but not the runner's C toolchain, so a cached
-      # target/ can carry C objects built against a different glibc than we link against.
-      - name: Fingerprint build toolchain
-        id: toolchain
-        run: echo "fingerprint=$(getconf GNU_LIBC_VERSION | tr ' ' '-')-rustc-$(rustc -V | awk '{print $2}')" >> "$GITHUB_OUTPUT"
-
-      - name: Cache cargo registry and target
-        uses: actions/cache@v6
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            seaweed-volume/target
-          key: rust-${{ steps.toolchain.outputs.fingerprint }}-${{ hashFiles('seaweed-volume/Cargo.lock', 'seaweed-common/Cargo.lock') }}
-          restore-keys: |
-            rust-${{ steps.toolchain.outputs.fingerprint }}-
-
-      - name: Build Go weed binary
-        run: |
-          cd weed
-          go build -tags 5BytesOffset -o weed .
-          chmod +x weed
-          ./weed version
-
-      - name: Build Rust volume binary
-        run: cd seaweed-volume && cargo build --release
-
-      # Dealing the listed tests out one by one keeps the shards even. Bucketing
-      # them by first letter did not: names cluster, so ^Test[I-S] drew 50 of
-      # the 114 grpc tests and ran nearly twice as long as the other two shards.
-      - name: Select this shard's tests
-        env:
-          TEST_TYPE: ${{ matrix.test-type }}
-          SHARD: ${{ matrix.shard }}
-        run: |
-          tests=$(go test -tags 5BytesOffset ./test/volume_server/"$TEST_TYPE"/... -list '.*' | grep '^Test' | sort -u)
-          # An empty list would make -run match nothing and the shard pass vacuously.
-          [ -n "$tests" ] || { echo "listed no tests in test/volume_server/$TEST_TYPE"; exit 1; }
-          selected=$(echo "$tests" | awk -v n="$SHARD_COUNT" -v i="$SHARD" 'NR % n == i - 1')
-          echo "shard $SHARD of $SHARD_COUNT runs $(echo "$selected" | wc -l) of $(echo "$tests" | wc -l) tests"
-          echo "TEST_PATTERN=^($(echo "$selected" | paste -sd'|' -))\$" >> "$GITHUB_ENV"
-
-      - name: Run volume server integration tests with Rust volume
-        env:
-          WEED_BINARY: ${{ github.workspace }}/weed/weed
-          RUST_VOLUME_BINARY: ${{ github.workspace }}/seaweed-volume/target/release/weed-volume
-          VOLUME_SERVER_IMPL: rust
-        run: |
-          echo "Running Go volume server tests with Rust volume for ${{ matrix.test-type }} (Shard ${{ matrix.shard }} of ${SHARD_COUNT})..."
-          go test -v -count=1 -tags 5BytesOffset -timeout=30m ./test/volume_server/${{ matrix.test-type }}/... -run "${TEST_PATTERN}"
-
-      - name: Collect logs on failure
-        if: failure()
-        run: |
-          mkdir -p /tmp/rust-volume-go-test-logs
-          find /tmp -maxdepth 1 -type d -name "seaweedfs_volume_server_it_*" -print -exec cp -r {} /tmp/rust-volume-go-test-logs/ \; || true
-
-      - name: Archive logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: rust-volume-go-test-logs-${{ matrix.test-type }}-shard${{ matrix.shard }}
-          path: /tmp/rust-volume-go-test-logs/
-          if-no-files-found: warn
-          retention-days: 7
-
-      - name: Test summary
-        if: always()
-        run: |
-          echo "## Rust Volume - Go Test Summary (${{ matrix.test-type }} - Shard ${{ matrix.shard }})" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Suite: test/volume_server/${{ matrix.test-type }} (shard ${{ matrix.shard }} of ${SHARD_COUNT}, see 'Select this shard's tests' for the split)" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Volume server: Rust (VOLUME_SERVER_IMPL=rust)" >> "$GITHUB_STEP_SUMMARY"

.github/workflows/rust-worker-tests.yml

@@ -1,106 +0,0 @@
-name: "Rust Plugin Worker Tests"
-
-on:
-  pull_request:
-    branches: [ master ]
-    paths:
-      - 'seaweed-worker/**'
-      - 'seaweed-common/**'
-      - 'weed/pb/plugin.proto'
-      - '.github/workflows/rust-worker-tests.yml'
-  push:
-    branches: [ master, main ]
-    paths:
-      - 'seaweed-worker/**'
-      - 'seaweed-common/**'
-      - 'weed/pb/plugin.proto'
-      - '.github/workflows/rust-worker-tests.yml'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  rust-worker-build:
-    name: Rust Plugin Worker Build and Unit Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 45
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-
-      # cargo tracks its own inputs but not the runner's C toolchain, so a cached
-      # target/ can carry C objects built against a different glibc than we link against.
-      - name: Fingerprint build toolchain
-        id: toolchain
-        run: echo "fingerprint=$(getconf GNU_LIBC_VERSION | tr ' ' '-')-rustc-$(rustc -V | awk '{print $2}')" >> "$GITHUB_OUTPUT"
-
-      - name: Cache cargo registry and target
-        uses: actions/cache@v6
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            seaweed-worker/target/release
-          key: rust-worker-${{ steps.toolchain.outputs.fingerprint }}-${{ hashFiles('seaweed-worker/Cargo.lock', 'seaweed-common/Cargo.lock') }}
-          restore-keys: |
-            rust-worker-${{ steps.toolchain.outputs.fingerprint }}-
-
-      # lance's build scripts compile their own protos and look for a protoc.
-      # Point them at the one protoc-bin-vendored ships, which seaweed-worker's
-      # own build already uses, so no job depends on a system package and every
-      # build sees the same version.
-      - name: Use the vendored protoc
-        run: |
-          cd seaweed-worker
-          cargo fetch
-          # The version from the lock, not whatever else a restored cache holds.
-          version=$(awk '/^name = "protoc-bin-vendored-linux-x86_64"$/{found=1; next} found && /^version = /{gsub(/"/,"",$3); print $3; exit}' Cargo.lock)
-          test -n "$version" || { echo "protoc-bin-vendored-linux-x86_64 is not in Cargo.lock" >&2; exit 1; }
-          protoc=$(find ~/.cargo/registry/src -path "*protoc-bin-vendored-linux-x86_64-$version/bin/protoc" | head -1)
-          test -x "$protoc" || { echo "no vendored protoc $version in the registry" >&2; exit 1; }
-          echo "PROTOC=$protoc" >> "$GITHUB_ENV"
-
-      # The release profile is what ships, and it is where the release and the
-      # container builds would otherwise discover a break for the first time.
-      - name: Build the plugin workers
-        run: cd seaweed-worker && cargo build --release
-
-      # The workspace is warning-free under clippy as of the sweep that added
-      # this step. Uncomment to make that a gate; `[workspace.lints.clippy]`
-      # in seaweed-worker/Cargo.toml is where crate-wide exceptions live.
-      # - name: Clippy
-      #   run: cd seaweed-worker && cargo clippy --workspace --all-targets -- -D warnings
-
-      # The workspace is rustfmt-clean as of the PR that added this step.
-      # Uncomment to keep it that way.
-      # - name: Check formatting
-      #   run: cd seaweed-worker && cargo fmt --all --check
-
-      # seaweed-common is a path dependency of core and lance, not a member of
-      # this workspace, so `--workspace` below does not reach its own tests.
-      # Release and this job's cached target directory, and the cache key above
-      # covers the shared crate's lock. That lock pins the same rustls and
-      # aws-lc-sys this workspace resolves, so the release build above has
-      # already paid for them.
-      - name: Run shared-crate unit tests
-        env:
-          CARGO_TARGET_DIR: ${{ github.workspace }}/seaweed-worker/target
-        run: cd seaweed-common && cargo test --release
-
-      # The tests that need a live gateway skip themselves without one, the way
-      # the Go integration tests skip without Docker; the lifecycle suite in
-      # test/s3tables/lifecycle is what runs them against a real cluster.
-      # Release, so this reuses the build above rather than compiling lance,
-      # arrow and datafusion a second time in another profile.
-      - name: Run unit tests
-        run: cd seaweed-worker && cargo test --release --workspace

.github/workflows/rust_binaries_dev.yml

@@ -1,161 +0,0 @@
-name: "rust: build dev volume server binaries"
-
-on:
-  push:
-    branches: [ master ]
-    paths:
-      - 'seaweed-volume/**'
-      - 'seaweed-common/**'
-      - '.github/workflows/rust_binaries_dev.yml'
-
-permissions:
-  contents: read
-
-jobs:
-
-  cleanup:
-    permissions:
-      contents: write
-    runs-on: ubuntu-latest
-    steps:
-      - name: Delete old Rust volume dev assets
-        uses: mknejp/delete-release-assets@v1
-        continue-on-error: true
-        with:
-          token: ${{ github.token }}
-          tag: dev
-          fail-if-no-assets: false
-          assets: |
-            weed-volume-*
-
-  build-rust-volume-dev-linux:
-    permissions:
-      contents: write
-    needs: cleanup
-    runs-on: ubuntu-22.04
-    strategy:
-      matrix:
-        include:
-          - target: x86_64-unknown-linux-gnu
-            asset_suffix: linux-amd64
-
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-
-      - name: Cache cargo registry and target
-        uses: actions/cache@v6
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            seaweed-volume/target
-          key: rust-dev-${{ matrix.target }}-${{ hashFiles('seaweed-volume/Cargo.lock') }}
-          restore-keys: |
-            rust-dev-${{ matrix.target }}-
-
-      - name: Set BUILD_TIME
-        run: echo BUILD_TIME=$(date -u +%Y%m%d-%H%M) >> "$GITHUB_ENV"
-
-      - name: Build Rust volume server (large disk)
-        env:
-          SEAWEEDFS_COMMIT: ${{ github.sha }}
-        run: cd seaweed-volume && cargo build --release
-
-      - name: Package large disk binary
-        run: |
-          cp seaweed-volume/target/release/weed-volume weed-volume-large-disk
-          tar czf "weed-volume-large-disk-${{ env.BUILD_TIME }}-${{ matrix.asset_suffix }}.tar.gz" weed-volume-large-disk
-          rm weed-volume-large-disk
-
-      - name: Build Rust volume server (normal)
-        env:
-          SEAWEEDFS_COMMIT: ${{ github.sha }}
-        run: cd seaweed-volume && cargo build --release --no-default-features
-
-      - name: Package normal binary
-        run: |
-          cp seaweed-volume/target/release/weed-volume weed-volume-normal
-          tar czf "weed-volume-${{ env.BUILD_TIME }}-${{ matrix.asset_suffix }}.tar.gz" weed-volume-normal
-          rm weed-volume-normal
-
-      - name: Upload dev release assets
-        uses: softprops/action-gh-release@v3
-        with:
-          tag_name: dev
-          prerelease: true
-          files: |
-            weed-volume-large-disk-${{ env.BUILD_TIME }}-${{ matrix.asset_suffix }}.tar.gz
-            weed-volume-${{ env.BUILD_TIME }}-${{ matrix.asset_suffix }}.tar.gz
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-  build-rust-volume-dev-darwin:
-    permissions:
-      contents: write
-    needs: build-rust-volume-dev-linux
-    runs-on: macos-latest
-    strategy:
-      matrix:
-        include:
-          - target: aarch64-apple-darwin
-            asset_suffix: darwin-arm64
-          - target: x86_64-apple-darwin
-            asset_suffix: darwin-amd64
-
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: ${{ matrix.target }}
-
-      - name: Cache cargo registry and target
-        uses: actions/cache@v6
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            seaweed-volume/target
-          key: rust-dev-${{ matrix.target }}-${{ hashFiles('seaweed-volume/Cargo.lock') }}
-          restore-keys: |
-            rust-dev-${{ matrix.target }}-
-
-      - name: Set BUILD_TIME
-        run: echo BUILD_TIME=$(date -u +%Y%m%d-%H%M) >> "$GITHUB_ENV"
-
-      - name: Build Rust volume server (large disk)
-        env:
-          SEAWEEDFS_COMMIT: ${{ github.sha }}
-        run: cd seaweed-volume && cargo build --release --target ${{ matrix.target }}
-
-      - name: Package large disk binary
-        run: |
-          cp seaweed-volume/target/${{ matrix.target }}/release/weed-volume weed-volume-large-disk
-          tar czf "weed-volume-large-disk-${{ env.BUILD_TIME }}-${{ matrix.asset_suffix }}.tar.gz" weed-volume-large-disk
-          rm weed-volume-large-disk
-
-      - name: Build Rust volume server (normal)
-        env:
-          SEAWEEDFS_COMMIT: ${{ github.sha }}
-        run: cd seaweed-volume && cargo build --release --target ${{ matrix.target }} --no-default-features
-
-      - name: Package normal binary
-        run: |
-          cp seaweed-volume/target/${{ matrix.target }}/release/weed-volume weed-volume-normal
-          tar czf "weed-volume-${{ env.BUILD_TIME }}-${{ matrix.asset_suffix }}.tar.gz" weed-volume-normal
-          rm weed-volume-normal
-
-      - name: Upload dev release assets
-        uses: softprops/action-gh-release@v3
-        with:
-          tag_name: dev
-          prerelease: true
-          files: |
-            weed-volume-large-disk-${{ env.BUILD_TIME }}-${{ matrix.asset_suffix }}.tar.gz
-            weed-volume-${{ env.BUILD_TIME }}-${{ matrix.asset_suffix }}.tar.gz
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/rust_binaries_release.yml

@@ -1,371 +0,0 @@
-name: "rust: build versioned binaries"
-
-on:
-  push:
-    tags:
-      - '*'
-
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-
-  build-rust-volume-linux:
-    permissions:
-      contents: write
-    runs-on: ubuntu-22.04
-    strategy:
-      matrix:
-        include:
-          - target: x86_64-unknown-linux-gnu
-            asset_suffix: linux_amd64
-          - target: aarch64-unknown-linux-gnu
-            asset_suffix: linux_arm64
-            cross: true
-
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: ${{ matrix.target }}
-
-      - name: Install cross-compilation tools
-        if: matrix.cross
-        run: |
-          sudo dpkg --add-architecture arm64
-          sudo sed -i 's/^deb /deb [arch=amd64] /' /etc/apt/sources.list
-          echo "deb [arch=arm64] http://ports.ubuntu.com/ jammy main restricted universe multiverse" | sudo tee /etc/apt/sources.list.d/arm64.list
-          echo "deb [arch=arm64] http://ports.ubuntu.com/ jammy-updates main restricted universe multiverse" | sudo tee -a /etc/apt/sources.list.d/arm64.list
-          sudo apt-get update
-          sudo apt-get install -y gcc-aarch64-linux-gnu libssl-dev:arm64
-          echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc" >> "$GITHUB_ENV"
-          echo "OPENSSL_DIR=/usr" >> "$GITHUB_ENV"
-          echo "OPENSSL_INCLUDE_DIR=/usr/include" >> "$GITHUB_ENV"
-          echo "OPENSSL_LIB_DIR=/usr/lib/aarch64-linux-gnu" >> "$GITHUB_ENV"
-
-      - name: Cache cargo registry and target
-        uses: actions/cache@v6
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            seaweed-volume/target
-          key: rust-release-${{ matrix.target }}-${{ hashFiles('seaweed-volume/Cargo.lock') }}
-          restore-keys: |
-            rust-release-${{ matrix.target }}-
-
-      - name: Build Rust volume server (large disk)
-        env:
-          SEAWEEDFS_COMMIT: ${{ github.sha }}
-        run: |
-          cd seaweed-volume
-          cargo build --release --target ${{ matrix.target }} --target-dir target/large-disk
-
-      - name: Build Rust volume server (normal)
-        env:
-          SEAWEEDFS_COMMIT: ${{ github.sha }}
-        run: |
-          cd seaweed-volume
-          cargo build --release --target ${{ matrix.target }} --no-default-features --target-dir target/normal
-
-      - name: Package binaries
-        run: |
-          # Large disk (default, 5bytes feature)
-          cp seaweed-volume/target/large-disk/${{ matrix.target }}/release/weed-volume weed-volume-large-disk
-          tar czf weed-volume_large_disk_${{ matrix.asset_suffix }}.tar.gz weed-volume-large-disk
-          rm weed-volume-large-disk
-
-          # Normal volume size
-          cp seaweed-volume/target/normal/${{ matrix.target }}/release/weed-volume weed-volume-normal
-          tar czf weed-volume_${{ matrix.asset_suffix }}.tar.gz weed-volume-normal
-          rm weed-volume-normal
-
-      - name: Generate md5 checksums
-        run: |
-          for f in weed-volume_large_disk_${{ matrix.asset_suffix }}.tar.gz weed-volume_${{ matrix.asset_suffix }}.tar.gz; do
-            md5sum "$f" > "$f.md5"
-          done
-
-      - name: Upload release assets
-        if: startsWith(github.ref, 'refs/tags/')
-        uses: softprops/action-gh-release@v3
-        with:
-          files: |
-            weed-volume_large_disk_${{ matrix.asset_suffix }}.tar.gz
-            weed-volume_large_disk_${{ matrix.asset_suffix }}.tar.gz.md5
-            weed-volume_${{ matrix.asset_suffix }}.tar.gz
-            weed-volume_${{ matrix.asset_suffix }}.tar.gz.md5
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Upload artifacts
-        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
-        uses: actions/upload-artifact@v7
-        with:
-          name: rust-volume-${{ matrix.asset_suffix }}
-          path: |
-            weed-volume_large_disk_${{ matrix.asset_suffix }}.tar.gz
-            weed-volume_large_disk_${{ matrix.asset_suffix }}.tar.gz.md5
-            weed-volume_${{ matrix.asset_suffix }}.tar.gz
-            weed-volume_${{ matrix.asset_suffix }}.tar.gz.md5
-
-  # The Rust maintenance worker: Linux only, because it runs beside the cluster
-  # it maintains rather than on a laptop, and its dependency tree (lance, arrow,
-  # datafusion) makes every extra target an expensive build.
-  build-rust-worker-linux:
-    permissions:
-      contents: write
-    runs-on: ubuntu-22.04
-    strategy:
-      matrix:
-        include:
-          - target: x86_64-unknown-linux-gnu
-            asset_suffix: linux_amd64
-          - target: aarch64-unknown-linux-gnu
-            asset_suffix: linux_arm64
-            cross: true
-
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          # The upload step is handed a token explicitly; a cargo build script
-          # should not find another one sitting in the checkout's git config.
-          persist-credentials: false
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: ${{ matrix.target }}
-
-      - name: Install cross-compilation tools
-        if: matrix.cross
-        run: |
-          sudo dpkg --add-architecture arm64
-          sudo sed -i 's/^deb /deb [arch=amd64] /' /etc/apt/sources.list
-          echo "deb [arch=arm64] http://ports.ubuntu.com/ jammy main restricted universe multiverse" | sudo tee /etc/apt/sources.list.d/arm64.list
-          echo "deb [arch=arm64] http://ports.ubuntu.com/ jammy-updates main restricted universe multiverse" | sudo tee -a /etc/apt/sources.list.d/arm64.list
-          sudo apt-get update
-          sudo apt-get install -y gcc-aarch64-linux-gnu
-          echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc" >> "$GITHUB_ENV"
-
-      - name: Cache cargo registry and target
-        uses: actions/cache@v6
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            seaweed-worker/target/${{ matrix.target }}/release
-          key: rust-worker-release-${{ matrix.target }}-${{ hashFiles('seaweed-worker/Cargo.lock') }}
-          restore-keys: |
-            rust-worker-release-${{ matrix.target }}-
-
-      # lance's build scripts compile their own protos and look for a protoc.
-      # Point them at the one protoc-bin-vendored ships, which seaweed-worker's
-      # own build already uses, so no job depends on a system package and every
-      # build sees the same version.
-      - name: Use the vendored protoc
-        run: |
-          cd seaweed-worker
-          cargo fetch
-          # The version from the lock, not whatever else a restored cache holds.
-          version=$(awk '/^name = "protoc-bin-vendored-linux-x86_64"$/{found=1; next} found && /^version = /{gsub(/"/,"",$3); print $3; exit}' Cargo.lock)
-          test -n "$version" || { echo "protoc-bin-vendored-linux-x86_64 is not in Cargo.lock" >&2; exit 1; }
-          protoc=$(find ~/.cargo/registry/src -path "*protoc-bin-vendored-linux-x86_64-$version/bin/protoc" | head -1)
-          test -x "$protoc" || { echo "no vendored protoc $version in the registry" >&2; exit 1; }
-          echo "PROTOC=$protoc" >> "$GITHUB_ENV"
-
-      - name: Build the Rust maintenance worker
-        run: |
-          cd seaweed-worker
-          cargo build --release -p weed-lance-worker --target ${{ matrix.target }}
-
-      - name: Package binary
-        run: |
-          cp seaweed-worker/target/${{ matrix.target }}/release/weed-worker weed-worker
-          tar czf weed-worker_${{ matrix.asset_suffix }}.tar.gz weed-worker
-          rm weed-worker
-          md5sum weed-worker_${{ matrix.asset_suffix }}.tar.gz > weed-worker_${{ matrix.asset_suffix }}.tar.gz.md5
-
-      - name: Upload release assets
-        if: startsWith(github.ref, 'refs/tags/')
-        uses: softprops/action-gh-release@v3
-        with:
-          files: |
-            weed-worker_${{ matrix.asset_suffix }}.tar.gz
-            weed-worker_${{ matrix.asset_suffix }}.tar.gz.md5
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Upload artifacts
-        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
-        uses: actions/upload-artifact@v7
-        with:
-          name: rust-worker-${{ matrix.asset_suffix }}
-          path: |
-            weed-worker_${{ matrix.asset_suffix }}.tar.gz
-            weed-worker_${{ matrix.asset_suffix }}.tar.gz.md5
-
-  build-rust-volume-darwin:
-    permissions:
-      contents: write
-    runs-on: macos-latest
-    strategy:
-      matrix:
-        include:
-          - target: x86_64-apple-darwin
-            asset_suffix: darwin_amd64
-          - target: aarch64-apple-darwin
-            asset_suffix: darwin_arm64
-
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: ${{ matrix.target }}
-
-      - name: Cache cargo registry and target
-        uses: actions/cache@v6
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            seaweed-volume/target
-          key: rust-release-${{ matrix.target }}-${{ hashFiles('seaweed-volume/Cargo.lock') }}
-          restore-keys: |
-            rust-release-${{ matrix.target }}-
-
-      - name: Build Rust volume server (large disk)
-        env:
-          SEAWEEDFS_COMMIT: ${{ github.sha }}
-        run: |
-          cd seaweed-volume
-          cargo build --release --target ${{ matrix.target }} --target-dir target/large-disk
-
-      - name: Build Rust volume server (normal)
-        env:
-          SEAWEEDFS_COMMIT: ${{ github.sha }}
-        run: |
-          cd seaweed-volume
-          cargo build --release --target ${{ matrix.target }} --no-default-features --target-dir target/normal
-
-      - name: Package binaries
-        run: |
-          cp seaweed-volume/target/large-disk/${{ matrix.target }}/release/weed-volume weed-volume-large-disk
-          tar czf weed-volume_large_disk_${{ matrix.asset_suffix }}.tar.gz weed-volume-large-disk
-          rm weed-volume-large-disk
-
-          cp seaweed-volume/target/normal/${{ matrix.target }}/release/weed-volume weed-volume-normal
-          tar czf weed-volume_${{ matrix.asset_suffix }}.tar.gz weed-volume-normal
-          rm weed-volume-normal
-
-      - name: Generate md5 checksums
-        run: |
-          for f in weed-volume_large_disk_${{ matrix.asset_suffix }}.tar.gz weed-volume_${{ matrix.asset_suffix }}.tar.gz; do
-            md5 -r "$f" > "$f.md5"
-          done
-
-      - name: Upload release assets
-        if: startsWith(github.ref, 'refs/tags/')
-        uses: softprops/action-gh-release@v3
-        with:
-          files: |
-            weed-volume_large_disk_${{ matrix.asset_suffix }}.tar.gz
-            weed-volume_large_disk_${{ matrix.asset_suffix }}.tar.gz.md5
-            weed-volume_${{ matrix.asset_suffix }}.tar.gz
-            weed-volume_${{ matrix.asset_suffix }}.tar.gz.md5
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Upload artifacts
-        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
-        uses: actions/upload-artifact@v7
-        with:
-          name: rust-volume-${{ matrix.asset_suffix }}
-          path: |
-            weed-volume_large_disk_${{ matrix.asset_suffix }}.tar.gz
-            weed-volume_large_disk_${{ matrix.asset_suffix }}.tar.gz.md5
-            weed-volume_${{ matrix.asset_suffix }}.tar.gz
-            weed-volume_${{ matrix.asset_suffix }}.tar.gz.md5
-
-  build-rust-volume-windows:
-    permissions:
-      contents: write
-    runs-on: windows-latest
-
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-
-      - name: Cache cargo registry and target
-        uses: actions/cache@v6
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            seaweed-volume/target
-          key: rust-release-windows-${{ hashFiles('seaweed-volume/Cargo.lock') }}
-          restore-keys: |
-            rust-release-windows-
-
-      - name: Build Rust volume server (large disk)
-        env:
-          SEAWEEDFS_COMMIT: ${{ github.sha }}
-        run: |
-          cd seaweed-volume
-          cargo build --release --target-dir target/large-disk
-
-      - name: Build Rust volume server (normal)
-        env:
-          SEAWEEDFS_COMMIT: ${{ github.sha }}
-        run: |
-          cd seaweed-volume
-          cargo build --release --no-default-features --target-dir target/normal
-
-      - name: Package binaries
-        shell: bash
-        run: |
-          cp seaweed-volume/target/large-disk/release/weed-volume.exe weed-volume-large-disk.exe
-          7z a weed-volume_large_disk_windows_amd64.zip weed-volume-large-disk.exe
-          rm weed-volume-large-disk.exe
-
-          cp seaweed-volume/target/normal/release/weed-volume.exe weed-volume-normal.exe
-          7z a weed-volume_windows_amd64.zip weed-volume-normal.exe
-          rm weed-volume-normal.exe
-
-      - name: Generate md5 checksums
-        shell: bash
-        run: |
-          for f in weed-volume_large_disk_windows_amd64.zip weed-volume_windows_amd64.zip; do
-            md5sum "$f" > "$f.md5"
-          done
-
-      - name: Upload release assets
-        if: startsWith(github.ref, 'refs/tags/')
-        uses: softprops/action-gh-release@v3
-        with:
-          files: |
-            weed-volume_large_disk_windows_amd64.zip
-            weed-volume_large_disk_windows_amd64.zip.md5
-            weed-volume_windows_amd64.zip
-            weed-volume_windows_amd64.zip.md5
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Upload artifacts
-        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
-        uses: actions/upload-artifact@v7
-        with:
-          name: rust-volume-windows_amd64
-          path: |
-            weed-volume_large_disk_windows_amd64.zip
-            weed-volume_large_disk_windows_amd64.zip.md5
-            weed-volume_windows_amd64.zip
-            weed-volume_windows_amd64.zip.md5

.github/workflows/s3-etag-acl-tests.yml

@@ -1,129 +0,0 @@
-name: "S3 ETag and ACL Tests"
-
-on:
-  push:
-    branches: [ master ]
-    paths:
-      - 'weed/s3api/**'
-      - 'weed/filer/etag*.go'
-      - 'weed/server/filer_server_handlers_*.go'
-      - 'test/s3/etag/**'
-      - 'test/s3/acl/**'
-      - '.github/workflows/s3-etag-acl-tests.yml'
-  pull_request:
-    branches: [ master ]
-    paths:
-      - 'weed/s3api/**'
-      - 'weed/filer/etag*.go'
-      - 'weed/server/filer_server_handlers_*.go'
-      - 'test/s3/etag/**'
-      - 'test/s3/acl/**'
-      - '.github/workflows/s3-etag-acl-tests.yml'
-
-concurrency:
-  group: ${{ github.head_ref || github.ref }}/s3-etag-acl-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  s3-etag-acl-tests:
-    name: S3 ETag + ACL Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-
-      - name: Install SeaweedFS
-        run: |
-          cd weed && go install -buildvcs=false
-
-      - name: Start weed mini (S3 on :8333)
-        run: |
-          mkdir -p /tmp/seaweedfs-etag-acl
-          # Minimal identity config so SSE-aware tests under acl/ can authenticate.
-          cat > /tmp/seaweedfs-etag-acl-s3.json <<'JSON'
-          {
-            "identities": [
-              {
-                "name": "admin",
-                "credentials": [
-                  {"accessKey": "some_access_key1", "secretKey": "some_secret_key1"}
-                ],
-                "actions": ["Admin", "Read", "Write"]
-              }
-            ]
-          }
-          JSON
-          AWS_ACCESS_KEY_ID=some_access_key1 \
-          AWS_SECRET_ACCESS_KEY=some_secret_key1 \
-            weed mini \
-              -dir=/tmp/seaweedfs-etag-acl \
-              -s3.port=8333 \
-              -s3.config=/tmp/seaweedfs-etag-acl-s3.json \
-              -ip=127.0.0.1 \
-              > /tmp/weed-mini.log 2>&1 &
-          echo $! > /tmp/weed-mini.pid
-
-          # Wait for the S3 endpoint to come up (returns 403 unauth before any
-          # request is signed; that's fine — it means the server is listening).
-          for i in $(seq 1 30); do
-            if curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:8333/ | grep -qE "^(200|403)$"; then
-              echo "weed mini is ready"
-              exit 0
-            fi
-            sleep 1
-          done
-          echo "weed mini failed to start within 30s"
-          tail -50 /tmp/weed-mini.log
-          exit 1
-
-      - name: Run ETag tests
-        # Pins the regression for #7768: PutObject of an auto-chunked file (>8MB)
-        # must return a pure MD5 hex ETag, not a `<md5>-N` composite — the AWS
-        # SDK for Java v2 rejects the latter on the PutObject path.
-        env:
-          S3_ENDPOINT: http://127.0.0.1:8333
-          AWS_ACCESS_KEY_ID: some_access_key1
-          AWS_SECRET_ACCESS_KEY: some_secret_key1
-          AWS_REGION: us-east-1
-        run: go test -v -timeout=5m ./test/s3/etag/...
-
-      - name: Run ACL versioning tests
-        # Pins object-ACL behavior on a versioned bucket: GetObjectAcl /
-        # PutObjectAcl with and without versionId, modifying ACLs on different
-        # versions independently.
-        env:
-          S3_ENDPOINT: http://127.0.0.1:8333
-          AWS_ACCESS_KEY_ID: some_access_key1
-          AWS_SECRET_ACCESS_KEY: some_secret_key1
-          AWS_REGION: us-east-1
-        run: go test -v -timeout=5m ./test/s3/acl/...
-
-      - name: Stop weed mini
-        if: always()
-        run: |
-          if [ -f /tmp/weed-mini.pid ]; then
-            kill "$(cat /tmp/weed-mini.pid)" 2>/dev/null || true
-          fi
-
-      - name: Show server log on failure
-        if: failure()
-        run: |
-          echo "=== weed mini log (last 200 lines) ==="
-          tail -n 200 /tmp/weed-mini.log 2>/dev/null || echo "no log available"
-
-      - name: Archive log
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-etag-acl-server-log
-          path: /tmp/weed-mini.log
-          retention-days: 3

.github/workflows/s3-example-integration-tests.yml

@@ -1,89 +0,0 @@
-name: "S3 Authenticated Integration Tests"
-
-on:
-  pull_request:
-    paths:
-      - 'weed/s3api/**'
-      - 'weed/iam/**'
-      - 'weed/filer/**'
-      - 'weed/server/**'
-      - 'test/s3/normal/**'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/s3-example-integration-tests.yml'
-
-concurrency:
-  group: ${{ github.head_ref }}/s3-integration-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  tests:
-    name: S3 Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Build SeaweedFS
-        run: |
-          cd weed
-          go build -o weed -buildvcs=false
-
-      - name: Run S3 Integration Tests
-        timeout-minutes: 15
-        working-directory: test/s3/normal
-        run: |
-          set -x
-          echo "=== Running S3 Integration Tests ==="
-          go test -v -timeout=60s -run TestS3Integration ./...
-
-      - name: Run S3 DeleteBucketNotEmpty Tests
-        timeout-minutes: 15
-        working-directory: test/s3/normal
-        run: |
-          set -x
-          echo "=== Running S3 DeleteBucketNotEmpty Tests ==="
-          go test -v -timeout=60s -run TestS3DeleteBucketNotEmpty ./...
-
-      - name: Run S3 Empty Directory Marker Tests
-        timeout-minutes: 15
-        working-directory: test/s3/normal
-        run: |
-          set -x
-          echo "=== Running S3 Empty Directory Marker Tests ==="
-          go test -v -timeout=180s -run TestS3ListObjectsEmptyDirectoryMarkers ./...
-
-      - name: Run S3 Prefix Object Tests
-        timeout-minutes: 15
-        working-directory: test/s3/normal
-        run: |
-          set -x
-          echo "=== Running S3 Prefix Object Tests ==="
-          go test -v -timeout=180s -run TestS3PrefixObjectKeys ./...
-
-      - name: Run IAM Integration Tests
-        timeout-minutes: 15
-        working-directory: test/s3/normal
-        run: |
-          set -x
-          echo "=== Running IAM Integration Tests ==="
-          go test -v -timeout=60s -run TestIAMOperations ./...
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: integration-test-logs
-          path: test/s3/normal/*.log
-          retention-days: 3

.github/workflows/s3-filer-group-tests.yml

@@ -1,94 +0,0 @@
-name: "S3 Filer Group Tests"
-
-on:
-  pull_request:
-    paths:
-      - 'weed/s3api/**'
-      - 'weed/filer/**'
-      - 'weed/server/**'
-      - 'test/s3/filer_group/**'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/s3-filer-group-tests.yml'
-
-concurrency:
-  group: ${{ github.head_ref }}/s3-filer-group-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-defaults:
-  run:
-    working-directory: weed
-
-jobs:
-  s3-filer-group-tests:
-    name: S3 Filer Group Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run S3 Filer Group Tests
-        timeout-minutes: 15
-        working-directory: test/s3/filer_group
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          df -h
-          echo "=== Starting Filer Group Tests ==="
-          
-          # Run tests with automatic server management
-          # The test-with-server target handles server startup/shutdown automatically
-          # Server is started with -filer.group=testgroup
-          make test-with-server || {
-            echo "❌ Filer group tests failed, checking logs..."
-            if [ -f weed-test.log ]; then
-              echo "=== Server logs ==="
-              tail -100 weed-test.log
-            fi
-            echo "=== Process information ==="
-            ps aux | grep -E "(weed|test)" || true
-            exit 1
-          }
-
-      - name: Show server logs on failure
-        if: failure()
-        working-directory: test/s3/filer_group
-        run: |
-          echo "=== Server Logs ==="
-          if [ -f weed-test.log ]; then
-            echo "Last 100 lines of server logs:"
-            tail -100 weed-test.log
-          else
-            echo "No server log file found"
-          fi
-          
-          echo "=== Test Environment ==="
-          ps aux | grep -E "(weed|test)" || true
-          netstat -tlnp | grep -E "(8333|9333|8080)" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-filer-group-test-logs
-          path: test/s3/filer_group/weed-test*.log
-          retention-days: 3
-
-

.github/workflows/s3-go-tests.yml

@@ -1,676 +0,0 @@
-name: "S3 Go Tests"
-
-on:
-  pull_request:
-    paths:
-      - 'weed/s3api/**'
-      - 'weed/filer/**'
-      - 'weed/server/**'
-      - 'test/s3/**'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/s3-go-tests.yml'
-
-concurrency:
-  group: ${{ github.head_ref }}/s3-go-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-defaults:
-  run:
-    working-directory: weed
-
-jobs:
-  s3-versioning-tests:
-    name: S3 Versioning Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-    strategy:
-      matrix:
-        test-type: ["quick", "comprehensive"]
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run S3 Versioning Tests - ${{ matrix.test-type }}
-        timeout-minutes: 25
-        working-directory: test/s3/versioning
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          df -h
-          echo "=== Starting Tests ==="
-          
-          # Run tests with automatic server management
-          # The test-with-server target handles server startup/shutdown automatically
-          if [ "${{ matrix.test-type }}" = "quick" ]; then
-            # Override TEST_PATTERN for quick tests only
-            make test-with-server TEST_PATTERN="TestBucketListReturnDataVersioning|TestVersioningBasicWorkflow|TestVersioningDeleteMarkers"
-          else
-            # Run all versioning tests
-            make test-with-server
-          fi
-
-      - name: Show server logs on failure
-        if: failure()
-        working-directory: test/s3/versioning
-        run: |
-          echo "=== Server Logs ==="
-          if [ -f weed-test.log ]; then
-            echo "Last 100 lines of server logs:"
-            tail -100 weed-test.log
-          else
-            echo "No server log file found"
-          fi
-          
-          echo "=== Test Environment ==="
-          ps aux | grep -E "(weed|test)" || true
-          netstat -tlnp | grep -E "(8333|9333|8080)" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-versioning-test-logs-${{ matrix.test-type }}
-          path: test/s3/versioning/weed-test*.log
-          retention-days: 3
-
-  s3-versioning-compatibility:
-    name: S3 Versioning Compatibility Test
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run Core Versioning Test (Python s3tests equivalent)
-        timeout-minutes: 15
-        working-directory: test/s3/versioning
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          
-          # Run the specific test that is equivalent to the Python s3tests
-          make test-with-server || {
-            echo "❌ Test failed, checking logs..."
-            if [ -f weed-test.log ]; then
-              echo "=== Server logs ==="
-              tail -100 weed-test.log
-            fi
-            echo "=== Process information ==="
-            ps aux | grep -E "(weed|test)" || true
-            exit 1
-          }
-
-      - name: Upload server logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-versioning-compatibility-logs
-          path: test/s3/versioning/weed-test*.log
-          retention-days: 3
-
-  s3-cors-compatibility:
-    name: S3 CORS Compatibility Test
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run Core CORS Test (AWS S3 compatible)
-        timeout-minutes: 15
-        working-directory: test/s3/cors
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          
-          # Run the specific test that is equivalent to AWS S3 CORS behavior
-          make test-with-server || {
-            echo "❌ Test failed, checking logs..."
-            if [ -f weed-test.log ]; then
-              echo "=== Server logs ==="
-              tail -100 weed-test.log
-            fi
-            echo "=== Process information ==="
-            ps aux | grep -E "(weed|test)" || true
-            exit 1
-          }
-
-      - name: Upload server logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-cors-compatibility-logs
-          path: test/s3/cors/weed-test*.log
-          retention-days: 3
-
-  s3-retention-tests:
-    name: S3 Retention Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-    strategy:
-      matrix:
-        test-type: ["quick", "comprehensive"]
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run S3 Retention Tests - ${{ matrix.test-type }}
-        timeout-minutes: 25
-        working-directory: test/s3/retention
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          df -h
-          echo "=== Starting Tests ==="
-          
-          # Run tests with automatic server management
-          # The test-with-server target handles server startup/shutdown automatically
-          if [ "${{ matrix.test-type }}" = "quick" ]; then
-            # Override TEST_PATTERN for quick tests only
-            make test-with-server TEST_PATTERN="TestBasicRetentionWorkflow|TestRetentionModeCompliance|TestLegalHoldWorkflow"
-          else
-            # Run all retention tests
-            make test-with-server
-          fi
-
-      - name: Show server logs on failure
-        if: failure()
-        working-directory: test/s3/retention
-        run: |
-          echo "=== Server Logs ==="
-          if [ -f weed-test.log ]; then
-            echo "Last 100 lines of server logs:"
-            tail -100 weed-test.log
-          else
-            echo "No server log file found"
-          fi
-          
-          echo "=== Test Environment ==="
-          ps aux | grep -E "(weed|test)" || true
-          netstat -tlnp | grep -E "(8333|9333|8080)" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-retention-test-logs-${{ matrix.test-type }}
-          path: test/s3/retention/weed-test*.log
-          retention-days: 3
-
-  s3-lifecycle-tests:
-    name: S3 Lifecycle Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
-    strategy:
-      fail-fast: false
-      matrix:
-        # One job per test so each gets a fresh `weed mini` server, avoiding
-        # the cross-test volume-pool exhaustion that surfaced when several
-        # TTL-pinned bucket collections piled up in a single run.
-        test:
-          - TestLifecycleAbortIncompleteMultipartUpload
-          - TestLifecycleAdminDispatchSucceedsWithCustomFilerGrpcPort
-          - TestLifecycleBootstrapWalkOnExistingObjects
-          - TestLifecycleConfigUpdateBetweenSweeps
-          - TestLifecycleDeleteBucketLifecycleStopsDispatching
-          - TestLifecycleDisabledRuleSkipsObject
-          - TestLifecycleEmptyBucketSweepIsNoOp
-          - TestLifecycleExpirationDateInThePast
-          - TestLifecycleExpirationFiresOnBackdatedObject
-          - TestLifecycleExpiredDeleteMarkerCleanup
-          - TestLifecycleMultipleBucketsInOneSweep
-          - TestLifecycleMultipleRulesInOneBucket
-          - TestLifecycleNewerNoncurrentVersions
-          - TestLifecycleNoncurrentVersionExpiration
-          - TestLifecycleSizeFilterGreaterThan
-          - TestLifecycleSkipsObjectLockedObjects
-          - TestLifecycleSuspendedVersioningExpiration
-          - TestLifecycleTagFilter
-          - TestLifecycleVersionedBucketCreatesDeleteMarker
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run ${{ matrix.test }}
-        timeout-minutes: 8
-        working-directory: test/s3/lifecycle
-        run: |
-          set -x
-          make test-with-server TEST_PATTERN='^${{ matrix.test }}$$'
-
-      - name: Show server logs on failure
-        if: failure()
-        working-directory: test/s3/lifecycle
-        run: |
-          if [ -f weed-test.log ]; then
-            echo "=== Last 200 lines of server logs ==="
-            tail -200 weed-test.log
-          fi
-          ps aux | grep -E "(weed|test)" || true
-          netstat -tlnp 2>/dev/null | grep -E "(8333|9333|8080|8888)" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-lifecycle-test-logs-${{ matrix.test }}
-          path: test/s3/lifecycle/weed-test*.log
-          retention-days: 3
-
-  s3-checksum-tests:
-    name: S3 Checksum Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run S3 Checksum Tests
-        timeout-minutes: 16
-        working-directory: test/s3/checksum
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          df -h
-          echo "=== Starting Tests ==="
-          make test-with-server
-
-      - name: Show server logs on failure
-        if: failure()
-        working-directory: test/s3/checksum
-        run: |
-          echo "=== Server Logs ==="
-          if [ -f weed-test.log ]; then
-            echo "Last 100 lines of server logs:"
-            tail -100 weed-test.log
-          else
-            echo "No server log file found"
-          fi
-
-          echo "=== Test Environment ==="
-          ps aux | grep -E "(weed|test)" || true
-          netstat -tlnp | grep -E "(8333|9333|8080)" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-checksum-test-logs
-          path: test/s3/checksum/weed-test*.log
-          retention-days: 3
-
-  s3-cors-tests:
-    name: S3 CORS Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-    strategy:
-      matrix:
-        test-type: ["quick", "comprehensive"]
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run S3 CORS Tests - ${{ matrix.test-type }}
-        timeout-minutes: 25
-        working-directory: test/s3/cors
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          df -h
-          echo "=== Starting Tests ==="
-          
-          # Run tests with automatic server management
-          # The test-with-server target handles server startup/shutdown automatically
-          if [ "${{ matrix.test-type }}" = "quick" ]; then
-            # Override TEST_PATTERN for quick tests only
-            make test-with-server TEST_PATTERN="TestCORSConfigurationManagement|TestServiceLevelCORS|TestCORSBasicWorkflow"
-          else
-            # Run all CORS tests
-            make test-with-server
-          fi
-
-      - name: Show server logs on failure
-        if: failure()
-        working-directory: test/s3/cors
-        run: |
-          echo "=== Server Logs ==="
-          if [ -f weed-test.log ]; then
-            echo "Last 100 lines of server logs:"
-            tail -100 weed-test.log
-          else
-            echo "No server log file found"
-          fi
-          
-          echo "=== Test Environment ==="
-          ps aux | grep -E "(weed|test)" || true
-          netstat -tlnp | grep -E "(8333|9333|8080)" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-cors-test-logs-${{ matrix.test-type }}
-          path: test/s3/cors/weed-test*.log
-          retention-days: 3
-
-  s3-retention-worm:
-    name: S3 Retention WORM Integration Test
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run WORM Integration Tests
-        timeout-minutes: 15
-        working-directory: test/s3/retention
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          
-          # Run the WORM integration tests with automatic server management
-          # The test-with-server target handles server startup/shutdown automatically
-          make test-with-server TEST_PATTERN="TestWORM|TestRetentionExtendedAttributes|TestRetentionConcurrentOperations" || {
-            echo "❌ WORM integration test failed, checking logs..."
-            if [ -f weed-test.log ]; then
-              echo "=== Server logs ==="
-              tail -100 weed-test.log
-            fi
-            echo "=== Process information ==="
-            ps aux | grep -E "(weed|test)" || true
-            exit 1
-          }
-
-      - name: Upload server logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-retention-worm-logs
-          path: test/s3/retention/weed-test*.log
-          retention-days: 3
-
-  s3-versioning-stress:
-    name: S3 Versioning Stress Test
-    runs-on: ubuntu-22.04
-    timeout-minutes: 35
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run S3 Versioning Stress Tests
-        timeout-minutes: 30
-        working-directory: test/s3/versioning
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          
-          # Start server for stress tests
-          make start-server
-          
-          # Run stress tests (concurrent operations)
-          make test-versioning-stress || {
-            echo "❌ Stress test failed, checking logs..."
-            if [ -f weed-test.log ]; then
-              echo "=== Server logs ==="
-              tail -200 weed-test.log
-            fi
-            make stop-server
-            make clean
-            exit 1
-          }
-          
-          # Run pagination stress tests (>1000 versions)
-          echo "=== Running pagination stress tests ==="
-          make test-versioning-pagination-stress || {
-            echo "❌ Pagination stress test failed, checking logs..."
-            if [ -f weed-test.log ]; then
-              echo "=== Server logs ==="
-              tail -200 weed-test.log
-            fi
-            make stop-server
-            make clean
-            exit 1
-          }
-          
-          make stop-server
-          make clean
-
-      - name: Upload stress test logs
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-versioning-stress-logs
-          path: test/s3/versioning/weed-test*.log
-          retention-days: 7
-
-  s3-tagging-tests:
-    # CI job for S3 object tagging tests
-    name: S3 Tagging Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run S3 Tagging Tests
-        timeout-minutes: 15
-        working-directory: test/s3/tagging
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          
-          # Set environment variables for the test
-          export S3_ENDPOINT="http://localhost:8006"
-          export S3_ACCESS_KEY="0555b35654ad1656d804"
-          export S3_SECRET_KEY="h7GhxuBLTrlhVUyxSPUKUV8r/2EI4ngqJxD7iBdBYLhwluN30JaT3Q=="
-          export AWS_ACCESS_KEY_ID="$S3_ACCESS_KEY"
-          export AWS_SECRET_ACCESS_KEY="$S3_SECRET_KEY"
-          
-          # Run the specific test that is equivalent to AWS S3 tagging behavior
-          make test-with-server || {
-            echo "❌ Test failed, checking logs..."
-            if [ -f weed-test.log ]; then
-              echo "=== Server logs ==="
-              tail -100 weed-test.log
-            fi
-            echo "=== Process information ==="
-            ps aux | grep -E "(weed|test)" || true
-            exit 1
-          }
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-tagging-test-logs
-          path: test/s3/tagging/weed-test*.log
-          retention-days: 3
-
-  s3-remote-cache-tests:
-    name: S3 Remote Cache Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run S3 Remote Cache Tests
-        timeout-minutes: 15
-        working-directory: test/s3/remote_cache
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          
-          # Run the remote cache integration tests
-          # Tests singleflight deduplication for caching remote objects
-          make test-with-server || {
-            echo "❌ Test failed, checking logs..."
-            if [ -f primary-weed.log ]; then
-              echo "=== Primary server logs ==="
-              tail -100 primary-weed.log
-            fi
-            if [ -f remote-weed.log ]; then
-              echo "=== Remote server logs ==="
-              tail -100 remote-weed.log
-            fi
-            echo "=== Process information ==="
-            ps aux | grep -E "(weed|test)" || true
-            exit 1
-          }
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-remote-cache-test-logs
-          path: |
-            test/s3/remote_cache/primary-weed.log
-            test/s3/remote_cache/remote-weed.log
-          retention-days: 3
-
-  # Removed SSE-C integration tests and compatibility job

.github/workflows/s3-iam-tests.yml

@@ -1,309 +0,0 @@
-name: "S3 IAM Integration Tests"
-
-on:
-  pull_request:
-    paths:
-      - 'weed/iam/**'
-      - 'weed/s3api/**'
-      - 'weed/credential/**'
-      - 'weed/pb/**'
-      - 'test/s3/iam/**'
-      - '.github/workflows/s3-iam-tests.yml'
-  push:
-    branches: [ master ]
-    paths:
-      - 'weed/iam/**'
-      - 'weed/s3api/**'
-      - 'weed/credential/**'
-      - 'weed/pb/**'
-      - 'test/s3/iam/**'
-      - '.github/workflows/s3-iam-tests.yml'
-  
-concurrency:
-  group: ${{ github.head_ref }}/s3-iam-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-defaults:
-  run:
-    working-directory: weed
-
-jobs:
-  # Unit tests for IAM components
-  iam-unit-tests:
-    name: IAM Unit Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Get dependencies
-        run: |
-          go mod download
-
-      - name: Run IAM Unit Tests
-        timeout-minutes: 10
-        run: |
-          set -x
-          echo "=== Running IAM STS Tests ==="
-          go test -v -timeout 5m ./iam/sts/...
-          
-          echo "=== Running IAM Policy Tests ==="
-          go test -v -timeout 5m ./iam/policy/...
-          
-          echo "=== Running IAM Integration Tests ==="
-          go test -v -timeout 5m ./iam/integration/...
-          
-          echo "=== Running S3 API IAM Tests ==="
-          go test -v -timeout 5m ./s3api/... -run ".*IAM.*|.*JWT.*|.*Auth.*"
-
-      - name: Upload test results on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: iam-unit-test-results
-          path: |
-            weed/testdata/
-            weed/**/testdata/
-          retention-days: 3
-
-  # S3 IAM integration tests with SeaweedFS services
-  s3-iam-integration-tests:
-    name: S3 IAM Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 25
-    strategy:
-      matrix:
-        test-type: ["basic", "advanced", "policy-enforcement", "group", "sts"]
-        
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        working-directory: weed
-        run: |
-          go install -buildvcs=false
-
-      - name: Run S3 IAM Integration Tests - ${{ matrix.test-type }}
-        timeout-minutes: 20
-        working-directory: test/s3/iam
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          df -h
-          echo "=== Starting S3 IAM Integration Tests (${{ matrix.test-type }}) ==="
-          
-          # Set WEED_BINARY to use the installed version
-          export WEED_BINARY=$(which weed)
-          export TEST_TIMEOUT=15m
-          
-          # Run tests based on type
-          case "${{ matrix.test-type }}" in
-            "basic")
-              echo "Running basic IAM functionality tests..."
-              make clean setup start-services wait-for-services
-              go test -v -timeout 15m -run "TestS3IAMAuthentication|TestS3IAMBasicWorkflow|TestS3IAMTokenValidation|TestIAMUserManagement|TestIAMAccessKeyManagement|TestIAMPolicyManagement" ./...
-              ;;
-            "advanced")
-              echo "Running advanced IAM feature tests..."
-              make clean setup start-services wait-for-services
-              go test -v -timeout 15m -run "TestS3IAMSessionExpiration|TestS3IAMMultipart|TestS3IAMPresigned" ./...
-              ;;
-            "policy-enforcement")
-              echo "Running policy enforcement tests..."
-              make clean setup start-services wait-for-services
-              go test -v -timeout 15m -run "TestS3IAMPolicyEnforcement|TestS3IAMBucketPolicy|TestS3IAMContextual" ./...
-              ;;
-            "group")
-              echo "Running IAM group management tests..."
-              make clean setup start-services wait-for-services
-              go test -v -timeout 15m -run "TestIAMGroup" ./...
-              ;;
-            "sts")
-              echo "Running STS and service account tests..."
-              make clean setup start-services wait-for-services
-              # SigV4-signed STS calls need admin credentials matching test_config.json.
-              # Tests default to "admin"/"admin" when env vars are unset, which don't exist.
-              export STS_TEST_ACCESS_KEY=test-access-key
-              export STS_TEST_SECRET_KEY=test-secret-key
-              # The use_service_account_credentials subtest is excluded because
-              # newly-created service-account access keys are not currently
-              # persisted to the filer after CreateServiceAccount — a
-              # pre-existing sync issue tracked separately from the
-              # GetFederationToken routing fix this PR addresses.
-              go test -v -timeout 15m \
-                -run "TestSTS|TestAssumeRoleWithWebIdentity|TestServiceAccount" \
-                -skip "TestServiceAccountLifecycle/use_service_account_credentials" \
-                ./...
-              ;;
-            *)
-              echo "Unknown test type: ${{ matrix.test-type }}"
-              exit 1
-              ;;
-          esac
-          
-          # Always cleanup
-          make stop-services
-
-      - name: Show service logs on failure
-        if: failure()
-        working-directory: test/s3/iam
-        run: |
-          echo "=== Service Logs ==="
-          echo "--- Master Log ---"
-          tail -50 weed-master.log 2>/dev/null || echo "No master log found"
-          echo ""
-          echo "--- Filer Log ---"
-          tail -50 weed-filer.log 2>/dev/null || echo "No filer log found"
-          echo ""
-          echo "--- Volume Log ---"
-          tail -50 weed-volume.log 2>/dev/null || echo "No volume log found"
-          echo ""
-          echo "--- S3 API Log ---"
-          tail -50 weed-s3.log 2>/dev/null || echo "No S3 log found"
-          echo ""
-          
-          echo "=== Process Information ==="
-          ps aux | grep -E "(weed|test)" || true
-          netstat -tlnp | grep -E "(8333|8888|9333|8080)" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-iam-integration-logs-${{ matrix.test-type }}
-          path: test/s3/iam/weed-*.log
-          retention-days: 5
-
-  # Distributed IAM tests
-  s3-iam-distributed-tests:
-    name: S3 IAM Distributed Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 25
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        working-directory: weed
-        run: |
-          go install -buildvcs=false
-
-      - name: Run Distributed IAM Tests
-        timeout-minutes: 20
-        working-directory: test/s3/iam
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          
-          export WEED_BINARY=$(which weed)
-          export TEST_TIMEOUT=15m
-          
-          # Test distributed configuration
-          echo "Testing distributed IAM configuration..."
-          make clean setup
-          
-          # Start services with distributed IAM config
-          echo "Starting services with distributed configuration..."
-          make start-services
-          make wait-for-services
-          
-          # Run distributed-specific tests
-          export ENABLE_DISTRIBUTED_TESTS=true
-          go test -v -timeout 15m -run "TestS3IAMDistributedTests" ./... || {
-            echo "❌ Distributed tests failed, checking logs..."
-            make logs
-            exit 1
-          }
-          
-          make stop-services
-
-      - name: Upload distributed test logs
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-iam-distributed-logs
-          path: test/s3/iam/weed-*.log
-          retention-days: 7
-
-  # Performance and stress tests
-  s3-iam-performance-tests:
-    name: S3 IAM Performance Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        working-directory: weed
-        run: |
-          go install -buildvcs=false
-
-      - name: Run IAM Performance Benchmarks
-        timeout-minutes: 25
-        working-directory: test/s3/iam
-        run: |
-          set -x
-          echo "=== Running IAM Performance Tests ==="
-          
-          export WEED_BINARY=$(which weed)
-          export TEST_TIMEOUT=20m
-          
-          make clean setup start-services wait-for-services
-          
-          # Run performance tests (benchmarks disabled for CI)
-          echo "Running performance tests..."
-          export ENABLE_PERFORMANCE_TESTS=true
-          go test -v -timeout 15m -run "TestS3IAMPerformanceTests" ./... || {
-            echo "❌ Performance tests failed"
-            make logs
-            exit 1
-          }
-          
-          make stop-services
-
-      - name: Upload performance test results
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-iam-performance-results
-          path: |
-            test/s3/iam/weed-*.log
-            test/s3/iam/*.test
-          retention-days: 7

.github/workflows/s3-keycloak-tests.yml

@@ -1,161 +0,0 @@
-name: "S3 Keycloak Integration Tests"
-
-on:
-  pull_request:
-    paths:
-      - 'weed/iam/**'
-      - 'weed/s3api/**'
-      - 'test/s3/iam/**'
-      - '.github/workflows/s3-keycloak-tests.yml'
-  push:
-    branches: [ master ]
-    paths:
-      - 'weed/iam/**'
-      - 'weed/s3api/**'
-      - 'test/s3/iam/**'
-      - '.github/workflows/s3-keycloak-tests.yml'
-  
-concurrency:
-  group: ${{ github.head_ref }}/s3-keycloak-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-defaults:
-  run:
-    working-directory: weed
-
-jobs:
-  # Dedicated job for Keycloak integration tests
-  s3-keycloak-integration-tests:
-    name: S3 Keycloak Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        working-directory: weed
-        run: |
-          go install -buildvcs=false
-
-      - name: Run Keycloak Integration Tests
-        timeout-minutes: 25
-        working-directory: test/s3/iam
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          df -h
-          echo "=== Starting S3 Keycloak Integration Tests ==="
-          
-          # Set WEED_BINARY to use the installed version
-          export WEED_BINARY=$(which weed)
-          export TEST_TIMEOUT=20m
-          
-          echo "Running Keycloak integration tests..."
-          # Start Keycloak container first
-          docker run -d \
-            --name keycloak \
-            -p 8080:8080 \
-            -e KC_BOOTSTRAP_ADMIN_USERNAME=admin \
-            -e KC_BOOTSTRAP_ADMIN_PASSWORD=admin \
-            -e KC_HTTP_ENABLED=true \
-            -e KC_HOSTNAME_STRICT=false \
-            -e KC_HOSTNAME_STRICT_HTTPS=false \
-            quay.io/keycloak/keycloak:26.0 \
-            start-dev
-          
-          # Wait for Keycloak with better health checking
-          timeout 300 bash -c '
-            while true; do
-              if curl -s http://localhost:8080/health/ready > /dev/null 2>&1; then
-                echo "✅ Keycloak health check passed"
-                break
-              fi
-              echo "... waiting for Keycloak to be ready"
-              sleep 5
-            done
-          '
-          
-          # Setup Keycloak configuration
-          ./setup_keycloak.sh
-          
-          # Start SeaweedFS services
-          make clean setup start-services wait-for-services
-          
-          # Verify service accessibility
-          echo "=== Verifying Service Accessibility ==="
-          curl -f http://localhost:8080/realms/master
-          curl -s http://localhost:8333/healthz
-          echo "✅ SeaweedFS S3 API is responding (IAM-protected endpoint)"
-          
-          # Run Keycloak-specific tests
-          echo "=== Running Keycloak Tests ==="
-          export KEYCLOAK_URL=http://localhost:8080
-          export S3_ENDPOINT=http://localhost:8333
-          
-          # Wait for realm to be properly configured
-          timeout 120 bash -c 'until curl -fs http://localhost:8080/realms/seaweedfs-test/.well-known/openid-configuration > /dev/null; do echo "... waiting for realm"; sleep 3; done'
-          
-          # Run the Keycloak integration tests
-          go test -v -timeout 20m -run "TestKeycloak" ./...
-          
-      - name: Show server logs on failure
-        if: failure()
-        working-directory: test/s3/iam
-        run: |
-          echo "=== Service Logs ==="
-          echo "--- Keycloak logs ---"
-          docker logs keycloak --tail=100 || echo "No Keycloak container logs"
-          
-          echo "--- SeaweedFS Master logs ---"
-          if [ -f weed-master.log ]; then
-            tail -100 weed-master.log
-          fi
-          
-          echo "--- SeaweedFS S3 logs ---"
-          if [ -f weed-s3.log ]; then
-            tail -100 weed-s3.log
-          fi
-          
-          echo "--- SeaweedFS Filer logs ---"
-          if [ -f weed-filer.log ]; then
-            tail -100 weed-filer.log
-          fi
-          
-          echo "=== System Status ==="
-          ps aux | grep -E "(weed|keycloak)" || true
-          netstat -tlnp | grep -E "(8333|9333|8080|8888)" || true
-          docker ps -a || true
-
-      - name: Cleanup
-        if: always()
-        working-directory: test/s3/iam
-        run: |
-          # Stop Keycloak container
-          docker stop keycloak || true
-          docker rm keycloak || true
-          
-          # Stop SeaweedFS services
-          make clean || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-keycloak-test-logs
-          path: |
-            test/s3/iam/*.log
-            test/s3/iam/test-volume-data/
-          retention-days: 3

.github/workflows/s3-mutation-regression-tests.yml

@@ -1,148 +0,0 @@
-name: "S3 Mutation Regression Tests"
-
-on:
-  pull_request:
-    paths:
-      - 'weed/s3api/**'
-      - 'test/s3/delete/**'
-      - 'test/s3/distributed_lock/**'
-      - 'test/s3/versioning/**'
-      - 'test/volume_server/framework/**'
-      - 'docker/compose/s3.json'
-      - '.github/workflows/s3-mutation-regression-tests.yml'
-
-concurrency:
-  group: ${{ github.head_ref }}/s3-mutation-regression-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  s3-versioning-regressions:
-    name: S3 Versioning Regression Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 25
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-
-      - name: Run S3 versioning regression tests
-        timeout-minutes: 20
-        working-directory: test/s3/versioning
-        run: |
-          set -x
-          # Run every versioning test, so a regression test lands covered instead
-          # of waiting for someone to remember this file. Name a test in EXCLUDE,
-          # with the reason, to keep it out.
-          #
-          # TestVersioningPagination*: opt-in stress tests that build 1500+
-          # versions. They self-skip without ENABLE_STRESS_TESTS and have their
-          # own make target, so this gate should not carry them.
-          EXCLUDE='TestVersioningPagination.*'
-          tests=$(go test . -list '.*' | grep '^Test' | sort -u)
-          # An empty list would make -run match nothing and pass this job vacuously.
-          [ -n "$tests" ] || { echo "listed no versioning tests"; exit 1; }
-          selected=$(echo "$tests" | grep -vE "^($EXCLUDE)$")
-          [ -n "$selected" ] || { echo "EXCLUDE matched every test"; exit 1; }
-          echo "running $(echo "$selected" | wc -l) of $(echo "$tests" | wc -l) versioning tests"
-          # make swallows a lone trailing $, taking the anchor with it, so escape it.
-          make test-with-server TEST_PATTERN="^($(echo "$selected" | paste -sd'|' -))"'$$'
-
-      - name: Show server logs on failure
-        if: failure()
-        working-directory: test/s3/versioning
-        run: |
-          echo "=== Server Logs ==="
-          if [ -f weed-test.log ]; then
-            tail -100 weed-test.log
-          fi
-
-      - name: Upload versioning logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-versioning-regression-logs
-          path: test/s3/versioning/weed-test*.log
-          retention-days: 3
-
-  s3-delete-regressions:
-    name: S3 Delete Regression Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-
-      - name: Run S3 delete regression tests
-        timeout-minutes: 15
-        working-directory: test/s3/delete
-        run: |
-          set -x
-          make test-with-server
-
-      - name: Show server logs on failure
-        if: failure()
-        working-directory: test/s3/delete
-        run: |
-          echo "=== Server Logs ==="
-          if [ -f weed-test.log ]; then
-            tail -100 weed-test.log
-          fi
-
-      - name: Upload delete logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-delete-regression-logs
-          path: test/s3/delete/weed-test*.log
-          retention-days: 3
-
-  s3-distributed-lock-regressions:
-    name: S3 Distributed Lock Regression Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-
-      - name: Build SeaweedFS
-        run: |
-          go build -o weed/weed -buildvcs=false ./weed
-
-      - name: Run distributed lock regressions
-        timeout-minutes: 25
-        env:
-          TMPDIR: ${{ github.workspace }}/test/s3/distributed_lock/tmp
-          S3_DISTRIBUTED_LOCK_KEEP_LOGS: "1"
-          WEED_BINARY: ${{ github.workspace }}/weed/weed
-        run: |
-          set -x
-          mkdir -p "$TMPDIR"
-          go test -v -count=1 -timeout=20m ./test/s3/distributed_lock
-
-      - name: Upload distributed lock logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-distributed-lock-regression-logs
-          path: test/s3/distributed_lock/tmp/seaweedfs_s3_distributed_lock_*
-          retention-days: 3

.github/workflows/s3-parquet-tests.yml

@@ -1,163 +0,0 @@
-name: "S3 PyArrow Parquet Tests"
-
-on:
-  push:
-    branches: [master]
-    paths:
-      - 'weed/s3api/**'
-      - 'weed/filer/**'
-      - 'test/s3/parquet/**'
-      - '.github/workflows/s3-parquet-tests.yml'
-  pull_request:
-    branches: [master]
-    paths:
-      - 'weed/s3api/**'
-      - 'weed/filer/**'
-      - 'test/s3/parquet/**'
-      - '.github/workflows/s3-parquet-tests.yml'
-  workflow_dispatch:
-
-env:
-  S3_ACCESS_KEY: some_access_key1
-  S3_SECRET_KEY: some_secret_key1
-  S3_ENDPOINT_URL: http://localhost:8333
-  BUCKET_NAME: test-parquet-bucket
-
-jobs:
-  parquet-integration-tests:
-    name: PyArrow Parquet Tests (Python ${{ matrix.python-version }})
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    
-    strategy:
-      fail-fast: false
-      matrix:
-        python-version: ['3.9', '3.11', '3.12']
-    
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v7
-      
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version: ^1.26
-          cache: true
-      
-      - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v7
-        with:
-          python-version: ${{ matrix.python-version }}
-          cache: 'pip'
-          cache-dependency-path: 'test/s3/parquet/requirements.txt'
-      
-      - name: Install system dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y lsof netcat-openbsd
-      
-      - name: Build SeaweedFS
-        run: |
-          cd weed
-          go build -v
-          sudo cp weed /usr/local/bin/
-          weed version
-      
-      - name: Run PyArrow Parquet integration tests
-        run: |
-          cd test/s3/parquet
-          make test-with-server
-        env:
-          SEAWEEDFS_BINARY: weed
-          S3_PORT: 8333
-          FILER_PORT: 8888
-          VOLUME_PORT: 8080
-          MASTER_PORT: 9333
-          VOLUME_MAX_SIZE_MB: 50
-      
-      - name: Run implicit directory fix tests
-        run: |
-          cd test/s3/parquet
-          make test-implicit-dir-with-server
-        env:
-          SEAWEEDFS_BINARY: weed
-          S3_PORT: 8333
-          FILER_PORT: 8888
-          VOLUME_PORT: 8080
-          MASTER_PORT: 9333
-      
-      - name: Run PyArrow native S3 filesystem tests
-        run: |
-          cd test/s3/parquet
-          make test-native-s3-with-server
-        env:
-          SEAWEEDFS_BINARY: weed
-          S3_PORT: 8333
-          FILER_PORT: 8888
-          VOLUME_PORT: 8080
-          MASTER_PORT: 9333
-      
-      - name: Run cross-filesystem compatibility tests
-        run: |
-          cd test/s3/parquet
-          TEST_QUICK=1 make test-cross-fs-with-server
-        env:
-          SEAWEEDFS_BINARY: weed
-          S3_PORT: 8333
-          FILER_PORT: 8888
-          VOLUME_PORT: 8080
-          MASTER_PORT: 9333
-      
-      - name: Run SSE-S3 encryption compatibility tests
-        run: |
-          cd test/s3/parquet
-          make test-sse-s3-compat
-        env:
-          SEAWEEDFS_BINARY: weed
-          S3_PORT: 8333
-          FILER_PORT: 8888
-          VOLUME_PORT: 8080
-          MASTER_PORT: 9333
-      
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: test-logs-python-${{ matrix.python-version }}
-          path: |
-            /tmp/seaweedfs-parquet-*.log
-            test/s3/parquet/*.log
-          retention-days: 7
-      
-      - name: Cleanup
-        if: always()
-        run: |
-          cd test/s3/parquet
-          make stop-seaweedfs-safe || true
-          make clean || true
-
-  unit-tests:
-    name: Go Unit Tests (Implicit Directory)
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v7
-      
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version: ^1.26
-          cache: true
-      
-      - name: Run Go unit tests
-        run: |
-          cd weed/s3api
-          go test -v -run TestImplicitDirectory
-      
-      - name: Run all S3 API tests
-        run: |
-          cd weed/s3api
-          go test -v -timeout 5m
-

.github/workflows/s3-policy-tests.yml

@@ -1,426 +0,0 @@
-name: "S3 Policy Integration Tests"
-
-on:
-  pull_request:
-    paths:
-      - 'weed/s3api/s3_iam_middleware.go'
-      - 'weed/s3api/s3api_bucket_policy*.go'
-      - 'weed/s3api/s3_action_resolver.go'
-      - 'weed/s3api/policy/**'
-      - 'weed/iam/**'
-      - 'test/s3/iam/**'
-      - 'test/s3/policy/**'
-      - '.github/workflows/s3-policy-tests.yml'
-  push:
-    branches: [ master, main ]
-    paths:
-      - 'weed/s3api/s3_iam_middleware.go'
-      - 'weed/s3api/s3api_bucket_policy*.go'
-      - 'weed/s3api/s3_action_resolver.go'
-      - 'weed/s3api/policy/**'
-      - 'weed/iam/**'
-      - 'test/s3/iam/**'
-      - 'test/s3/policy/**'
-      - '.github/workflows/s3-policy-tests.yml'
-
-concurrency:
-  group: ${{ github.head_ref }}/s3-policy-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-defaults:
-  run:
-    working-directory: weed
-
-jobs:
-  # Unit tests for policy components
-  policy-unit-tests:
-    name: S3 Policy Unit Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Get dependencies
-        run: |
-          go mod download
-
-      - name: Run S3 Policy Unit Tests
-        timeout-minutes: 10
-        run: |
-          set -x
-          echo "=== Running S3 Action Resolver Tests ==="
-          go test -v -timeout 5m ./s3api/... -run ".*ActionResolver.*"
-          
-          echo "=== Running S3 Bucket Policy Engine Tests ==="
-          go test -v -timeout 5m ./s3api/... -run ".*BucketPolicy.*|.*PolicyEngine.*"
-          
-          echo "=== Running IAM Policy Tests ==="
-          go test -v -timeout 5m ./iam/policy/...
-
-      - name: Upload test results on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: policy-unit-test-results
-          path: |
-            weed/testdata/
-            weed/**/testdata/
-          retention-days: 3
-
-  # S3 Policy Variables Integration Tests
-  s3-policy-variables-tests:
-    name: S3 Policy Variables Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 25
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run S3 Policy Variables Integration Tests
-        timeout-minutes: 20
-        working-directory: test/s3/iam
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          df -h
-          
-          echo "=== Starting S3 Policy Variables Integration Tests ==="
-          
-          # Set WEED_BINARY to use the installed version
-          export WEED_BINARY=$(which weed)
-          export TEST_TIMEOUT=15m
-          
-          # Run policy variables tests
-          echo "Running policy variables tests..."
-          
-          # Kill any existing weed server on port 8333
-          if lsof -Pi :8333 -sTCP:LISTEN -t >/dev/null 2>&1 ; then
-            kill $(lsof -t -i:8333) 2>/dev/null || true
-            sleep 2
-          fi
-          
-          # Start weed server with IAM configuration
-          echo "Starting weed server with IAM configuration..."
-          $WEED_BINARY server \
-            -s3 \
-            -s3.port=8333 \
-            -s3.iam.config="$(pwd)/test_iam_config.json" \
-            -filer \
-            -volume.max=0 \
-            -master.volumeSizeLimitMB=100 \
-            -s3.allowDeleteBucketNotEmpty=true \
-            > /tmp/weed_policy_test_server.log 2>&1 &
-          
-          SERVER_PID=$!
-          echo "Server started with PID: $SERVER_PID"
-          
-          # Wait for server to be ready
-          echo "Waiting for server to be ready..."
-          MAX_WAIT=30
-          COUNTER=0
-          while ! curl -s http://localhost:8333/status > /dev/null 2>&1; do
-            sleep 1
-            COUNTER=$((COUNTER + 1))
-            if [ $COUNTER -ge $MAX_WAIT ]; then
-              echo "Server failed to start within ${MAX_WAIT} seconds"
-              echo "Server log:"
-              cat /tmp/weed_policy_test_server.log
-              kill $SERVER_PID 2>/dev/null || true
-              exit 1
-            fi
-          done
-          
-          echo "Server is ready!"
-          
-          # Trap to ensure server is killed on exit
-          trap "kill $SERVER_PID 2>/dev/null || true" EXIT
-          
-          # Run the tests
-          go test -v -timeout 15m -run TestS3PolicyVariables ./...
-
-      - name: Show service logs on failure
-        if: failure()
-        working-directory: test/s3/iam
-        run: |
-          echo "=== Service Logs ==="
-          if [ -f /tmp/weed_policy_test_server.log ]; then
-            echo "--- Last 100 lines of Server Log ---"
-            tail -100 /tmp/weed_policy_test_server.log
-          fi
-          echo ""
-          echo "=== Process Information ==="
-          ps aux | grep -E "(weed|test)" || true
-          netstat -tlnp | grep -E "(8333|8888|9333|8080)" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-policy-variables-test-logs
-          path: /tmp/weed_policy_test_server.log
-          retention-days: 5
-
-  # S3 Policy Enforcement Integration Tests
-  s3-policy-enforcement-tests:
-    name: S3 Policy Enforcement Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-    strategy:
-      matrix:
-        test-case: ["basic-policy", "contextual-policy", "advanced-policy"]
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run S3 Policy Enforcement Tests - ${{ matrix.test-case }}
-        timeout-minutes: 25
-        working-directory: test/s3/iam
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          df -h
-          
-          echo "=== Starting S3 Policy Enforcement Tests (${{ matrix.test-case }}) ==="
-          
-          export WEED_BINARY=$(which weed)
-          export TEST_TIMEOUT=20m
-          
-          # Kill any existing weed server on port 8333
-          if lsof -Pi :8333 -sTCP:LISTEN -t >/dev/null 2>&1 ; then
-            kill $(lsof -t -i:8333) 2>/dev/null || true
-            sleep 2
-          fi
-          
-          # Start weed server with IAM configuration
-          echo "Starting weed server with IAM configuration..."
-          $WEED_BINARY server \
-            -s3 \
-            -s3.port=8333 \
-            -s3.iam.config="$(pwd)/test_iam_config.json" \
-            -filer \
-            -volume.max=0 \
-            -master.volumeSizeLimitMB=100 \
-            -s3.allowDeleteBucketNotEmpty=true \
-            > /tmp/weed_policy_enforcement_${{ matrix.test-case }}.log 2>&1 &
-          
-          SERVER_PID=$!
-          echo "Server started with PID: $SERVER_PID"
-          
-          # Wait for server to be ready
-          echo "Waiting for server to be ready..."
-          MAX_WAIT=30
-          COUNTER=0
-          while ! curl -s http://localhost:8333/status > /dev/null 2>&1; do
-            sleep 1
-            COUNTER=$((COUNTER + 1))
-            if [ $COUNTER -ge $MAX_WAIT ]; then
-              echo "Server failed to start within ${MAX_WAIT} seconds"
-              cat /tmp/weed_policy_enforcement_${{ matrix.test-case }}.log
-              kill $SERVER_PID 2>/dev/null || true
-              exit 1
-            fi
-          done
-          
-          echo "Server is ready!"
-          
-          # Trap to ensure server is killed on exit
-          trap "kill $SERVER_PID 2>/dev/null || true" EXIT
-          
-          # Run tests based on test case
-          case "${{ matrix.test-case }}" in
-            "basic-policy")
-              echo "Running basic policy enforcement tests..."
-              go test -v -timeout 20m -run "TestS3IAMBucketPolicy|TestS3IAMPolicyEnforcement" ./...
-              ;;
-            "contextual-policy")
-              echo "Running contextual policy tests..."
-              go test -v -timeout 20m -run "TestS3PolicyVariables|TestS3IAMContextual" ./...
-              ;;
-            "advanced-policy")
-              echo "Running advanced policy tests..."
-              go test -v -timeout 20m -run "TestS3IAMMultipart|TestS3IAMPresigned" ./...
-              ;;
-            *)
-              echo "Unknown test case: ${{ matrix.test-case }}"
-              exit 1
-              ;;
-          esac
-
-      - name: Show service logs on failure
-        if: failure()
-        working-directory: test/s3/iam
-        run: |
-          echo "=== Service Logs ==="
-          if [ -f /tmp/weed_policy_enforcement_${{ matrix.test-case }}.log ]; then
-            echo "--- Last 100 lines of Server Log ---"
-            tail -100 /tmp/weed_policy_enforcement_${{ matrix.test-case }}.log
-          fi
-          echo ""
-          echo "=== Process Information ==="
-          ps aux | grep -E "(weed|test)" || true
-          netstat -tlnp | grep -E "(8333|8888|9333|8080)" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-policy-enforcement-logs-${{ matrix.test-case }}
-          path: /tmp/weed_policy_enforcement_${{ matrix.test-case }}.log
-          retention-days: 5
-
-  # Trusted Proxy Detection Tests
-  trusted-proxy-tests:
-    name: Trusted Proxy Detection Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run Trusted Proxy Tests
-        timeout-minutes: 15
-        working-directory: test/s3/iam
-        run: |
-          set -x
-          echo "=== Running Trusted Proxy Detection Tests ==="
-          
-          export WEED_BINARY=$(which weed)
-          
-          # Kill any existing weed server on port 8333
-          if lsof -Pi :8333 -sTCP:LISTEN -t >/dev/null 2>&1 ; then
-            kill $(lsof -t -i:8333) 2>/dev/null || true
-            sleep 2
-          fi
-          
-          # Start weed server
-          echo "Starting weed server..."
-          $WEED_BINARY server \
-            -s3 \
-            -s3.port=8333 \
-            -s3.iam.config="$(pwd)/test_iam_config.json" \
-            -filer \
-            -volume.max=0 \
-            -master.volumeSizeLimitMB=100 \
-            -s3.allowDeleteBucketNotEmpty=true \
-            > /tmp/weed_proxy_test.log 2>&1 &
-          
-          SERVER_PID=$!
-          echo "Server started with PID: $SERVER_PID"
-          
-          # Wait for server to be ready
-          echo "Waiting for server to be ready..."
-          MAX_WAIT=30
-          COUNTER=0
-          while ! curl -s http://localhost:8333/status > /dev/null 2>&1; do
-            sleep 1
-            COUNTER=$((COUNTER + 1))
-            if [ $COUNTER -ge $MAX_WAIT ]; then
-              echo "Server failed to start within ${MAX_WAIT} seconds"
-              kill $SERVER_PID 2>/dev/null || true
-              exit 1
-            fi
-          done
-          
-          # Trap to ensure server is killed on exit
-          trap "kill $SERVER_PID 2>/dev/null || true" EXIT
-          
-          # Run proxy tests
-          go test -v -timeout 10m -run "TestTrustedProxy|TestPrivateIP" ./...
-
-      - name: Show service logs on failure
-        if: failure()
-        run: |
-          echo "=== Service Logs ==="
-          if [ -f /tmp/weed_proxy_test.log ]; then
-            echo "--- Last 100 lines of Server Log ---"
-            tail -100 /tmp/weed_proxy_test.log
-          fi
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: trusted-proxy-test-logs
-          path: /tmp/weed_proxy_test.log
-          retention-days: 3
-
-  # S3 Policy Shell Integration Tests
-  s3-policy-shell-tests:
-    name: S3 Policy Shell Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run S3 Policy Shell Tests
-        timeout-minutes: 10
-        working-directory: test/s3/policy
-        run: |
-          set -x
-          echo "=== Running S3 Policy Shell Tests ==="
-
-          # Set WEED_BINARY to use the installed version (though test uses 'weed' command)
-          export WEED_BINARY=$(which weed)
-          export PATH=$PATH:$(dirname $WEED_BINARY)
-
-          go test -v -timeout 10m ./...

.github/workflows/s3-proxy-signature-tests.yml

@@ -1,143 +0,0 @@
-name: "S3 Proxy Signature Tests"
-
-on:
-  push:
-    branches: [ master ]
-    paths:
-      - 'weed/s3api/**'
-      - 'weed/server/**'
-      - 'test/s3/proxy_signature/**'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/s3-proxy-signature-tests.yml'
-  pull_request:
-    branches: [ master ]
-    paths:
-      - 'weed/s3api/**'
-      - 'weed/server/**'
-      - 'test/s3/proxy_signature/**'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/s3-proxy-signature-tests.yml'
-
-concurrency:
-  group: ${{ github.head_ref || github.ref }}/s3-proxy-signature-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  proxy-signature-tests:
-    name: S3 Proxy Signature Verification Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    steps:
-      - name: Check out code into the Go module directory
-        uses: actions/checkout@v7
-
-      - name: Set up Go 1.x
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Configure Docker Hub mirror
-        run: |
-          echo '{"registry-mirrors": ["https://mirror.gcr.io"]}' | sudo tee /etc/docker/daemon.json
-          sudo systemctl restart docker
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-
-      - name: Build SeaweedFS binary for Linux
-        run: |
-          set -x
-          CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -buildvcs=false -v -o test/s3/proxy_signature/weed ./weed
-
-      - name: Run S3 Proxy Signature Tests
-        timeout-minutes: 10
-        working-directory: test/s3/proxy_signature
-        run: |
-          set -x
-          echo "Starting Docker Compose services..."
-          docker compose up -d --build
-          
-          # Check if containers are running
-          echo "Checking container status..."
-          docker compose ps
-          
-          # Wait for services to be ready
-          echo "Waiting for nginx proxy to be ready..."
-          PROXY_READY=0
-          for i in $(seq 1 30); do
-            if curl -s http://localhost:9000/ > /dev/null 2>&1; then
-              echo "Proxy is ready"
-              PROXY_READY=1
-              break
-            fi
-            echo "Waiting for proxy... ($i/30)"
-            sleep 1
-          done
-          if [ $PROXY_READY -eq 0 ]; then
-            echo "ERROR: Proxy failed to become ready after 30 seconds"
-            echo "Docker compose logs:"
-            docker compose logs --no-color || true
-            exit 1
-          fi
-          
-          # Wait for SeaweedFS to be ready
-          echo "Waiting for SeaweedFS S3 gateway to be ready via proxy..."
-          S3_READY=0
-          for i in $(seq 1 30); do
-            # Check logs first for the readiness line. weed mini's progress
-            # board prints "  S3           ready (Xs)"; older builds and the
-            # standalone S3 binary log "S3 (gateway|service) ... ready".
-            if docker compose logs seaweedfs 2>&1 | grep -qE "S3 (gateway|service).*(started|ready)|S3[[:space:]]+ready"; then
-              echo "SeaweedFS S3 gateway is ready"
-              S3_READY=1
-              break
-            fi
-            # Fallback: check headers via proxy (which is already ready)
-            if curl -s -I http://localhost:9000/ | grep -qi "SeaweedFS"; then
-              echo "SeaweedFS S3 gateway is responding via proxy"
-              S3_READY=1
-              break
-            fi
-            echo "Waiting for S3 gateway... ($i/30)"
-            sleep 1
-          done
-          if [ $S3_READY -eq 0 ]; then
-            echo "ERROR: SeaweedFS S3 gateway failed to become ready after 30 seconds"
-            echo "Latest seaweedfs logs:"
-            docker compose logs --no-color --tail 20 seaweedfs || true
-            exit 1
-          fi
-          
-          # Run the test script inside AWS CLI container
-          echo "Running test script..."
-          docker run --rm --network host \
-            --entrypoint bash \
-            amazon/aws-cli:latest \
-            -c "$(cat test.sh)"
-          
-          TEST_RESULT=$?
-          
-          # Cleanup
-          docker compose down
-          
-          exit $TEST_RESULT
-
-      - name: Cleanup on failure
-        if: failure()
-        working-directory: test/s3/proxy_signature
-        run: |
-          echo "Cleaning up Docker containers..."
-          ls -al weed || true
-          ldd weed || true
-          echo "Docker compose logs:"
-          docker compose logs --no-color || true
-          echo "Container status before cleanup:"
-          docker ps -a
-          echo "Stopping services..."
-          docker compose down || true

.github/workflows/s3-sdk-v2-routing-tests.yml

@@ -1,110 +0,0 @@
-name: "S3 SDK V2 Route Disambiguation Tests"
-
-on:
-  push:
-    branches: [ master ]
-    paths:
-      - 'weed/s3api/**'
-      - 'test/s3/sdk_v2_routing/**'
-      - '.github/workflows/s3-sdk-v2-routing-tests.yml'
-  pull_request:
-    branches: [ master ]
-    paths:
-      - 'weed/s3api/**'
-      - 'test/s3/sdk_v2_routing/**'
-      - '.github/workflows/s3-sdk-v2-routing-tests.yml'
-
-concurrency:
-  group: ${{ github.head_ref || github.ref }}/s3-sdk-v2-routing-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  s3-sdk-v2-routing-tests:
-    name: S3 SDK V2 Routing Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-
-      - name: Install SeaweedFS
-        run: |
-          cd weed && go install -buildvcs=false
-
-      - name: Start weed mini (S3 on :8333)
-        # Pins the regression for issue #9559: AWS SDK V2 / Hadoop s3a
-        # listing a bucket literally named "buckets" must get an XML
-        # ListObjectsV2 response, not the JSON ListTableBuckets body
-        # served by the S3 Tables REST endpoint on the same path.
-        run: |
-          mkdir -p /tmp/seaweedfs-sdk-v2-routing
-          cat > /tmp/seaweedfs-sdk-v2-routing-s3.json <<'JSON'
-          {
-            "identities": [
-              {
-                "name": "admin",
-                "credentials": [
-                  {"accessKey": "some_access_key1", "secretKey": "some_secret_key1"}
-                ],
-                "actions": ["Admin", "Read", "Write"]
-              }
-            ]
-          }
-          JSON
-          AWS_ACCESS_KEY_ID=some_access_key1 \
-          AWS_SECRET_ACCESS_KEY=some_secret_key1 \
-            weed mini \
-              -dir=/tmp/seaweedfs-sdk-v2-routing \
-              -s3.port=8333 \
-              -s3.config=/tmp/seaweedfs-sdk-v2-routing-s3.json \
-              -ip=127.0.0.1 \
-              > /tmp/weed-mini.log 2>&1 &
-          echo $! > /tmp/weed-mini.pid
-
-          for i in $(seq 1 30); do
-            if curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:8333/ | grep -qE "^(200|403)$"; then
-              echo "weed mini is ready"
-              exit 0
-            fi
-            sleep 1
-          done
-          echo "weed mini failed to start within 30s"
-          tail -50 /tmp/weed-mini.log
-          exit 1
-
-      - name: Run SDK V2 routing tests
-        env:
-          S3_ENDPOINT: http://127.0.0.1:8333
-          AWS_ACCESS_KEY_ID: some_access_key1
-          AWS_SECRET_ACCESS_KEY: some_secret_key1
-          AWS_REGION: us-east-1
-        run: go test -v -timeout=5m ./test/s3/sdk_v2_routing/...
-
-      - name: Stop weed mini
-        if: always()
-        run: |
-          if [ -f /tmp/weed-mini.pid ]; then
-            kill "$(cat /tmp/weed-mini.pid)" 2>/dev/null || true
-          fi
-
-      - name: Show server log on failure
-        if: failure()
-        run: |
-          echo "=== weed mini log (last 200 lines) ==="
-          tail -n 200 /tmp/weed-mini.log 2>/dev/null || echo "no log available"
-
-      - name: Archive log
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-sdk-v2-routing-server-log
-          path: /tmp/weed-mini.log
-          retention-days: 3

.github/workflows/s3-snowflake-tests.yml

@@ -1,106 +0,0 @@
-name: "Snowflake S3Compat API tests"
-
-on:
-  push:
-    branches: [ master ]
-    paths:
-      - 'weed/s3api/**'
-      - 'weed/filer/**'
-      - 'weed/server/**'
-      - 'weed/iam/**'
-      - 'weed/command/**'
-      - 'weed/storage/**'
-      - 'weed/operation/**'
-      - 'weed/wdclient/**'
-      - 'weed/cluster/**'
-      - 'weed/pb/**'
-      - 'test/s3/snowflake/**'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/s3-snowflake-tests.yml'
-  pull_request:
-    branches: [ master ]
-    paths:
-      - 'weed/s3api/**'
-      - 'weed/filer/**'
-      - 'weed/server/**'
-      - 'weed/iam/**'
-      - 'weed/command/**'
-      - 'weed/storage/**'
-      - 'weed/operation/**'
-      - 'weed/wdclient/**'
-      - 'weed/cluster/**'
-      - 'weed/pb/**'
-      - 'test/s3/snowflake/**'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/s3-snowflake-tests.yml'
-
-concurrency:
-  group: ${{ github.event.pull_request.number || github.ref }}/s3-snowflake-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  snowflake-s3compat-tests:
-    name: Snowflake S3Compat API tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-    env:
-      WORK_DIR: /tmp/seaweedfs-snowflake-tests
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Set up Java
-        uses: actions/setup-java@v6
-        with:
-          java-version: '17'
-          distribution: 'temurin'
-          cache: 'maven'
-
-      - name: Install SeaweedFS
-        run: |
-          cd weed
-          go install -buildvcs=false
-          weed version
-
-      - name: Run Snowflake S3Compat API tests
-        timeout-minutes: 20
-        run: |
-          # Starts weed server, creates the buckets/objects the suite needs,
-          # clones the upstream suite, and runs mvn -Dtest=S3CompatApiTest.
-          bash test/s3/snowflake/run.sh
-
-      - name: Show logs on failure
-        if: failure()
-        run: |
-          echo "=== SeaweedFS Server Log ==="
-          tail -200 "$WORK_DIR/weed.log" || echo "No server log"
-          echo ""
-          echo "=== Surefire results ==="
-          cat "$WORK_DIR"/snowflake-s3compat-api-test-suite/s3compatapi/target/surefire-reports/*.txt 2>/dev/null || echo "No surefire reports"
-
-      - name: Upload test results
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: snowflake-s3compat-surefire-reports
-          path: /tmp/seaweedfs-snowflake-tests/snowflake-s3compat-api-test-suite/s3compatapi/target/surefire-reports/
-          retention-days: 14
-
-      - name: Cleanup
-        if: always()
-        run: |
-          pkill -9 -f "weed server" || true
-          rm -rf "$WORK_DIR" || true

.github/workflows/s3-spark-tests.yml

@@ -1,85 +0,0 @@
-name: "S3 Spark Integration Tests"
-
-on:
-  pull_request:
-    paths:
-      - 'weed/s3api/**'
-      - 'weed/filer/**'
-      - 'test/s3/spark/**'
-      - 'test/s3tables/testutil/**'
-      - '.github/workflows/s3-spark-tests.yml'
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.head_ref }}/s3-spark-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  s3-spark-issue-repro-tests:
-    name: S3 Spark Issue Reproduction Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 45
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Configure Docker Hub mirror
-        run: |
-          echo '{"registry-mirrors": ["https://mirror.gcr.io"]}' | sudo tee /etc/docker/daemon.json
-          sudo systemctl restart docker
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false ./weed
-
-      - name: Pre-pull Spark image
-        run: |
-          pull() { for i in 1 2 3; do docker pull "$1" && return 0; sleep 15; done; return 1; }
-          pull apache/spark:3.5.1
-
-      - name: Run S3 Spark integration tests
-        working-directory: test/s3/spark
-        timeout-minutes: 35
-        run: |
-          set -x
-          set -o pipefail
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          df -h
-          echo "=== Starting S3 Spark Integration Tests ==="
-
-          go test -v -timeout 30m . 2>&1 | tee test-output.log || {
-            echo "S3 Spark integration tests failed"
-            exit 1
-          }
-
-      - name: Show test output on failure
-        if: failure()
-        working-directory: test/s3/spark
-        run: |
-          echo "=== Test Output ==="
-          if [ -f test-output.log ]; then
-            tail -200 test-output.log
-          fi
-
-          echo "=== Process information ==="
-          ps aux | grep -E "(weed|test|docker|spark)" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-spark-test-logs
-          path: test/s3/spark/test-output.log
-          retention-days: 3

.github/workflows/s3-sse-tests.yml

@@ -1,401 +0,0 @@
-name: "S3 SSE Tests"
-
-on:
-  pull_request:
-    paths:
-      - 'weed/s3api/s3_sse_*.go'
-      - 'weed/s3api/s3api_object_handlers.go'
-      - 'weed/s3api/s3api_object_handlers_put.go'
-      - 'weed/s3api/s3api_object_handlers_copy*.go'
-      - 'weed/server/filer_server_handlers_*.go'
-      - 'weed/kms/**'
-      - 'test/s3/sse/**'
-      - '.github/workflows/s3-sse-tests.yml'
-  push:
-    branches: [ master, main ]
-    paths:
-      - 'weed/s3api/s3_sse_*.go'
-      - 'weed/s3api/s3api_object_handlers.go'
-      - 'weed/s3api/s3api_object_handlers_put.go'
-      - 'weed/s3api/s3api_object_handlers_copy*.go'
-      - 'weed/server/filer_server_handlers_*.go'
-      - 'weed/kms/**'
-      - 'test/s3/sse/**'
-  
-concurrency:
-  group: ${{ github.head_ref }}/s3-sse-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-defaults:
-  run:
-    working-directory: weed
-
-jobs:
-  s3-sse-integration-tests:
-    name: S3 SSE Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-    strategy:
-      matrix:
-        test-type: ["quick", "comprehensive"]
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run S3 SSE Integration Tests - ${{ matrix.test-type }}
-        timeout-minutes: 25
-        working-directory: test/s3/sse
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          df -h
-          echo "=== Starting SSE Tests ==="
-          
-          # Run tests with automatic server management
-          # The test-with-server target handles server startup/shutdown automatically
-          if [ "${{ matrix.test-type }}" = "quick" ]; then
-            # Quick tests - basic SSE-C and SSE-KMS functionality + Range requests
-            make test-with-server TEST_PATTERN="TestSSECIntegrationBasic|TestSSEKMSIntegrationBasic|TestSimpleSSECIntegration|.*RangeRequestsServerBehavior"
-          else
-            # Comprehensive tests - SSE-C/KMS functionality plus cross-SSE copy.
-            # The copy-operation tests (`.*ObjectCopyIntegration`, `TestCrossSSECopy`,
-            # `TestSSEMultipartCopy`) were excluded for a long time as "pre-existing
-            # SSE-C issues" (#9281); fixed and brought back into CI as part of the
-            # same change that fixed them.
-            make test-with-server TEST_PATTERN="TestSSECIntegrationBasic|TestSSECIntegrationVariousDataSizes|TestSSEKMSIntegrationBasic|TestSSEKMSIntegrationVariousDataSizes|.*Multipart.*Integration|TestSimpleSSECIntegration|.*RangeRequestsServerBehavior|.*ObjectCopyIntegration|TestCrossSSECopy|TestSSEMultipartCopy"
-          fi
-
-      - name: Show server logs on failure
-        if: failure()
-        working-directory: test/s3/sse
-        run: |
-          echo "=== Server Logs ==="
-          if [ -f weed-test.log ]; then
-            echo "Last 100 lines of server logs:"
-            tail -100 weed-test.log
-          else
-            echo "No server log file found"
-          fi
-          
-          echo "=== Test Environment ==="
-          ps aux | grep -E "(weed|test)" || true
-          netstat -tlnp | grep -E "(8333|9333|8080|8888)" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-sse-test-logs-${{ matrix.test-type }}
-          path: test/s3/sse/weed-test*.log
-          retention-days: 3
-
-  s3-sse-compatibility:
-    name: S3 SSE Compatibility Test
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run Core SSE Compatibility Test (AWS S3 equivalent)
-        timeout-minutes: 15
-        working-directory: test/s3/sse
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          
-          # Run the specific tests that validate AWS S3 SSE compatibility - both SSE-C and SSE-KMS basic functionality plus Range requests
-          make test-with-server TEST_PATTERN="TestSSECIntegrationBasic|TestSSEKMSIntegrationBasic|.*RangeRequestsServerBehavior" || {
-            echo "❌ SSE compatibility test failed, checking logs..."
-            if [ -f weed-test.log ]; then
-              echo "=== Server logs ==="
-              tail -100 weed-test.log
-            fi
-            echo "=== Process information ==="
-            ps aux | grep -E "(weed|test)" || true
-            exit 1
-          }
-
-      - name: Upload server logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-sse-compatibility-logs
-          path: test/s3/sse/weed-test*.log
-          retention-days: 3
-
-  s3-sse-metadata-persistence:
-    name: S3 SSE Metadata Persistence Test
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run SSE Metadata Persistence Test
-        timeout-minutes: 15
-        working-directory: test/s3/sse
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          
-          # Run the specific test that would catch filer metadata storage bugs
-          # This test validates that encryption metadata survives the full PUT/GET cycle
-          make test-metadata-persistence || {
-            echo "❌ SSE metadata persistence test failed, checking logs..."
-            if [ -f weed-test.log ]; then
-              echo "=== Server logs ==="
-              tail -100 weed-test.log
-            fi
-            echo "=== Process information ==="
-            ps aux | grep -E "(weed|test)" || true
-            exit 1
-          }
-
-      - name: Upload server logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-sse-metadata-persistence-logs
-          path: test/s3/sse/weed-test*.log
-          retention-days: 3
-
-  s3-sse-copy-operations:
-    name: S3 SSE Copy Operations Test  
-    runs-on: ubuntu-22.04
-    timeout-minutes: 25
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run SSE Copy Operations Tests
-        timeout-minutes: 20
-        working-directory: test/s3/sse
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          
-          # Run tests that validate SSE copy operations and cross-encryption scenarios
-          echo "🚀 Running SSE copy operations tests..."
-          echo "📋 Note: SSE-C copy operations have pre-existing functionality gaps"
-          echo "    Cross-encryption copy security fix has been implemented and maintained"
-          
-          # Skip SSE-C copy operations due to pre-existing HTTP 500 errors
-          # The critical security fix for cross-encryption (SSE-C → SSE-KMS) has been preserved
-          echo "⏭️  Skipping SSE copy operations tests due to known limitations:"
-          echo "   - SSE-C copy operations: HTTP 500 errors (pre-existing functionality gap)"
-          echo "   - Cross-encryption security fix: ✅ Implemented and tested (forces streaming copy)"
-          echo "   - These limitations are documented as pre-existing issues"
-          exit 0  # Job succeeds with security fix preserved and limitations documented
-
-      - name: Upload server logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-sse-copy-operations-logs
-          path: test/s3/sse/weed-test*.log
-          retention-days: 3
-
-  s3-sse-multipart:
-    name: S3 SSE Multipart Upload Test
-    runs-on: ubuntu-22.04
-    timeout-minutes: 25
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run SSE Multipart Upload Tests
-        timeout-minutes: 20
-        working-directory: test/s3/sse
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          
-          # Multipart tests - Document known architectural limitations
-          echo "🚀 Running multipart upload tests..."
-          echo "📋 Note: SSE-KMS multipart upload has known architectural limitation requiring per-chunk metadata storage"
-          echo "    SSE-C multipart tests will be skipped due to pre-existing functionality gaps"
-          
-          # Test SSE-C basic multipart (skip advanced multipart that fails with HTTP 500)
-          # Skip SSE-KMS multipart due to architectural limitation (each chunk needs independent metadata)
-          echo "⏭️  Skipping multipart upload tests due to known limitations:"
-          echo "   - SSE-C multipart GET operations: HTTP 500 errors (pre-existing functionality gap)"  
-          echo "   - SSE-KMS multipart decryption: Requires per-chunk SSE metadata architecture changes"
-          echo "   - These limitations are documented and require future architectural work"
-          exit 0  # Job succeeds with clear documentation of known limitations
-
-      - name: Upload server logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-sse-multipart-logs
-          path: test/s3/sse/weed-test*.log
-          retention-days: 3
-
-  s3-sse-performance:
-    name: S3 SSE Performance Test
-    runs-on: ubuntu-22.04
-    timeout-minutes: 35
-    # Only run performance tests on master branch pushes to avoid overloading PR testing
-    if: github.event_name == 'push' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main')
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run S3 SSE Performance Tests
-        timeout-minutes: 30
-        working-directory: test/s3/sse
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          
-          # Run performance tests with various data sizes
-          make perf || {
-            echo "❌ SSE performance test failed, checking logs..."
-            if [ -f weed-test.log ]; then
-              echo "=== Server logs ==="
-              tail -200 weed-test.log
-            fi
-            make clean
-            exit 1
-          }
-          make clean
-
-      - name: Upload performance test logs
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-sse-performance-logs
-          path: test/s3/sse/weed-test*.log
-          retention-days: 7
-
-  s3-volume-encryption:
-    name: S3 Volume Encryption Test
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run S3 Volume Encryption Integration Tests
-        timeout-minutes: 15
-        working-directory: test/s3/sse
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          
-          # Run volume encryption tests with -s3.encryptVolumeData flag
-          echo "🚀 Running S3 volume encryption integration tests..."
-          make test-volume-encryption || {
-            echo "❌ Volume encryption tests failed, checking logs..."
-            if [ -f /tmp/seaweedfs-sse-mini.log ]; then
-              echo "=== Server logs ==="
-              tail -100 /tmp/seaweedfs-sse-mini.log
-            fi
-            echo "=== Process information ==="
-            ps aux | grep -E "(weed|test)" || true
-            exit 1
-          }
-
-      - name: Upload server logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-volume-encryption-logs
-          path: /tmp/seaweedfs-sse-*.log
-          retention-days: 3
-

.github/workflows/samba-integration.yml

@@ -1,120 +0,0 @@
-name: "Samba on FUSE Integration"
-
-on:
-  push:
-    branches: [ master, main ]
-    paths:
-      - 'weed/mount/**'
-      - 'weed/filer/**'
-      - 'weed/cluster/**'
-      - 'test/samba/**'
-      - '.github/workflows/samba-integration.yml'
-  pull_request:
-    branches: [ master, main ]
-    paths:
-      - 'weed/mount/**'
-      - 'weed/filer/**'
-      - 'weed/cluster/**'
-      - 'test/samba/**'
-      - '.github/workflows/samba-integration.yml'
-  workflow_dispatch:
-
-concurrency:
-  group: samba-integration/${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  samba-integration:
-    name: samba-integration
-    runs-on: ubuntu-22.04
-    timeout-minutes: 45
-
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v7
-
-    - name: Set up Go
-      uses: actions/setup-go@v7
-      with:
-        go-version-file: 'go.mod'
-
-    - name: Start local Docker registry
-      run: docker run -d --restart=always -p 5000:5000 --name registry registry:2
-
-    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v4
-      with:
-        driver-opts: network=host
-
-    - name: Build weed race binary
-      run: |
-        cd docker
-        make binary_race
-
-    - name: Build SeaweedFS e2e image
-      uses: docker/build-push-action@v7
-      with:
-        context: docker
-        file: docker/Dockerfile.e2e
-        tags: localhost:5000/chrislusf/seaweedfs:e2e
-        push: true
-        cache-from: type=gha,scope=samba-e2e
-        cache-to: type=gha,mode=max,scope=samba-e2e
-
-    - name: Tag e2e image for docker compose
-      run: |
-        docker pull localhost:5000/chrislusf/seaweedfs:e2e
-        docker tag localhost:5000/chrislusf/seaweedfs:e2e chrislusf/seaweedfs:e2e
-
-    - name: Build samba image
-      uses: docker/build-push-action@v7
-      with:
-        context: test/samba
-        build-contexts: |
-          chrislusf/seaweedfs:e2e=docker-image://localhost:5000/chrislusf/seaweedfs:e2e
-        tags: localhost:5000/chrislusf/seaweedfs:samba
-        push: true
-        cache-from: type=gha,scope=samba-harness
-        cache-to: type=gha,mode=max,scope=samba-harness
-
-    - name: Tag samba image for docker compose
-      run: |
-        docker pull localhost:5000/chrislusf/seaweedfs:samba
-        docker tag localhost:5000/chrislusf/seaweedfs:samba chrislusf/seaweedfs:samba
-
-    - name: Start SeaweedFS cluster and Samba
-      run: |
-        docker compose -f test/samba/docker-compose.yml up --wait
-
-    - name: Run Samba test battery
-      run: |
-        set -o pipefail
-        docker compose -f test/samba/docker-compose.yml exec -T samba \
-          /run_inside_container.sh 2>&1 | tee /tmp/samba-output.log
-
-    - name: Collect logs
-      if: always()
-      run: |
-        mkdir -p /tmp/samba-docker-logs
-        for svc in master volume filer samba; do
-          docker compose -f test/samba/docker-compose.yml logs "$svc" \
-            > "/tmp/samba-docker-logs/${svc}.log" 2>&1 || true
-        done
-
-    - name: Tear down
-      if: always()
-      run: |
-        docker compose -f test/samba/docker-compose.yml down -v
-
-    - name: Upload logs
-      if: always()
-      uses: actions/upload-artifact@v7
-      with:
-        name: samba-integration-results
-        path: |
-          /tmp/samba-output.log
-          /tmp/samba-docker-logs/
-        retention-days: 7

.github/workflows/sftp-tests.yml

@@ -1,93 +0,0 @@
-name: "SFTP Integration Tests"
-
-on:
-  push:
-    branches: [ master, main ]
-    paths:
-      - 'weed/sftpd/**'
-      - 'weed/command/sftp.go'
-      - 'test/sftp/**'
-      - '.github/workflows/sftp-tests.yml'
-  pull_request:
-    branches: [ master, main ]
-    paths:
-      - 'weed/sftpd/**'
-      - 'weed/command/sftp.go'
-      - 'test/sftp/**'
-      - '.github/workflows/sftp-tests.yml'
-
-concurrency:
-  group: ${{ github.head_ref }}/sftp-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-env:
-  TEST_TIMEOUT: '15m'
-
-jobs:
-  sftp-integration:
-    name: SFTP Integration Testing
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-    
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v7
-      
-    - name: Set up Go
-      uses: actions/setup-go@v7
-      with:
-        go-version-file: 'go.mod'
-        
-    - name: Install dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y openssh-client
-        
-    - name: Build SeaweedFS
-      run: |
-        cd weed
-        go build -o weed .
-        chmod +x weed
-        ./weed version
-        
-    - name: Run SFTP Integration Tests
-      run: |
-        cd test/sftp
-        
-        echo "🧪 Running SFTP integration tests..."
-        echo "============================================"
-        
-        # Install test dependencies
-        go mod download
-        
-        # Run all SFTP tests
-        go test -v -timeout=${{ env.TEST_TIMEOUT }} ./...
-        
-        echo "============================================"
-        echo "✅ SFTP integration tests completed"
-        
-    - name: Test Summary
-      if: always()
-      run: |
-        echo "## 🔐 SFTP Integration Test Summary" >> $GITHUB_STEP_SUMMARY
-        echo "" >> $GITHUB_STEP_SUMMARY
-        echo "### Test Coverage" >> $GITHUB_STEP_SUMMARY
-        echo "- ✅ **HomeDir Path Translation**: User home directory mapping (fixes #7470)" >> $GITHUB_STEP_SUMMARY
-        echo "- ✅ **File Operations**: Upload, download, delete" >> $GITHUB_STEP_SUMMARY
-        echo "- ✅ **Directory Operations**: Create, list, remove" >> $GITHUB_STEP_SUMMARY
-        echo "- ✅ **Large File Handling**: 1MB+ file support" >> $GITHUB_STEP_SUMMARY
-        echo "- ✅ **Path Edge Cases**: Unicode, trailing slashes, .. paths" >> $GITHUB_STEP_SUMMARY
-        echo "- ✅ **Admin Access**: Root user verification" >> $GITHUB_STEP_SUMMARY
-        echo "" >> $GITHUB_STEP_SUMMARY
-        echo "### Test Configuration" >> $GITHUB_STEP_SUMMARY
-        echo "| User | HomeDir | Permissions |" >> $GITHUB_STEP_SUMMARY
-        echo "|------|---------|-------------|" >> $GITHUB_STEP_SUMMARY
-        echo "| admin | / | Full access |" >> $GITHUB_STEP_SUMMARY
-        echo "| testuser | /sftp/testuser | Home directory only |" >> $GITHUB_STEP_SUMMARY
-        echo "| readonly | /public | Read-only |" >> $GITHUB_STEP_SUMMARY
-
-
-

.github/workflows/spark-integration-tests.yml

@@ -1,263 +0,0 @@
-name: Spark Integration Tests
-
-on:
-  push:
-    paths:
-      - 'test/java/spark/**'
-      - 'other/java/hdfs3/**'
-      - 'other/java/client/**'
-      - '.github/workflows/spark-integration-tests.yml'
-  pull_request:
-    paths:
-      - 'test/java/spark/**'
-      - 'other/java/hdfs3/**'
-      - 'other/java/client/**'
-      - '.github/workflows/spark-integration-tests.yml'
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  checks: write
-  pull-requests: write
-
-jobs:
-  spark-integration-tests:
-    name: Spark Integration Tests
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-    
-    steps:
-    # ========================================
-    # SETUP & BUILD
-    # ========================================
-    - name: Checkout code
-      uses: actions/checkout@v7
-
-    - name: Set up JDK 11
-      uses: actions/setup-java@v6
-      with:
-        java-version: '11'
-        distribution: 'temurin'
-        cache: maven
-
-    - name: Set up Go
-      uses: actions/setup-go@v7
-      with:
-        go-version-file: 'go.mod'
-
-    - name: Build SeaweedFS binary
-      run: |
-        echo "Building SeaweedFS binary (statically linked for Alpine)..."
-        cd weed
-        CGO_ENABLED=0 go build -o ../docker/weed
-        cd ../docker
-        ls -la weed filer.toml entrypoint.sh
-        file weed
-        echo "OK SeaweedFS binary built"
-
-    - name: Build SeaweedFS Java dependencies
-      run: |
-        echo "Building Java client..."
-        cd other/java/client
-        mvn clean install -U -DskipTests -Dgpg.skip=true -Dcentral.publishing.skip=true
-        echo "OK Java client built"
-        cd ../../..
-        
-        echo "Building HDFS3 client..."
-        cd other/java/hdfs3
-        mvn clean install -U -DskipTests -Dgpg.skip=true -Dcentral.publishing.skip=true
-        echo "OK HDFS3 client built"
-        echo ""
-        echo "All Java dependencies installed to ~/.m2/repository"
-
-    # ========================================
-    # SPARK INTEGRATION TESTS (DOCKER)
-    # ========================================
-    - name: Start SeaweedFS services for tests
-      working-directory: test/java/spark
-      run: |
-        echo "=== Starting SeaweedFS Services for Tests ==="
-        docker compose down -v || true
-        docker compose build --no-cache
-        docker compose up -d seaweedfs-master seaweedfs-volume seaweedfs-filer
-        
-        echo "Waiting for services..."
-        for i in {1..30}; do
-          if curl -f http://localhost:8888/ > /dev/null 2>&1; then
-            echo "OK SeaweedFS filer is ready!"
-            break
-          fi
-          if [ $i -eq 30 ]; then
-            echo "FAILED Services failed to start"
-            docker compose ps -a
-            docker compose logs
-            exit 1
-          fi
-          echo "Waiting... ($i/30)"
-          sleep 2
-        done
-        
-        curl -f http://localhost:9333/cluster/status || exit 1
-        echo "OK All services healthy"
-
-    - name: Prepare Maven repository for Docker
-      working-directory: test/java/spark
-      run: |
-        echo "Copying Maven artifacts for Docker container..."
-        mkdir -p .m2/repository/com
-        cp -r ~/.m2/repository/com/seaweedfs .m2/repository/com/
-        echo "OK Maven artifacts copied"
-
-    - name: Run Spark integration tests
-      working-directory: test/java/spark
-      run: |
-        echo "=== Running Spark Integration Tests ==="
-        docker compose up --abort-on-container-exit spark-tests
-        
-        echo ""
-        echo "=== Test Logs ==="
-        docker compose logs spark-tests | tail -100
-
-    - name: Stop test services
-      if: always()
-      working-directory: test/java/spark
-      run: docker compose down -v
-
-    - name: Upload test results
-      if: always()
-      uses: actions/upload-artifact@v7
-      with:
-        name: spark-test-results
-        path: test/java/spark/target/surefire-reports/
-        retention-days: 30
-
-    - name: Publish test report
-      if: always()
-      uses: dorny/test-reporter@v3
-      with:
-        name: Spark Test Results
-        path: test/java/spark/target/surefire-reports/*.xml
-        reporter: java-junit
-        fail-on-error: true
-
-    # ========================================
-    # SPARK EXAMPLE (HOST-BASED) - DISABLED
-    # Note: Host-based example doesn't work with Docker networking
-    # because master returns Docker hostnames (seaweedfs-volume)
-    # which are not resolvable from the host.
-    # The Docker-based tests above are sufficient.
-    # ========================================
-    - name: Cache Apache Spark
-      if: false && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
-      id: cache-spark
-      uses: actions/cache@v6
-      with:
-        path: spark-3.5.0-bin-hadoop3
-        key: spark-3.5.0-hadoop3
-
-    - name: Download Apache Spark
-      if: false && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && steps.cache-spark.outputs.cache-hit != 'true'
-      run: |
-        echo "Downloading Apache Spark 3.5.0..."
-        wget -q https://archive.apache.org/dist/spark/spark-3.5.0/spark-3.5.0-bin-hadoop3.tgz
-        tar xzf spark-3.5.0-bin-hadoop3.tgz
-        echo "OK Spark downloaded"
-
-    - name: Start SeaweedFS services for example
-      if: false && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
-      working-directory: test/java/spark
-      run: |
-        echo "=== Starting SeaweedFS Services for Example ==="
-        docker compose down -v || true
-        docker compose build --no-cache
-        docker compose up -d seaweedfs-master seaweedfs-volume seaweedfs-filer
-        
-        echo "Waiting for services..."
-        for i in {1..30}; do
-          if curl -f http://localhost:8888/ > /dev/null 2>&1; then
-            echo "OK SeaweedFS filer is ready!"
-            break
-          fi
-          if [ $i -eq 30 ]; then
-            echo "FAILED Services failed to start"
-            docker compose ps -a
-            docker compose logs
-            exit 1
-          fi
-          echo "Waiting... ($i/30)"
-          sleep 2
-        done
-        
-        curl -f http://localhost:9333/cluster/status || exit 1
-        echo "OK All services healthy"
-
-    - name: Clean target directory
-      if: false && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
-      working-directory: test/java/spark
-      run: |
-        # Force remove target directory to avoid permission issues
-        sudo rm -rf target || rm -rf target || true
-        echo "OK Target directory cleaned"
-
-    - name: Build project for example
-      if: false && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
-      working-directory: test/java/spark
-      run: mvn package -DskipTests
-
-    - name: Run Spark example application
-      if: false && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
-      working-directory: test/java/spark
-      run: |
-        echo "=== Running Spark Example Application ==="
-        export SPARK_HOME=$(pwd)/../../../spark-3.5.0-bin-hadoop3
-        $SPARK_HOME/bin/spark-submit \
-          --class seaweed.spark.SparkSeaweedFSExample \
-          --master local[2] \
-          --conf spark.hadoop.fs.seaweedfs.impl=seaweed.hdfs.SeaweedFileSystem \
-          --conf spark.hadoop.fs.seaweed.filer.host=localhost \
-          --conf spark.hadoop.fs.seaweed.filer.port=8888 \
-          --conf spark.hadoop.fs.seaweed.filer.port.grpc=18888 \
-          --conf spark.hadoop.fs.seaweed.replication="" \
-          target/seaweedfs-spark-integration-tests-1.0-SNAPSHOT.jar \
-          seaweedfs://localhost:8888/ci-spark-output
-        echo "OK Example completed"
-
-    - name: Verify example output
-      if: false && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
-      run: |
-        echo "Verifying output..."
-        curl -s http://localhost:8888/ci-spark-output/ || echo "Output listing unavailable"
-
-    - name: Stop example services
-      if: false && always() && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
-      working-directory: test/java/spark
-      run: docker compose down -v
-
-    # ========================================
-    # DIAGNOSTICS
-    # ========================================
-    - name: Display diagnostics on failure
-      if: failure()
-      working-directory: test/java/spark
-      run: |
-        echo "=== Container Status ==="
-        docker compose ps -a
-        echo ""
-        echo "=== Master Logs ==="
-        docker compose logs seaweedfs-master
-        echo ""
-        echo "=== Volume Logs ==="
-        docker compose logs seaweedfs-volume
-        echo ""
-        echo "=== Filer Logs ==="
-        docker compose logs seaweedfs-filer
-        echo ""
-        echo "=== Volume List ==="
-        docker compose exec -T seaweedfs-master weed shell <<EOF || echo "Failed"
-        volume.list
-        exit
-        EOF
-        echo ""
-        echo "=== Cluster Status ==="
-        curl -s http://localhost:9333/dir/status | jq '.' || curl -s http://localhost:9333/dir/status
-

.github/workflows/star_history.yml

@@ -1,74 +0,0 @@
----
-name: Star History
-
-on:
-  schedule:
-    - cron: "0 0 * * *"  # daily, 00:00 UTC
-  workflow_dispatch:
-
-permissions:
-  contents: write
-
-concurrency:
-  # Only one chart regeneration per branch at a time; a newer run on the same
-  # branch cancels an in-flight one so overlapping runs never conflict on
-  # note/star_history.svg during rebase. Scoped by ref so a manual run on
-  # another branch can't cancel the daily master update.
-  group: star-history-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  render:
-    name: Regenerate star history chart
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          # Full history so the chart commit can rebase onto a moved master.
-          fetch-depth: 0
-
-      - name: Set up Python
-        uses: actions/setup-python@v7
-        with:
-          python-version: "3.x"
-          cache: pip
-          cache-dependency-path: .github/scripts/star_history.py
-
-      - name: Install matplotlib
-        run: pip install matplotlib
-
-      - name: Render chart
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: python .github/scripts/star_history.py
-
-      - name: Commit if changed
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          if git diff --quiet -- note/star_history.svg; then
-            echo "No changes to the chart."
-            exit 0
-          fi
-          git add note/star_history.svg
-          git commit -m "docs: regenerate star history chart"
-          # Rebase and retry so a concurrent push to master doesn't lose the chart.
-          for attempt in 1 2 3 4 5; do
-            if [ "$attempt" -gt 1 ]; then
-              # Guard the rebase: a transient fetch error or conflict must not
-              # abort the fail-fast shell before the remaining attempts run.
-              if ! git pull --rebase origin "$GITHUB_REF_NAME"; then
-                echo "rebase failed (attempt ${attempt}); aborting and retrying"
-                git rebase --abort || true
-                continue
-              fi
-            fi
-            if git push origin HEAD:"$GITHUB_REF_NAME"; then
-              exit 0
-            fi
-            echo "push rejected (attempt ${attempt}); will rebase and retry"
-          done
-          echo "::error::could not push star history chart after retries"
-          exit 1

.github/workflows/telemetry-integration.yml

@@ -1,46 +0,0 @@
-name: Telemetry Integration Tests
-
-on:
-  push:
-    branches: [ master ]
-    paths:
-      - 'telemetry/**'
-      - 'weed/telemetry/**'
-      - '.github/workflows/telemetry-integration.yml'
-  pull_request:
-    branches: [ master ]
-    paths:
-      - 'telemetry/**'
-      - 'weed/telemetry/**'
-      - '.github/workflows/telemetry-integration.yml'
-
-permissions:
-  contents: read
-
-jobs:
-  telemetry-integration-test:
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v7
-
-    - name: Set up Go
-      uses: actions/setup-go@v7
-      with:
-        go-version-file: 'go.mod'
-
-    - name: Build telemetry server
-      run: cd telemetry/server && go build -o telemetry-server .
-
-    - name: Run telemetry integration test
-      run: go run telemetry/test/integration.go
-
-    - name: Upload test logs on failure
-      if: failure()
-      uses: actions/upload-artifact@v7
-      with:
-        name: telemetry-test-logs
-        path: telemetry-server-test.log
-        retention-days: 7

.github/workflows/terraform_ci.yml

@@ -1,80 +0,0 @@
-name: "terraform: validate and test modules"
-
-on:
-  push:
-    branches: [ master ]
-    paths: ['terraform/**', '.github/workflows/terraform_ci.yml']
-  pull_request:
-    branches: [ master ]
-    paths: ['terraform/**', '.github/workflows/terraform_ci.yml']
-
-permissions:
-  contents: read
-
-jobs:
-  validate:
-    name: fmt, validate, plan-level tests
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Set up OpenTofu
-        uses: opentofu/setup-opentofu@v2
-        with:
-          tofu_version: 1.12.1
-
-      - name: fmt check
-        working-directory: terraform
-        run: tofu fmt -recursive -check -diff
-
-      - name: validate core
-        working-directory: terraform/modules/core
-        run: |
-          tofu init -backend=false -input=false
-          tofu validate
-
-      - name: validate security
-        working-directory: terraform/modules/security
-        run: |
-          tofu init -backend=false -input=false
-          tofu validate
-
-      - name: plan-level tests (core)
-        working-directory: terraform/modules/core
-        run: tofu test
-
-      - name: validate examples
-        run: |
-          set -e
-          for ex in terraform/examples/*/; do
-            echo "== validate $ex =="
-            tofu -chdir="$ex" init -backend=false -input=false
-            tofu -chdir="$ex" validate
-          done
-
-  smoke:
-    name: local cluster smoke test (real weed)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: go.mod
-
-      - name: Build weed
-        run: go build -o "$RUNNER_TEMP/weed" ./weed
-
-      - name: Set up OpenTofu
-        uses: opentofu/setup-opentofu@v2
-        with:
-          tofu_version: 1.12.1
-
-      - name: Run local cluster harness
-        working-directory: terraform/test/local
-        run: WEED="$RUNNER_TEMP/weed" ./run_local_cluster.sh
-
-      - name: Run local mTLS cluster harness
-        working-directory: terraform/test/local-secure
-        run: WEED="$RUNNER_TEMP/weed" ./run_local_secure.sh

.github/workflows/test-s3-over-https-using-awscli.yml

@@ -1,123 +0,0 @@
-name: "test s3 over https using aws-cli"
-
-on:
-  push:
-    branches: [master, test-https-s3-awscli]
-    paths:
-      - 'weed/s3api/**'
-      - 'weed/server/**'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/test-s3-over-https-using-awscli.yml'
-  pull_request:
-    branches: [master, test-https-s3-awscli]
-    paths:
-      - 'weed/s3api/**'
-      - 'weed/server/**'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/test-s3-over-https-using-awscli.yml'
-
-env:
-  AWS_ACCESS_KEY_ID: some_access_key1
-  AWS_SECRET_ACCESS_KEY: some_secret_key1
-  AWS_ENDPOINT_URL: https://localhost:8443
-
-defaults:
-  run:
-    working-directory: weed
-
-jobs:
-  awscli-tests:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v7
-
-      - uses: actions/setup-go@v7
-        with:
-          go-version: ^1.26
-
-      - name: Build SeaweedFS
-        run: |
-          go build
-
-      - name: Start SeaweedFS
-        run: |
-          set -e
-          mkdir -p /tmp/data
-          ./weed -v=3 server -s3 -dir=/tmp/data -s3.config=../docker/compose/s3.json -master.peers=none > weed.log 2>&1 &
-          until curl -s http://localhost:8333/healthz > /dev/null; do sleep 1; done
-
-      - name: Setup Caddy
-        run: |
-          curl -fsSL "https://caddyserver.com/api/download?os=linux&arch=amd64" -o caddy
-          chmod +x caddy
-          ./caddy version
-          echo "{
-            auto_https disable_redirects
-            local_certs
-          }
-          localhost:8443 {
-            tls internal
-            reverse_proxy localhost:8333
-          }" > Caddyfile
-
-      - name: Start Caddy
-        run: |
-          ./caddy start
-          until curl -fsS --insecure https://localhost:8443/healthz > /dev/null; do sleep 1; done
-
-      - name: Create Bucket
-        run: |
-          aws --no-verify-ssl s3api create-bucket --bucket bucket
-
-      - name: Test PutObject
-        run: |
-          set -e
-          dd if=/dev/urandom of=generated bs=1M count=2
-          aws --no-verify-ssl s3api put-object --bucket bucket --key test-putobject --body generated
-          aws --no-verify-ssl s3api get-object --bucket bucket --key test-putobject downloaded
-          diff -q generated downloaded
-          rm -f generated downloaded
-
-      - name: Test Multi-part Upload
-        run: |
-          set -e
-          dd if=/dev/urandom of=generated bs=1M count=32
-          aws --no-verify-ssl s3 cp --no-progress generated s3://bucket/test-multipart
-          aws --no-verify-ssl s3 cp --no-progress s3://bucket/test-multipart downloaded
-          diff -q generated downloaded
-          rm -f generated downloaded
-
-      - name: Test GetObject with If-Match
-        run: |
-          set -e
-          dd if=/dev/urandom of=generated bs=1M count=32
-          ETAG=$(aws --no-verify-ssl s3api put-object --bucket bucket --key test-get-obj --body generated | jq -r .ETag)
-          # jq -r already removes quotes, so use ETAG directly (handles both simple and multipart ETags)
-          aws --no-verify-ssl s3api get-object --bucket bucket --key test-get-obj --if-match "$ETAG" downloaded
-          diff -q generated downloaded
-          rm -f generated downloaded
-
-      - name: Show server logs on failure
-        if: failure()
-        run: |
-          echo "========================================="
-          echo "SeaweedFS Server Logs"
-          echo "========================================="
-          # Note: weed.log is relative to working-directory (weed/)
-          if [ -f weed.log ]; then
-            cat weed.log
-          else
-            echo "No weed.log file found"
-          fi
-
-      - name: Upload server logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: seaweedfs-logs
-          # Note: actions don't use defaults.run.working-directory, so path is relative to workspace root
-          path: weed/weed.log
-          retention-days: 3

.github/workflows/tls-rotation-tests.yml

@@ -1,68 +0,0 @@
-name: "TLS Rotation Integration Tests"
-
-on:
-  push:
-    branches: [ master ]
-    paths:
-      - 'weed/**'
-      - 'test/tls_rotation/**'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/tls-rotation-tests.yml'
-  pull_request:
-    branches: [ master ]
-    paths:
-      - 'weed/**'
-      - 'test/tls_rotation/**'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/tls-rotation-tests.yml'
-
-permissions:
-  contents: read
-
-jobs:
-  tls-rotation-tests:
-    name: TLS Rotation Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
-    steps:
-    - name: Set up Go 1.x
-      uses: actions/setup-go@v7
-      with:
-        go-version: ^1.26
-      id: go
-
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v7
-
-    - name: Build weed binary
-      run: |
-        cd weed && go build -o weed .
-
-    - name: Run TLS Rotation Integration Tests
-      working-directory: test/tls_rotation
-      run: |
-        go test -v -count=1 -timeout 5m
-
-    - name: Collect server logs on failure
-      if: failure()
-      run: |
-        echo "Collecting master logs from temp directories..."
-        mkdir -p /tmp/tls-rotation-test-logs
-        find /tmp -maxdepth 1 -type d -name "TestMasterHTTPS*" 2>/dev/null | while read dir; do
-          if [ -d "$dir" ]; then
-            echo "Found test directory: $dir"
-            cp -r "$dir" /tmp/tls-rotation-test-logs/ 2>/dev/null || true
-          fi
-        done
-        echo "Collected logs:"
-        find /tmp/tls-rotation-test-logs -type f -name "*.log" 2>/dev/null || echo "No logs found"
-
-    - name: Archive logs
-      if: failure()
-      uses: actions/upload-artifact@v7
-      with:
-        name: tls-rotation-test-logs
-        path: /tmp/tls-rotation-test-logs/
-        retention-days: 14

.github/workflows/tus-tests.yml

@@ -1,110 +0,0 @@
-name: "TUS Protocol Tests"
-
-on:
-  pull_request:
-    paths:
-      - 'weed/server/**'
-      - 'weed/filer/**'
-      - 'test/tus/**'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/tus-tests.yml'
-
-concurrency:
-  group: ${{ github.head_ref || github.ref }}/tus-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-defaults:
-  run:
-    working-directory: weed
-
-jobs:
-  tus-integration-tests:
-    name: TUS Protocol Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-    
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run TUS Integration Tests
-        timeout-minutes: 15
-        working-directory: test/tus
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          df -h
-          echo "=== Starting TUS Tests ==="
-          
-          # Run tests with automatic server management
-          make test-with-server || {
-            echo "TUS integration tests failed, checking logs..."
-            if [ -f /tmp/seaweedfs-tus-filer.log ]; then
-              echo "=== Filer logs ==="
-              tail -100 /tmp/seaweedfs-tus-filer.log
-            fi
-            if [ -f /tmp/seaweedfs-tus-master.log ]; then
-              echo "=== Master logs ==="
-              tail -50 /tmp/seaweedfs-tus-master.log
-            fi
-            if [ -f /tmp/seaweedfs-tus-volume.log ]; then
-              echo "=== Volume logs ==="
-              tail -50 /tmp/seaweedfs-tus-volume.log
-            fi
-            exit 1
-          }
-
-      - name: Show server logs on failure
-        if: failure()
-        working-directory: test/tus
-        run: |
-          echo "=== Filer Server Logs ==="
-          if [ -f /tmp/seaweedfs-tus-filer.log ]; then
-            echo "Last 100 lines of filer logs:"
-            tail -100 /tmp/seaweedfs-tus-filer.log
-          else
-            echo "No filer log file found"
-          fi
-          
-          echo "=== Master Server Logs ==="
-          if [ -f /tmp/seaweedfs-tus-master.log ]; then
-            tail -50 /tmp/seaweedfs-tus-master.log
-          else
-            echo "No master log file found"
-          fi
-          
-          echo "=== Volume Server Logs ==="
-          if [ -f /tmp/seaweedfs-tus-volume.log ]; then
-            tail -50 /tmp/seaweedfs-tus-volume.log
-          else
-            echo "No volume log file found"
-          fi
-          
-          echo "=== Test Environment ==="
-          ps aux | grep -E "(weed|test)" || true
-          netstat -tlnp 2>/dev/null | grep -E "(18888|19333|18080)" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: tus-test-logs
-          path: |
-            /tmp/seaweedfs-tus-*.log
-          retention-days: 3

.github/workflows/vacuum-integration-tests.yml

@@ -1,68 +0,0 @@
-name: "Vacuum Integration Tests"
-
-on:
-  push:
-    branches: [ master ]
-    paths:
-      - 'weed/**'
-      - 'test/vacuum/**'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/vacuum-integration-tests.yml'
-  pull_request:
-    branches: [ master ]
-    paths:
-      - 'weed/**'
-      - 'test/vacuum/**'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/vacuum-integration-tests.yml'
-
-permissions:
-  contents: read
-
-jobs:
-  vacuum-integration-tests:
-    name: Vacuum Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    steps:
-    - name: Set up Go 1.x
-      uses: actions/setup-go@v7
-      with:
-        go-version: ^1.26
-      id: go
-
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v7
-
-    - name: Build weed binary
-      run: |
-        cd weed && go build -o weed .
-
-    - name: Run Vacuum Integration Tests
-      working-directory: test/vacuum
-      run: |
-        go test -v -timeout 10m
-
-    - name: Collect server logs on failure
-      if: failure()
-      run: |
-        echo "Collecting server logs from temp directories..."
-        mkdir -p /tmp/vacuum-test-logs
-        find /tmp -maxdepth 1 -type d -name "TestVacuum*" 2>/dev/null | while read dir; do
-          if [ -d "$dir" ]; then
-            echo "Found test directory: $dir"
-            cp -r "$dir" /tmp/vacuum-test-logs/ 2>/dev/null || true
-          fi
-        done
-        echo "Collected logs:"
-        find /tmp/vacuum-test-logs -type f -name "*.log" 2>/dev/null || echo "No logs found"
-
-    - name: Archive logs
-      if: failure()
-      uses: actions/upload-artifact@v7
-      with:
-        name: vacuum-integration-test-logs
-        path: /tmp/vacuum-test-logs/
-        retention-days: 14

.github/workflows/volume-server-integration-tests.yml

@@ -1,104 +0,0 @@
-name: "Volume Server Integration Tests"
-
-on:
-  pull_request:
-    branches: [ master ]
-    paths:
-      - 'test/volume_server/**'
-      - 'weed/server/**'
-      - 'weed/storage/**'
-      - 'weed/pb/volume_server.proto'
-      - 'weed/pb/volume_server_pb/**'
-      - '.github/workflows/volume-server-integration-tests.yml'
-  push:
-    branches: [ master, main ]
-    paths:
-      - 'test/volume_server/**'
-      - 'weed/server/**'
-      - 'weed/storage/**'
-      - 'weed/pb/volume_server.proto'
-      - 'weed/pb/volume_server_pb/**'
-      - '.github/workflows/volume-server-integration-tests.yml'
-
-concurrency:
-  group: ${{ github.head_ref || github.ref }}/volume-server-integration-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-env:
-  TEST_TIMEOUT: '30m'
-  # Keep in step with the length of matrix.shard below.
-  SHARD_COUNT: 3
-
-jobs:
-  volume-server-integration-tests:
-    name: Volume Server Integration Tests (${{ matrix.test-type }} - Shard ${{ matrix.shard }})
-    runs-on: ubuntu-22.04
-    timeout-minutes: 45
-    strategy:
-      fail-fast: false
-      matrix:
-        test-type: [grpc, http]
-        shard: [1, 2, 3]
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-
-      - name: Build SeaweedFS binary
-        run: |
-          cd weed
-          go build -o weed .
-          chmod +x weed
-          ./weed version
-
-      # Dealing the listed tests out one by one keeps the shards even. Bucketing
-      # them by first letter did not: names cluster, so ^Test[I-S] drew 50 of
-      # the 114 grpc tests and ran nearly twice as long as the other two shards.
-      - name: Select this shard's tests
-        env:
-          TEST_TYPE: ${{ matrix.test-type }}
-          SHARD: ${{ matrix.shard }}
-        run: |
-          tests=$(go test ./test/volume_server/"$TEST_TYPE"/... -list '.*' | grep '^Test' | sort -u)
-          # An empty list would make -run match nothing and the shard pass vacuously.
-          [ -n "$tests" ] || { echo "listed no tests in test/volume_server/$TEST_TYPE"; exit 1; }
-          selected=$(echo "$tests" | awk -v n="$SHARD_COUNT" -v i="$SHARD" 'NR % n == i - 1')
-          echo "shard $SHARD of $SHARD_COUNT runs $(echo "$selected" | wc -l) of $(echo "$tests" | wc -l) tests"
-          echo "TEST_PATTERN=^($(echo "$selected" | paste -sd'|' -))\$" >> "$GITHUB_ENV"
-
-      - name: Run volume server integration tests
-        env:
-          WEED_BINARY: ${{ github.workspace }}/weed/weed
-        run: |
-          echo "Running volume server integration tests for ${{ matrix.test-type }} (Shard ${{ matrix.shard }} of ${SHARD_COUNT})..."
-          go test -v -count=1 -timeout=${{ env.TEST_TIMEOUT }} ./test/volume_server/${{ matrix.test-type }}/... -run "${TEST_PATTERN}"
-
-      - name: Collect logs on failure
-        if: failure()
-        run: |
-          mkdir -p /tmp/volume-server-it-logs
-          find /tmp -maxdepth 1 -type d -name "seaweedfs_volume_server_it_*" -print -exec cp -r {} /tmp/volume-server-it-logs/ \; || true
-
-      - name: Archive logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: volume-server-integration-test-logs
-          path: /tmp/volume-server-it-logs/
-          if-no-files-found: warn
-          retention-days: 7
-
-      - name: Test summary
-        if: always()
-        run: |
-          echo "## Volume Server Integration Test Summary (${{ matrix.test-type }} - Shard ${{ matrix.shard }})" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Suite: test/volume_server/${{ matrix.test-type }} (shard ${{ matrix.shard }} of ${SHARD_COUNT}, see 'Select this shard's tests' for the split)" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Command: go test -v -count=1 -timeout=${{ env.TEST_TIMEOUT }} ./test/volume_server/${{ matrix.test-type }}/... -run \"\${TEST_PATTERN}\"" >> "$GITHUB_STEP_SUMMARY"

.gitignore

@@ -2,7 +2,6 @@
 vendor
 tags
 *.swp
-.claude/
 ### OSX template
 .DS_Store
 .AppleDouble
@@ -88,59 +87,3 @@ other/java/hdfs/dependency-reduced-pom.xml
 
 # binary file
 weed/weed
-docker/weed
-
-# test generated files
-weed/*/*.jpg
-docker/weed_sub
-docker/weed_pub
-weed/mq/schema/example.parquet
-docker/agent_sub_record
-test/mq/bin/consumer
-test/mq/bin/producer
-test/producer
-bin/weed
-weed_binary
-/test/s3/copying/filerldb2
-/filerldb2
-/test/s3/retention/test-volume-data
-test/s3/cors/weed-test.log
-test/s3/cors/weed-server.pid
-/test/s3/cors/test-volume-data
-test/s3/cors/cors.test
-/test/s3/retention/filerldb2
-test/s3/retention/weed-server.pid
-test/s3/retention/weed-test.log
-/test/s3/versioning/test-volume-data
-test/s3/versioning/weed-test.log
-/docker/admin_integration/data
-docker/agent_pub_record
-docker/admin_integration/weed-local
-/test/s3/encryption/filerldb2
-/test/s3/sse/filerldb2
-test/s3/sse/weed-test.log
-ADVANCED_IAM_DEVELOPMENT_PLAN.md
-/test/s3/iam/test-volume-data
-*.log
-weed-iam
-test/kafka/kafka-client-loadtest/weed-linux-arm64
-/test/tus/filerldb2
-coverage.out
-/test/s3/remote_cache/test-primary-data
-/test/s3/remote_cache/test-remote-data
-test/s3/remote_cache/remote-server.pid
-test/s3/remote_cache/primary-server.pid
-/test/erasure_coding/filerldb2
-/test/s3/cors/test-mini-data
-/test/s3/filer_group/test-volume-data
-
-# ID and PID files
-*.id
-*.pid
-test/s3/iam/.test_env
-/test/erasure_coding/admin_dockertest/tmp
-/test/erasure_coding/admin_dockertest/task_logs
-weed_bin
-telemetry/server/telemetry-server
-.aider*
-/seaweed-volume/docs

.superset/config.json

@@ -1,5 +0,0 @@
-{
-  "setup": [],
-  "teardown": [],
-  "run": []
-}

CODE_OF_CONDUCT.md

@@ -1,74 +0,0 @@
-# Contributor Covenant Code of Conduct
-
-## Our Pledge
-
-In the interest of fostering an open and welcoming environment, we as
-contributors and maintainers pledge to make participation in our project and
-our community a harassment-free experience for everyone, regardless of age, body
-size, disability, ethnicity, gender identity and expression, level of experience,
-nationality, personal appearance, race, religion, or sexual identity and
-orientation.
-
-## Our Standards
-
-Examples of behavior that contributes to creating a positive environment
-include:
-
-- Using welcoming and inclusive language
-- Being respectful of differing viewpoints and experiences
-- Gracefully accepting constructive criticism
-- Focusing on what is best for the community
-- Showing empathy towards other community members
-
-Examples of unacceptable behavior by participants include:
-
-- The use of sexualized language or imagery and unwelcome sexual attention or
-  advances
-- Trolling, insulting/derogatory comments, and personal or political attacks
-- Public or private harassment
-- Publishing others' private information, such as a physical or electronic
-  address, without explicit permission
-- Other conduct which could reasonably be considered inappropriate in a
-  professional setting
-
-## Our Responsibilities
-
-Project maintainers are responsible for clarifying the standards of acceptable
-behavior and are expected to take appropriate and fair corrective action in
-response to any instances of unacceptable behavior.
-
-Project maintainers have the right and responsibility to remove, edit, or
-reject comments, commits, code, wiki edits, issues, and other contributions
-that are not aligned to this Code of Conduct, or to ban temporarily or
-permanently any contributor for other behaviors that they deem inappropriate,
-threatening, offensive, or harmful.
-
-## Scope
-
-This Code of Conduct applies both within project spaces and in public spaces
-when an individual is representing the project or its community. Examples of
-representing a project or community include using an official project e-mail
-address, posting via an official social media account, or acting as an appointed
-representative at an online or offline event. Representation of a project may be
-further defined and clarified by project maintainers.
-
-## Enforcement
-
-Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported by contacting the project team at <enteremailhere>. All
-complaints will be reviewed and investigated and will result in a response that
-is deemed necessary and appropriate to the circumstances. The project team is
-obligated to maintain confidentiality with regard to the reporter of an incident.
-Further details of specific enforcement policies may be posted separately.
-
-Project maintainers who do not follow or enforce the Code of Conduct in good
-faith may face temporary or permanent repercussions as determined by other
-members of the project's leadership.
-
-## Attribution
-
-This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
-available at [http://contributor-covenant.org/version/1/4][version]
-
-[homepage]: http://contributor-covenant.org
-[version]: http://contributor-covenant.org/version/1/4/

LICENSE

@@ -186,7 +186,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright 2025 Chris Lu
+   Copyright 2016 Chris Lu
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

Makefile

@@ -1,73 +1,14 @@
-.PHONY: test admin-generate admin-build admin-clean admin-dev admin-run admin-test admin-fmt admin-help weed-commands
-
 BINARY = weed
-ADMIN_DIR = weed/admin
 
 SOURCE_DIR = .
-debug ?= 0
 
 all: install
 
-install: admin-generate
+install:
 	cd weed; go install
 
-weed-commands:
-	cd weed && $(MAKE) weed-db weed-sql
+full_install:
+	cd weed; go install -tags "elastic gocdk sqlite ydb tikv"
 
-warp_install:
-	go install github.com/minio/warp@v0.7.6
-
-full_install: admin-generate
-	cd weed; go install -tags "elastic gocdk sqlite ydb tarantool tikv rclone"
-
-server: install
-	weed -v 0 server -s3 -filer -filer.maxMB=64 -volume.max=0 -master.volumeSizeLimitMB=100 -volume.preStopSeconds=1 -s3.port=8000 -s3.allowDeleteBucketNotEmpty=true -s3.config=./docker/compose/s3.json -metricsPort=9324
-
-benchmark: install warp_install
-	pkill weed || true
-	pkill warp || true
-	weed server -debug=$(debug) -s3 -filer -volume.max=0 -master.volumeSizeLimitMB=100 -volume.preStopSeconds=1 -s3.port=8000 -s3.allowDeleteBucketNotEmpty=false -s3.config=./docker/compose/s3.json &
-	warp client &
-	while ! nc -z localhost 8000 ; do sleep 1 ; done
-	warp mixed --host=127.0.0.1:8000 --access-key=some_access_key1 --secret-key=some_secret_key1 --autoterm
-	pkill warp
-	pkill weed
-
-# curl -o profile "http://127.0.0.1:6060/debug/pprof/profile?debug=1"
-benchmark_with_pprof: debug = 1
-benchmark_with_pprof: benchmark
-
-test: admin-generate
-	cd weed; go test -tags "elastic gocdk sqlite ydb tarantool tikv rclone" -v ./...
-
-# Admin component targets
-admin-generate:
-	@cd $(ADMIN_DIR) && $(MAKE) generate
-
-admin-build: admin-generate
-	@echo "Building admin component..."
-	@cd $(ADMIN_DIR) && $(MAKE) build
-
-admin-clean:
-	@echo "Cleaning admin component..."
-	@cd $(ADMIN_DIR) && $(MAKE) clean
-
-admin-dev:
-	@echo "Starting admin development server..."
-	@cd $(ADMIN_DIR) && $(MAKE) dev
-
-admin-run:
-	@echo "Running admin server..."
-	@cd $(ADMIN_DIR) && $(MAKE) run
-
-admin-test:
-	@echo "Testing admin component..."
-	@cd $(ADMIN_DIR) && $(MAKE) test
-
-admin-fmt:
-	@echo "Formatting admin component..."
-	@cd $(ADMIN_DIR) && $(MAKE) fmt
-
-admin-help:
-	@echo "Admin component help..."
-	@cd $(ADMIN_DIR) && $(MAKE) help
+tests:
+	cd weed; go test -tags "elastic gocdk sqlite ydb tikv" -v ./...

README.md

@@ -3,267 +3,391 @@
 
 [![Slack](https://img.shields.io/badge/slack-purple)](https://join.slack.com/t/seaweedfs/shared_invite/enQtMzI4MTMwMjU2MzA3LTEyYzZmZWYzOGQ3MDJlZWMzYmI0OTE4OTJiZjJjODBmMzUxNmYwODg0YjY3MTNlMjBmZDQ1NzQ5NDJhZWI2ZmY)
 [![Twitter](https://img.shields.io/twitter/follow/seaweedfs.svg?style=social&label=Follow)](https://twitter.com/intent/follow?screen_name=seaweedfs)
-[![Build Status](https://img.shields.io/github/actions/workflow/status/seaweedfs/seaweedfs/go.yml)](https://github.com/seaweedfs/seaweedfs/actions/workflows/go.yml)
+[![Build Status](https://img.shields.io/github/workflow/status/chrislusf/seaweedfs/Go)](https://github.com/seaweedfs/seaweedfs/actions/workflows/go.yml)
 [![GoDoc](https://godoc.org/github.com/seaweedfs/seaweedfs/weed?status.svg)](https://godoc.org/github.com/seaweedfs/seaweedfs/weed)
 [![Wiki](https://img.shields.io/badge/docs-wiki-blue.svg)](https://github.com/seaweedfs/seaweedfs/wiki)
 [![Docker Pulls](https://img.shields.io/docker/pulls/chrislusf/seaweedfs?maxAge=4800)](https://hub.docker.com/r/chrislusf/seaweedfs/)
 [![SeaweedFS on Maven Central](https://img.shields.io/maven-central/v/com.github.chrislusf/seaweedfs-client)](https://search.maven.org/search?q=g:com.github.chrislusf)
-[![Artifact Hub](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/seaweedfs)](https://artifacthub.io/packages/search?repo=seaweedfs)
+
 
 ![SeaweedFS Logo](https://raw.githubusercontent.com/seaweedfs/seaweedfs/master/note/seaweedfs.png)
 
+<h2 align="center"><a href="https://www.patreon.com/seaweedfs">Sponsor SeaweedFS via Patreon</a></h2>
+
+SeaweedFS is an independent Apache-licensed open source project with its ongoing development made
+possible entirely thanks to the support of these awesome [backers](https://github.com/seaweedfs/seaweedfs/blob/master/backers.md).
+If you'd like to grow SeaweedFS even stronger, please consider joining our
+<a href="https://www.patreon.com/seaweedfs">sponsors on Patreon</a>.
+
+Your support will be really appreciated by me and other supporters!
+
+<!--
+<h4 align="center">Platinum</h4>
+
+<p align="center">
+  <a href="" target="_blank">
+    Add your name or icon here
+  </a>
+</p>
+-->
+
+### Gold Sponsors
+[![nodion](https://www.nodion.com/img/logo.svg)](https://www.nodion.com)
+[![piknik](https://raw.githubusercontent.com/seaweedfs/seaweedfs/master/note/piknik.png)](https://www.piknik.com)
+
+---
+
+- [Download Binaries for different platforms](https://github.com/seaweedfs/seaweedfs/releases/latest)
+- [SeaweedFS on Slack](https://join.slack.com/t/seaweedfs/shared_invite/enQtMzI4MTMwMjU2MzA3LTEyYzZmZWYzOGQ3MDJlZWMzYmI0OTE4OTJiZjJjODBmMzUxNmYwODg0YjY3MTNlMjBmZDQ1NzQ5NDJhZWI2ZmY)
+- [SeaweedFS on Twitter](https://twitter.com/SeaweedFS)
+- [SeaweedFS on Telegram](https://t.me/Seaweedfs) 
+- [SeaweedFS on Reddit](https://www.reddit.com/r/SeaweedFS/)
+- [SeaweedFS Mailing List](https://groups.google.com/d/forum/seaweedfs)
+- [Wiki Documentation](https://github.com/seaweedfs/seaweedfs/wiki)
+- [SeaweedFS White Paper](https://github.com/seaweedfs/seaweedfs/wiki/SeaweedFS_Architecture.pdf)
+- [SeaweedFS Introduction Slides 2021.5](https://docs.google.com/presentation/d/1DcxKWlINc-HNCjhYeERkpGXXm6nTCES8mi2W5G0Z4Ts/edit?usp=sharing)
+- [SeaweedFS Introduction Slides 2019.3](https://www.slideshare.net/chrislusf/seaweedfs-introduction)
+
+Table of Contents
+=================
+
+* [Quick Start](#quick-start)
+    * [Quick Start for S3 API on Docker](#quick-start-for-s3-api-on-docker)
+    * [Quick Start with Single Binary](#quick-start-with-single-binary)
+    * [Quick Start SeaweedFS S3 on AWS](#quick-start-seaweedfs-s3-on-aws)
+* [Introduction](#introduction)
+* [Features](#features)
+    * [Additional Features](#additional-features)
+    * [Filer Features](#filer-features)
+* [Example: Using Seaweed Object Store](#example-using-seaweed-object-store)
+* [Architecture](#object-store-architecture)
+* [Compared to Other File Systems](#compared-to-other-file-systems)
+    * [Compared to HDFS](#compared-to-hdfs)
+    * [Compared to GlusterFS, Ceph](#compared-to-glusterfs-ceph)
+    * [Compared to GlusterFS](#compared-to-glusterfs)
+    * [Compared to Ceph](#compared-to-ceph)
+* [Dev Plan](#dev-plan)
+* [Installation Guide](#installation-guide)
+* [Disk Related Topics](#disk-related-topics)
+* [Benchmark](#benchmark)
+* [License](#license)
+
+# Quick Start #
+
+## Quick Start for S3 API on Docker ##
+
+`docker run -p 8333:8333 chrislusf/seaweedfs server -s3`
+
+## Quick Start with Single Binary ##
+* Download the latest binary from https://github.com/seaweedfs/seaweedfs/releases and unzip a single binary file `weed` or `weed.exe`
+* Run `weed server -dir=/some/data/dir -s3` to start one master, one volume server, one filer, and one S3 gateway.
+
+Also, to increase capacity, just add more volume servers by running `weed volume -dir="/some/data/dir2" -mserver="<master_host>:9333" -port=8081` locally, or on a different machine, or on thousands of machines. That is it!
+
+## Quick Start SeaweedFS S3 on AWS ##
+* Setup fast production-ready [SeaweedFS S3 on AWS with cloudformation](https://aws.amazon.com/marketplace/pp/prodview-nzelz5gprlrjc)
+
+# Introduction #
+
 SeaweedFS is a simple and highly scalable distributed file system. There are two objectives:
 
 1. to store billions of files!
 2. to serve the files fast!
 
-One `weed` binary serves an S3 object store, a POSIX file system, and a lakehouse with S3 Tables, all over the same data. Each blob is one disk read away, capacity grows by starting another volume server, and cloud storage can be cached or tiered transparently. Both read and write operations have O(1) complexity and can run at the full speed supported by the underlying hardware.
+SeaweedFS started as an Object Store to handle small files efficiently. 
+Instead of managing all file metadata in a central master, 
+the central master only manages volumes on volume servers, 
+and these volume servers manage files and their metadata. 
+This relieves concurrency pressure from the central master and spreads file metadata into volume servers, 
+allowing faster file access (O(1), usually just one disk read operation).
 
-- [Download Binaries for different platforms](https://github.com/seaweedfs/seaweedfs/releases/latest)
-- [Wiki Documentation](https://github.com/seaweedfs/seaweedfs/wiki)
-- [HTTP REST API](REST_API.md) for the filer, master, and volume servers
-- Community: [Slack](https://join.slack.com/t/seaweedfs/shared_invite/enQtMzI4MTMwMjU2MzA3LTEyYzZmZWYzOGQ3MDJlZWMzYmI0OTE4OTJiZjJjODBmMzUxNmYwODg0YjY3MTNlMjBmZDQ1NzQ5NDJhZWI2ZmY), [Twitter](https://twitter.com/SeaweedFS), [Telegram](https://t.me/Seaweedfs), [Reddit](https://www.reddit.com/r/SeaweedFS/), [Mailing List](https://groups.google.com/d/forum/seaweedfs)
-- [SeaweedFS White Paper](https://github.com/seaweedfs/seaweedfs/wiki/SeaweedFS_Architecture.pdf) and introduction slides: [2025.5](https://docs.google.com/presentation/d/1tdkp45J01oRV68dIm4yoTXKJDof-EhainlA0LMXexQE/edit?usp=sharing), [2021.5](https://docs.google.com/presentation/d/1DcxKWlINc-HNCjhYeERkpGXXm6nTCES8mi2W5G0Z4Ts/edit?usp=sharing), [2019.3](https://www.slideshare.net/chrislusf/seaweedfs-introduction)
+There is only 40 bytes of disk storage overhead for each file's metadata. 
+It is so simple with O(1) disk reads that you are welcome to challenge the performance with your actual use cases.
 
-Table of Contents
-=================
+SeaweedFS started by implementing [Facebook's Haystack design paper](http://www.usenix.org/event/osdi10/tech/full_papers/Beaver.pdf). 
+Also, SeaweedFS implements erasure coding with ideas from 
+[f4: Facebook’s Warm BLOB Storage System](https://www.usenix.org/system/files/conference/osdi14/osdi14-paper-muralidhar.pdf), and has a lot of similarities with [Facebook’s Tectonic Filesystem](https://www.usenix.org/system/files/fast21-pan.pdf)
 
-* [Quick Start](#quick-start)
-    * [One command](#one-command)
-    * [Docker](#docker)
-    * [Docker Compose](#docker-compose)
-    * [Kubernetes with Helm](#kubernetes-with-helm)
-    * [Build from source](#build-from-source)
-    * [Scale out](#scale-out)
-* [Why SeaweedFS](#why-seaweedfs)
-    * [Fast](#fast)
-    * [Scalable](#scalable)
-    * [The most complete S3 API](#the-most-complete-s3-api)
-    * [A data warehouse with S3 Tables](#a-data-warehouse-with-s3-tables)
-    * [A fast cache for cloud storage](#a-fast-cache-for-cloud-storage)
-    * [Active-active replication and more](#active-active-replication-and-more)
-* [Architecture](#architecture)
-* [Compared to Other Systems](#compared-to-other-systems)
-    * [Compared to HDFS](#compared-to-hdfs)
-    * [Compared to GlusterFS, Ceph](#compared-to-glusterfs-ceph)
-    * [Compared to MooseFS](#compared-to-moosefs)
-    * [Compared to Ceph](#compared-to-ceph)
-    * [Compared to MinIO, RustFS](#compared-to-minio-rustfs)
-* [Benchmark](#benchmark)
-* [Enterprise](#enterprise)
-* [License](#license)
-* [Sponsors](#sponsors)
+On top of the object store, optional [Filer] can support directories and POSIX attributes. 
+Filer is a separate linearly-scalable stateless server with customizable metadata stores, 
+e.g., MySql, Postgres, Redis, Cassandra, HBase, Mongodb, Elastic Search, LevelDB, RocksDB, Sqlite, MemSql, TiDB, Etcd, CockroachDB, YDB, etc.
 
-# Quick Start #
+For any distributed key value stores, the large values can be offloaded to SeaweedFS. 
+With the fast access speed and linearly scalable capacity, 
+SeaweedFS can work as a distributed [Key-Large-Value store][KeyLargeValueStore].
 
-## One command ##
-
-Download the latest binary from the [releases](https://github.com/seaweedfs/seaweedfs/releases/latest) page and unzip the single `weed` (or `weed.exe`) file, or let the install script put it in `/usr/local/bin`:
-
-```bash
-curl -fsSL https://raw.githubusercontent.com/seaweedfs/seaweedfs/master/install.sh | bash
-```
-
-Then start a ready-to-use S3 object store:
-
-```bash
-AWS_ACCESS_KEY_ID=admin \
-AWS_SECRET_ACCESS_KEY=secret \
-S3_BUCKET=my-bucket \
-./weed mini -dir=./data
-```
-
-That's it. The S3 endpoint is at http://localhost:8333, `my-bucket` exists, and `admin`/`secret` are valid credentials:
-
-```bash
-AWS_ACCESS_KEY_ID=admin AWS_SECRET_ACCESS_KEY=secret \
-  aws --endpoint-url http://localhost:8333 s3 cp README.md s3://my-bucket/
-```
-
-The same process also runs the master, a volume server, the filer, WebDAV, the Iceberg REST catalog, and the Admin UI. Add `S3_TABLE_BUCKET=warehouse` to also create an Iceberg table bucket, or `warehouse:LANCE` for a Lance one. Drop the AWS keys to run without authentication for development.
-
-> macOS: if the binary is quarantined, run `xattr -d com.apple.quarantine ./weed` first.
-
-`weed mini` is auto-tuned for one node and is fine for single-node production, such as an S3 gateway that issues presigned URLs. See [Quick Start with weed mini][WeedMini].
-
-## Docker ##
-
-```bash
-docker run -p 8333:8333 -v weed-data:/data \
-  -e AWS_ACCESS_KEY_ID=admin \
-  -e AWS_SECRET_ACCESS_KEY=secret \
-  -e S3_BUCKET=my-bucket \
-  chrislusf/seaweedfs
-```
-
-Same behavior as the `weed mini` command above.
-
-## Docker Compose ##
-
-To run master, volume server, filer, S3, and WebDAV as separate services:
-
-```bash
-wget https://raw.githubusercontent.com/seaweedfs/seaweedfs/master/docker/seaweedfs-compose.yml
-wget -P prometheus https://raw.githubusercontent.com/seaweedfs/seaweedfs/master/docker/prometheus/prometheus.yml
-docker compose -f seaweedfs-compose.yml -p seaweedfs up
-```
-
-[Docker Compose for S3][DockerComposeS3] adds credentials, and the [docker/compose](docker/compose) folder has variants for replication, mounts, message queues, and more.
-
-## Kubernetes with Helm ##
-
-```bash
-helm repo add seaweedfs https://seaweedfs.github.io/seaweedfs/helm
-helm install seaweedfs seaweedfs/seaweedfs -n seaweedfs --create-namespace -f values.yaml
-```
-
-A production-shaped `values.yaml` for a three-node cluster: two copies of every write, three masters, and an S3 endpoint with credentials and a bucket.
-
-```yaml
-global:
-  seaweedfs:
-    enableReplication: true
-    replicationPlacement: "001"   # one extra copy on another server; "002" for two
-
-master:
-  replicas: 3
-  data:
-    type: persistentVolumeClaim   # the cluster's default storage class; add storageClass to pick one
-    size: 1Gi
-
-volume:
-  replicas: 3                     # at least 1 + the sum of the replication digits
-  dataDirs:
-    - name: data
-      type: persistentVolumeClaim
-      size: 500Gi
-      maxVolumes: 0               # size the volume count from the disk
-
-filer:
-  replicas: 2
-  data:
-    type: persistentVolumeClaim
-    size: 20Gi
-
-s3:
-  enabled: true
-  replicas: 2
-  enableAuth: true
-  credentials:
-    admin:
-      accessKey: admin
-      secretKey: change-me
-  createBuckets:
-    - name: app-storage
-```
-
-The S3 endpoint is the `seaweedfs-s3` service on port 8333. [Helm Chart Recipes][HelmRecipes] has values for a development cluster, a lakehouse with the Iceberg catalog exposed, filer metadata on PostgreSQL, and node-local disks. The [SeaweedFS Operator][Operator] and the [CSI driver][SeaweedFsCsiDriver] are the other Kubernetes paths.
-
-## Build from source ##
-
-```bash
-git clone https://github.com/seaweedfs/seaweedfs.git
-cd seaweedfs/weed && make install
-```
-
-`weed` lands in `$GOPATH/bin`. [Getting Started][GettingStarted] covers running master, volume, filer, and S3 as separate processes.
-
-## Scale out ##
-
-Capacity is a volume server. Start one on any machine with disk and point it at the master:
-
-```bash
-weed volume -dir=/data -master=<master_host>:9333
-```
-
-Nothing rebalances until you ask it to. Throughput is a filer or S3 gateway; they are stateless, so run as many as you need behind a load balancer. [Production Setup][ProductionSetup] walks through a multi-node cluster.
+SeaweedFS can transparently integrate with the cloud. 
+With hot data on local cluster, and warm data on the cloud with O(1) access time, 
+SeaweedFS can achieve both fast local access time and elastic cloud storage capacity.
+What's more, the cloud storage access API cost is minimized. 
+Faster and Cheaper than direct cloud storage!
 
 [Back to TOC](#table-of-contents)
 
-# Why SeaweedFS #
-
-## Fast ##
-
-* One disk read per blob. A small file is one blob; a large file is split into chunks of a few MB, each its own blob. A volume server keeps a 16-byte index entry per blob in memory and reads it in a single seek, also for erasure-coded data.
-* The master is not in the read path. Clients cache the volume-to-server mapping and talk to volume servers directly.
-* 40 bytes of metadata per file on disk. Small files are packed into append-only volume files, so there is no per-file inode, no per-file metadata file, no fragmentation, and writes are SSD friendly.
-* Hot data is replicated; [erasure coding][ErasureCoding] is applied to warm data in the background, so writes never pay the encoding cost.
-* The [Rust volume server][RustVolume] is a drop-in for higher throughput and lower tail latency on the same on-disk format.
-
-On one laptop, [`weed benchmark`][Benchmarks] writes 1KB files at 15,700 per second and reads them back at 47,000 per second, and a mixed S3 [warp][S3Benchmark] run totals 3.2 GiB/s. Numbers are in the [Benchmark](#benchmark) section; throughput grows with volume servers and gateways.
-
-## Scalable ##
-
-* The master tracks volumes, not files. A cluster with billions of files has a few thousand volumes, so the master stays small. One master is enough for most clusters; run three for [Raft failover][FailoverMaster].
-* Adding a server adds capacity with no data reshuffle. Balancing, vacuum, erasure coding, and repair run on demand from [`weed shell`][WeedShell] or the [maintenance worker][Worker].
-* Filer and S3 gateways are stateless and scale linearly. Directory metadata lives in a [store you already run][FilerStores]: LevelDB, RocksDB, SQLite, MySQL, PostgreSQL, Cassandra, HBase, MongoDB, Redis, Elasticsearch, etcd, TiKV, FoundationDB, YDB, ArangoDB, Tarantool, and MySQL or PostgreSQL compatible databases such as TiDB, CockroachDB, and MemSQL.
-* Rack and data center aware [replication][Replication], [tiered storage][TieredStorage] across disk types, and [transparent cloud tiering][CloudTier] for unlimited capacity.
-* Files from a byte to [tens of TB][SuperLargeFiles]. Volumes up to 8TB with the large-disk build.
-
-## The most complete S3 API ##
-
-The S3 gateway implements the object, bucket, S3 Tables, IAM, and STS APIs on one endpoint, so the AWS SDKs and CLI, rclone, restic, Spark, and Trino work unchanged.
-
-| API | Operations |
-| --- | --- |
-| S3 bucket and object | 73 |
-| S3 Tables | 36 |
-| IAM | 39 |
-| STS | 5 |
-
-* [Versioning][Versioning], [Object Lock][ObjectLock] with retention and legal hold, [lifecycle][Lifecycle] rules, tagging, [CORS][CORS], [conditional reads and writes][ConditionalOps], checksums, presigned URLs, browser POST uploads, multipart uploads, and an atomic [RenameObject][RenameObject].
-* [Bucket policies][BucketPolicies] with [conditions][PolicyConditions] and [variables][PolicyVariables]; IAM users, groups, and policies; STS with [OIDC][OIDC], LDAP, and [Kubernetes service accounts][K8sSA].
-* [SSE-S3, SSE-KMS, and SSE-C][SSE] server-side encryption, with OpenBao and Vault, AWS KMS, Azure Key Vault, and GCP KMS as key providers.
-* [Audit log][AuditLog], [bucket quota][BucketQuota], and [rate limiting][RateLimiting].
-* Each bucket is its own collection, so deleting a bucket is instant.
-
-The full operation list is in [Amazon S3 API][AmazonS3API], and [Supported APIs vs MinIO][S3vsMinio] compares. The S3 compatibility suite and the SDK, IAM, SSE, policy, and Spark integration tests run in CI on every change.
-
-## A data warehouse with S3 Tables ##
-
-SeaweedFS is a lakehouse in one system. [S3 Table Buckets][S3TableBucket] hold Apache Iceberg tables by default, or [Lance][LanceCatalog] tables for vectors and multimodal data, and the built-in [Iceberg REST Catalog][IcebergCatalog] and Lance namespace serve them directly. There is no Hive Metastore, Glue, or separate catalog service to deploy, secure, and back up.
-
-* Query engines operate on the same tables at the same time: [Spark][SparkIceberg], [Trino][TrinoIceberg], [Dremio][DremioIceberg], [DuckDB][DuckDBIceberg], [Apache Doris][DorisIceberg], [RisingWave][RisingWaveIceberg], ClickHouse, and [LanceDB][LanceDB]. Catalog commits are atomic compare-and-swap, so concurrent writers are safe. [Lakekeeper][Lakekeeper] can front the same storage with STS-vended credentials.
-* [Automated table maintenance][IcebergMaintenance]: compaction, snapshot expiration, orphan file removal, and manifest rewriting, configured per bucket or table through the S3 Tables maintenance APIs, and the same for [Lance][LanceMaintenance].
-* IAM at the bucket, namespace, and table level with standard bucket policies, see [S3 Tables Security][S3TablesSecurity].
-* A [Hadoop compatible file system][Hadoop] for Spark, Flink, and HBase.
-
-`S3_TABLE_BUCKET=warehouse ./weed mini -dir=./data` brings the whole stack up on a laptop.
-
-## A fast cache for cloud storage ##
-
-[Cloud Drive][CloudDrive] mounts a bucket from S3, Google Cloud Storage, Azure, Backblaze B2, Wasabi, Storj, or any S3-compatible store into SeaweedFS and serves it at local speed:
-
-* Metadata is pulled once, so listing, stat, and directory walks cost no cloud API calls.
-* File content is downloaded once, on first read or [warmed][CacheRemote] by folder, name pattern, size, or age, and cached with the capacity of the whole cluster: cache everything, no churn.
-* Local writes complete at local latency and are written back to the cloud asynchronously in the cloud's native layout, so other tools keep reading the bucket directly.
-* Uncache by the same rules to free local disk while keeping the metadata.
-
-[Cloud Tier][CloudTier] goes the other direction, moving whole warm volumes to cloud storage while keeping one-read access, and the [Gateway to Remote Object Storage][GatewayToRemoteObjectStore] mirrors every bucket to a remote store. Faster and cheaper than reading the cloud directly.
-
-## Active-active replication and more ##
-
-* [Active-active or active-passive replication][ActiveActiveAsyncReplication] between clusters, continuous and resumable, for the whole tree or chosen folders, across data centers.
-* [Filer store replication][FilerStoreReplication] for metadata HA, [async backup][AsyncBackup] to cloud storage, [metadata backup][MetaBackup], and [change data capture][CDC] with [webhooks][Webhook] on every metadata event.
-* The same data as a [FUSE mount][Mount] on Linux, macOS, and [Windows][MountWindows], over [WebDAV][WebDAV], [SFTP][SFTP], HDFS, HTTP, and [TUS resumable uploads][TUS]; on Kubernetes through the [CSI driver][SeaweedFsCsiDriver] and [Operator][Operator].
-* [AES256-GCM encryption at rest][FilerDataEncryption], TLS and mTLS between components, JWT-signed volume access, and [FIPS][FIPS] builds.
-* [Admin UI][AdminUI], Prometheus [metrics][Metrics], [TTL][VolumeServerTTL] per file or volume, automatic compression and compaction, and [seaweed-up][SeaweedUp] for bare-metal clusters.
+# Features #
+## Additional Features ##
+* Can choose no replication or different replication levels, rack and data center aware.
+* Automatic master servers failover - no single point of failure (SPOF).
+* Automatic Gzip compression depending on file MIME type.
+* Automatic compaction to reclaim disk space after deletion or update.
+* [Automatic entry TTL expiration][VolumeServerTTL].
+* Any server with some disk spaces can add to the total storage space.
+* Adding/Removing servers does **not** cause any data re-balancing unless triggered by admin commands.
+* Optional picture resizing.
+* Support ETag, Accept-Range, Last-Modified, etc.
+* Support in-memory/leveldb/readonly mode tuning for memory/performance balance.
+* Support rebalancing the writable and readonly volumes.
+* [Customizable Multiple Storage Tiers][TieredStorage]: Customizable storage disk types to balance performance and cost.
+* [Transparent cloud integration][CloudTier]: unlimited capacity via tiered cloud storage for warm data.
+* [Erasure Coding for warm storage][ErasureCoding]  Rack-Aware 10.4 erasure coding reduces storage cost and increases availability.
 
 [Back to TOC](#table-of-contents)
 
-# Architecture #
+## Filer Features ##
+* [Filer server][Filer] provides "normal" directories and files via http.
+* [File TTL][FilerTTL] automatically expires file metadata and actual file data.
+* [Mount filer][Mount] reads and writes files directly as a local directory via FUSE.
+* [Filer Store Replication][FilerStoreReplication] enables HA for filer meta data stores.
+* [Active-Active Replication][ActiveActiveAsyncReplication] enables asynchronous one-way or two-way cross cluster continuous replication.
+* [Amazon S3 compatible API][AmazonS3API] accesses files with S3 tooling.
+* [Hadoop Compatible File System][Hadoop] accesses files from Hadoop/Spark/Flink/etc or even runs HBase.
+* [Async Replication To Cloud][BackupToCloud] has extremely fast local access and backups to Amazon S3, Google Cloud Storage, Azure, BackBlaze.
+* [WebDAV] accesses as a mapped drive on Mac and Windows, or from mobile devices.
+* [AES256-GCM Encrypted Storage][FilerDataEncryption] safely stores the encrypted data.
+* [Super Large Files][SuperLargeFiles] stores large or super large files in tens of TB.
+* [Cloud Drive][CloudDrive] mounts cloud storage to local cluster, cached for fast read and write with asynchronous write back.
+* [Gateway to Remote Object Store][GatewayToRemoteObjectStore] mirrors bucket operations to remote object storage, in addition to [Cloud Drive][CloudDrive]
 
-![SeaweedFS Architecture](https://raw.githubusercontent.com/seaweedfs/seaweedfs/master/note/SeaweedFS_Architecture.png)
+## Kubernetes ##
+* [Kubernetes CSI Driver][SeaweedFsCsiDriver] A Container Storage Interface (CSI) Driver. [![Docker Pulls](https://img.shields.io/docker/pulls/chrislusf/seaweedfs-csi-driver.svg?maxAge=4800)](https://hub.docker.com/r/chrislusf/seaweedfs-csi-driver/)
+* [SeaweedFS Operator](https://github.com/seaweedfs/seaweedfs-operator)
 
-* **Master** servers, one or a Raft group of three, track which volume lives on which volume server and hand out file ids. They are not in the read path.
-* **Volume** servers store blobs in append-only volume files, keep a 16-byte in-memory index per blob, and replicate or erasure-code at the volume level.
-* **Filer** servers add directories and files on top, with metadata in a store of your choice, and expose HTTP, S3, WebDAV, SFTP, FUSE, and the table catalogs.
+[Filer]: https://github.com/seaweedfs/seaweedfs/wiki/Directories-and-Files
+[SuperLargeFiles]: https://github.com/seaweedfs/seaweedfs/wiki/Data-Structure-for-Large-Files
+[Mount]: https://github.com/seaweedfs/seaweedfs/wiki/FUSE-Mount
+[AmazonS3API]: https://github.com/seaweedfs/seaweedfs/wiki/Amazon-S3-API
+[BackupToCloud]: https://github.com/seaweedfs/seaweedfs/wiki/Async-Replication-to-Cloud
+[Hadoop]: https://github.com/seaweedfs/seaweedfs/wiki/Hadoop-Compatible-File-System
+[WebDAV]: https://github.com/seaweedfs/seaweedfs/wiki/WebDAV
+[ErasureCoding]: https://github.com/seaweedfs/seaweedfs/wiki/Erasure-coding-for-warm-storage
+[TieredStorage]: https://github.com/seaweedfs/seaweedfs/wiki/Tiered-Storage
+[CloudTier]: https://github.com/seaweedfs/seaweedfs/wiki/Cloud-Tier
+[FilerDataEncryption]: https://github.com/seaweedfs/seaweedfs/wiki/Filer-Data-Encryption
+[FilerTTL]: https://github.com/seaweedfs/seaweedfs/wiki/Filer-Stores
+[VolumeServerTTL]: https://github.com/seaweedfs/seaweedfs/wiki/Store-file-with-a-Time-To-Live
+[SeaweedFsCsiDriver]: https://github.com/seaweedfs/seaweedfs-csi-driver
+[ActiveActiveAsyncReplication]: https://github.com/seaweedfs/seaweedfs/wiki/Filer-Active-Active-cross-cluster-continuous-synchronization
+[FilerStoreReplication]: https://github.com/seaweedfs/seaweedfs/wiki/Filer-Store-Replication
+[KeyLargeValueStore]: https://github.com/seaweedfs/seaweedfs/wiki/Filer-as-a-Key-Large-Value-Store
+[CloudDrive]: https://github.com/seaweedfs/seaweedfs/wiki/Cloud-Drive-Architecture
+[GatewayToRemoteObjectStore]: https://github.com/seaweedfs/seaweedfs/wiki/Gateway-to-Remote-Object-Storage
 
-The blob store started from [Facebook's Haystack](http://www.usenix.org/event/osdi10/tech/full_papers/Beaver.pdf), erasure coding takes ideas from [f4](https://www.usenix.org/system/files/conference/osdi14/osdi14-paper-muralidhar.pdf), and the whole has a lot in common with [Tectonic](https://www.usenix.org/system/files/fast21-pan.pdf) and [Colossus](https://cloud.google.com/blog/products/storage-data-transfer/a-peek-behind-colossus-googles-file-system). How file ids are assigned, written, and looked up, and why a master that tracks volumes scales, is in [Blob Store Architecture][BlobStoreArchitecture]; the services are in [Components][Components] and the [white paper][WhitePaper].
 
 [Back to TOC](#table-of-contents)
 
-# Compared to Other Systems #
+## Example: Using Seaweed Object Store ##
+
+By default, the master node runs on port 9333, and the volume nodes run on port 8080.
+Let's start one master node, and two volume nodes on port 8080 and 8081. Ideally, they should be started from different machines. We'll use localhost as an example.
+
+SeaweedFS uses HTTP REST operations to read, write, and delete. The responses are in JSON or JSONP format.
+
+### Start Master Server ###
+
+```
+> ./weed master
+```
+
+### Start Volume Servers ###
+
+```
+> weed volume -dir="/tmp/data1" -max=5  -mserver="localhost:9333" -port=8080 &
+> weed volume -dir="/tmp/data2" -max=10 -mserver="localhost:9333" -port=8081 &
+```
+
+### Write File ###
+
+To upload a file: first, send a HTTP POST, PUT, or GET request to `/dir/assign` to get an `fid` and a volume server URL:
+
+```
+> curl http://localhost:9333/dir/assign
+{"count":1,"fid":"3,01637037d6","url":"127.0.0.1:8080","publicUrl":"localhost:8080"}
+```
+
+Second, to store the file content, send a HTTP multi-part POST request to `url + '/' + fid` from the response:
+
+```
+> curl -F file=@/home/chris/myphoto.jpg http://127.0.0.1:8080/3,01637037d6
+{"name":"myphoto.jpg","size":43234,"eTag":"1cc0118e"}
+```
+
+To update, send another POST request with updated file content.
+
+For deletion, send an HTTP DELETE request to the same `url + '/' + fid` URL:
+
+```
+> curl -X DELETE http://127.0.0.1:8080/3,01637037d6
+```
+
+### Save File Id ###
+
+Now, you can save the `fid`, 3,01637037d6 in this case, to a database field.
+
+The number 3 at the start represents a volume id. After the comma, it's one file key, 01, and a file cookie, 637037d6.
+
+The volume id is an unsigned 32-bit integer. The file key is an unsigned 64-bit integer. The file cookie is an unsigned 32-bit integer, used to prevent URL guessing.
+
+The file key and file cookie are both coded in hex. You can store the <volume id, file key, file cookie> tuple in your own format, or simply store the `fid` as a string.
+
+If stored as a string, in theory, you would need 8+1+16+8=33 bytes. A char(33) would be enough, if not more than enough, since most uses will not need 2^32 volumes.
+
+If space is really a concern, you can store the file id in your own format. You would need one 4-byte integer for volume id, 8-byte long number for file key, and a 4-byte integer for the file cookie. So 16 bytes are more than enough.
+
+### Read File ###
+
+Here is an example of how to render the URL.
+
+First look up the volume server's URLs by the file's volumeId:
+
+```
+> curl http://localhost:9333/dir/lookup?volumeId=3
+{"volumeId":"3","locations":[{"publicUrl":"localhost:8080","url":"localhost:8080"}]}
+```
+
+Since (usually) there are not too many volume servers, and volumes don't move often, you can cache the results most of the time. Depending on the replication type, one volume can have multiple replica locations. Just randomly pick one location to read.
+
+Now you can take the public URL, render the URL or directly read from the volume server via URL:
+
+```
+ http://localhost:8080/3,01637037d6.jpg
+```
+
+Notice we add a file extension ".jpg" here. It's optional and just one way for the client to specify the file content type.
+
+If you want a nicer URL, you can use one of these alternative URL formats:
+
+```
+ http://localhost:8080/3/01637037d6/my_preferred_name.jpg
+ http://localhost:8080/3/01637037d6.jpg
+ http://localhost:8080/3,01637037d6.jpg
+ http://localhost:8080/3/01637037d6
+ http://localhost:8080/3,01637037d6
+```
+
+If you want to get a scaled version of an image, you can add some params:
+
+```
+http://localhost:8080/3/01637037d6.jpg?height=200&width=200
+http://localhost:8080/3/01637037d6.jpg?height=200&width=200&mode=fit
+http://localhost:8080/3/01637037d6.jpg?height=200&width=200&mode=fill
+```
+
+### Rack-Aware and Data Center-Aware Replication ###
+
+SeaweedFS applies the replication strategy at a volume level. So, when you are getting a file id, you can specify the replication strategy. For example:
+
+```
+curl http://localhost:9333/dir/assign?replication=001
+```
+
+The replication parameter options are:
+
+```
+000: no replication
+001: replicate once on the same rack
+010: replicate once on a different rack, but same data center
+100: replicate once on a different data center
+200: replicate twice on two different data center
+110: replicate once on a different rack, and once on a different data center
+```
+
+More details about replication can be found [on the wiki][Replication].
+
+[Replication]: https://github.com/seaweedfs/seaweedfs/wiki/Replication
+
+You can also set the default replication strategy when starting the master server.
+
+### Allocate File Key on Specific Data Center ###
+
+Volume servers can be started with a specific data center name:
+
+```
+ weed volume -dir=/tmp/1 -port=8080 -dataCenter=dc1
+ weed volume -dir=/tmp/2 -port=8081 -dataCenter=dc2
+```
+
+When requesting a file key, an optional "dataCenter" parameter can limit the assigned volume to the specific data center. For example, this specifies that the assigned volume should be limited to 'dc1':
+
+```
+ http://localhost:9333/dir/assign?dataCenter=dc1
+```
+
+### Other Features ###
+  * [No Single Point of Failure][feat-1]
+  * [Insert with your own keys][feat-2]
+  * [Chunking large files][feat-3]
+  * [Collection as a Simple Name Space][feat-4]
+
+[feat-1]: https://github.com/seaweedfs/seaweedfs/wiki/Failover-Master-Server
+[feat-2]: https://github.com/seaweedfs/seaweedfs/wiki/Optimization#insert-with-your-own-keys
+[feat-3]: https://github.com/seaweedfs/seaweedfs/wiki/Optimization#upload-large-files
+[feat-4]: https://github.com/seaweedfs/seaweedfs/wiki/Optimization#collection-as-a-simple-name-space
+
+[Back to TOC](#table-of-contents)
+
+## Object Store Architecture ##
+
+Usually distributed file systems split each file into chunks, a central master keeps a mapping of filenames, chunk indices to chunk handles, and also which chunks each chunk server has.
+
+The main drawback is that the central master can't handle many small files efficiently, and since all read requests need to go through the chunk master, so it might not scale well for many concurrent users.
+
+Instead of managing chunks, SeaweedFS manages data volumes in the master server. Each data volume is 32GB in size, and can hold a lot of files. And each storage node can have many data volumes. So the master node only needs to store the metadata about the volumes, which is a fairly small amount of data and is generally stable.
+
+The actual file metadata is stored in each volume on volume servers. Since each volume server only manages metadata of files on its own disk, with only 16 bytes for each file, all file access can read file metadata just from memory and only needs one disk operation to actually read file data.
+
+For comparison, consider that an xfs inode structure in Linux is 536 bytes.
+
+### Master Server and Volume Server ###
+
+The architecture is fairly simple. The actual data is stored in volumes on storage nodes. One volume server can have multiple volumes, and can both support read and write access with basic authentication.
+
+All volumes are managed by a master server. The master server contains the volume id to volume server mapping. This is fairly static information, and can be easily cached.
+
+On each write request, the master server also generates a file key, which is a growing 64-bit unsigned integer. Since write requests are not generally as frequent as read requests, one master server should be able to handle the concurrency well.
+
+### Write and Read files ###
+
+When a client sends a write request, the master server returns (volume id, file key, file cookie, volume node URL) for the file. The client then contacts the volume node and POSTs the file content.
+
+When a client needs to read a file based on (volume id, file key, file cookie), it asks the master server by the volume id for the (volume node URL, volume node public URL), or retrieves this from a cache. Then the client can GET the content, or just render the URL on web pages and let browsers fetch the content.
+
+Please see the example for details on the write-read process.
+
+### Storage Size ###
+
+In the current implementation, each volume can hold 32 gibibytes (32GiB or 8x2^32 bytes). This is because we align content to 8 bytes. We can easily increase this to 64GiB, or 128GiB, or more, by changing 2 lines of code, at the cost of some wasted padding space due to alignment.
+
+There can be 4 gibibytes (4GiB or 2^32 bytes) of volumes. So the total system size is 8 x 4GiB x 4GiB which is 128 exbibytes (128EiB or 2^67 bytes).
+
+Each individual file size is limited to the volume size.
+
+### Saving memory ###
+
+All file meta information stored on an volume server is readable from memory without disk access. Each file takes just a 16-byte map entry of <64bit key, 32bit offset, 32bit size>. Of course, each map entry has its own space cost for the map. But usually the disk space runs out before the memory does.
+
+### Tiered Storage to the cloud ###
+
+The local volume servers are much faster, while cloud storages have elastic capacity and are actually more cost-efficient if not accessed often (usually free to upload, but relatively costly to access). With the append-only structure and O(1) access time, SeaweedFS can take advantage of both local and cloud storage by offloading the warm data to the cloud.
+
+Usually hot data are fresh and warm data are old. SeaweedFS puts the newly created volumes on local servers, and optionally upload the older volumes on the cloud. If the older data are accessed less often, this literally gives you unlimited capacity with limited local servers, and still fast for new data. 
+
+With the O(1) access time, the network latency cost is kept at minimum. 
+
+If the hot/warm data is split as 20/80, with 20 servers, you can achieve storage capacity of 100 servers. That's a cost saving of 80%! Or you can repurpose the 80 servers to store new data also, and get 5X storage throughput.
+
+[Back to TOC](#table-of-contents)
+
+## Compared to Other File Systems ##
 
 Most other distributed file systems seem more complicated than necessary.
 
@@ -271,7 +395,9 @@ SeaweedFS is meant to be fast and simple, in both setup and operation. If you do
 
 SeaweedFS is constantly moving forward. Same with other systems. These comparisons can be outdated quickly. Please help to keep them updated.
 
-## Compared to HDFS ##
+[Back to TOC](#table-of-contents)
+
+### Compared to HDFS ###
 
 HDFS uses the chunk approach for each file, and is ideal for storing large files.
 
@@ -279,7 +405,9 @@ SeaweedFS is ideal for serving relatively smaller files quickly and concurrently
 
 SeaweedFS can also store extra large files by splitting them into manageable data chunks, and store the file ids of the data chunks into a meta chunk. This is managed by "weed upload/download" tool, and the weed master or volume servers are agnostic about it.
 
-## Compared to GlusterFS, Ceph ##
+[Back to TOC](#table-of-contents)
+
+### Compared to GlusterFS, Ceph ###
 
 The architectures are mostly the same. SeaweedFS aims to store and read files fast, with a simple and flat architecture. The main differences are
 
@@ -295,18 +423,27 @@ The architectures are mostly the same. SeaweedFS aims to store and read files fa
 | GlusterFS      | hashing          |                  | FUSE, NFS          |          |                           |
 | Ceph           | hashing + rules  |                  | FUSE               | Yes      |                           |
 | MooseFS        | in memory        |                  | FUSE               |       | No                          |
-| MinIO          | separate meta file per drive for each file  |                  |         | Yes   | No                          |
-| RustFS         | separate meta file per drive for each file  |                  |         | Yes   | No                          |
+| MinIO          | separate meta file for each file  |                  |         | Yes   | No                          |
 
-GlusterFS stores files, both directories and content, in configurable volumes called "bricks". It hashes the path and filename into ids, and assigned to virtual volumes, and then mapped to "bricks".
+[Back to TOC](#table-of-contents)
 
-## Compared to MooseFS ##
+### Compared to GlusterFS ###
+
+GlusterFS stores files, both directories and content, in configurable volumes called "bricks".
+
+GlusterFS hashes the path and filename into ids, and assigned to virtual volumes, and then mapped to "bricks".
+
+[Back to TOC](#table-of-contents)
+
+### Compared to MooseFS ###
 
 MooseFS chooses to neglect small file issue. From moosefs 3.0 manual, "even a small file will occupy 64KiB plus additionally 4KiB of checksums and 1KiB for the header", because it "was initially designed for keeping large amounts (like several thousands) of very big files"
 
-MooseFS Master Server keeps all meta data in memory. Same issue as HDFS namenode.
+MooseFS Master Server keeps all meta data in memory. Same issue as HDFS namenode. 
 
-## Compared to Ceph ##
+[Back to TOC](#table-of-contents)
+
+### Compared to Ceph ###
 
 Ceph can be setup similar to SeaweedFS as a key->blob store. It is much more complicated, with the need to support layers on top of it. [Here is a more detailed comparison](https://github.com/seaweedfs/seaweedfs/issues/120)
 
@@ -326,68 +463,127 @@ SeaweedFS Filer uses off-the-shelf stores, such as MySql, Postgres, Sqlite, Mong
 | Volume  | OSD | optimized for small files |
 | Filer  | Ceph FS | linearly scalable, Customizable, O(1) or O(logN) |
 
-## Compared to MinIO, RustFS ##
+[Back to TOC](#table-of-contents)
 
-Please note, as Apr 25, 2026 MinIO ceased development. It's strongly discouraged to use that unmaintained software with multiple security bugs. RustFS is a MinIO reimplementation in Rust, Apache 2.0 licensed and still developed, keeping MinIO's storage model down to a byte-compatible on-disk format. So the points below apply to both.
+### Compared to MinIO ###
 
-MinIO followed AWS S3 closely and was ideal for testing for S3 API. It had good UI, policies, versionings, etc. SeaweedFS is trying to catch up here.
+MinIO follows AWS S3 closely and is ideal for testing for S3 API. It has good UI, policies, versionings, etc. SeaweedFS is trying to catch up here. It is also possible to put MinIO as a gateway in front of SeaweedFS later.
 
-The metadata are in simple files. Each file write incurs extra writes to the corresponding meta file, on every drive of the erasure set. Changing only tags or retention rewrites that meta file on all of them, so the write amplification does not shrink with object size.
+MinIO metadata are in simple files. Each file write will incur extra writes to corresponding meta file.
 
-There is no optimization for lots of small files. The files are simply stored as is to local disks.
+MinIO does not have optimization for lots of small files. The files are simply stored as is to local disks.
 Plus the extra meta file and shards for erasure coding, it only amplifies the LOSF problem.
 
-Multiple disk IO are needed to read one file. SeaweedFS has O(1) disk reads, even for erasure coded files.
+MinIO has multiple disk IO to read one file. SeaweedFS has O(1) disk reads, even for erasure coded files.
 
-Erasure coding is full-time. SeaweedFS uses replication on hot data for faster speed and optionally applies erasure coding on warm data.
+MinIO has full-time erasure coding. SeaweedFS uses replication on hot data for faster speed and optionally applies erasure coding on warm data.
 
-No POSIX-like API support.
+MinIO does not have POSIX-like API support.
 
-There are specific requirements on storage layout, which makes it hard to scale out and to maintain. An erasure set must be 2 to 16 drives and must divide the drive list symmetrically, and capacity grows or shrinks a whole pool at a time. In SeaweedFS, just start one volume server pointing to the master. That's all.
+MinIO has specific requirements on storage layout. It is not flexible to adjust capacity. In SeaweedFS, just start one volume server pointing to the master. That's all.
+
+## Dev Plan ##
+
+* More tools and documentation, on how to manage and scale the system.
+* Read and write stream data.
+* Support structured data.
+
+This is a super exciting project! And we need helpers and [support](https://www.patreon.com/seaweedfs)!
 
 [Back to TOC](#table-of-contents)
 
-# Benchmark #
+## Installation Guide ##
 
-Unscientific single-machine numbers from a MacBook with an SSD. [`weed benchmark`][Benchmarks], 1 million 1KB files, concurrency 16:
+> Installation guide for users who are not familiar with golang
 
-| | Requests per second | p50 | p99 |
-| --- | --- | --- | --- |
-| Write | 15,708 | 0.8 ms | 2.6 ms |
-| Random read | 47,019 | 0.3 ms | 0.7 ms |
+Step 1: install go on your machine and setup the environment by following the instructions at:
 
-`make benchmark` runs [warp][S3Benchmark] mixed S3 traffic against a local `weed server`:
+https://golang.org/doc/install
 
+make sure to define your $GOPATH
+
+
+Step 2: checkout this repo:
+```bash
+git clone https://github.com/seaweedfs/seaweedfs.git
 ```
-Mixed operations.
-Operation: DELETE, 10%, Concurrency: 20, Ran 42s.
- * Throughput: 55.13 obj/s
+Step 3: download, compile, and install the project by executing the following command
 
-Operation: GET, 45%, Concurrency: 20, Ran 42s.
- * Throughput: 2477.45 MiB/s, 247.75 obj/s
-
-Operation: PUT, 15%, Concurrency: 20, Ran 42s.
- * Throughput: 825.85 MiB/s, 82.59 obj/s
-
-Operation: STAT, 30%, Concurrency: 20, Ran 42s.
- * Throughput: 165.27 obj/s
-
-Cluster Total: 3302.88 MiB/s, 550.51 obj/s over 43s.
+```bash
+cd seaweedfs/weed && make install
 ```
 
-Read throughput is bounded by the random read speed of the disks, and grows with every volume server added. More numbers, including multi-node, FUSE, and Hadoop, are in [Benchmarks][Benchmarks], [S3 API Benchmark][S3Benchmark], [FIO benchmark][FIO], and [Independent Benchmarks][IndependentBenchmarks].
+Once this is done, you will find the executable "weed" in your `$GOPATH/bin` directory
 
 [Back to TOC](#table-of-contents)
 
-# Enterprise #
+## Disk Related Topics ##
 
-For enterprise users, please visit [seaweedfs.com](https://seaweedfs.com) for the SeaweedFS Enterprise Edition,
-which has advanced features, including data recovery, self-healing storage,
-customizable erasure coding, EC vacuum and repair, etc.
+### Hard Drive Performance ###
+
+When testing read performance on SeaweedFS, it basically becomes a performance test of your hard drive's random read speed. Hard drives usually get 100MB/s~200MB/s.
+
+### Solid State Disk ###
+
+To modify or delete small files, SSD must delete a whole block at a time, and move content in existing blocks to a new block. SSD is fast when brand new, but will get fragmented over time and you have to garbage collect, compacting blocks. SeaweedFS is friendly to SSD since it is append-only. Deletion and compaction are done on volume level in the background, not slowing reading and not causing fragmentation.
 
 [Back to TOC](#table-of-contents)
 
-# License #
+## Benchmark ##
+
+My Own Unscientific Single Machine Results on Mac Book with Solid State Disk, CPU: 1 Intel Core i7 2.6GHz.
+
+Write 1 million 1KB file:
+```
+Concurrency Level:      16
+Time taken for tests:   66.753 seconds
+Completed requests:      1048576
+Failed requests:        0
+Total transferred:      1106789009 bytes
+Requests per second:    15708.23 [#/sec]
+Transfer rate:          16191.69 [Kbytes/sec]
+
+Connection Times (ms)
+              min      avg        max      std
+Total:        0.3      1.0       84.3      0.9
+
+Percentage of the requests served within a certain time (ms)
+   50%      0.8 ms
+   66%      1.0 ms
+   75%      1.1 ms
+   80%      1.2 ms
+   90%      1.4 ms
+   95%      1.7 ms
+   98%      2.1 ms
+   99%      2.6 ms
+  100%     84.3 ms
+```
+
+Randomly read 1 million files:
+```
+Concurrency Level:      16
+Time taken for tests:   22.301 seconds
+Completed requests:      1048576
+Failed requests:        0
+Total transferred:      1106812873 bytes
+Requests per second:    47019.38 [#/sec]
+Transfer rate:          48467.57 [Kbytes/sec]
+
+Connection Times (ms)
+              min      avg        max      std
+Total:        0.0      0.3       54.1      0.2
+
+Percentage of the requests served within a certain time (ms)
+   50%      0.3 ms
+   90%      0.4 ms
+   98%      0.6 ms
+   99%      0.7 ms
+  100%     54.1 ms
+```
+
+[Back to TOC](#table-of-contents)
+
+## License ##
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -401,114 +597,10 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 
-[Back to TOC](#table-of-contents)
-
-# Sponsors #
-
-<h3 align="center"><a href="https://www.patreon.com/seaweedfs">Sponsor SeaweedFS via Patreon</a></h3>
-
-SeaweedFS is an independent Apache-licensed open source project with its ongoing development made
-possible entirely thanks to the support of these awesome [backers](https://github.com/seaweedfs/seaweedfs/blob/master/backers.md).
-If you'd like to grow SeaweedFS even stronger, please consider joining our
-<a href="https://www.patreon.com/seaweedfs">sponsors on Patreon</a>.
-
-Your support will be really appreciated by me and other supporters!
-
-<!--
-<h4 align="center">Platinum</h4>
-
-<p align="center">
-  <a href="" target="_blank">
-    <img src="https://raw.githubusercontent.com/seaweedfs/seaweedfs/master/note/sponsor_nodion.png" width="200" alt="nodion">
-  </a>
-</p>
--->
-
-### Gold Sponsors
-[![nodion](https://raw.githubusercontent.com/seaweedfs/seaweedfs/master/note/sponsor_nodion.png)](https://www.nodion.com)
-[![piknik](https://raw.githubusercontent.com/seaweedfs/seaweedfs/master/note/piknik.png)](https://www.piknik.com)
-[![keepsec](https://raw.githubusercontent.com/seaweedfs/seaweedfs/master/note/keepsec.png)](https://www.keepsec.ca)
-[![zyner](https://raw.githubusercontent.com/seaweedfs/seaweedfs/master/note/sponsor_zyner.png)](https://zyner.org)
+The text of this page is available for modification and reuse under the terms of the Creative Commons Attribution-Sharealike 3.0 Unported License and the GNU Free Documentation License (unversioned, with no invariant sections, front-cover texts, or back-cover texts).
 
 [Back to TOC](#table-of-contents)
 
-## Star History
+## Stargazers over time
 
-![Star History](note/star_history.svg)
-
-[WeedMini]: https://github.com/seaweedfs/seaweedfs/wiki/Quick-Start-with-weed-mini
-[DockerComposeS3]: https://github.com/seaweedfs/seaweedfs/wiki/Docker-Compose-for-S3
-[HelmRecipes]: https://github.com/seaweedfs/seaweedfs/wiki/Helm-Chart-Recipes
-[Operator]: https://github.com/seaweedfs/seaweedfs-operator
-[SeaweedFsCsiDriver]: https://github.com/seaweedfs/seaweedfs-csi-driver
-[GettingStarted]: https://github.com/seaweedfs/seaweedfs/wiki/Getting-Started
-[ProductionSetup]: https://github.com/seaweedfs/seaweedfs/wiki/Production-Setup
-[ErasureCoding]: https://github.com/seaweedfs/seaweedfs/wiki/Erasure-Coding-for-warm-storage
-[RustVolume]: https://github.com/seaweedfs/seaweedfs/wiki/Rust-Volume-Server
-[Benchmarks]: https://github.com/seaweedfs/seaweedfs/wiki/Benchmarks
-[S3Benchmark]: https://github.com/seaweedfs/seaweedfs/wiki/S3-API-Benchmark
-[FIO]: https://github.com/seaweedfs/seaweedfs/wiki/FIO-benchmark
-[IndependentBenchmarks]: https://github.com/seaweedfs/seaweedfs/wiki/Independent-Benchmarks
-[FailoverMaster]: https://github.com/seaweedfs/seaweedfs/wiki/Failover-Master-Server
-[WeedShell]: https://github.com/seaweedfs/seaweedfs/wiki/weed-shell
-[Worker]: https://github.com/seaweedfs/seaweedfs/wiki/Worker
-[FilerStores]: https://github.com/seaweedfs/seaweedfs/wiki/Filer-Stores
-[Replication]: https://github.com/seaweedfs/seaweedfs/wiki/Replication
-[TieredStorage]: https://github.com/seaweedfs/seaweedfs/wiki/Tiered-Storage
-[CloudTier]: https://github.com/seaweedfs/seaweedfs/wiki/Cloud-Tier
-[SuperLargeFiles]: https://github.com/seaweedfs/seaweedfs/wiki/Data-Structure-for-Large-Files
-[Versioning]: https://github.com/seaweedfs/seaweedfs/wiki/S3-Object-Versioning
-[ObjectLock]: https://github.com/seaweedfs/seaweedfs/wiki/S3-Object-Lock-and-Retention
-[Lifecycle]: https://github.com/seaweedfs/seaweedfs/wiki/S3-Lifecycle
-[CORS]: https://github.com/seaweedfs/seaweedfs/wiki/S3-CORS
-[ConditionalOps]: https://github.com/seaweedfs/seaweedfs/wiki/S3-Conditional-Operations
-[RenameObject]: https://github.com/seaweedfs/seaweedfs/wiki/S3-RenameObject
-[BucketPolicies]: https://github.com/seaweedfs/seaweedfs/wiki/S3-Bucket-Policies
-[PolicyConditions]: https://github.com/seaweedfs/seaweedfs/wiki/S3-Policy-Conditions
-[PolicyVariables]: https://github.com/seaweedfs/seaweedfs/wiki/S3-Policy-Variables
-[OIDC]: https://github.com/seaweedfs/seaweedfs/wiki/OIDC-Integration
-[K8sSA]: https://github.com/seaweedfs/seaweedfs/wiki/Kubernetes-ServiceAccount-Authentication
-[SSE]: https://github.com/seaweedfs/seaweedfs/wiki/Server-Side-Encryption
-[AuditLog]: https://github.com/seaweedfs/seaweedfs/wiki/S3-API-Audit-log
-[BucketQuota]: https://github.com/seaweedfs/seaweedfs/wiki/S3-Bucket-Quota
-[RateLimiting]: https://github.com/seaweedfs/seaweedfs/wiki/S3-Rate-Limiting
-[AmazonS3API]: https://github.com/seaweedfs/seaweedfs/wiki/Amazon-S3-API
-[S3vsMinio]: https://github.com/seaweedfs/seaweedfs/wiki/Supported-APIs-vs-Minio
-[S3TableBucket]: https://github.com/seaweedfs/seaweedfs/wiki/S3-Table-Bucket
-[LanceCatalog]: https://github.com/seaweedfs/seaweedfs/wiki/SeaweedFS-Lance-Catalog
-[IcebergCatalog]: https://github.com/seaweedfs/seaweedfs/wiki/SeaweedFS-Iceberg-Catalog
-[SparkIceberg]: https://github.com/seaweedfs/seaweedfs/wiki/Spark-Iceberg-Integration
-[TrinoIceberg]: https://github.com/seaweedfs/seaweedfs/wiki/Trino-Iceberg-Integration
-[DremioIceberg]: https://github.com/seaweedfs/seaweedfs/wiki/Dremio-Iceberg-Integration
-[DuckDBIceberg]: https://github.com/seaweedfs/seaweedfs/wiki/DuckDB-Iceberg-Integration
-[DorisIceberg]: https://github.com/seaweedfs/seaweedfs/wiki/Doris-Iceberg-Integration
-[RisingWaveIceberg]: https://github.com/seaweedfs/seaweedfs/wiki/RisingWave-Iceberg-Integration
-[LanceDB]: https://github.com/seaweedfs/seaweedfs/wiki/LanceDB-Integration
-[Lakekeeper]: https://github.com/seaweedfs/seaweedfs/wiki/Lakekeeper-Iceberg-Integration
-[IcebergMaintenance]: https://github.com/seaweedfs/seaweedfs/wiki/Iceberg-Table-Maintenance
-[LanceMaintenance]: https://github.com/seaweedfs/seaweedfs/wiki/Lance-Maintenance-Worker
-[S3TablesSecurity]: https://github.com/seaweedfs/seaweedfs/wiki/S3-Tables-Security
-[Hadoop]: https://github.com/seaweedfs/seaweedfs/wiki/Hadoop-Compatible-File-System
-[CloudDrive]: https://github.com/seaweedfs/seaweedfs/wiki/Cloud-Drive-Architecture
-[CacheRemote]: https://github.com/seaweedfs/seaweedfs/wiki/Cache-Remote-Storage
-[GatewayToRemoteObjectStore]: https://github.com/seaweedfs/seaweedfs/wiki/Gateway-to-Remote-Object-Storage
-[ActiveActiveAsyncReplication]: https://github.com/seaweedfs/seaweedfs/wiki/Filer-Active-Active-cross-cluster-continuous-synchronization
-[FilerStoreReplication]: https://github.com/seaweedfs/seaweedfs/wiki/Filer-Store-Replication
-[AsyncBackup]: https://github.com/seaweedfs/seaweedfs/wiki/Async-Backup
-[MetaBackup]: https://github.com/seaweedfs/seaweedfs/wiki/Async-Filer-Metadata-Backup
-[CDC]: https://github.com/seaweedfs/seaweedfs/wiki/Filer-Change-Data-Capture
-[Webhook]: https://github.com/seaweedfs/seaweedfs/wiki/Filer-Notification-Webhook
-[Mount]: https://github.com/seaweedfs/seaweedfs/wiki/FUSE-Mount
-[MountWindows]: https://github.com/seaweedfs/seaweedfs/wiki/Mount-on-Windows
-[WebDAV]: https://github.com/seaweedfs/seaweedfs/wiki/WebDAV
-[SFTP]: https://github.com/seaweedfs/seaweedfs/wiki/SFTP-Server
-[TUS]: https://github.com/seaweedfs/seaweedfs/wiki/TUS-Resumable-Uploads
-[FilerDataEncryption]: https://github.com/seaweedfs/seaweedfs/wiki/Filer-Data-Encryption
-[FIPS]: https://github.com/seaweedfs/seaweedfs/wiki/Cryptography-and-FIPS-Compliance
-[AdminUI]: https://github.com/seaweedfs/seaweedfs/wiki/Admin-UI
-[Metrics]: https://github.com/seaweedfs/seaweedfs/wiki/System-Metrics
-[VolumeServerTTL]: https://github.com/seaweedfs/seaweedfs/wiki/Store-file-with-a-Time-To-Live
-[SeaweedUp]: https://github.com/seaweedfs/seaweedfs/wiki/Deployment-with-seaweed-up
-[BlobStoreArchitecture]: https://github.com/seaweedfs/seaweedfs/wiki/Blob-Store-Architecture
-[Components]: https://github.com/seaweedfs/seaweedfs/wiki/Components
-[WhitePaper]: https://github.com/seaweedfs/seaweedfs/wiki/SeaweedFS_Architecture.pdf
+[![Stargazers over time](https://starchart.cc/chrislusf/seaweedfs.svg)](https://starchart.cc/chrislusf/seaweedfs)

REST_API.md

@@ -1,344 +0,0 @@
-# SeaweedFS HTTP REST API
-
-SeaweedFS exposes three HTTP surfaces:
-
-| Service | Default port | Addressing |
-|---------|--------------|------------|
-| Filer | 8888 | File system paths (`/dir/name`) |
-| Master | 9333 | File id assignment and cluster topology |
-| Volume server | 8080 | File content by file id (`vid,fid`) |
-
-Most clients only need the filer API (paths) or the S3 API. The master and
-volume APIs are the lower-level blob store interface.
-
-Conventions applying to all three:
-
-- Responses are JSON unless noted otherwise. Append `&pretty=y` to pretty-print.
-- A file id (`fid`) has the form `volumeId,fileKeyCookie`, e.g. `3,01637037d6`.
-  An optional suffix selects a reserved id from a `count` assignment
-  (`3,01637037d6_1`, `_2`, ...), and an optional extension
-  (`3,01637037d6.jpg`) sets the content type on reads.
-- `replication` is a 3-digit replica placement `xyz`: `x` copies in other
-  data centers, `y` on other racks in the same data center, `z` on other
-  volume servers on the same rack. `000` = no replication, `001` = one copy
-  on the same rack, `010` = one copy on a different rack, `100` = one copy in
-  another data center, `200` = two copies in two other data centers, `110` =
-  one copy in another data center plus one on another rack.
-- `ttl` units: `m` minute, `h` hour, `d` day, `w` week, `M` month, `y` year.
-
-## Filer API (port 8888)
-
-The filer presents a POSIX-like namespace over the volume servers.
-
-### Upload a file
-
-```bash
-# PUT the raw body to the target path
-curl -T /home/chris/myphoto.jpg "http://localhost:8888/dir/myphoto.jpg"
-
-# or POST as multipart form (the part filename becomes the entry name)
-curl -F file=@/home/chris/myphoto.jpg "http://localhost:8888/dir/"
-```
-
-Response `201 Created`:
-
-```json
-{"name":"myphoto.jpg","size":43234,"eTag":"0x6c656...","mtime":"...","chunks":[...]}
-```
-
-Query parameters:
-
-| Parameter | Description | Default |
-|-----------|-------------|---------|
-| `collection` | collection name | empty |
-| `replication` | replica placement code | filer default |
-| `ttl` | file expiration, e.g. `3d` | never |
-| `disk` | disk type to store on | filer default |
-| `fsync` | `true` fsyncs on the volume server | false |
-| `dataCenter` | preferred data center | empty |
-| `rack` | preferred rack | empty |
-| `dataNode` | preferred volume server | empty |
-| `saveInside` | store small content inside the metadata instead of a volume | false |
-| `maxMB` | split the upload into chunks of this many MB | filer `-maxMB` |
-| `mode` | unix permission bits, e.g. `0644` | `0660` |
-| `op` | `append` appends to an existing file | overwrite |
-| `skipCheckParentDir` | `true` skips the parent-directory existence check | false |
-
-### Create a directory
-
-```bash
-curl -X POST "http://localhost:8888/dir/newdir/"
-```
-
-A POST to a path ending in `/` with no content creates the directory,
-including missing parents.
-
-### Read a file
-
-```bash
-curl "http://localhost:8888/dir/myphoto.jpg"
-```
-
-Supports `Range` requests (`Accept-Ranges: bytes`), `ETag`, and the
-`If-None-Match` / `If-Modified-Since` conditional headers. `HEAD` returns
-headers only. Entry headers stored as extended attributes are echoed back,
-minus internal `Seaweed-` and `xattr-` keys.
-
-Entry metadata instead of content:
-
-```bash
-curl "http://localhost:8888/dir/myphoto.jpg?metadata=true"
-```
-
-`metadata=true&resolveManifest=true` additionally resolves chunked-manifest
-entries into their real chunk list.
-
-### List a directory
-
-```bash
-curl -H "Accept: application/json" "http://localhost:8888/dir/?limit=10&lastFileName=a.jpg"
-```
-
-| Parameter | Description | Default |
-|-----------|-------------|---------|
-| `limit` | max entries per page | filer `-dirListLimit` |
-| `lastFileName` | resume listing after this entry name | empty |
-| `namePattern` | include only names matching the wildcard | empty |
-| `namePatternExclude` | exclude names matching the wildcard | empty |
-
-The JSON response carries `Path`, `Entries`, `Limit`, `LastFileName`,
-`ShouldDisplayLoadMore`, and `EmptyFolder`. Without the `Accept` header the
-filer renders its HTML browser.
-
-### Move and copy
-
-```bash
-curl -X POST "http://localhost:8888/dir/newname.jpg?mv.from=/dir/myphoto.jpg"
-curl -X POST "http://localhost:8888/dir/copy.jpg?cp.from=/dir/myphoto.jpg"
-```
-
-`mv.from` renames or moves the source to the request path (`204 No Content`).
-`cp.from` copies it.
-
-### Append
-
-```bash
-curl -T chunk2.bin "http://localhost:8888/dir/file.bin?op=append"
-```
-
-### Delete
-
-```bash
-curl -X DELETE "http://localhost:8888/dir/myphoto.jpg"
-curl -X DELETE "http://localhost:8888/dir/?recursive=true"
-```
-
-| Parameter | Description | Default |
-|-----------|-------------|---------|
-| `recursive` | delete a non-empty directory tree | false; when the filer runs with `filer.options.recursive_delete=true`, deletes are recursive unless `recursive=false` |
-| `ignoreRecursiveError` | keep deleting remaining entries after an error | false |
-| `skipChunkDeletion` | remove only the metadata, keep volume data | false |
-
-### Tagging
-
-Tags are carried as `Seaweed-`-prefixed request headers, not query
-parameters; `?tagging` selects the tagging handler and `?tagging=K1,K2`
-lists the keys to remove. Header names are canonicalized on write
-(`Seaweed-k1` is stored as `Seaweed-K1`), and the delete list is matched
-case-sensitively against the stored names.
-
-```bash
-curl -X PUT -H "Seaweed-k1: v1" -H "Seaweed-k2: v2" "http://localhost:8888/dir/file.jpg?tagging"
-curl -X DELETE "http://localhost:8888/dir/file.jpg?tagging=K1,K2"
-```
-
-### Read by file id
-
-```bash
-curl "http://localhost:8888/?proxyChunkId=3,01637037d6"
-```
-
-The filer proxies the chunk read to the right volume server, so only the
-filer port needs to be exposed.
-
-### Resumable uploads
-
-The filer serves the [TUS protocol](https://tus.io/) for resumable uploads
-(`POST`, `PATCH`, `HEAD` on upload URLs). It is enabled by default at
-`/.tus`; `-tusBasePath` changes the endpoint base path.
-
-### Health
-
-`GET /healthz` and `GET /readyz` return `200 OK`.
-
-## Master API (port 9333)
-
-Write-affecting endpoints are automatically proxied to the current leader, so
-any master in the quorum can serve them.
-
-### Assign a file id
-
-```bash
-curl "http://localhost:9333/dir/assign?count=1&replication=001&collection=turbo&dataCenter=dc1&ttl=3d&disk=ssd"
-{"count":1,"fid":"3,01637037d6","url":"127.0.0.1:8080","publicUrl":"localhost:8080"}
-```
-
-Upload the file content to `http://<url>/<fid>` afterwards. With `count>1`,
-use `<fid>_1`, `<fid>_2`, ... for the additional ids.
-
-| Parameter | Description | Default |
-|-----------|-------------|---------|
-| `count` | file ids to reserve | 1 |
-| `collection` | collection name | empty |
-| `dataCenter` | preferred data center | empty |
-| `rack` | preferred rack | empty |
-| `dataNode` | preferred volume server | empty |
-| `replication` | replica placement | master `-defaultReplication` |
-| `ttl` | file expiration, e.g. `3d` | never |
-| `disk` | disk type | empty |
-| `dataSize` | expected file size in bytes | 0 |
-| `preallocate` | bytes to preallocate for new volumes | master `-volumePreallocate` |
-| `writableVolumeCount` | grow this many volumes when none are writable | master default |
-| `memoryMapMaxSizeMb` | memory-mapped file size (Windows) | 0 |
-
-### Look up a volume or file id
-
-```bash
-curl "http://localhost:9333/dir/lookup?volumeId=3"
-{"locations":[{"url":"localhost:8080","publicUrl":"localhost:8080"}]}
-```
-
-| Parameter | Description | Default |
-|-----------|-------------|---------|
-| `volumeId` | volume id; a full `vid,fid` is accepted too | required |
-| `fileId` | like `volumeId`, but also returns a write JWT when security is on | empty |
-| `collection` | speeds up the lookup | empty |
-| `read` | `yes` generates a read JWT instead of a write JWT | empty |
-
-### Store a file in one call
-
-```bash
-curl -F file=@/home/chris/report.pdf "http://localhost:9333/submit?collection=turbo&replication=001"
-{"fileName":"report.pdf","fid":"3,01637037d6","fileUrl":"localhost:8080/3,01637037d6","size":43234,"eTag":"0x6c656..."}
-```
-
-`POST /submit` accepts multipart file data plus the `dir/assign` placement
-parameters (`count`, `collection`, `dataCenter`, `rack`, `replication`,
-`ttl`, `disk`), assigns a file id, uploads to the volume server, and returns
-the result.
-
-### Redirect to a file
-
-```bash
-curl -v "http://localhost:9333/3,01637037d6"
-```
-
-`GET /{fileId}` answers `308 Permanent Redirect` to a volume server holding
-the file, preserving the query string (e.g. image-resize parameters).
-
-### Cluster status
-
-```bash
-curl "http://localhost:9333/dir/status?pretty=y"   # full topology tree
-curl "http://localhost:9333/vol/status?pretty=y"   # every volume on every node
-curl "http://localhost:9333/collection/info?collection=turbo"
-curl "http://localhost:9333/collection/info?collection=turbo&detail=true"
-```
-
-`collection/info` returns aggregated `TotalSize`, `FileCount`, `UsedSize`,
-`VolumeCount`; `detail=true` splits them per volume layout.
-
-### Grow volumes
-
-```bash
-curl "http://localhost:9333/vol/grow?count=4&replication=001&collection=turbo&ttl=5d&disk=ssd&dataCenter=dc1&rack=rack1"
-{"count":4}
-```
-
-`count` is required; the placement parameters match `dir/assign`. One volume
-serves one write at a time, so pre-allocated volumes raise write concurrency.
-
-### Vacuum deleted space
-
-```bash
-curl "http://localhost:9333/vol/vacuum?garbageThreshold=0.4"
-```
-
-| Parameter | Description | Default |
-|-----------|-------------|---------|
-| `garbageThreshold` | minimum deleted-bytes ratio before a volume is compacted | master `-garbageThreshold` (0.3) |
-
-Vacuuming makes a volume read-only, copies live needles to a new volume, and
-swaps it in.
-
-### Delete a collection
-
-```bash
-curl "http://localhost:9333/col/delete?collection=benchmark"
-```
-
-Deletes all volumes of the collection, including erasure-coded shards.
-`204 No Content` on success.
-
-### Health
-
-```bash
-curl -I "http://localhost:9333/healthz"     # liveness
-curl -I "http://localhost:9333/readyz"      # readiness
-curl "http://localhost:9333/"               # web UI
-```
-
-## Volume server API (port 8080)
-
-The volume server stores file content by file id. Clients normally get the
-volume URL from `dir/assign` or `dir/lookup`.
-
-### Upload
-
-```bash
-curl -F file=@/home/chris/myphoto.jpg "http://127.0.0.1:8080/3,01637037d6"
-{"name":"myphoto.jpg","size":43234,"eTag":"0x6c656...","mime":"image/jpeg","contentMd5":"..."}
-```
-
-PUT or POST the body (or a multipart `file` part) to `/{vid},{fid}`.
-`204 No Content` is returned when the content is unchanged. `?ts=<unix>`
-sets the stored modification time.
-
-### Read
-
-```bash
-curl "http://127.0.0.1:8080/3,01637037d6"
-curl "http://127.0.0.1:8080/3,01637037d6.jpg"        # sets Content-Type from the extension
-```
-
-Supports `Range` and `HEAD`. Image files can be resized server-side:
-
-| Parameter | Description |
-|-----------|-------------|
-| `width`, `height` | resize bounds in pixels |
-| `mode` | `fit` (contain) or `fill` (cover); omitted resizes to `width`/`height` |
-| `crop_x1`, `crop_y1`, `crop_x2`, `crop_y2` | explicit crop rectangle |
-| `cm` | `false` returns the chunk-manifest blob instead of resolving it |
-| `readDeleted` | `true` reads soft-deleted needles |
-| `collection` | passed through redirects for the right volume |
-
-### Delete
-
-```bash
-curl -X DELETE "http://127.0.0.1:8080/3,01637037d6"
-{"size":43234}
-```
-
-`?ts=<unix>` sets the deletion timestamp. Replicated volumes propagate the
-delete to every replica.
-
-### Status
-
-```bash
-curl "http://localhost:8080/status?pretty=y"  # disk and volume inventory
-curl -I "http://localhost:8080/healthz"       # liveness/readiness
-```
-
-`OPTIONS` preflights answer CORS headers. When `-port.public` differs from
-`-port`, the volume server opens a separate read-only public listener on
-that port; `-publicUrl` sets the address it advertises to clients.

SECURITY.md

@@ -1,78 +0,0 @@
-# Security Policy
-
-## Supported versions
-
-Security fixes land in the latest release. Please reproduce against a recent
-release or `master` before reporting; issues that only reproduce on old,
-unsupported versions are not eligible for a fix or an advisory.
-
-## Reporting a vulnerability
-
-Report privately through GitHub private vulnerability reporting (the "Report a
-vulnerability" button under the repository's Security tab). This keeps the
-report, the fix, and any CVE in one place. Do not open a public issue.
-
-### What a report must include
-
-We can only act on reports that show real impact. Please include:
-
-- Affected version (a release tag or `master` commit you reproduced on)
-- The exact deployment and configuration: which components are running
-  (master, volume, filer, S3, admin), which ports are reachable by the
-  attacker, and what authentication is enabled
-- The attacker's starting position: unauthenticated, a valid S3 user, an admin,
-  or someone with access to the internal cluster network
-- The trust boundary that is crossed (e.g. an unauthenticated client reading
-  another tenant's data, an S3 user escalating to admin)
-- A minimal, working reproduction or proof of concept
-- Expected vs. actual behavior
-
-A report without a working reproduction and a clear trust boundary is a
-hardening suggestion, not a vulnerability. We are glad to receive those, but
-they are handled on the normal issue tracker, not as security advisories.
-
-### Automated and AI-assisted reports
-
-Output from static analysis, dependency scanners, fuzzers, or LLMs is welcome
-only when you have manually validated it and can supply a working reproduction
-against a supported version, per the requirements above. Raw tool output,
-speculative findings, or generated reports without a demonstrated exploit will
-be closed as hardening suggestions.
-
-## Trust model
-
-SeaweedFS is built to run with its cluster components (master, volume servers,
-and the raw filer API) on a trusted network. Those internal APIs are not an
-authentication boundary unless you explicitly enable a control (for example
-volume JWT or filer authentication) and that control is bypassed. Exposing an
-internal port directly to untrusted clients is a deployment mistake, not a
-vulnerability in SeaweedFS.
-
-Reports are in scope when they cross a boundary SeaweedFS is meant to enforce,
-for example:
-
-- Unauthenticated access to data or operations that require authentication
-- One S3 identity reading, writing, or deleting another identity's data
-- Privilege escalation from a normal S3 user to administrative capability
-- Bypass of Object Lock / retention where it is configured
-- Remotely triggered data corruption or loss
-
-Reports are generally out of scope when they require:
-
-- Direct access to an internal cluster port that is meant to be private
-- Full master, filer, or volume server access (already a full compromise)
-- An insecure example configuration rather than a documented secure setup
-- Local-only impact on a host the attacker already controls
-
-## CVE assignment
-
-When a report is confirmed, we publish an advisory and request the CVE through
-GitHub. CVEs assigned by third parties without coordinating with us, or for
-issues that do not cross a boundary described above, may be disputed.
-
-## Response and disclosure
-
-- We aim to acknowledge a valid report within a few business days.
-- We will investigate, work on a fix, and coordinate a disclosure timeline
-  with you.
-- Please allow time for a fix before any public disclosure.

VOLUME_SERVER_RUST_PLAN.md

@@ -1,790 +0,0 @@
-# Execution Plan: SeaweedFS Volume Server — Go to Rust Port
-
-## Scope Summary
-
-| Component | Go Source | Lines (non-test) | Description |
-|---|---|---|---|
-| CLI & startup | `weed/command/volume.go` | 476 | ~40 CLI flags, server bootstrap |
-| HTTP server + handlers | `weed/server/volume_server*.go` | 1,517 | Struct, routes, read/write/delete handlers |
-| gRPC handlers | `weed/server/volume_grpc_*.go` | 3,073 | 40 RPC method implementations |
-| Storage engine | `weed/storage/` | 15,271 | Volumes, needles, index, compaction, EC, backend |
-| Protobuf definitions | `weed/pb/volume_server.proto` | 759 | Service + message definitions |
-| Shared utilities | `weed/security/`, `weed/stats/`, `weed/util/` | ~2,000+ | JWT, TLS, metrics, helpers |
-| **Total** | | **~23,000+** | |
-
-## Rust Crate & Dependency Strategy
-
-```
-seaweed-volume/
-├── Cargo.toml
-├── build.rs                    # protobuf codegen
-├── proto/
-│   ├── volume_server.proto     # copied from Go, adapted
-│   └── remote.proto
-├── src/
-│   ├── main.rs                 # CLI entry point
-│   ├── config.rs               # CLI flags + config
-│   ├── server/
-│   │   ├── mod.rs
-│   │   ├── volume_server.rs    # VolumeServer struct + lifecycle
-│   │   ├── http_handlers.rs    # HTTP route dispatch
-│   │   ├── http_read.rs        # GET/HEAD handlers
-│   │   ├── http_write.rs       # POST/PUT handlers
-│   │   ├── http_delete.rs      # DELETE handler
-│   │   ├── http_admin.rs       # /status, /healthz, /ui
-│   │   ├── grpc_service.rs     # gRPC trait impl dispatch
-│   │   ├── grpc_vacuum.rs
-│   │   ├── grpc_copy.rs
-│   │   ├── grpc_erasure_coding.rs
-│   │   ├── grpc_tail.rs
-│   │   ├── grpc_admin.rs
-│   │   ├── grpc_read_write.rs
-│   │   ├── grpc_batch_delete.rs
-│   │   ├── grpc_scrub.rs
-│   │   ├── grpc_tier.rs
-│   │   ├── grpc_remote.rs
-│   │   ├── grpc_query.rs
-│   │   ├── grpc_state.rs
-│   │   └── grpc_client_to_master.rs  # heartbeat
-│   ├── storage/
-│   │   ├── mod.rs
-│   │   ├── store.rs            # Store (multi-disk manager)
-│   │   ├── volume.rs           # Volume struct + lifecycle
-│   │   ├── volume_read.rs
-│   │   ├── volume_write.rs
-│   │   ├── volume_compact.rs
-│   │   ├── volume_info.rs
-│   │   ├── needle/
-│   │   │   ├── mod.rs
-│   │   │   ├── needle.rs       # Needle struct + serialization
-│   │   │   ├── needle_read.rs
-│   │   │   ├── needle_write.rs
-│   │   │   ├── needle_map.rs   # in-memory NeedleMap
-│   │   │   ├── needle_value.rs
-│   │   │   └── crc.rs
-│   │   ├── super_block.rs
-│   │   ├── idx/
-│   │   │   ├── mod.rs
-│   │   │   └── idx.rs          # .idx file format read/write
-│   │   ├── needle_map_leveldb.rs
-│   │   ├── types.rs            # NeedleId, Offset, Size, DiskType
-│   │   ├── disk_location.rs    # DiskLocation per-directory
-│   │   ├── erasure_coding/
-│   │   │   ├── mod.rs
-│   │   │   ├── ec_volume.rs
-│   │   │   ├── ec_shard.rs
-│   │   │   ├── ec_encoder.rs   # Reed-Solomon encoding
-│   │   │   └── ec_decoder.rs
-│   │   └── backend/
-│   │       ├── mod.rs
-│   │       ├── disk.rs
-│   │       └── s3_backend.rs   # tiered storage to S3
-│   ├── topology/
-│   │   └── volume_layout.rs    # replication placement
-│   ├── security/
-│   │   ├── mod.rs
-│   │   ├── guard.rs            # whitelist + JWT gate
-│   │   ├── jwt.rs
-│   │   └── tls.rs
-│   ├── stats/
-│   │   ├── mod.rs
-│   │   └── metrics.rs          # Prometheus counters/gauges
-│   └── util/
-│       ├── mod.rs
-│       ├── grpc.rs
-│       ├── http.rs
-│       └── file.rs
-└── tests/
-    ├── integration/
-    │   ├── http_read_test.rs
-    │   ├── http_write_test.rs
-    │   ├── grpc_test.rs
-    │   └── storage_test.rs
-    └── unit/
-        ├── needle_test.rs
-        ├── idx_test.rs
-        ├── super_block_test.rs
-        └── ec_test.rs
-```
-
-### Key Rust dependencies
-
-| Purpose | Crate |
-|---|---|
-| Async runtime | `tokio` |
-| gRPC | `tonic` + `prost` |
-| HTTP server | `hyper` + `axum` |
-| CLI parsing | `clap` (derive) |
-| Prometheus metrics | `prometheus` |
-| JWT | `jsonwebtoken` |
-| TLS | `rustls` + `tokio-rustls` |
-| LevelDB | `rusty-leveldb` or `rocksdb` |
-| Reed-Solomon EC | `reed-solomon-erasure` |
-| Logging | `tracing` + `tracing-subscriber` |
-| Config (security.toml) | `toml` + `serde` |
-| CRC32 | `crc32fast` |
-| Memory-mapped files | `memmap2` |
-
----
-
-## Phased Execution Plan
-
-### Phase 1: Project Skeleton & Protobuf Codegen
-**Goal:** Cargo project compiles, proto codegen works, CLI parses all flags.
-
-**Steps:**
-
-1.1. Create `seaweed-volume/Cargo.toml` with all dependencies listed above.
-
-1.2. Copy `volume_server.proto` and `remote.proto` into `proto/`. Adjust package paths for Rust codegen.
-
-1.3. Create `build.rs` using `tonic-build` to compile `.proto` files into Rust types.
-
-1.4. Create `src/main.rs` with `clap` derive structs mirroring all 40 CLI flags from `weed/command/volume.go`:
-   - `--port` (default 8080)
-   - `--port.grpc` (default 0 → 10000+port)
-   - `--port.public` (default 0 → same as port)
-   - `--ip` (auto-detect)
-   - `--id` (default empty → ip:port)
-   - `--publicUrl`
-   - `--ip.bind`
-   - `--master` (default "localhost:9333")
-   - `--mserver` (deprecated compat)
-   - `--preStopSeconds` (default 10)
-   - `--idleTimeout` (default 30)
-   - `--dataCenter`
-   - `--rack`
-   - `--index` [memory|leveldb|leveldbMedium|leveldbLarge]
-   - `--disk` [hdd|ssd|<tag>]
-   - `--tags`
-   - `--dir` (default temp dir)
-   - `--dir.idx`
-   - `--max` (default "8")
-   - `--whiteList`
-   - `--minFreeSpacePercent` (default "1")
-   - `--minFreeSpace`
-   - `--images.fix.orientation` (default false)
-   - `--readMode` [local|proxy|redirect] (default "proxy")
-   - `--cpuprofile`
-   - `--memprofile`
-   - `--compactionMBps` (default 0)
-   - `--maintenanceMBps` (default 0)
-   - `--fileSizeLimitMB` (default 256)
-   - `--concurrentUploadLimitMB` (default 0)
-   - `--concurrentDownloadLimitMB` (default 0)
-   - `--pprof` (default false)
-   - `--metricsPort` (default 0)
-   - `--metricsIp`
-   - `--inflightUploadDataTimeout` (default 60s)
-   - `--inflightDownloadDataTimeout` (default 60s)
-   - `--hasSlowRead` (default true)
-   - `--readBufferSizeMB` (default 4)
-   - `--index.leveldbTimeout` (default 0)
-   - `--debug` (default false)
-   - `--debug.port` (default 6060)
-
-1.5. Implement the same flag validation logic from `startVolumeServer()`:
-   - Parse comma-separated `--dir`, `--max`, `--minFreeSpace`, `--disk`, `--tags`
-   - Replicate single-value-to-all-dirs expansion
-   - Validate count matches between dirs and limits
-   - `--mserver` backward compat
-
-1.6. **Test:** `cargo build` succeeds. `cargo run -- --help` shows all flags. Proto types generated.
-
-**Verification:** Run with `--port 8080 --dir /tmp --master localhost:9333` — should parse without error and print config.
-
----
-
-### Phase 2: Core Storage Types & On-Disk Format
-**Goal:** Read and write the SeaweedFS needle/volume binary format bit-for-bit compatible with Go.
-
-**Source files to port:**
-- `weed/storage/types/needle_types.go` → `src/storage/types.rs`
-- `weed/storage/needle/needle.go` → `src/storage/needle/needle.rs`
-- `weed/storage/needle/needle_read.go` → `src/storage/needle/needle_read.rs`
-- `weed/storage/needle/needle_write.go` (partial) → `src/storage/needle/needle_write.rs`
-- `weed/storage/needle/crc.go` → `src/storage/needle/crc.rs`
-- `weed/storage/needle/needle_value_map.go` → `src/storage/needle/needle_value.rs`
-- `weed/storage/super_block/super_block.go` → `src/storage/super_block.rs`
-- `weed/storage/idx/` → `src/storage/idx/`
-
-**Steps:**
-
-2.1. **Fundamental types** (`types.rs`):
-   - `NeedleId` (u64), `Offset` (u32 or u64 depending on version), `Size` (i32, negative = deleted)
-   - `Cookie` (u32)
-   - `DiskType` enum (HDD, SSD, Custom)
-   - Version constants (Version1=1, Version2=2, Version3=3, CurrentVersion=3)
-   - Byte serialization matching Go's `binary.BigEndian` encoding
-
-2.2. **SuperBlock** (`super_block.rs`):
-   - 8-byte header: Version(1) + ReplicaPlacement(1) + TTL(2) + CompactRevision(2) + Reserved(2)
-   - `ReplicaPlacement` struct with same/diff rack/dc counts
-   - `TTL` struct with count + unit
-   - Read/write from first 8 bytes of `.dat` file
-   - Match exact byte layout from `super_block.go`
-
-2.3. **Needle binary format** (`needle.rs`, `needle_read.rs`):
-   - Version 2/3 header: Cookie(4) + NeedleId(8) + Size(4)
-   - Body: Data, Flags, Name, Mime, PairsSize, Pairs, LastModified, TTL, Checksum, AppendAtNs, Padding
-   - CRC32 checksum (matching Go's `crc32.ChecksumIEEE`)
-   - Padding to 8-byte alignment
-   - Read path: read header → compute body length → read body → verify CRC
-
-2.4. **Idx file format** (`idx/`):
-   - Fixed 16-byte records: NeedleId(8) + Offset(4) + Size(4)
-   - Sequential append-only file
-   - Walk/iterate all entries
-   - Binary search not used (loaded into memory map)
-
-2.5. **NeedleMap (in-memory)** (`needle_map.rs`):
-   - HashMap<NeedleId, NeedleValue> where NeedleValue = {Offset, Size}
-   - Load from `.idx` file on volume mount
-   - Support Get, Set, Delete operations
-   - Track file count, deleted count, deleted byte count
-
-2.6. **Tests:**
-   - Unit test: write a needle to bytes → read it back → verify fields match
-   - Unit test: write/read SuperBlock round-trip
-   - Unit test: write/read idx entries round-trip
-   - **Cross-compat test:** Use Go volume server to create a small volume with known data. Read it from Rust and verify all needles decoded correctly. (Keep test fixture `.dat`/`.idx` files in `tests/fixtures/`)
-
----
-
-### Phase 3: Volume Struct & Lifecycle
-**Goal:** Mount, read from, write to, and unmount a volume.
-
-**Source files to port:**
-- `weed/storage/volume.go` → `src/storage/volume.rs`
-- `weed/storage/volume_read.go` → `src/storage/volume_read.rs`
-- `weed/storage/volume_write.go` → `src/storage/volume_write.rs`
-- `weed/storage/volume_loading.go`
-- `weed/storage/volume_vacuum.go` → `src/storage/volume_compact.rs`
-- `weed/storage/volume_info/volume_info.go` → `src/storage/volume_info.rs`
-- `weed/storage/volume_super_block.go`
-
-**Steps:**
-
-3.1. **Volume struct** (`volume.rs`):
-   - Fields: Id, dir, dataFile, nm (NeedleMap), SuperBlock, readOnly, lastModifiedTs, lastCompactIndexOffset, lastCompactRevision
-   - `noWriteOrDelete` / `noWriteCanDelete` / `readOnly` state flags
-   - File handles for `.dat` file (read + append)
-   - Lock strategy: `RwLock` for concurrent reads, exclusive writes
-
-3.2. **Volume loading** — exact logic from `volume_loading.go`:
-   - Open `.dat` file, read SuperBlock from first 8 bytes
-   - Load `.idx` file into NeedleMap
-   - Handle `.vif` (VolumeInfo) JSON sidecar file
-   - Set volume state based on SuperBlock + VolumeInfo
-
-3.3. **Volume read** (`volume_read.rs`) — from `volume_read.go`:
-   - `ReadNeedle(needleId, cookie)`: lookup in NeedleMap → seek in .dat → read needle bytes → verify cookie + CRC → return data
-   - Handle deleted needles (Size < 0)
-   - `ReadNeedleBlob(offset, size)`: raw blob read
-   - `ReadNeedleMeta(needleId, offset, size)`: read metadata only
-
-3.4. **Volume write** (`volume_write.rs`) — from `volume_write.go`:
-   - `WriteNeedle(needle)`: serialize needle → append to .dat → update .idx → update NeedleMap
-   - `DeleteNeedle(needleId)`: mark as deleted in NeedleMap + append tombstone to .idx
-   - File size limit check
-   - Concurrent write serialization (mutex on write path)
-
-3.5. **Volume compaction** (`volume_compact.rs`) — from `volume_vacuum.go`:
-   - `CheckCompact()`: compute garbage ratio
-   - `Compact()`: create new .dat/.idx, copy only live needles, update compact revision
-   - `CommitCompact()`: rename compacted files over originals
-   - `CleanupCompact()`: remove temp files
-   - Throttle by `compactionBytePerSecond`
-
-3.6. **Volume info** (`volume_info.rs`):
-   - Read/write `.vif` JSON sidecar
-   - VolumeInfo protobuf struct mapping
-   - Remote file references for tiered storage
-
-3.7. **Tests:**
-   - Mount a volume, write 100 needles, read them all back, verify content
-   - Delete 50 needles, verify they return "deleted"
-   - Compact, verify only 50 remain, verify content
-   - Read Go-created volume fixtures
-
----
-
-### Phase 4: Store (Multi-Volume, Multi-Disk Manager)
-**Goal:** Manage multiple volumes across multiple disk directories.
-
-**Source files to port:**
-- `weed/storage/store.go` → `src/storage/store.rs`
-- `weed/storage/disk_location.go` → `src/storage/disk_location.rs`
-- `weed/storage/store_ec.go`
-- `weed/storage/store_state.go`
-
-**Steps:**
-
-4.1. **DiskLocation** (`disk_location.rs`):
-   - Directory path, max volume count, min free space, disk type, tags
-   - Load all volumes from directory on startup
-   - Track free space, check writable
-
-4.2. **Store** (`store.rs`):
-   - Vector of `DiskLocation`s
-   - `GetVolume(volumeId)` → lookup across all locations
-   - `HasVolume(volumeId)` check
-   - `AllocateVolume(...)` — create new volume in appropriate location
-   - `DeleteVolume(...)`, `MountVolume(...)`, `UnmountVolume(...)`
-   - `DeleteCollection(collection)` — delete all volumes of a collection
-   - Collect volume status for heartbeat
-   - `SetStopping()`, `Close()`
-   - Persistent state (maintenance mode) via `store_state.go`
-
-4.3. **Store state** — `VolumeServerState` protobuf with maintenance flag, persisted to disk.
-
-4.4. **Tests:**
-   - Create store with 2 dirs, allocate volumes in each, verify load balancing
-   - Mount/unmount/delete lifecycle
-   - State persistence across restart
-
----
-
-### Phase 5: Erasure Coding
-**Goal:** Full EC shard encode/decode/read/write/rebuild.
-
-**Source files to port:**
-- `weed/storage/erasure_coding/` (3,599 lines)
-
-**Steps:**
-
-5.1. **EC volume + shard structs** — `EcVolume`, `EcShard` with file handles for `.ec00`–`.ec13` shard files + `.ecx` index + `.ecj` journal.
-
-5.2. **EC encoder** — Reed-Solomon 10+4 (configurable) encoding using `reed-solomon-erasure` crate:
-   - `VolumeEcShardsGenerate`: read .dat → split into data shards → compute parity → write .ec00-.ec13 + .ecx
-
-5.3. **EC decoder/reader** — reconstruct data from any 10 of 14 shards:
-   - `EcShardRead`: read range from a specific shard
-   - Locate needle in EC volume via .ecx index
-   - Handle cross-shard needle reads
-
-5.4. **EC shard operations:**
-   - Copy, delete, mount, unmount shards
-   - `VolumeEcShardsRebuild`: rebuild missing shards from remaining
-   - `VolumeEcShardsToVolume`: reconstruct .dat from EC shards
-   - `VolumeEcBlobDelete`: mark deleted in EC journal
-   - `VolumeEcShardsInfo`: report shard metadata
-
-5.5. **Tests:**
-   - Encode a volume → verify 14 shards created
-   - Delete 4 shards → rebuild → verify data intact
-   - Read individual needles from EC volume
-   - Cross-compat with Go-generated EC shards
-
----
-
-### Phase 6: Backend / Tiered Storage
-**Goal:** Support tiered storage to remote backends (S3, etc).
-
-**Source files to port:**
-- `weed/storage/backend/` (1,850 lines)
-
-**Steps:**
-
-6.1. **Backend trait** — abstract `BackendStorage` trait with `ReadAt`, `WriteAt`, `Truncate`, `Close`, `Name`.
-
-6.2. **Disk backend** — default local disk implementation.
-
-6.3. **S3 backend** — upload .dat to S3, read ranges via S3 range requests.
-
-6.4. **Tier move operations:**
-   - `VolumeTierMoveDatToRemote`: upload .dat to remote, optionally delete local
-   - `VolumeTierMoveDatFromRemote`: download .dat from remote
-
-6.5. **Tests:**
-   - Disk backend read/write round-trip
-   - S3 backend with mock/localstack
-
----
-
-### Phase 7: Security Layer
-**Goal:** JWT authentication, whitelist guard, TLS configuration.
-
-**Source files to port:**
-- `weed/security/guard.go` → `src/security/guard.rs`
-- `weed/security/jwt.go` → `src/security/jwt.rs`
-- `weed/security/tls.go` → `src/security/tls.rs`
-
-**Steps:**
-
-7.1. **Guard** (`guard.rs`):
-   - Whitelist IP check (exact match on `r.RemoteAddr`)
-   - Wrap handlers with whitelist enforcement
-   - `UpdateWhiteList()` for live reload
-
-7.2. **JWT** (`jwt.rs`):
-   - `SeaweedFileIdClaims` with `fid` field
-   - Sign with HMAC-SHA256
-   - Verify + decode with expiry check
-   - Separate signing keys for read vs write
-   - `GetJwt(request)` — extract from `Authorization: Bearer` header or `jwt` query param
-
-7.3. **TLS** (`tls.rs`):
-   - Load server TLS cert/key for gRPC and HTTPS
-   - Load client TLS for mutual TLS
-   - Read from `security.toml` config (same format as Go's viper config)
-
-7.4. **Tests:**
-   - JWT sign → verify round-trip
-   - JWT with wrong key → reject
-   - JWT with expired token → reject
-   - JWT fid mismatch → reject
-   - Whitelist allow/deny
-
----
-
-### Phase 8: Prometheus Metrics
-**Goal:** Export same metric names as Go for dashboard compatibility.
-
-**Source files to port:**
-- `weed/stats/metrics.go` (volume server counters/gauges/histograms)
-
-**Steps:**
-
-8.1. Define all Prometheus metrics matching Go names:
-   - `VolumeServerRequestCounter` (labels: method, status)
-   - `VolumeServerRequestHistogram` (labels: method)
-   - `VolumeServerInFlightRequestsGauge` (labels: method)
-   - `VolumeServerInFlightUploadSize`
-   - `VolumeServerInFlightDownloadSize`
-   - `VolumeServerConcurrentUploadLimit`
-   - `VolumeServerConcurrentDownloadLimit`
-   - `VolumeServerHandlerCounter` (labels: type — UploadLimitCond, DownloadLimitCond)
-   - Read/Write/Delete request counters
-
-8.2. Metrics HTTP endpoint on `--metricsPort`.
-
-8.3. Optional push-based metrics loop (`LoopPushingMetric`).
-
-8.4. **Test:** Verify metric names and labels match Go output.
-
----
-
-### Phase 9: HTTP Server & Handlers
-**Goal:** All HTTP endpoints with exact same behavior as Go.
-
-**Source files to port:**
-- `weed/server/volume_server.go` → `src/server/volume_server.rs`
-- `weed/server/volume_server_handlers.go` → `src/server/http_handlers.rs`
-- `weed/server/volume_server_handlers_read.go` → `src/server/http_read.rs`
-- `weed/server/volume_server_handlers_write.go` → `src/server/http_write.rs`
-- `weed/server/volume_server_handlers_admin.go` → `src/server/http_admin.rs`
-- `weed/server/volume_server_handlers_helper.go` (URL parsing, proxy, JSON responses)
-- `weed/server/volume_server_handlers_ui.go` → `src/server/http_admin.rs`
-
-**Steps:**
-
-9.1. **URL path parsing** — from `handlers_helper.go`:
-   - Parse `/<vid>,<fid>` and `/<vid>/<fid>` patterns
-   - Extract volume ID, file ID, filename, ext
-
-9.2. **Route dispatch** — from `privateStoreHandler` and `publicReadOnlyHandler`:
-   - `GET /` → `GetOrHeadHandler`
-   - `HEAD /` → `GetOrHeadHandler`
-   - `POST /` → `PostHandler` (whitelist gated)
-   - `PUT /` → `PostHandler` (whitelist gated)
-   - `DELETE /` → `DeleteHandler` (whitelist gated)
-   - `OPTIONS /` → CORS preflight
-   - `GET /status` → JSON status
-   - `GET /healthz` → health check
-   - `GET /ui/index.html` → HTML UI page
-   - Static resources (CSS/JS for UI)
-
-9.3. **GET/HEAD handler** (`http_read.rs`) — from `handlers_read.go` (468 lines):
-   - JWT read authorization check
-   - Lookup needle by volume ID + needle ID + cookie
-   - ETag / If-None-Match / If-Modified-Since conditional responses
-   - Content-Type from stored MIME or filename extension
-   - Content-Disposition header
-   - Content-Encoding (gzip/zstd stored data)
-   - Range request support (HTTP 206 Partial Content)
-   - JPEG orientation fix (if configured)
-   - Proxy to replica on local miss (readMode=proxy)
-   - Redirect to replica (readMode=redirect)
-   - Download tracking (in-flight size accounting)
-
-9.4. **POST/PUT handler** (`http_write.rs`) — from `handlers_write.go` (170 lines):
-   - JWT write authorization check
-   - Multipart form parsing
-   - Extract file data, filename, content type, TTL, last-modified
-   - Optional gzip/zstd compression
-   - Write needle to volume
-   - Replicate to peers (same logic as Go's `DistributedOperation`)
-   - Return JSON: {name, size, eTag, error}
-
-9.5. **DELETE handler** — already in handlers.go:
-   - JWT authorization
-   - Delete from local volume
-   - Replicate delete to peers
-   - Return JSON result
-
-9.6. **Admin handlers** (`http_admin.rs`):
-   - `/status` → JSON with volumes, version, disk status
-   - `/healthz` → 200 OK if serving
-   - `/ui/index.html` → HTML dashboard
-
-9.7. **Concurrency limiting** — from `handlers.go`:
-   - Upload concurrency limit with `sync::Condvar` + timeout
-   - Download concurrency limit with proxy fallback to replicas
-   - HTTP 429 on timeout, 499 on client cancel
-   - Replication traffic bypasses upload limits
-
-9.8. **Public port** — if configured, separate listener with read-only routes (GET/HEAD/OPTIONS only).
-
-9.9. **Request ID middleware** — generate unique request ID per request.
-
-9.10. **Tests:**
-   - Integration: start server → upload file via POST → GET it back → verify content
-   - Integration: upload → DELETE → GET returns 404
-   - Integration: conditional GET with ETag → 304
-   - Integration: range request → 206 with correct bytes
-   - Integration: exceed upload limit → 429
-   - Integration: whitelist enforcement
-   - Integration: JWT enforcement
-
----
-
-### Phase 10: gRPC Service Implementation
-**Goal:** All 40 gRPC methods with exact logic.
-
-**Source files to port:**
-- `weed/server/volume_grpc_admin.go` (380 lines)
-- `weed/server/volume_grpc_vacuum.go` (124 lines)
-- `weed/server/volume_grpc_copy.go` (636 lines)
-- `weed/server/volume_grpc_copy_incremental.go` (66 lines)
-- `weed/server/volume_grpc_read_write.go` (74 lines)
-- `weed/server/volume_grpc_batch_delete.go` (124 lines)
-- `weed/server/volume_grpc_tail.go` (140 lines)
-- `weed/server/volume_grpc_erasure_coding.go` (619 lines)
-- `weed/server/volume_grpc_scrub.go` (121 lines)
-- `weed/server/volume_grpc_tier_upload.go` (98 lines)
-- `weed/server/volume_grpc_tier_download.go` (85 lines)
-- `weed/server/volume_grpc_remote.go` (95 lines)
-- `weed/server/volume_grpc_query.go` (69 lines)
-- `weed/server/volume_grpc_state.go` (26 lines)
-- `weed/server/volume_grpc_read_all.go` (35 lines)
-- `weed/server/volume_grpc_client_to_master.go` (325 lines)
-
-**Steps (grouped by functional area):**
-
-10.1. **Implement `tonic::Service` for `VolumeServer`** — the generated trait from proto.
-
-10.2. **Admin RPCs** (`grpc_admin.rs`):
-   - `AllocateVolume` — create volume on appropriate disk location
-   - `VolumeMount` / `VolumeUnmount` / `VolumeDelete`
-   - `VolumeMarkReadonly` / `VolumeMarkWritable`
-   - `VolumeConfigure` — change replication
-   - `VolumeStatus` — return read-only, size, file counts
-   - `VolumeServerStatus` — disk statuses, memory, version, DC, rack
-   - `VolumeServerLeave` — deregister from master
-   - `DeleteCollection`
-   - `VolumeNeedleStatus` — get needle metadata by ID
-   - `Ping` — latency measurement
-   - `GetState` / `SetState` — maintenance mode
-
-10.3. **Vacuum RPCs** (`grpc_vacuum.rs`):
-   - `VacuumVolumeCheck` — return garbage ratio
-   - `VacuumVolumeCompact` — stream progress (streaming response)
-   - `VacuumVolumeCommit` — finalize compaction
-   - `VacuumVolumeCleanup` — remove temp files
-
-10.4. **Copy RPCs** (`grpc_copy.rs`):
-   - `VolumeCopy` — stream .dat/.idx from source to create local copy
-   - `VolumeSyncStatus` — return sync metadata
-   - `VolumeIncrementalCopy` — stream .dat delta since timestamp (streaming)
-   - `CopyFile` — generic file copy by extension (streaming)
-   - `ReceiveFile` — receive streamed file (client streaming)
-   - `ReadVolumeFileStatus` — return file timestamps and sizes
-
-10.5. **Read/Write RPCs** (`grpc_read_write.rs`):
-   - `ReadNeedleBlob` — raw needle blob read
-   - `ReadNeedleMeta` — needle metadata
-   - `WriteNeedleBlob` — raw needle blob write
-   - `ReadAllNeedles` — stream all needles from volume(s) (streaming)
-
-10.6. **Batch delete** (`grpc_batch_delete.rs`):
-   - `BatchDelete` — delete multiple file IDs, return per-ID results
-
-10.7. **Tail RPCs** (`grpc_tail.rs`):
-   - `VolumeTailSender` — stream new needles since timestamp (streaming)
-   - `VolumeTailReceiver` — connect to another volume server and tail its changes
-
-10.8. **Erasure coding RPCs** (`grpc_erasure_coding.rs`):
-   - `VolumeEcShardsGenerate` — generate EC shards from volume
-   - `VolumeEcShardsRebuild` — rebuild missing shards
-   - `VolumeEcShardsCopy` — copy shards from another server
-   - `VolumeEcShardsDelete` — delete EC shards
-   - `VolumeEcShardsMount` / `VolumeEcShardsUnmount`
-   - `VolumeEcShardRead` — read from EC shard (streaming)
-   - `VolumeEcBlobDelete` — mark blob deleted in EC volume
-   - `VolumeEcShardsToVolume` — reconstruct volume from EC shards
-   - `VolumeEcShardsInfo` — return shard metadata
-
-10.9. **Scrub RPCs** (`grpc_scrub.rs`):
-   - `ScrubVolume` — integrity check volumes (INDEX / FULL / LOCAL modes)
-   - `ScrubEcVolume` — integrity check EC volumes
-
-10.10. **Tier RPCs** (`grpc_tier.rs`):
-   - `VolumeTierMoveDatToRemote` — upload to remote backend (streaming progress)
-   - `VolumeTierMoveDatFromRemote` — download from remote (streaming progress)
-
-10.11. **Remote storage** (`grpc_remote.rs`):
-   - `FetchAndWriteNeedle` — fetch from remote storage, write locally, replicate
-
-10.12. **Query** (`grpc_query.rs`):
-   - `Query` — experimental CSV/JSON/Parquet select on stored data (streaming)
-
-10.13. **Master heartbeat** (`grpc_client_to_master.rs`):
-   - `heartbeat()` background task — periodic gRPC stream to master
-   - Send: volume info, EC shard info, disk stats, has-no-space flags, deleted volumes
-   - Receive: volume size limit, leader address, metrics config
-   - Reconnect on failure with backoff
-   - `StopHeartbeat()` for graceful shutdown
-
-10.14. **Tests:**
-   - Integration test per RPC: call via tonic client → verify response
-   - Streaming RPCs: verify all chunks received
-   - Error cases: invalid volume ID, non-existent volume, etc.
-   - Heartbeat: mock master gRPC server, verify registration
-
----
-
-### Phase 11: Startup, Lifecycle & Graceful Shutdown
-**Goal:** Full server startup matching Go's `runVolume()` and `startVolumeServer()`.
-
-**Steps:**
-
-11.1. **Startup sequence** (match `volume.go` exactly):
-   1. Load security configuration from `security.toml`
-   2. Start metrics server on metrics port
-   3. Parse folder/max/minFreeSpace/diskType/tags
-   4. Validate all directory writable
-   5. Resolve IP, bind IP, public URL, gRPC port
-   6. Create `VolumeServer` struct
-   7. Check with master (initial handshake)
-   8. Create `Store` (loads all existing volumes from disk)
-   9. Create security `Guard`
-   10. Register HTTP routes on admin mux
-   11. Optionally register public mux
-   12. Start gRPC server on gRPC port
-   13. Start public HTTP server (if separated)
-   14. Start cluster HTTP server (with optional TLS)
-   15. Start heartbeat background task
-   16. Start metrics push loop
-   17. Register SIGHUP handler for config reload + new volume loading
-
-11.2. **Graceful shutdown** (match Go exactly):
-   1. On SIGINT/SIGTERM:
-   2. Stop heartbeat (notify master we're leaving)
-   3. Wait `preStopSeconds`
-   4. Stop public HTTP server
-   5. Stop cluster HTTP server
-   6. Graceful stop gRPC server
-   7. `volumeServer.Shutdown()` → `store.Close()` (flush all volumes)
-
-11.3. **Reload** (SIGHUP):
-   - Reload security config
-   - Update whitelist
-   - Load newly appeared volumes from disk
-
-11.4. **Tests:**
-   - Start server → send SIGTERM → verify clean shutdown
-   - Start server → SIGHUP → verify config reloaded
-
----
-
-### Phase 12: Integration & Cross-Compatibility Testing
-**Goal:** Rust volume server is a drop-in replacement for Go volume server.
-
-**Steps:**
-
-12.1. **Binary compatibility tests:**
-   - Create volumes with Go volume server
-   - Start Rust volume server on same data directory
-   - Read all data → verify identical
-   - Write new data with Rust → read with Go → verify
-
-12.2. **API compatibility tests:**
-   - Run same HTTP requests against both Go and Rust servers
-   - Compare response bodies, headers, status codes
-   - Test all gRPC RPCs against both
-
-12.3. **Master interop test:**
-   - Start Go master server
-   - Register Rust volume server
-   - Verify heartbeat works
-   - Verify volume assignment works
-   - Upload via filer → stored on Rust volume server → read back
-
-12.4. **Performance benchmarks:**
-   - Throughput: sequential writes, sequential reads
-   - Latency: p50/p99 for read/write
-   - Concurrency: parallel reads/writes
-   - Compare Rust vs Go numbers
-
-12.5. **Edge cases:**
-   - Volume at max size
-   - Disk full handling
-   - Corrupt .dat file recovery
-   - Network partition during replication
-   - EC shard loss + rebuild
-
----
-
-## Execution Order & Dependencies
-
-```
-Phase 1  (Skeleton + CLI)        ← no deps, start here
-   ↓
-Phase 2  (Storage types)         ← needs Phase 1 (types used everywhere)
-   ↓
-Phase 3  (Volume struct)         ← needs Phase 2
-   ↓
-Phase 4  (Store manager)         ← needs Phase 3
-   ↓
-Phase 7  (Security)              ← independent, can parallel with 3-4
-Phase 8  (Metrics)               ← independent, can parallel with 3-4
-   ↓
-Phase 9  (HTTP server)           ← needs Phase 4 + 7 + 8
-Phase 10 (gRPC server)           ← needs Phase 4 + 7 + 8
-   ↓
-Phase 5  (Erasure coding)        ← needs Phase 4, wire into Phase 10
-Phase 6  (Tiered storage)        ← needs Phase 4, wire into Phase 10
-   ↓
-Phase 11 (Startup + shutdown)    ← needs Phase 9 + 10
-   ↓
-Phase 12 (Integration tests)     ← needs all above
-```
-
-## Estimated Scope
-
-| Phase | Estimated Rust Lines | Complexity |
-|---|---|---|
-| 1. Skeleton + CLI | ~400 | Low |
-| 2. Storage types | ~2,000 | High (binary compat critical) |
-| 3. Volume struct | ~2,500 | High |
-| 4. Store manager | ~1,000 | Medium |
-| 5. Erasure coding | ~3,000 | High |
-| 6. Tiered storage | ~1,500 | Medium |
-| 7. Security | ~500 | Medium |
-| 8. Metrics | ~300 | Low |
-| 9. HTTP server | ~2,000 | High |
-| 10. gRPC server | ~3,500 | High |
-| 11. Startup/shutdown | ~500 | Medium |
-| 12. Integration tests | ~2,000 | Medium |
-| **Total** | **~19,000** | |
-
-## Critical Invariants to Preserve
-
-1. **Binary format compatibility** — Rust must read/write `.dat`, `.idx`, `.vif`, `.ecX` files identically to Go. A single byte off = data loss.
-2. **gRPC wire compatibility** — Same proto, same field semantics. Go master must talk to Rust volume server seamlessly.
-3. **HTTP API compatibility** — Same URL patterns, same JSON response shapes, same headers, same status codes.
-4. **Replication protocol** — Write replication between Go and Rust volume servers must work bidirectionally.
-5. **Heartbeat protocol** — Rust volume server must register with Go master and maintain heartbeat.
-6. **CRC32 algorithm** — Must use IEEE polynomial (same as Go's `crc32.ChecksumIEEE`).
-7. **JWT compatibility** — Tokens signed by Go filer/master must be verifiable by Rust volume server and vice versa.

backers.md

@@ -7,8 +7,6 @@
 
 - [Evercam Camera Management Software](https://evercam.io/)
 - [Spherical Elephant GmbH](https://www.sphericalelephant.com)
-- [WizardTales GmbH](https://www.wizardtales.com)
-- [Nimbus Web Services](https://nimbusws.com)
 
 - <h2 align="center">Backers</h2>
 

cmd/weed-db/dbcmd.go

@@ -1,419 +0,0 @@
-package main
-
-import (
-	"context"
-	"crypto/tls"
-	"encoding/json"
-	"fmt"
-	"io"
-	"os"
-	"os/signal"
-	"strings"
-	"syscall"
-	"time"
-
-	"github.com/seaweedfs/seaweedfs/weed/server/postgres"
-	"github.com/seaweedfs/seaweedfs/weed/util"
-	flag "github.com/seaweedfs/seaweedfs/weed/util/fla9"
-)
-
-const usageLine = "weed-db -port=5432 -master=<master_server>"
-
-const longHelp = `Start a PostgreSQL wire protocol compatible database server that provides SQL query access to SeaweedFS.
-
-This database server enables any PostgreSQL client, tool, or application to connect to SeaweedFS
-and execute SQL queries against MQ topics. It implements the PostgreSQL wire protocol for maximum
-compatibility with the existing PostgreSQL ecosystem.
-
-Examples:
-
-	# Start database server on default port 5432
-	weed-db
-	
-	# Start with MD5 authentication using JSON format (recommended)
-	weed-db -auth=md5 -users='{"admin":"secret","readonly":"view123"}'
-	
-	# Start with complex passwords using JSON format
-	weed-db -auth=md5 -users='{"admin":"pass;with;semicolons","user":"password:with:colons"}'
-	
-	# Start with credentials from JSON file (most secure)
-	weed-db -auth=md5 -users="@/etc/seaweedfs/users.json"
-	
-	# Start with custom port and master
-	weed-db -port=5433 -master=master1:9333
-	
-	# Allow connections from any host
-	weed-db -host=0.0.0.0 -port=5432
-	
-	# Start with TLS encryption
-	weed-db -tls-cert=server.crt -tls-key=server.key
-
-Client Connection Examples:
-
-	# psql command line client
-	psql "host=localhost port=5432 dbname=default user=seaweedfs"
-	psql -h localhost -p 5432 -U seaweedfs -d default
-	
-	# With password
-	PGPASSWORD=secret psql -h localhost -p 5432 -U admin -d default
-	
-	# Connection string
-	psql "postgresql://admin:secret@localhost:5432/default"
-
-Programming Language Examples:
-
-	# Python (psycopg2)
-	import psycopg2
-	conn = psycopg2.connect(
-		host="localhost", port=5432,
-		user="seaweedfs", database="default"
-	)
-	
-	# Java JDBC
-	String url = "jdbc:postgresql://localhost:5432/default";
-	Connection conn = DriverManager.getConnection(url, "seaweedfs", "");
-	
-	# Go (lib/pq)
-	db, err := sql.Open("postgres", "host=localhost port=5432 user=seaweedfs dbname=default sslmode=disable")
-	
-	# Node.js (pg)
-	const client = new Client({
-		host: 'localhost', port: 5432,
-		user: 'seaweedfs', database: 'default'
-	});
-
-Supported SQL Operations:
-	- SELECT queries on MQ topics
-	- DESCRIBE/DESC table_name commands
-	- EXPLAIN query execution plans
-	- SHOW DATABASES/TABLES commands
-	- Aggregation functions (COUNT, SUM, AVG, MIN, MAX)
-	- WHERE clauses with filtering
-	- System columns (_timestamp_ns, _key, _source)
-	- Basic PostgreSQL system queries (version(), current_database(), current_user)
-
-Authentication Methods:
-	- trust: No authentication required (default)
-	- password: Clear text password authentication
-	- md5: MD5 password authentication
-
-User Credential Formats:
-	- JSON format: '{"user1":"pass1","user2":"pass2"}' (supports any special characters)
-	- File format: "@/path/to/users.json" (JSON file)
-	
-	Note: JSON format supports passwords with semicolons, colons, and any other special characters.
-	      File format is recommended for production to keep credentials secure.
-
-Compatible Tools:
-	- psql (PostgreSQL command line client)
-	- Any PostgreSQL JDBC/ODBC compatible tool
-
-Security Features:
-	- Multiple authentication methods
-	- TLS encryption support
-	- Read-only access (no data modification)
-
-Performance Features:
-	- Fast path aggregation optimization (COUNT, MIN, MAX without WHERE clauses)
-	- Hybrid data scanning (parquet files + live logs)
-	- PostgreSQL wire protocol
-	- Query result streaming
-
-`
-
-type Options struct {
-	Host        string
-	Port        int
-	MasterAddr  string
-	AuthMethod  string
-	Users       string
-	Database    string
-	MaxConns    int
-	IdleTimeout string
-	TLSCert     string
-	TLSKey      string
-}
-
-// Run executes the weed-db CLI.
-func Run(args []string) int {
-	fs := flag.NewFlagSet("weed-db", flag.ContinueOnError)
-	usageWriter := io.Writer(os.Stderr)
-	fs.SetOutput(usageWriter)
-
-	var opts Options
-	fs.StringVar(&opts.Host, "host", "localhost", "Database server host")
-	fs.IntVar(&opts.Port, "port", 5432, "Database server port")
-	fs.StringVar(&opts.MasterAddr, "master", "localhost:9333", "SeaweedFS master server address")
-	fs.StringVar(&opts.AuthMethod, "auth", "trust", "Authentication method: trust, password, md5")
-	fs.StringVar(&opts.Users, "users", "", "User credentials for auth (JSON format '{\"user1\":\"pass1\",\"user2\":\"pass2\"}' or file '@/path/to/users.json')")
-	fs.StringVar(&opts.Database, "database", "default", "Default database name")
-	fs.IntVar(&opts.MaxConns, "max-connections", 100, "Maximum concurrent connections per server")
-	fs.StringVar(&opts.IdleTimeout, "idle-timeout", "1h", "Connection idle timeout")
-	fs.StringVar(&opts.TLSCert, "tls-cert", "", "TLS certificate file path")
-	fs.StringVar(&opts.TLSKey, "tls-key", "", "TLS private key file path")
-
-	fs.Usage = func() {
-		fmt.Fprintf(usageWriter, "Usage: %s\n\n%s\n", usageLine, longHelp)
-		fmt.Fprintln(usageWriter, "Default Parameters:")
-		fs.PrintDefaults()
-	}
-
-	if err := fs.Parse(args); err != nil {
-		return 2
-	}
-
-	if !runWithOptions(&opts) {
-		return 1
-	}
-	return 0
-}
-
-func runWithOptions(opts *Options) bool {
-	util.LoadConfiguration("security", false)
-
-	// Validate options.
-	if opts.MasterAddr == "" {
-		fmt.Fprintf(os.Stderr, "Error: master address is required\n")
-		return false
-	}
-
-	// Parse authentication method.
-	authMethod, err := parseAuthMethod(opts.AuthMethod)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
-		return false
-	}
-
-	// Parse user credentials.
-	users, err := parseUsers(opts.Users, authMethod)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
-		return false
-	}
-
-	// Parse idle timeout.
-	idleTimeout, err := time.ParseDuration(opts.IdleTimeout)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Error parsing idle timeout: %v\n", err)
-		return false
-	}
-
-	// Validate port number.
-	if err := validatePortNumber(opts.Port); err != nil {
-		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
-		return false
-	}
-
-	// Setup TLS if requested.
-	var tlsConfig *tls.Config
-	if opts.TLSCert != "" && opts.TLSKey != "" {
-		cert, err := tls.LoadX509KeyPair(opts.TLSCert, opts.TLSKey)
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "Error loading TLS certificates: %v\n", err)
-			return false
-		}
-		tlsConfig = &tls.Config{
-			Certificates: []tls.Certificate{cert},
-		}
-	}
-
-	// Create server configuration.
-	config := &postgres.PostgreSQLServerConfig{
-		Host:        opts.Host,
-		Port:        opts.Port,
-		AuthMethod:  authMethod,
-		Users:       users,
-		Database:    opts.Database,
-		MaxConns:    opts.MaxConns,
-		IdleTimeout: idleTimeout,
-		TLSConfig:   tlsConfig,
-	}
-
-	// Create database server.
-	dbServer, err := postgres.NewPostgreSQLServer(config, opts.MasterAddr)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Error creating database server: %v\n", err)
-		return false
-	}
-
-	// Print startup information.
-	fmt.Printf("Starting SeaweedFS Database Server...\n")
-	fmt.Printf("Host: %s\n", opts.Host)
-	fmt.Printf("Port: %d\n", opts.Port)
-	fmt.Printf("Master: %s\n", opts.MasterAddr)
-	fmt.Printf("Database: %s\n", opts.Database)
-	fmt.Printf("Auth Method: %s\n", opts.AuthMethod)
-	fmt.Printf("Max Connections: %d\n", opts.MaxConns)
-	fmt.Printf("Idle Timeout: %s\n", opts.IdleTimeout)
-	if tlsConfig != nil {
-		fmt.Printf("TLS: Enabled\n")
-	} else {
-		fmt.Printf("TLS: Disabled\n")
-	}
-	if len(users) > 0 {
-		fmt.Printf("Users: %d configured\n", len(users))
-	}
-
-	fmt.Printf("\nDatabase Connection Examples:\n")
-	fmt.Printf("  psql -h %s -p %d -U seaweedfs -d %s\n", opts.Host, opts.Port, opts.Database)
-	if len(users) > 0 {
-		// Show first user as example.
-		for username := range users {
-			fmt.Printf("  psql -h %s -p %d -U %s -d %s\n", opts.Host, opts.Port, username, opts.Database)
-			break
-		}
-	}
-	fmt.Printf("  postgresql://%s:%d/%s\n", opts.Host, opts.Port, opts.Database)
-
-	fmt.Printf("\nSupported Operations:\n")
-	fmt.Printf("  - SELECT queries on MQ topics\n")
-	fmt.Printf("  - DESCRIBE/DESC table_name\n")
-	fmt.Printf("  - EXPLAIN query execution plans\n")
-	fmt.Printf("  - SHOW DATABASES/TABLES\n")
-	fmt.Printf("  - Aggregations: COUNT, SUM, AVG, MIN, MAX\n")
-	fmt.Printf("  - System columns: _timestamp_ns, _key, _source\n")
-	fmt.Printf("  - Basic PostgreSQL system queries\n")
-
-	fmt.Printf("\nReady for database connections!\n\n")
-
-	// Start the server.
-	err = dbServer.Start()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Error starting database server: %v\n", err)
-		return false
-	}
-
-	// Set up signal handling for graceful shutdown.
-	sigChan := make(chan os.Signal, 1)
-	signal.Notify(sigChan, syscall.SIGINT, syscall.SIGTERM)
-
-	// Wait for shutdown signal.
-	<-sigChan
-	fmt.Printf("\nReceived shutdown signal, stopping database server...\n")
-
-	// Create context with timeout for graceful shutdown.
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	// Stop the server with timeout.
-	done := make(chan error, 1)
-	go func() {
-		done <- dbServer.Stop()
-	}()
-
-	select {
-	case err := <-done:
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "Error stopping database server: %v\n", err)
-			return false
-		}
-		fmt.Printf("Database server stopped successfully\n")
-	case <-ctx.Done():
-		fmt.Fprintf(os.Stderr, "Timeout waiting for database server to stop\n")
-		return false
-	}
-
-	return true
-}
-
-// parseAuthMethod parses the authentication method string.
-func parseAuthMethod(method string) (postgres.AuthMethod, error) {
-	switch strings.ToLower(method) {
-	case "trust":
-		return postgres.AuthTrust, nil
-	case "password":
-		return postgres.AuthPassword, nil
-	case "md5":
-		return postgres.AuthMD5, nil
-	default:
-		return postgres.AuthTrust, fmt.Errorf("unsupported auth method '%s'. Supported: trust, password, md5", method)
-	}
-}
-
-// parseUsers parses the user credentials string with support for secure formats only.
-// Supported formats:
-// 1. JSON format: {"username":"password","username2":"password2"}
-// 2. File format: /path/to/users.json or @/path/to/users.json
-func parseUsers(usersStr string, authMethod postgres.AuthMethod) (map[string]string, error) {
-	users := make(map[string]string)
-
-	if usersStr == "" {
-		// No users specified.
-		if authMethod != postgres.AuthTrust {
-			return nil, fmt.Errorf("users must be specified when auth method is not 'trust'")
-		}
-		return users, nil
-	}
-
-	// Trim whitespace.
-	usersStr = strings.TrimSpace(usersStr)
-
-	// Determine format and parse accordingly.
-	if strings.HasPrefix(usersStr, "{") && strings.HasSuffix(usersStr, "}") {
-		// JSON format.
-		return parseUsersJSON(usersStr, authMethod)
-	}
-
-	// Check if it's a file path (with or without @ prefix) before declaring invalid format.
-	filePath := strings.TrimPrefix(usersStr, "@")
-	if _, err := os.Stat(filePath); err == nil {
-		// File format.
-		return parseUsersFile(usersStr, authMethod) // Pass original string to preserve @ handling.
-	}
-
-	// Invalid format.
-	return nil, fmt.Errorf("invalid user credentials format. Use JSON format '{\"user\":\"pass\"}' or file format '@/path/to/users.json' or 'path/to/users.json'. Legacy semicolon-separated format is no longer supported")
-}
-
-// parseUsersJSON parses user credentials from JSON format.
-func parseUsersJSON(jsonStr string, authMethod postgres.AuthMethod) (map[string]string, error) {
-	var users map[string]string
-	if err := json.Unmarshal([]byte(jsonStr), &users); err != nil {
-		return nil, fmt.Errorf("invalid JSON format for users: %v", err)
-	}
-
-	// Validate users.
-	for username, password := range users {
-		if username == "" {
-			return nil, fmt.Errorf("empty username in JSON user specification")
-		}
-		if authMethod != postgres.AuthTrust && password == "" {
-			return nil, fmt.Errorf("empty password for user '%s' with auth method", username)
-		}
-	}
-
-	return users, nil
-}
-
-// parseUsersFile parses user credentials from a JSON file.
-func parseUsersFile(filePath string, authMethod postgres.AuthMethod) (map[string]string, error) {
-	// Remove @ prefix if present.
-	filePath = strings.TrimPrefix(filePath, "@")
-
-	// Read file content.
-	content, err := os.ReadFile(filePath)
-	if err != nil {
-		return nil, fmt.Errorf("failed to read users file '%s': %v", filePath, err)
-	}
-
-	contentStr := strings.TrimSpace(string(content))
-
-	// File must contain JSON format.
-	if !strings.HasPrefix(contentStr, "{") || !strings.HasSuffix(contentStr, "}") {
-		return nil, fmt.Errorf("users file '%s' must contain JSON format: {\"user\":\"pass\"}. Legacy formats are no longer supported", filePath)
-	}
-
-	// Parse as JSON.
-	return parseUsersJSON(contentStr, authMethod)
-}
-
-// validatePortNumber validates that the port number is reasonable.
-func validatePortNumber(port int) error {
-	if port < 1 || port > 65535 {
-		return fmt.Errorf("port number must be between 1 and 65535, got %d", port)
-	}
-	if port < 1024 {
-		fmt.Fprintf(os.Stderr, "Warning: port number %d may require root privileges\n", port)
-	}
-	return nil
-}

cmd/weed-db/main.go

@@ -1,7 +0,0 @@
-package main
-
-import "os"
-
-func main() {
-	os.Exit(Run(os.Args[1:]))
-}

cmd/weed-sql/main.go

@@ -1,7 +0,0 @@
-package main
-
-import "os"
-
-func main() {
-	os.Exit(Run(os.Args[1:]))
-}

cmd/weed-sql/sqlcmd.go

@@ -1,623 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/csv"
-	"encoding/json"
-	"fmt"
-	"io"
-	"os"
-	"path"
-	"strings"
-	"time"
-
-	"github.com/peterh/liner"
-	"github.com/seaweedfs/seaweedfs/weed/query/engine"
-	flag "github.com/seaweedfs/seaweedfs/weed/util/fla9"
-	"github.com/seaweedfs/seaweedfs/weed/util/grace"
-	"github.com/seaweedfs/seaweedfs/weed/util/sqlutil"
-)
-
-const usageLine = "weed-sql [-master=localhost:9333] [-interactive] [-file=query.sql] [-output=table|json|csv] [-database=dbname] [-query=\"SQL\"]"
-
-const longHelp = `Enhanced SQL interface for SeaweedFS Message Queue topics with multiple execution modes.
-
-Execution Modes:
-- Interactive shell (default): weed-sql -interactive
-- Single query: weed-sql -query "SELECT * FROM user_events"
-- Batch from file: weed-sql -file queries.sql
-- Context switching: weed-sql -database analytics -interactive
-
-Output Formats:
-- table: ASCII table format (default for interactive)
-- json: JSON format (default for non-interactive)
-- csv: Comma-separated values
-
-Features:
-- Full WHERE clause support (=, <, >, <=, >=, !=, LIKE, IN)
-- Advanced pattern matching with LIKE wildcards (%, _)
-- Multi-value filtering with IN operator
-- Real MQ namespace and topic discovery
-- Database context switching
-
-Examples:
-  weed-sql -interactive
-  weed-sql -query "SHOW DATABASES" -output json
-  weed-sql -file batch_queries.sql -output csv
-  weed-sql -database analytics -query "SELECT COUNT(*) FROM metrics"
-  weed-sql -master broker1:9333 -interactive
-`
-
-type Options struct {
-	Master      string
-	Interactive bool
-	File        string
-	Output      string
-	Database    string
-	Query       string
-}
-
-// OutputFormat represents different output formatting options.
-type OutputFormat string
-
-const (
-	OutputTable OutputFormat = "table"
-	OutputJSON  OutputFormat = "json"
-	OutputCSV   OutputFormat = "csv"
-)
-
-// SQLContext holds the execution context for SQL operations.
-type SQLContext struct {
-	engine          *engine.SQLEngine
-	currentDatabase string
-	outputFormat    OutputFormat
-	interactive     bool
-	master          string
-}
-
-// Run executes the weed-sql CLI.
-func Run(args []string) int {
-	fs := flag.NewFlagSet("weed-sql", flag.ContinueOnError)
-	usageWriter := io.Writer(os.Stderr)
-	fs.SetOutput(usageWriter)
-
-	var opts Options
-	fs.StringVar(&opts.Master, "master", "localhost:9333", "SeaweedFS master server HTTP address")
-	fs.BoolVar(&opts.Interactive, "interactive", false, "start interactive shell mode")
-	fs.StringVar(&opts.File, "file", "", "execute SQL queries from file")
-	fs.StringVar(&opts.Output, "output", "", "output format: table, json, csv (auto-detected if not specified)")
-	fs.StringVar(&opts.Database, "database", "", "default database context")
-	fs.StringVar(&opts.Query, "query", "", "execute single SQL query")
-
-	fs.Usage = func() {
-		fmt.Fprintf(usageWriter, "Usage: %s\n\n%s\n", usageLine, longHelp)
-		fmt.Fprintln(usageWriter, "Default Parameters:")
-		fs.PrintDefaults()
-	}
-
-	if err := fs.Parse(args); err != nil {
-		return 2
-	}
-
-	if !runWithOptions(&opts) {
-		return 1
-	}
-	return 0
-}
-
-func runWithOptions(opts *Options) bool {
-	// Initialize SQL engine with master address for service discovery.
-	sqlEngine := engine.NewSQLEngine(opts.Master)
-
-	// Determine execution mode and output format.
-	interactive := opts.Interactive || (opts.Query == "" && opts.File == "")
-	outputFormat := determineOutputFormat(opts.Output, interactive)
-
-	// Create SQL context.
-	ctx := &SQLContext{
-		engine:          sqlEngine,
-		currentDatabase: opts.Database,
-		outputFormat:    outputFormat,
-		interactive:     interactive,
-		master:          opts.Master,
-	}
-
-	// Set current database in SQL engine if specified via command line.
-	if opts.Database != "" {
-		ctx.engine.GetCatalog().SetCurrentDatabase(opts.Database)
-	}
-
-	// Execute based on mode.
-	switch {
-	case opts.Query != "":
-		// Single query mode.
-		return executeSingleQuery(ctx, opts.Query)
-	case opts.File != "":
-		// Batch file mode.
-		return executeFileQueries(ctx, opts.File)
-	default:
-		// Interactive mode.
-		return runInteractiveShell(ctx)
-	}
-}
-
-// determineOutputFormat selects the appropriate output format.
-func determineOutputFormat(specified string, interactive bool) OutputFormat {
-	switch strings.ToLower(specified) {
-	case "table":
-		return OutputTable
-	case "json":
-		return OutputJSON
-	case "csv":
-		return OutputCSV
-	default:
-		// Auto-detect based on mode.
-		if interactive {
-			return OutputTable
-		}
-		return OutputJSON
-	}
-}
-
-// executeSingleQuery executes a single query and outputs the result.
-func executeSingleQuery(ctx *SQLContext, query string) bool {
-	if ctx.outputFormat != OutputTable {
-		// Suppress banner for non-interactive output.
-		return executeAndDisplay(ctx, query, false)
-	}
-
-	fmt.Printf("Executing query against %s...\n", ctx.master)
-	return executeAndDisplay(ctx, query, true)
-}
-
-// executeFileQueries processes SQL queries from a file.
-func executeFileQueries(ctx *SQLContext, filename string) bool {
-	content, err := os.ReadFile(filename)
-	if err != nil {
-		fmt.Printf("Error reading file %s: %v\n", filename, err)
-		return false
-	}
-
-	if ctx.outputFormat == OutputTable && ctx.interactive {
-		fmt.Printf("Executing queries from %s against %s...\n", filename, ctx.master)
-	}
-
-	// Split file content into individual queries (robust approach).
-	queries := sqlutil.SplitStatements(string(content))
-
-	for i, query := range queries {
-		query = strings.TrimSpace(query)
-		if query == "" {
-			continue
-		}
-
-		if ctx.outputFormat == OutputTable && len(queries) > 1 {
-			fmt.Printf("\n--- Query %d ---\n", i+1)
-		}
-
-		if !executeAndDisplay(ctx, query, ctx.outputFormat == OutputTable) {
-			return false
-		}
-	}
-
-	return true
-}
-
-// runInteractiveShell starts the enhanced interactive shell with readline support.
-func runInteractiveShell(ctx *SQLContext) bool {
-	fmt.Println("SeaweedFS Enhanced SQL Interface")
-	fmt.Println("Type 'help;' for help, 'exit;' to quit")
-	fmt.Printf("Connected to master: %s\n", ctx.master)
-	if ctx.currentDatabase != "" {
-		fmt.Printf("Current database: %s\n", ctx.currentDatabase)
-	}
-	fmt.Println("Advanced WHERE operators supported: <=, >=, !=, LIKE, IN")
-	fmt.Println("Use up/down arrows for command history")
-	fmt.Println()
-
-	// Initialize liner for readline functionality.
-	line := liner.NewLiner()
-	defer line.Close()
-
-	// Handle Ctrl+C gracefully.
-	line.SetCtrlCAborts(true)
-	grace.OnInterrupt(func() {
-		line.Close()
-	})
-
-	// Load command history.
-	historyPath := path.Join(os.TempDir(), "weed-sql-history")
-	if f, err := os.Open(historyPath); err == nil {
-		line.ReadHistory(f)
-		f.Close()
-	}
-
-	// Save history on exit.
-	defer func() {
-		if f, err := os.Create(historyPath); err == nil {
-			line.WriteHistory(f)
-			f.Close()
-		}
-	}()
-
-	var queryBuffer strings.Builder
-
-	for {
-		// Show prompt with current database context.
-		var prompt string
-		if queryBuffer.Len() == 0 {
-			if ctx.currentDatabase != "" {
-				prompt = fmt.Sprintf("seaweedfs:%s> ", ctx.currentDatabase)
-			} else {
-				prompt = "seaweedfs> "
-			}
-		} else {
-			prompt = "    -> " // Continuation prompt.
-		}
-
-		// Read line with readline support.
-		input, err := line.Prompt(prompt)
-		if err != nil {
-			if err == liner.ErrPromptAborted {
-				fmt.Println("Query cancelled")
-				queryBuffer.Reset()
-				continue
-			}
-			if err != io.EOF {
-				fmt.Printf("Input error: %v\n", err)
-			}
-			break
-		}
-
-		lineStr := strings.TrimSpace(input)
-
-		// Handle empty lines.
-		if lineStr == "" {
-			continue
-		}
-
-		// Accumulate lines in query buffer.
-		if queryBuffer.Len() > 0 {
-			queryBuffer.WriteString(" ")
-		}
-		queryBuffer.WriteString(lineStr)
-
-		// Check if we have a complete statement (ends with semicolon or special command).
-		fullQuery := strings.TrimSpace(queryBuffer.String())
-		isComplete := strings.HasSuffix(lineStr, ";") ||
-			isSpecialCommand(fullQuery)
-
-		if !isComplete {
-			continue // Continue reading more lines.
-		}
-
-		// Add completed command to history.
-		line.AppendHistory(fullQuery)
-
-		// Handle special commands (with or without semicolon).
-		cleanQuery := strings.TrimSuffix(fullQuery, ";")
-		cleanQuery = strings.TrimSpace(cleanQuery)
-
-		if cleanQuery == "exit" || cleanQuery == "quit" || cleanQuery == "\\q" {
-			fmt.Println("Goodbye!")
-			break
-		}
-
-		if cleanQuery == "help" {
-			showEnhancedHelp()
-			queryBuffer.Reset()
-			continue
-		}
-
-		// Handle database switching - use proper SQL parser instead of manual parsing.
-		if strings.HasPrefix(strings.ToUpper(cleanQuery), "USE ") {
-			// Execute USE statement through the SQL engine for proper parsing.
-			result, err := ctx.engine.ExecuteSQL(context.Background(), cleanQuery)
-			if err != nil {
-				fmt.Printf("Error: %v\n\n", err)
-			} else if result.Error != nil {
-				fmt.Printf("Error: %v\n\n", result.Error)
-			} else {
-				// Extract the database name from the result message for CLI context.
-				if len(result.Rows) > 0 && len(result.Rows[0]) > 0 {
-					message := result.Rows[0][0].ToString()
-					// Extract database name from "Database changed to: dbname".
-					if strings.HasPrefix(message, "Database changed to: ") {
-						ctx.currentDatabase = strings.TrimPrefix(message, "Database changed to: ")
-					}
-					fmt.Printf("%s\n\n", message)
-				}
-			}
-			queryBuffer.Reset()
-			continue
-		}
-
-		// Handle output format switching.
-		if strings.HasPrefix(strings.ToUpper(cleanQuery), "\\FORMAT ") {
-			format := strings.TrimSpace(strings.TrimPrefix(strings.ToUpper(cleanQuery), "\\FORMAT "))
-			switch format {
-			case "TABLE":
-				ctx.outputFormat = OutputTable
-				fmt.Println("Output format set to: table")
-			case "JSON":
-				ctx.outputFormat = OutputJSON
-				fmt.Println("Output format set to: json")
-			case "CSV":
-				ctx.outputFormat = OutputCSV
-				fmt.Println("Output format set to: csv")
-			default:
-				fmt.Printf("Invalid format: %s. Supported: table, json, csv\n", format)
-			}
-			queryBuffer.Reset()
-			continue
-		}
-
-		// Execute SQL query (without semicolon).
-		executeAndDisplay(ctx, cleanQuery, true)
-
-		// Reset buffer for next query.
-		queryBuffer.Reset()
-	}
-
-	return true
-}
-
-// isSpecialCommand checks if a command is a special command that doesn't require semicolon.
-func isSpecialCommand(query string) bool {
-	cleanQuery := strings.TrimSuffix(strings.TrimSpace(query), ";")
-	cleanQuery = strings.ToLower(cleanQuery)
-
-	// Special commands that work with or without semicolon.
-	specialCommands := []string{
-		"exit", "quit", "\\q", "help",
-	}
-
-	for _, cmd := range specialCommands {
-		if cleanQuery == cmd {
-			return true
-		}
-	}
-
-	// Commands that are exactly specific commands (not just prefixes).
-	parts := strings.Fields(strings.ToUpper(cleanQuery))
-	if len(parts) == 0 {
-		return false
-	}
-	return (parts[0] == "USE" && len(parts) >= 2) ||
-		strings.HasPrefix(strings.ToUpper(cleanQuery), "\\FORMAT ")
-}
-
-// executeAndDisplay executes a query and displays the result in the specified format.
-func executeAndDisplay(ctx *SQLContext, query string, showTiming bool) bool {
-	startTime := time.Now()
-
-	// Execute the query.
-	execCtx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	result, err := ctx.engine.ExecuteSQL(execCtx, query)
-	if err != nil {
-		if ctx.outputFormat == OutputJSON {
-			errorResult := map[string]interface{}{
-				"error": err.Error(),
-				"query": query,
-			}
-			jsonBytes, _ := json.MarshalIndent(errorResult, "", "  ")
-			fmt.Println(string(jsonBytes))
-		} else {
-			fmt.Printf("Error: %v\n", err)
-		}
-		return false
-	}
-
-	if result.Error != nil {
-		if ctx.outputFormat == OutputJSON {
-			errorResult := map[string]interface{}{
-				"error": result.Error.Error(),
-				"query": query,
-			}
-			jsonBytes, _ := json.MarshalIndent(errorResult, "", "  ")
-			fmt.Println(string(jsonBytes))
-		} else {
-			fmt.Printf("Query Error: %v\n", result.Error)
-		}
-		return false
-	}
-
-	// Display results in the specified format.
-	switch ctx.outputFormat {
-	case OutputTable:
-		displayTableResult(result)
-	case OutputJSON:
-		displayJSONResult(result)
-	case OutputCSV:
-		displayCSVResult(result)
-	}
-
-	// Show execution time for interactive/table mode.
-	// Only show timing if there are columns or if result is truly empty.
-	if showTiming && ctx.outputFormat == OutputTable && (len(result.Columns) > 0 || len(result.Rows) == 0) {
-		elapsed := time.Since(startTime)
-		fmt.Printf("\n(%d rows in set, %.3f sec)\n\n", len(result.Rows), elapsed.Seconds())
-	}
-
-	return true
-}
-
-// displayTableResult formats and displays query results in ASCII table format.
-func displayTableResult(result *engine.QueryResult) {
-	if len(result.Columns) == 0 {
-		fmt.Println("Empty result set")
-		return
-	}
-
-	// Calculate column widths for formatting.
-	colWidths := make([]int, len(result.Columns))
-	for i, col := range result.Columns {
-		colWidths[i] = len(col)
-	}
-
-	// Check data for wider columns.
-	for _, row := range result.Rows {
-		for i, val := range row {
-			if i < len(colWidths) {
-				valStr := val.ToString()
-				if len(valStr) > colWidths[i] {
-					colWidths[i] = len(valStr)
-				}
-			}
-		}
-	}
-
-	// Print header separator.
-	fmt.Print("+")
-	for _, width := range colWidths {
-		fmt.Print(strings.Repeat("-", width+2) + "+")
-	}
-	fmt.Println()
-
-	// Print column headers.
-	fmt.Print("|")
-	for i, col := range result.Columns {
-		fmt.Printf(" %-*s |", colWidths[i], col)
-	}
-	fmt.Println()
-
-	// Print separator.
-	fmt.Print("+")
-	for _, width := range colWidths {
-		fmt.Print(strings.Repeat("-", width+2) + "+")
-	}
-	fmt.Println()
-
-	// Print data rows.
-	for _, row := range result.Rows {
-		fmt.Print("|")
-		for i, val := range row {
-			if i < len(colWidths) {
-				fmt.Printf(" %-*s |", colWidths[i], val.ToString())
-			}
-		}
-		fmt.Println()
-	}
-
-	// Print bottom separator.
-	fmt.Print("+")
-	for _, width := range colWidths {
-		fmt.Print(strings.Repeat("-", width+2) + "+")
-	}
-	fmt.Println()
-}
-
-// displayJSONResult outputs query results in JSON format.
-func displayJSONResult(result *engine.QueryResult) {
-	// Convert result to JSON-friendly format.
-	jsonResult := map[string]interface{}{
-		"columns": result.Columns,
-		"rows":    make([]map[string]interface{}, len(result.Rows)),
-		"count":   len(result.Rows),
-	}
-
-	// Convert rows to JSON objects.
-	for i, row := range result.Rows {
-		rowObj := make(map[string]interface{})
-		for j, val := range row {
-			if j < len(result.Columns) {
-				rowObj[result.Columns[j]] = val.ToString()
-			}
-		}
-		jsonResult["rows"].([]map[string]interface{})[i] = rowObj
-	}
-
-	// Marshal and print JSON.
-	jsonBytes, err := json.MarshalIndent(jsonResult, "", "  ")
-	if err != nil {
-		fmt.Printf("Error formatting JSON: %v\n", err)
-		return
-	}
-
-	fmt.Println(string(jsonBytes))
-}
-
-// displayCSVResult outputs query results in CSV format.
-func displayCSVResult(result *engine.QueryResult) {
-	// Handle execution plan results specially to avoid CSV quoting issues.
-	if len(result.Columns) == 1 && result.Columns[0] == "Query Execution Plan" {
-		// For execution plans, output directly without CSV encoding to avoid quotes.
-		for _, row := range result.Rows {
-			if len(row) > 0 {
-				fmt.Println(row[0].ToString())
-			}
-		}
-		return
-	}
-
-	// Standard CSV output for regular query results.
-	writer := csv.NewWriter(os.Stdout)
-	defer writer.Flush()
-
-	// Write headers.
-	if err := writer.Write(result.Columns); err != nil {
-		fmt.Printf("Error writing CSV headers: %v\n", err)
-		return
-	}
-
-	// Write data rows.
-	for _, row := range result.Rows {
-		csvRow := make([]string, len(row))
-		for i, val := range row {
-			csvRow[i] = val.ToString()
-		}
-		if err := writer.Write(csvRow); err != nil {
-			fmt.Printf("Error writing CSV row: %v\n", err)
-			return
-		}
-	}
-}
-
-func showEnhancedHelp() {
-	fmt.Println(`SeaweedFS Enhanced SQL Interface Help:
-
-METADATA OPERATIONS:
-  SHOW DATABASES;              - List all MQ namespaces
-  SHOW TABLES;                 - List all topics in current namespace
-  SHOW TABLES FROM database;   - List topics in specific namespace
-  DESCRIBE table_name;         - Show table schema
-
-ADVANCED QUERYING:
-  SELECT * FROM table_name;                    - Query all data
-  SELECT col1, col2 FROM table WHERE ...;     - Column projection
-  SELECT * FROM table WHERE id <= 100;        - Range filtering
-  SELECT * FROM table WHERE name LIKE 'admin%'; - Pattern matching
-  SELECT * FROM table WHERE status IN ('active', 'pending'); - Multi-value
-  SELECT COUNT(*), MAX(id), MIN(id) FROM ...;  - Aggregation functions
-
-QUERY ANALYSIS:
-  EXPLAIN SELECT ...;                          - Show hierarchical execution plan
-                                                 (data sources, optimizations, timing)
-
-DDL OPERATIONS:
-  CREATE TABLE topic (field1 INT, field2 STRING); - Create topic
-  Note: ALTER TABLE and DROP TABLE are not supported
-
-SPECIAL COMMANDS:
-  USE database_name;           - Switch database context
-  \format table|json|csv       - Change output format
-  help;                        - Show this help
-  exit; or quit; or \q        - Exit interface
-
-EXTENDED WHERE OPERATORS:
-  =, <, >, <=, >=             - Comparison operators
-  !=, <>                      - Not equal operators
-  LIKE 'pattern%'             - Pattern matching (% = any chars, _ = single char)
-  IN (value1, value2, ...)    - Multi-value matching
-  AND, OR                     - Logical operators
-
-EXAMPLES:
-  SELECT * FROM user_events WHERE user_id >= 10 AND status != 'deleted';
-  SELECT username FROM users WHERE email LIKE '%@company.com';
-  SELECT * FROM logs WHERE level IN ('error', 'warning') AND timestamp >= '2023-01-01';
-  EXPLAIN SELECT MAX(id) FROM events;  -- View execution plan
-
-Current Status: Full WHERE clause support + Real MQ integration`)
-}