server

Canonical build sources

The source lock locks the sibling repositories to complete commit IDs. Check out those revisions beside server, using the listed directory names, and use Go 1.27.3. The source gate verifies the effective module replacements and refuses stale or dirty sibling inputs. Build first to populate the checksum-verified module cache used by the offline source check:

GOWORK=off GOTOOLCHAIN=local CGO_ENABLED=0 go build -mod=readonly -p 2 ./cli/api ./cli/taskworker ./cli/connect ./cli/proxy
GOWORK=off GOTOOLCHAIN=local go test -mod=readonly -p 2 ./local/source-graph -count=1

Review and update the lock's refs together when changing the source graph. Connect owns the tracked sctp/ fork. Server and SN's fixture generator consume the same local gVisor sibling, whose revision is locked by the same file. Frozen PERF arms therefore use their own captured source. The release builder converts this local replacement to the checked-out fork's immutable module revision when preparing published modules. These compile checks do not run integration fixtures.

Local integration tests

Server integration tests create and drop PostgreSQL databases and lease Redis logical databases. Start the isolated backing services in one terminal:

./local/run-local.sh

The launcher manages the dedicated loopback address and host mappings; do not point the local service names at 127.0.0.1, where a production tunnel could be listening.

Use the canonical test runner from a second terminal:

./test.sh -run TestName

For a direct package release gate, source the same environment and dependency preflight first. For example:

source ./test-env.sh &&
  go test . ./stats -count=1 -timeout=30m

The preflight sets WARP_ENV=local only when it is unset, refuses any non-local value, resolves the required PostgreSQL/Redis resources, and checks both services before tests start. An isolated server checkout uses the public, throwaway resources under local/testdata; normally a sibling vault/config checkout or explicit WARP_VAULT_HOME/WARP_CONFIG_HOME takes precedence. Set WARP_TEST_ENV_USE_PORTABLE_RESOURCES=1 to force the throwaway resources in an environment that also has sibling configuration checkouts.

Use the same resource selection for the launcher and tests. For example, forcing portable resources only for go test cannot authenticate to a container started with different vault/local/pg.yml credentials. A persistent PostgreSQL volume retains its initialized password even if the container environment changes. Prefer the matching local profile; see local setup before reinitializing a volume.

A test binary reads only fixture vaults. When the launcher runs with a sibling or WARP_HOME vault's local credentials, test-env.sh names the vault it selected by the launcher's rules for the test vault guard, and a test then reads only pg.yml, pg_maintenance.yml and redis.yml from that vault's local directory, while the launcher attestation stays valid and names their endpoints, and everything else from local/testdata/vault. Run DB tests that way, as described in DB tests and the test vault guard, not with URNETWORK_TEST_REAL_VAULT=1 and not by cherry-picking a change onto a base from before the guard.