Add WorkerCommandsTask outbound task to dispatch worker commands via Nexus

.github/.golangci.yml

@@ -34,7 +34,7 @@ linters:
       forbid:
         - pattern: time.Sleep
           msg: "Please use require.Eventually or assert.Eventually instead unless you've no other option"
-        - pattern: panic
+        - pattern: "^panic$"
           msg: "Please avoid using panic in application code"
         - pattern: time\.Now
           msg: "Using time.Now is not allowed in chasm/lib package (non-test files), use ctx.Now(component) instead"
@@ -46,6 +46,10 @@ linters:
           msg: "Do not use .UnixNano() for Cassandra timestamps. Use p.UnixMilliseconds() which returns milliseconds."
         - pattern: FunctionalTestBase
           msg: "FunctionalTestBase is deprecated. Use testcore.NewEnv(t) instead. See docs/development/testing.md for details."
+        - pattern: context\.Background\(\)
+          msg: "Avoid context.Background() in tests; use t.Context() to respect test timeouts and cancellation"
+        - pattern: 'assert\.\w+'
+          msg: "Use require.X / protorequire.X instead of assert.X / protoassert.X — assert doesn't stop the test on failure. assert.CollectT is still allowed for EventuallyWithT callbacks."
     depguard:
       rules:
         main:
@@ -67,6 +71,9 @@ linters:
         # internal server pbs have their own suffix to avoid naming conflicts
         - pkg: go.temporal.io/server/api/(\w+)/v1
           alias: ${1}spb
+    testifylint:
+      disable:
+        - suite-method-signature # parallelsuite.Run supports extra args passed to Test* methods
     exhaustive:
       # Presence of "default" case in switch statements satisfies exhaustiveness,
       # even if all enum members are not listed.
@@ -191,6 +198,13 @@ linters:
         text: "FunctionalTestBase"
         linters:
           - forbidigo
+      - path-except: tests/.+_test\.go # only enforce in test files
+        text: "context.Background"
+        linters:
+          - forbidigo
+      - text: "use of `assert\\.CollectT`" # allowed for EventuallyWithT callbacks
+        linters:
+          - forbidigo
       - path: _test\.go|tests/.+\.go|common/testing/
         text: "(cyclomatic|cognitive)" # false positives when using subtests
         linters:

.github/CODEOWNERS

@@ -1,4 +1,96 @@
 # Syntax is here:
 # https://docs.github.com/en/github/creating-cloning-and-archiving-repositories/about-code-owners#codeowners-syntax
 
-*                @temporalio/server @temporalio/cgs
+*                @temporalio/server @temporalio/cgs @temporalio/nexus
+
+# CHASM
+
+# This only matching files directly in /chasm/ folder, but not any nested files
+/chasm/* @temporalio/oss-foundations
+
+/chasm/lib/activity/ @temporalio/act
+/chasm/lib/scheduler/ @temporalio/act
+
+/chasm/lib/nexusoperation/ @temporalio/act @temporalio/nexus
+/chasm/lib/callback/ @temporalio/act @temporalio/nexus
+
+# Service Clients
+
+/client/matching/ @temporalio/oss-matching
+
+# Common
+
+/common/taskqueue/ @temporalio/oss-matching
+/common/worker_versioning/ @temporalio/oss-matching
+/common/tqid/ @temporalio/oss-matching
+
+/common/archiver/ @temporalio/oss-foundations
+/common/searchattribute/ @temporalio/oss-foundations
+
+/common/nexus/ @temporalio/act @temporalio/nexus
+
+/common/tasks/ @temporalio/oss-foundations @temporalio/cgs
+/common/persistence/ @temporalio/oss-foundations @temporalio/oss-matching @temporalio/cgs
+
+# Components
+
+/components/ @temporalio/act @temporalio/nexus
+
+# Proto Definitions
+
+/proto/internal/temporal/server/api/schedule/ @temporalio/act
+
+/proto/internal/temporal/server/api/deployment/ @temporalio/oss-matching
+/proto/internal/temporal/server/api/matchingservice/ @temporalio/oss-matching
+/proto/internal/temporal/server/api/taskqueue/ @temporalio/oss-matching
+
+/proto/internal/temporal/server/api/archiver/ @temporalio/oss-foundations
+
+/proto/internal/temporal/server/api/replication/ @temporalio/cgs
+
+# DB Schema
+/schema/**/visibility/ @temporalio/oss-foundations
+
+# History Service
+
+/service/history/archival/ @temporalio/oss-foundations
+/service/history/*chasm* @temporalio/oss-foundations
+/service/history/deletemanager/ @temporalio/oss-foundations
+/service/history/queues/ @temporalio/oss-foundations
+/service/history/shard/ @temporalio/oss-foundations
+/service/history/*queue* @temporalio/oss-foundations
+/service/history/*statemachine* @temporalio/oss-foundations
+
+/service/history/ndc/ @temporalio/cgs
+/service/history/replication/ @temporalio/cgs
+
+/service/history/tasks/ @temporalio/oss-foundations @temporalio/cgs
+/service/history/*task* @temporalio/oss-foundations @temporalio/cgs
+
+# Matching Service
+
+/service/matching/ @temporalio/oss-matching
+
+# Worker Service
+
+/service/worker/batcher/ @temporalio/act
+/service/worker/scheduler/ @temporalio/act
+
+/service/worker/workerdeployment/ @temporalio/oss-matching
+
+/service/worker/addsearchattributes/ @temporalio/oss-foundations
+/service/worker/deletenamespace/ @temporalio/oss-foundations
+/service/worker/dlq/ @temporalio/oss-foundations
+
+/service/worker/scanner/ @temporalio/oss-foundations @temporalio/oss-matching
+/service/worker/scanner/executions/ @temporalio/oss-foundations 
+/service/worker/scanner/history/ @temporalio/oss-foundations
+/service/worker/scanner/build_ids/ @temporalio/oss-matching
+/service/worker/scanner/taskqueue/ @temporalio/oss-matching
+
+/service/worker/migration/ @temporalio/cgs
+/service/worker/replicator/ @temporalio/cgs
+
+/service/worker/parentclosepolicy/ @temporalio/oss-foundations @temporalio/act
+
+/tools/ @temporalio/server

.github/actions/build-docker-images/action.yml

@@ -23,20 +23,31 @@ inputs:
     required: false
     default: "false"
   cli-version:
-    description: "Temporal CLI version to download"
+    description: "Temporal CLI version to download (uses default from build helper if empty)"
     required: false
-    default: "1.5.1"
+    default: ""
   alpine-tag:
     description: "Alpine base image tag"
     required: false
-    default: "3.23.3"
+    default: ""
   dockerhub-username:
     description: "Docker Hub username"
     required: false
   dockerhub-token:
     description: "Docker Hub token"
     required: false
 
+outputs:
+  branch-tag:
+    description: "Docker-safe branch tag (e.g., branch-main, branch-release-v1.30.0)"
+    value: ${{ steps.image-tags.outputs.tag }}
+  sha-tag:
+    description: "Docker SHA tag (e.g., sha-abc1234)"
+    value: ${{ steps.image-tags.outputs.sha }}
+  sha-full-tag:
+    description: "Docker full SHA tag (e.g., sha-abcdef123456...)"
+    value: ${{ steps.image-tags.outputs.sha-full }}
+
 runs:
   using: composite
   steps:
@@ -70,12 +81,19 @@ runs:
       run: |
         .github/actions/build-docker-images/scripts/docker-build-helper download-cli
 
+    - name: Extract CLI version from binary
+      id: extract-cli-version
+      shell: bash
+      working-directory: ${{ github.workspace }}
+      run: |
+        .github/actions/build-docker-images/scripts/docker-build-helper extract-binary-version temporal cli-version
+
     - name: Extract server version from binary
       id: extract-version
       shell: bash
       working-directory: ${{ github.workspace }}
       run: |
-        .github/actions/build-docker-images/scripts/docker-build-helper extract-version
+        .github/actions/build-docker-images/scripts/docker-build-helper extract-binary-version temporal-server server-version
 
     - name: Set up QEMU
       uses: docker/setup-qemu-action@v3
@@ -96,22 +114,30 @@ runs:
       working-directory: ${{ github.workspace }}
       env:
         IMAGE_REPO: temporaliotest
-        IMAGE_SHA_TAG: ${{ steps.image-tags.outputs.sha }}
+        IMAGE_SHA_SHORT_TAG: ${{ steps.image-tags.outputs.sha }}
+        IMAGE_SHA_FULL_TAG: ${{ steps.image-tags.outputs.sha-full }}
         IMAGE_BRANCH_TAG: ${{ steps.image-tags.outputs.tag }}
-        TEMPORAL_SHA: ${{ github.sha }}
+        TEMPORAL_SHA: ${{ steps.image-tags.outputs.git-sha }}
         TAG_LATEST: ${{ inputs.tag-latest }}
         ALPINE_TAG: ${{ inputs.alpine-tag }}
+        PLATFORM: ${{ inputs.platform }}
+        LOAD: ${{ inputs.load }}
         SERVER_VERSION: ${{ steps.extract-version.outputs.server-version }}
+        CLI_VERSION: ${{ steps.extract-cli-version.outputs.cli-version }}
       run: |
-        if [ -n "${{ inputs.platform }}" ]; then
+        if [ -z "${ALPINE_TAG}" ]; then
+          unset ALPINE_TAG
+        fi
+
+        if [ -n "${PLATFORM}" ]; then
           docker buildx bake \
-            --set "*.platform=${{ inputs.platform }}" \
-            ${{ inputs.load == 'true' && '--load' || '' }} \
+            --set "*.platform=${PLATFORM}" \
+            $( [ "${LOAD}" = "true" ] && echo --load ) \
             -f docker/docker-bake.hcl \
             server admin-tools
         else
           docker buildx bake \
-            ${{ inputs.load == 'true' && '--load' || '' }} \
+            $( [ "${LOAD}" = "true" ] && echo --load ) \
             -f docker/docker-bake.hcl \
             server admin-tools
         fi
@@ -122,13 +148,19 @@ runs:
       working-directory: ${{ github.workspace }}
       env:
         IMAGE_REPO: temporaliotest
-        IMAGE_SHA_TAG: ${{ steps.image-tags.outputs.sha }}
+        IMAGE_SHA_SHORT_TAG: ${{ steps.image-tags.outputs.sha }}
+        IMAGE_SHA_FULL_TAG: ${{ steps.image-tags.outputs.sha-full }}
         IMAGE_BRANCH_TAG: ${{ steps.image-tags.outputs.tag }}
-        TEMPORAL_SHA: ${{ github.sha }}
+        TEMPORAL_SHA: ${{ steps.image-tags.outputs.git-sha }}
         TAG_LATEST: ${{ inputs.tag-latest }}
         ALPINE_TAG: ${{ inputs.alpine-tag }}
         SERVER_VERSION: ${{ steps.extract-version.outputs.server-version }}
+        CLI_VERSION: ${{ steps.extract-cli-version.outputs.cli-version }}
       run: |
+        if [ -z "${ALPINE_TAG}" ]; then
+          unset ALPINE_TAG
+        fi
+
         docker buildx bake \
           --push \
           -f docker/docker-bake.hcl \