Exclude CODEOWNERS from language statistics

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Alexey Palazhchenko <alexey.palazhchenko@ferretdb.io>

.codecov.yml

@@ -1,34 +0,0 @@
----
-# https://docs.codecov.com/docs/codecovyml-reference
-codecov:
-  require_ci_to_pass: true
-  notify:
-    after_n_builds: 4 # 1 for unit tests + 3 for integration tests with different handlers
-    wait_for_ci: true
-
-# https://docs.codecov.com/docs/coverage-configuration
-coverage:
-  range: "50...65"
-
-  # https://docs.codecov.com/docs/commit-status
-  status:
-    project:
-      default:
-        target: auto
-        threshold: 1%
-    patch:
-      default:
-        target: 50%
-
-# https://docs.codecov.com/docs/ignoring-paths
-ignore:
-  - cmd
-
-# https://docs.codecov.com/docs/pull-request-comments
-comment:
-  layout: reach,diff,files,flags
-
-# https://docs.codecov.com/docs/github-checks
-# Annotations may be hidden by pressing the "a" key or by unselecting "Show annotations" in the top right of the file.
-github_checks:
-  annotations: true

.dockerignore

@@ -1,5 +1,18 @@
 **
+
+# Go code
+!build/version
 !cmd
 !internal
 !go.mod
 !go.sum
+
+# so `go build` could set `vcs.revision`, etc.
+!.git
+
+# so generated *.txt files do not make binaries dirty
+!.gitignore
+
+# additional files for Docker images
+!build/ferretdb
+!build/postgres-documentdb

.editorconfig

@@ -0,0 +1,9 @@
+# https://editorconfig.org
+
+root = true
+
+[*]
+end_of_line = lf
+trim_trailing_whitespace = true
+insert_final_newline = true
+charset = utf-8

.gitattributes

@@ -0,0 +1,10 @@
+*.jpeg filter=lfs diff=lfs merge=lfs -text
+*.jpg filter=lfs diff=lfs merge=lfs -text
+*.png filter=lfs diff=lfs merge=lfs -text
+*.webp filter=lfs diff=lfs merge=lfs -text
+*.gif filter=lfs diff=lfs merge=lfs -text
+
+*.pdf filter=lfs diff=lfs merge=lfs -text
+
+*.go diff=golang
+.gitea/CODEOWNERS linguist-detectable=false

.gitea/CODEOWNERS

@@ -0,0 +1,3 @@
+# Pull requests request review from the eligible staff team(s).
+# One approval from either an Admin or Developer satisfies branch protection.
+*   @trueog/Admins @trueog/Developers

.github/CODEOWNERS

@@ -1,9 +1,10 @@
 # https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
-# Order is important; the last matching pattern takes the most precedence.
+# Order is important; the last matching pattern has the highest precedence.
 
-*              @AlekSi
-/integration/  @FerretDB/leads
-/internal/     @FerretDB/leads
+*               @AlekSi @chilagrow
 
-go.mod         @AlekSi
-go.sum         @AlekSi
+/website/       @AlekSi @Fashander
+
+# @AlekSi for engineering, @ptrfarkas for marketing.
+# See also Mergify configuration.
+/website/blog/  @AlekSi @ptrfarkas

.github/ISSUE_TEMPLATE/bug.md

@@ -1,5 +0,0 @@
----
-name: Bug
-about: Some feature works incorrectly
-labels: code/bug
----

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,66 @@
+---
+# https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/syntax-for-githubs-form-schema
+
+name: Bug
+description: Some feature works incorrectly.
+assignees: ["ferretdb-bot"]
+labels: ["code/bug", "not ready"]
+body:
+  - type: markdown
+    attributes:
+      value: >
+        Thanks for taking the time to fill out this bug report!
+        Please check if a similar issue is [already filed](https://github.com/FerretDB/FerretDB/issues).
+  - type: textarea
+    id: version
+    attributes:
+      label: FerretDB, PostgreSQL, and DocumentDB versions
+      description: >
+        Please add the output of the `serverStatus` command.
+      value: |
+        ```json
+        {
+        }
+        ```
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Environment
+      description: |
+        For example:
+          - **OS**: Ubuntu 24.04 x86_64
+          - **Deployment**: Docker using `ghcr.io/ferretdb/ferretdb:2` image
+          - **Deployment details**: Docker version 27.3.1
+      value: |
+        - **OS**:
+        - **Deployment**:
+        - **Deployment details**:
+    validations:
+      required: true
+  - type: textarea
+    id: do
+    attributes:
+      label: What did you do?
+      description: >
+        Include MongoDB queries or
+        [pull request with a test script](https://github.com/FerretDB/FerretDB/blob/main/CONTRIBUTING.md#reporting-a-bug)
+        if you can.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: What did you expect to see?
+      description: >
+        Include expected MongoDB results if you can.
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: What did you see instead?
+      description: >
+        Please include FerretDB [logs](https://docs.ferretdb.io/configuration/observability/).
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/chore.yml

@@ -0,0 +1,40 @@
+---
+# https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/syntax-for-githubs-form-schema
+
+name: Chore
+description: Code maintenance improvements.
+assignees: ["ferretdb-bot"]
+labels: ["code/chore", "not ready"]
+body:
+  - type: markdown
+    attributes:
+      value: >
+        Thanks for taking the time to fill out this form!
+        Please check if a similar issue is [already filed](https://github.com/FerretDB/FerretDB/issues).
+  - type: textarea
+    id: what
+    attributes:
+      label: What should be done?
+    validations:
+      required: true
+  - type: textarea
+    id: where
+    attributes:
+      label: Where?
+      description: Include permalinks if possible.
+    validations:
+      required: true
+  - type: textarea
+    id: dod
+    attributes:
+      label: Definition of Done
+      description: What should be done to consider this issue done? List everything that applies.
+      value: |
+        - handler updated;
+        - unit tests added/updated;
+        - integration/compatibility tests added/updated;
+        - spot refactorings done;
+        - user documentation updated (or an issue to create documentation created);
+        - something else?
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -1,10 +1,11 @@
 ---
 # https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/configuring-issue-templates-for-your-repository
+
 blank_issues_enabled: false
 contact_links:
   - name: Quick question
-    url: https://join.slack.com/t/ferretdb/shared_invite/zt-zqe9hj8g-ZcMG3~5Cs5u9uuOPnZB8~A
-    about: Please join our Slack chat
+    url: https://slack.ferretdb.io/
+    about: Please join our Slack chat.
   - name: General question or discussion
     url: https://github.com/FerretDB/FerretDB/discussions/categories/general
-    about: Please use GitHub Discussions
+    about: Please use GitHub Discussions.

.github/ISSUE_TEMPLATE/documentation.yml

@@ -0,0 +1,19 @@
+---
+# https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/syntax-for-githubs-form-schema
+
+name: Documentation
+description: Something is badly or not documented.
+assignees: ["ferretdb-bot"]
+labels: ["documentation", "not ready"]
+body:
+  - type: markdown
+    attributes:
+      value: >
+        Thanks for taking the time to fill out this form!
+        Please check if a similar issue is [already filed](https://github.com/FerretDB/FerretDB/issues).
+  - type: textarea
+    id: what
+    attributes:
+      label: What should be done?
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/enhancement.md

@@ -1,5 +0,0 @@
----
-name: Enhancement
-about: Some feature could work better
-labels: code/enhancement
----

.github/ISSUE_TEMPLATE/enhancement.yml

@@ -0,0 +1,19 @@
+---
+# https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/syntax-for-githubs-form-schema
+
+name: Enhancement
+description: Some feature could work better.
+assignees: ["ferretdb-bot"]
+labels: ["code/enhancement", "not ready"]
+body:
+  - type: markdown
+    attributes:
+      value: >
+        Thanks for taking the time to fill out this form!
+        Please check if a similar issue is [already filed](https://github.com/FerretDB/FerretDB/issues).
+  - type: textarea
+    id: what
+    attributes:
+      label: What should be done?
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/feature.md

@@ -1,5 +0,0 @@
----
-name: Feature
-about: Some feature is not implemented yet
-labels: code/feature
----

.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,19 @@
+---
+# https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/syntax-for-githubs-form-schema
+
+name: Feature
+description: Some feature is not implemented yet.
+assignees: ["ferretdb-bot"]
+labels: ["code/feature", "not ready"]
+body:
+  - type: markdown
+    attributes:
+      value: >
+        Thanks for taking the time to fill out this form!
+        Please check if a similar issue is [already filed](https://github.com/FerretDB/FerretDB/issues).
+  - type: textarea
+    id: what
+    attributes:
+      label: What should be done?
+    validations:
+      required: true

.github/PROCESS.md

@@ -6,43 +6,72 @@ We will do all that for you so you can focus on what is really interesting for y
 
 This guide tries to be short and does not mention things that are completely automated by our tooling.
 
+## Showing progress
+
+We want our work to be visible and transparent.
+This way we can help each other and make sure that we are on the right track.
+To uphold these principles, we agree to make results of our daily work available for others through various means
+such as pushed commits, updated pull requests, code reviews, created issues, or any other relevant method.
+
+### Community
+
+We expect issues picked up by the community to be done in about two weeks.
+After about a week of inactivity, we should ping contributors.
+
 ## Pull requests
 
+For FerretDB Inc. engineers and long-term contributors,
+besides the guides in [CONTRIBUTING.md](../CONTRIBUTING.md),
+please follow these notes below when you working with pull request:
+
 1. Send pull requests from forks; do not make personal branches in the main repository.
    This way, we are similar to community members and could notice similar problems that we could fix for everyone,
    not just for us.
-2. Pull request **title** should be accurate and descriptive as it is used in the generated changelog.
-   It should not mention the issue number but describe the fixed issue instead.
-3. Most of the time pull requests are related to some issues.
-   In such cases pull request **description** should mention the issue number like `#123`.
-   Do not use URLs like `https://github.com/org/repo/issue/123` even if they are rendered the same on GitHub.
-   If you propose a tiny fix, there is no needed to create a new issue.
-4. We provide a pull requests template that includes suggestions and readiness checklist.
-5. Please create a draft pull request as soon as you start working on an issue; that is needed for our process tooling.
+2. Pull request title should be accurate and descriptive
+   as it is used in the generated [changelog](../CHANGELOG.md) as is.
+   It generally should start with imperative verb ("Fix …", not "Fixing …", "Fixed …" or other forms).
+   It should not have a prefix ("Fix …", not "Fix: …") (we use labels for categorization).
+   It should not mention the issue number.
+3. It is fine to send several sequential pull requests for one issue to make them easier to review.
+   In that case, please still use the `Closes` word as described in [CONTRIBUTING.md](../CONTRIBUTING.md)
+   (because [words like "refs" do not link PR to the issue](https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue#linking-a-pull-request-to-an-issue-using-a-keyword)),
+   but don't forget to reopen the issue once PR is merged,
+   but the issue as a whole is not done.
+4. Please create a draft pull request as soon as you start working on an issue; that is needed for our process tooling.
    Once it is ready for review, please mark it as such.
    After that, there is no need to switch between draft and non-draft states.
-6. Please don't forget to click "re-request review" buttons once PR is ready for re-review.
-7. Commit messages (both titles and bodies) are not important and can be "WIP" or anything else.
-   All commits are always squashed on merge by GitHub, so there is no need to squash them manually, amend them, and/or do force pushes.
-   Autogenerated GitHub's squash commit's body should be manually replaced by "Refs #{issue_number}." or "Closes #{issue_number}.".
-   Do not leave original commit messages in the squashed commit body.
+5. Pull requests should be merged by an auto-merge that the author should enable.
+   If the pull request is not ready to be merged for some reason (but ready to be reviewed as usual),
+   the description should explain why, and the `do not merge` label should be applied.
+   Even in that case, auto-merge should still be enabled by the author.
+6. Autogenerated GitHub's squash commit's body should be manually replaced by `Closes #<issue_number>.`
+   with optional [trailers for co-authors](https://docs.github.com/en/pull-requests/committing-changes-to-your-project/creating-and-editing-commits/creating-a-commit-with-multiple-authors).
+7. Ultimately, the author is responsible for doing everything to ensure that the pull request is merged and done.
 
-## Team Performance Metrics
+One can see all pull requests that await review [there](https://github.com/pulls/review-requested?q=user%3AFerretDB+is%3Aopen).
+We also have [#devlog channel](https://ferretdb.slack.com/archives/C02P0MR7VJS)
+in our community Slack with periodic reminders.
+To make them useful,
+talk with [@GitHub bot in direct messages](https://ferretdb.slack.com/archives/D02P4EJPFGV)
+to link your Slack and GitHub identities,
+and then configure notification only for your name.
 
-1. We want to deliver fast and make our deliverables predictable.
-2. To achieve that, we measure the flow of work and estimate tasks.
-3. The flow of work is measured automatically based on GitHub's pull request workflow.
-4. Tasks are measured manually by engineers during Sprint planning.
-5. Task estimation depends on the following parameters:
-   * Scope. Are the changes required in one or multiple files, packages, components?
-   * Complexity. How hard is the task? Does it require to cover a lot of test cases? How many "unknowns" do we have?
-   * Clarity. Are the description and definition of done clear? Does the task require extra research?
-6. We use the following T-Shirt Sizes to estimate tasks:
-   * **S**: Small simple clear task.
-   * **M**: Only one parameter can be changed compared to **S** (e.g. a small but not completely clear task).
-   * **L**: Two parameters can be changed compared to **M** (e.g. clear medium-sized somewhat complex task).
-7. If the team thinks that the task is bigger than **L**, it should be decomposed into smaller tasks or
-   an additional research task needs to be created to clarify all the details.
-8. After every Sprint, we measure how many tasks of each size we were able to complete and discuss
-   what went well and what could be improved.
-   We also look at the flows' metrics to gather more information about the team's dynamic.
+### Test scripts
+
+Pull requests that add temporary `test.js` test scripts have slightly different rules:
+
+1. The title should start with "Add test script for".
+2. The descriptions of both PR and issue should link to each other.
+3. Commits must change only the `test.js` file.
+
+Once PR with a test script is sent and verified by someone else, it is closed.
+Once the linked issue is resolved, the PR should be reopened and merged with `main` to confirm that the test script pass now.
+Then it should be closed again.
+
+## Creating issues
+
+1. Please use `Chore` type instead of `Enhancement` or `Feature` (but not `Bug`)
+   because its template is much more useful
+   (but may be too daunting for regular users, that's why templates for enhancements and features are much simpler).
+   After creating an issue, please change its type (label) manually.
+2. Do not change other automatically applied labels, assignees, or projects.

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,25 +1,31 @@
+<!--
+Please remove comments like this one, but keep and use the rest of the template.
+See CONTRIBUTING.md for details.
+-->
+
 # Description
 
-This PR closes #{issue_number}.
-
 <!--
-    Write a short description to explain changes that are not mentioned in the initial issue.
-    What were the reasons for those changes?
-    Which decisions did you make and why?
-    What else should reviewers know about your changes?
+Write a short description to explain changes that are not mentioned in the initial issue.
+What were the reasons for those changes?
+Which decisions did you make and why?
+What else should reviewers know about your changes?
 -->
 
+<!-- Replace <issue_number> with an actual issue number. -->
+
+Closes #<issue_number>.
+
 ## Readiness checklist
 
-<!--
-    If you want your changes to be merged quickly,
-    please follow CONTRIBUTING.md.
--->
+<!-- Please check all items in this checklist that were done. -->
 
-* [ ] I added tests for new functionality or bugfixes.
-* [ ] I ran `task all`, and it passed.
-* [ ] I added/updated comments for both exported and unexported top-level declarations (functions, types, etc).
-* [ ] I checked comments rendering with `task godocs`.
-* [ ] (for maintainers only) I set Reviewers ([`@FerretDB/core`](https://github.com/orgs/FerretDB/teams/core)),
-      Assignee, Labels, Project and project's Sprint fields.
-* [ ] I marked all done items in this checklist.
+- [ ] I added/updated unit tests (and they pass).
+- [ ] I added/updated integration/compatibility tests (and they pass).
+- [ ] I added/updated comments and checked rendering.
+- [ ] I made spot refactorings.
+- [ ] I updated user documentation.
+- [ ] I ran `task all`, and it passed.
+- [ ] I ensured that PR title is good enough for the changelog.
+- [ ] (for maintainers only) I set Reviewers ([`@FerretDB/core`](https://github.com/orgs/FerretDB/teams/core)), Milestone (`Next`), Labels, Project and project's Sprint fields.
+- [ ] I marked all done items in this checklist.

.github/RELEASE_CHECKLIST.md

@@ -1,28 +1,71 @@
 # Release Checklist
 
-1. Check tests, linters.
-2. Check issues and pull requests, update milestones and labels.
-3. Create draft release on GitHub with autogenerated release notes.
-4. Tweak generated release notes:
-   * Ensure that "This section should be empty" section does not exist.
-   * Add "All closed issues and pull requests" and "All commits", remove "Full Changelog".
-   * Tweak spacing, headers levels.
-5. Update CHANGELOG.md with the same release notes:
-   * Check spacing, header levels.
-6. Make a signed tag `vX.Y.Z` with the relevant section of the changelog using `--cleanup=verbatim`.
-7. Push it!
-8. Make [release](https://github.com/FerretDB/FerretDB/releases).
-9. Upload .deb and .rpm packages from the CI build for the tag.
-10. Refresh
-    * `env GOPROXY=https://proxy.golang.org go install -v github.com/FerretDB/FerretDB/cmd/ferretdb@<tag>`
-    * `env GOPROXY=https://proxy.golang.org go install -v github.com/FerretDB/FerretDB/ferretdb@<tag>`
-      (expected error message is `package github.com/FerretDB/FerretDB/ferretdb is not a main package`)
-    * <https://pkg.go.dev/github.com/FerretDB/FerretDB>
-11. `task docker-local`
-12. `task docker-push` with four tags (`X.Y.Z` without leading `v` and `latest` for both ghcr.io and Docker Hub):
-    * `task docker-push DOCKER_IMAGE=ferretdb/ferretdb:latest`
-    * `task docker-push DOCKER_IMAGE=ferretdb/ferretdb:<tag>`
-    * `task docker-push DOCKER_IMAGE=ghcr.io/ferretdb/ferretdb:latest`
-    * `task docker-push DOCKER_IMAGE=ghcr.io/ferretdb/ferretdb:<tag>`
-13. Close milestone in issues.
-14. Announce it!
+## Preparation
+
+1. [Release DocumentDB](https://github.com/FerretDB/documentdb/blob/ferretdb/.github/RELEASE_CHECKLIST.md).
+2. Update DocumentDB image tags to point to release in:
+   - [eval image](../build/ferretdb/eval.Dockerfile);
+   - [eval-dev image](../build/ferretdb/eval-dev.Dockerfile);
+   - [local image](../build/deps/postgres-documentdb.Dockerfile);
+   - [bw image](../build/ferretdb-bw/Dockerfile).
+3. Update constants in [`documentdb.go`](../build/version/documentdb.go).
+4. Check DocumentDB images/tags in documentation (where we specify full tags).
+5. Re-run tests, linters.
+6. Check issues and pull requests, update milestones and labels.
+7. Check if there are breaking changes or anything that should be reflected in the changelog and/or user documentation.
+8. Create draft release on GitHub with autogenerated release notes.
+9. Update CHANGELOG.md:
+   - Run `task changelog PREV=vX.Y.Z NEXT=vX.Y.Z` to generate release changelog for the given milestone.
+   - Check warnings, copy output to the `CHANGELOG.md` file.
+   - Sort items within sections according to importance if needed.
+   - Add first-time contributor credits if any (copy this data from the release draft).
+   - Add link to DocumentDB release page.
+10. Run `task docs-version VERSION=X.Y`.
+    Update `versions` and `createRedirects` in `docusaurus.config.js`.
+    Remove the oldest version from `versioned_docs`, `versioned_sidebars`, `versions.json`.
+11. Run `task docs`.
+12. Commit and push changes to the PR.
+13. Merge PR, pull and check `git status`.
+
+## Git tag
+
+1. Make a signed tag `vX.Y.Z` with the relevant section of the changelog using `--cleanup=verbatim`.
+2. Check `task gen-version; git status` output.
+3. Push it!
+4. Refresh
+   - `env GOPROXY=https://proxy.golang.org go mod download -x github.com/FerretDB/FerretDB/v2@<vX.Y.Z>`
+   - `https://pkg.go.dev/github.com/FerretDB/FerretDB/v2@<vX.Y.Z>` from https://pkg.go.dev/github.com/FerretDB/FerretDB/v2?tab=versions.
+
+## Release
+
+1. Copy release notes from `CHANGELOG.md` and trim them.
+2. Wait for the [packages CI build](https://github.com/FerretDB/FerretDB/actions/workflows/packages.yml?query=event%3Apush)
+   to finish.
+3. Upload binaries and packages to the draft release.
+4. Check:
+   - https://hub.docker.com/r/ferretdb/ferretdb/tags
+   - https://hub.docker.com/r/ferretdb/ferretdb-dev/tags
+   - https://hub.docker.com/r/ferretdb/ferretdb-eval/tags
+   - https://hub.docker.com/r/ferretdb/ferretdb-eval-dev/tags
+   - https://github.com/FerretDB/FerretDB/pkgs/container/ferretdb
+   - https://github.com/FerretDB/FerretDB/pkgs/container/ferretdb-dev
+   - https://github.com/FerretDB/FerretDB/pkgs/container/ferretdb-eval
+   - https://github.com/FerretDB/FerretDB/pkgs/container/ferretdb-eval-dev
+   - https://quay.io/repository/ferretdb/ferretdb?tab=tags
+   - https://quay.io/repository/ferretdb/ferretdb-dev?tab=tags
+   - https://quay.io/repository/ferretdb/ferretdb-eval?tab=tags
+   - https://quay.io/repository/ferretdb/ferretdb-eval-dev?tab=tags
+5. Close milestone in issues.
+6. Publish release on GitHub.
+7. Announce it on Slack.
+
+## Soon after
+
+1. Publish and announce blog post.
+2. Add link to blog post to `CHANGELOG.md` and release page.
+3. Bump the latest version on https://beacon.ferretdb.com and https://beacon.ferretdb.io.
+4. Update DocumentDB images/tags in Dockerfiles to point back to development version.
+5. Update DocumentDB images/tags in the current documentation (where we specify full tags)
+   to point to the next (non-existing) version.
+6. Update URLs with `/refs/tags/` in them in the current documentation
+   to point to the next (non-existing) version.

.github/codecov.yml

@@ -0,0 +1,63 @@
+---
+# https://docs.codecov.com/docs/codecovyml-reference
+codecov:
+  require_ci_to_pass: true
+  notify:
+    wait_for_ci: true
+
+# https://docs.codecov.com/docs/coverage-configuration
+coverage:
+  range: "50...65"
+
+  # https://docs.codecov.com/docs/commit-status
+  status:
+    project:
+      default:
+        target: auto
+        threshold: 1%
+    patch:
+      default:
+        target: 50%
+
+# https://docs.codecov.com/docs/ignoring-paths
+ignore:
+  - cmd
+
+# https://docs.codecov.com/docs/flags#recommended-automatic-flag-management
+flag_management:
+  default_rules:
+    carryforward: false
+
+# https://docs.codecov.com/docs/pull-request-comments
+comment:
+  layout: reach,diff,files,flags,components
+
+# https://docs.codecov.com/docs/components
+component_management:
+  default_rules:
+    statuses:
+      - type: project
+        target: auto
+        threshold: 1%
+  individual_components:
+    - component_id: clientconn
+      name: "clientconn"
+      paths:
+        - internal/clientconn/**
+    - component_id: dataapi
+      name: "dataapi"
+      paths:
+        - internal/dataapi/**
+    - component_id: documentdb
+      name: "documentdb"
+      paths:
+        - internal/documentdb/**
+    - component_id: handler
+      name: "handler"
+      paths:
+        - internal/handler/**
+
+# https://docs.codecov.com/docs/github-checks
+# Annotations may be hidden by pressing the "a" key or by unselecting "Show annotations" in the top right of the file.
+github_checks:
+  annotations: true

.github/dependabot.yml

@@ -1,45 +1,214 @@
 ---
+# Runs on Wednesday after deps repo.
+# Apply the "not ready" label to prevent cascaded CI runs on each auto-merge.
+
 version: 2
+
+# Most configurations are duplicated to add main-v1 branch.
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
-    labels: [deps]
+    labels: ["deps", "not ready"]
+    assignees: [AlekSi]
+    open-pull-requests-limit: 20
+    groups:
+      github-actions:
+        patterns: ["*"]
     schedule:
       interval: "weekly"
-      day: "thursday"
+      day: "wednesday"
+      time: "01:42"
+  - package-ecosystem: "github-actions"
+    target-branch: "main-v1"
+    directory: "/"
+    labels: ["deps", "not ready"]
+    assignees: [AlekSi]
+    open-pull-requests-limit: 20
+    groups:
+      github-actions-v1:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+      time: "01:42"
+
+  - package-ecosystem: "docker"
+    directory: "/build/ferretdb"
+    labels: ["deps", "not ready"]
+    assignees: [AlekSi]
+    open-pull-requests-limit: 20
+    groups:
+      build-docker:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
       time: "01:42"
   - package-ecosystem: "docker"
-    directory: "/"
-    labels: [deps]
+    target-branch: "main-v1"
+    directory: "/build/ferretdb"
+    labels: ["deps", "not ready"]
+    assignees: [AlekSi]
+    open-pull-requests-limit: 20
+    groups:
+      build-docker-v1:
+        patterns: ["*"]
     schedule:
       interval: "weekly"
-      day: "thursday"
+      day: "wednesday"
       time: "01:42"
+
   - package-ecosystem: "docker"
     directory: "/build/deps"
-    labels: [deps]
+    labels: ["deps", "not ready"]
+    assignees: [AlekSi]
+    open-pull-requests-limit: 20
+    groups:
+      build-deps:
+        patterns: ["*"]
     schedule:
       interval: "weekly"
-      day: "thursday"
+      day: "wednesday"
       time: "01:42"
+  - package-ecosystem: "docker"
+    target-branch: "main-v1"
+    directory: "/build/deps"
+    labels: ["deps", "not ready"]
+    assignees: [AlekSi]
+    open-pull-requests-limit: 20
+    groups:
+      build-deps-v1:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+      time: "01:42"
+
   - package-ecosystem: "gomod"
     directory: "/"
-    labels: [deps]
+    labels: ["deps", "not ready"]
+    assignees: [AlekSi]
+    open-pull-requests-limit: 20
+    groups:
+      ferretdb:
+        patterns: ["*"]
     schedule:
       interval: "weekly"
-      day: "thursday"
+      day: "wednesday"
       time: "01:42"
+  - package-ecosystem: "gomod"
+    target-branch: "main-v1"
+    directory: "/"
+    labels: ["deps", "not ready"]
+    assignees: [AlekSi]
+    open-pull-requests-limit: 20
+    groups:
+      ferretdb-v1:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+      time: "01:42"
+
   - package-ecosystem: "gomod"
     directory: "/integration"
-    labels: [deps]
+    labels: ["deps", "not ready"]
+    assignees: [AlekSi]
+    open-pull-requests-limit: 20
+    groups:
+      integration:
+        patterns: ["*"]
     schedule:
       interval: "weekly"
-      day: "thursday"
+      day: "wednesday"
       time: "01:42"
   - package-ecosystem: "gomod"
-    directory: "/tools"
-    labels: [deps]
+    target-branch: "main-v1"
+    directory: "/integration"
+    labels: ["deps", "not ready"]
+    assignees: [AlekSi]
+    open-pull-requests-limit: 20
+    groups:
+      integration-v1:
+        patterns: ["*"]
     schedule:
       interval: "weekly"
-      day: "thursday"
+      day: "wednesday"
+      time: "01:42"
+
+  - package-ecosystem: "gomod"
+    directory: "/tools"
+    labels: ["deps", "not ready"]
+    assignees: [AlekSi]
+    open-pull-requests-limit: 20
+    groups:
+      tools:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+      time: "01:42"
+  - package-ecosystem: "gomod"
+    target-branch: "main-v1"
+    directory: "/tools"
+    labels: ["deps", "not ready"]
+    assignees: [AlekSi]
+    open-pull-requests-limit: 20
+    groups:
+      tools-v1:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+      time: "01:42"
+
+  - package-ecosystem: "gomod"
+    directory: "/tools/golangci"
+    labels: ["deps", "not ready"]
+    assignees: [AlekSi]
+    open-pull-requests-limit: 20
+    groups:
+      golangci:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+      time: "01:42"
+  - package-ecosystem: "gomod"
+    target-branch: "main-v1"
+    directory: "/tools/golangci"
+    labels: ["deps", "not ready"]
+    assignees: [AlekSi]
+    open-pull-requests-limit: 20
+    groups:
+      golangci-v1:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+      time: "01:42"
+
+  # no mcphost in main-v1
+  - package-ecosystem: "gomod"
+    directory: "/tools/mcphost"
+    labels: ["deps", "not ready"]
+    assignees: [AlekSi]
+    open-pull-requests-limit: 20
+    groups:
+      mcphost:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+      time: "01:42"
+
+  # no submodules in main-v1
+  - package-ecosystem: "gitsubmodule"
+    directory: "/"
+    labels: ["deps", "not ready"]
+    assignees: [AlekSi]
+    open-pull-requests-limit: 20
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
       time: "01:42"

.github/mergify.yml

@@ -0,0 +1,63 @@
+---
+# see https://docs.mergify.com/
+
+pull_request_rules:
+  - name: "Update out-of-date approved PRs"
+    conditions:
+      # those rules are implicit for the update action:
+      # - "-closed"
+      # - "-conflict"
+      # - "#commits-behind > 0"
+      - "-draft"
+      - "-locked"
+      - "-merged"
+      - "base = main"
+      - "branch-protection-review-decision = APPROVED"
+      - "check-success = golangci-lint"
+      - "check-success = Test"
+      - "label != 'not ready'"
+      - "#review-threads-unresolved = 0"
+    actions:
+      update:
+
+  - name: "Request review for engineering blogs posts"
+    conditions:
+      - "label = 'blog/engineering'"
+    actions:
+      request_reviews:
+        users_from_teams: ["@FerretDB/core", "@FerretDB/docs"]
+      comment:
+        message: "Engineering blog posts should be reviewed by @FerretDB/core and @FerretDB/docs."
+
+  - name: "Request review for marketing blogs posts"
+    conditions:
+      - "label = 'blog/marketing'"
+    actions:
+      request_reviews:
+        users: ["ptrfarkas", "AlekSi"]
+      comment:
+        message: "Marketing blog posts should be reviewed by @ptrfarkas and @AlekSi."
+
+  - name: "Assign PRs"
+    conditions:
+      - "-closed"
+      - "#assignee = 0"
+    actions:
+      assign:
+        add_users: ["{{ author }}"]
+
+  - name: "Add label on conflicts"
+    conditions:
+      - "conflict"
+    actions:
+      comment:
+        message: "@{{author}} this pull request has merge conflicts."
+      label:
+        add: [conflict]
+
+  - name: "Remove label when conflicts were resolved"
+    conditions:
+      - "-conflict"
+    actions:
+      label:
+        remove: [conflict]

.github/release.yml

@@ -1,30 +0,0 @@
----
-# https://docs.github.com/en/repositories/releasing-projects-on-github/automatically-generated-release-notes
-
-changelog:
-  categories:
-    - title: New Features 🎉
-      labels:
-        - code/feature
-
-    - title: Fixed Bugs 🐛
-      labels:
-        - code/bug
-        - code/bug-regression
-
-    - title: Enhancements 🛠
-      labels:
-        - code/enhancement
-
-    - title: Documentation 📄
-      labels:
-        - documentation
-
-    - title: Other Changes 🤖
-      labels:
-        - code/chore
-        - deps
-
-    - title: This section should be empty
-      labels:
-        - "*"

.github/settings.yml

@@ -0,0 +1,148 @@
+---
+# https://github.com/repository-settings/app
+
+repository:
+  allow_squash_merge: true
+  allow_merge_commit: false
+  allow_rebase_merge: false
+  allow_auto_merge: true
+  allow_update_branch: true
+  delete_branch_on_merge: true
+  enable_automated_security_fixes: true
+  enable_vulnerability_alerts: true
+
+# https://docs.github.com/en/rest/issues/labels
+# Labels are being used by issues, PRs, and discussions.
+labels:
+  # area
+  - name: area/admin
+    color: "#2931BF"
+    description: Issues about administration commands
+  - name: area/aggregations
+    color: "#5319E7"
+    description: Issues about aggregation pipelines
+  - name: area/auth
+    color: "#E4012C"
+    description: Issues about authentication and authorization
+  - name: area/build
+    color: "#52D58A"
+    description: Issues about builds and CI
+  - name: area/cursors
+    color: "#D93F0B"
+    description: Issues about cursors
+  - name: area/dataapi
+    color: "#D98F93"
+    description: Issues about Data API
+  - name: area/diag
+    color: "#909BA6"
+    description: Issues about diagnostic commands
+  - name: area/errors
+    color: "#DE231F"
+    description: Issues about MongoDB-compatible error codes and messages
+  - name: area/fuzz
+    color: "#D4C5F9"
+    description: Issues about fuzzing and smithing
+  - name: area/indexes
+    color: "#006B75"
+    description: Issues about indexes
+  - name: area/mcp
+    color: "#95921F"
+    description: Issues about MCP
+  - name: area/observability
+    color: "#E04D33"
+    description: Issues about metrics, logs, traces, pprof, etc
+  - name: area/performance
+    color: "#D02FE8"
+    description: Issues about performance
+  - name: area/wire
+    color: "#0354F4"
+    description: Issues about BSON and the wire protocol
+
+  # blog
+  - name: blog/engineering
+    color: "#FEF2C0"
+    description: Engineering blog posts
+  - name: blog/marketing
+    color: "#80D0C9"
+    description: Marketing (and releases) blog posts
+
+  # code
+  - name: code/bug
+    color: "#CC0000"
+    description: Some user-visible feature works incorrectly
+  - name: code/bug-regression
+    color: "#FF0000"
+    description: Some user-visible feature works incorrectly, but worked before
+  - name: code/chore
+    color: "#E99695"
+    description: Code maintenance improvements
+  - name: code/enhancement
+    color: "#FBCA04"
+    description: Some user-visible feature could work better
+  - name: code/feature
+    color: "#0E8A16"
+    description: Some user-visible feature is not implemented yet
+
+  # the rest sorted alphabetically
+
+  - name: badly estimated
+    color: "#FF3333"
+    description: Scope, difficulty and/or clarify of the issue were different
+
+  - name: community
+    color: "#297252"
+    description: Issues and PRs assigned to community members
+
+  - name: conflict
+    color: "#FF0000"
+    description: PRs that have merge conflicts
+
+  - name: deps
+    color: "#D4C5F9"
+    description: PRs that update dependencies
+
+  - name: do not merge
+    color: "#0052CC"
+    description: PRs that should not be merged
+
+  - name: documentation
+    color: "#0052CC"
+    description: Something user-visible is badly or not documented
+
+  - name: good first issue
+    color: "#5319E7"
+    description: Good issues for new external contributors
+
+  # until the next time
+  # - name: hacktoberfest
+  #   color: "#FEFBA2"
+  #   description: Good issues for Hacktoberfest
+
+  - name: help wanted
+    color: "#006B75"
+    description: Issues that require extra attention
+
+  - name: not ready
+    color: "#000000"
+    description: Issues that are not ready to be worked on; PRs that should skip CI
+
+  - name: packages
+    color: "#9B022C"
+    description: PRs that should build packages
+
+  - name: project
+    color: "#E99695"
+    description: Project maintenance
+
+  # https://hacktoberfest.com/participation/#spam
+  - name: spam
+    color: "#C5DEF5"
+    description: Spam issues and PRs
+
+  - name: trust
+    color: "#00FF00"
+    description: PRs that can access Actions secrets
+
+  - name: use-git-lfs
+    color: "#FF0000"
+    description: PRs that add large files without Git LFS

.github/workflows/_integration.yml

@@ -0,0 +1,163 @@
+---
+name: Integration # visible at https://github.com/FerretDB/FerretDB/actions
+on:
+  workflow_call:
+    inputs:
+      task:
+        required: true
+        type: string
+      shard_index:
+        required: true
+        type: number
+      shard_total:
+        required: true
+        type: number
+      test_timeout:
+        required: false
+        type: string
+        default: 20m
+      no_xfail:
+        required: false
+        type: boolean
+        default: false
+      skip_flaky_check:
+        required: false
+        type: boolean
+        default: false
+
+env:
+  GOPATH: /home/runner/go
+  GOCACHE: /home/runner/go/cache
+  GOLANGCI_LINT_CACHE: /home/runner/go/cache/lint
+  GOMODCACHE: /home/runner/go/mod
+  GOPROXY: https://proxy.golang.org
+  GOTOOLCHAIN: local
+
+jobs:
+  run:
+    # make it short to fit in GitHub UI; all parameters are already in the caller's name
+    name: Run
+    runs-on: ubuntu-24.04
+    timeout-minutes: 25
+
+    steps:
+      # TODO https://github.com/FerretDB/github-actions/issues/211
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0 # for `git describe` to work
+          lfs: false # LFS is used only by website
+
+      # for branch.txt on pull_request; the correct branch is already checked out on push / schedule
+      - name: Name branch
+        if: github.event_name == 'pull_request'
+        env:
+          BRANCH: ${{ github.head_ref }} # see https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
+        run: git checkout -b $BRANCH
+
+      - name: Setup Go
+        uses: FerretDB/github-actions/setup-go@main
+        with:
+          cache-key: integration
+
+      - name: Install Task
+        run: go generate -x
+        working-directory: tools
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Start environment
+        run: bin/task env-up-detach
+
+      - name: Run init
+        run: bin/task init
+
+      - name: Setup Ollama and MCPHost
+        run: |
+          mkdir -p tmp/logs
+          curl -fsSL https://ollama.com/install.sh | sh
+          sudo systemctl stop ollama
+          bin/task ollama  > tmp/logs/ollama.log  2>&1 &
+          bin/task mcphost > tmp/logs/mcphost.log 2>&1 &
+
+      - name: Wait for and setup environment
+        run: bin/task env-setup
+
+      - name: >
+          Run ${{ inputs.task }} tests
+          (${{ inputs.shard_index }}/${{ inputs.shard_total }})
+        run: >
+          bin/task test-integration-${{ inputs.task }}
+          SHARD_INDEX=${{ inputs.shard_index }}
+          SHARD_TOTAL=${{ inputs.shard_total }}
+          TEST_TIMEOUT=${{ inputs.test_timeout }}
+          NO_XFAIL=${{ inputs.no_xfail }}
+        env:
+          ENVTOOL_DEBUG: ${{ runner.debug == '1' && 'true' || 'false' }}
+
+      - name: Collect logs
+        if: failure()
+        run: |
+          bin/task env-logs-collect
+          cp -v integration/*.json.tmp integration/*.txt.tmp tmp/logs/
+
+      - name: Compress logs before upload
+        if: failure()
+        run: zip -r -q -9 logs.zip tmp/logs
+
+      - name: Upload logs
+        if: failure()
+        uses: actions/upload-artifact@v5
+        with:
+          name: logs-${{ inputs.task }}-${{ inputs.shard_index }}-${{ inputs.shard_total }}
+          path: logs.zip
+          retention-days: 3
+
+      - name: Upload coverage information to codecov
+        if: always()
+        uses: codecov/codecov-action@v5
+        with:
+          files: ./integration/integration-${{ inputs.task }}.txt
+          flags: integration,${{ inputs.task }},${{ inputs.task }}-${{ inputs.shard_index }}
+          disable_file_fixes: true
+          fail_ci_if_error: true
+          verbose: true
+
+      - name: Upload coverage information to coveralls
+        if: always()
+        uses: coverallsapp/github-action@v2
+        with:
+          file: ./integration/integration-${{ inputs.task }}.txt
+          flag-name: integration-${{ inputs.task }}-${{ inputs.shard_index }}
+          parallel: true
+
+      - name: Convert test results to JUnit XML format
+        if: always() && !inputs.skip_flaky_check
+        run: >
+          ./bin/go-junit-report -parser=gojson
+          -in ./integration/*.json.tmp
+          -out ./integration/${{ inputs.task }}.xml
+
+      - name: Upload test results to Codecov
+        if: always()
+        uses: codecov/test-results-action@v1
+        with:
+          flags: integration,${{ inputs.task }},${{ inputs.task }}-${{ inputs.shard_index }}
+          file: ./integration/${{ inputs.task }}.xml
+
+      # we don't want them on CI
+      - name: Clean test and fuzz caches
+        if: always()
+        run: go clean -testcache -fuzzcache
+
+      - name: Check dirty
+        if: always()
+        run: |
+          git status --untracked-files --ignored
+          git status
+          git diff --exit-code

.github/workflows/cleanup.yml

@@ -0,0 +1,43 @@
+---
+name: Cleanup
+on:
+  schedule:
+    - cron: "10 0 * * 1"
+  workflow_dispatch:
+
+env:
+  GOPATH: /home/runner/go
+  GOCACHE: /home/runner/go/cache
+  GOLANGCI_LINT_CACHE: /home/runner/go/cache/lint
+  GOMODCACHE: /home/runner/go/mod
+  GOPROXY: https://proxy.golang.org
+  GOTOOLCHAIN: local
+
+jobs:
+  cleanup:
+    name: Cleanup
+    runs-on: server
+
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0 # for `git describe` to work
+          lfs: false # LFS is used only by website
+
+      - name: Setup Go
+        uses: FerretDB/github-actions/setup-go@main
+        # no cache-key on server
+
+      - name: Install Task
+        run: go generate -x
+        working-directory: tools
+
+      - name: Run docker-cleanup
+        run: bin/task docker-cleanup
+
+      - name: Clean Go caches
+        run: go clean -cache -testcache -modcache -fuzzcache

.github/workflows/conform-pr.yml

@@ -1,36 +1,55 @@
 ---
-# Attention! This workflow uses `pull_request_target` event that has access to secrets.
-# If you modify this workflow, make sure that you don't introduce dangerous steps.
-# See also: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/.
+# This and other workflows that use `pull_request_target` event are dangerous
+# and should be handled with a lot of care to avoid security problems.
+# We use this event to give pull requests access to secrets with permissions to query projects,
+# login into Docker registry, etc.
+# But rogue PR authors could try to steal our secrets.
+# We prevent that with the following:
+#
+# * We require approval for PRs from first-time contributors. That's a built-in feature for all actions.
+# * For workflows that checkout source code,
+#   we require the `trust` label to be assigned to PRs by FerretDB maintainers after reviewing changes.
+#   Only a few trusted people have permission to do that.
+# * Thanks to the way `pull_request_target` trigger works,
+#   PR changes in the workflow itself are not run until they are merged.
+# * We use short-lived automatic `GITHUB_TOKEN`s instead of a long-living personal access tokens (PAT) where possible.
+# * Both `GITHUB_TOKEN`s and PATs have minimal permissions.
+# * We publish Docker images from PRs as separate packages that should not be run by users.
+# * We limit what third-party actions can be used.
+#
+# Relevant GitHub documentation is a bit scattered. The first article gives a good overview:
+# * https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
+# * https://docs.github.com/en/actions/security-guides/automatic-token-authentication
+# * https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
+
 name: Conform PR
 on:
   pull_request_target:
     # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target
     # List all types to make it easier to enable new ones when they are needed.
     types:
-      # - assigned
-      # - unassigned
-      # - labeled
-      - unlabeled # if GitHub Actions stuck, add and remove "no ci" label to force rebuild
+      - assigned
+      - unassigned
+      - labeled
+      - unlabeled
       - opened
       - edited
       # - closed
       - reopened
       - synchronize
-      # - converted_to_draft
-      # - ready_for_review
+      - converted_to_draft
+      - ready_for_review
       # - locked
-      # - unlocked
-      # - review_requested
-      # - review_request_removed
-      # - auto_merge_enabled
-      # - auto_merge_disabled
+      - unlocked
+      - review_requested
+      - review_request_removed
+      - auto_merge_enabled
+      - auto_merge_disabled
 
-# Stop pending and in-progress jobs of this workflow.
-# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#example-using-a-fallback-value
+# Do not run this workflow in parallel for any PR change.
 concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: false
 
 env:
   GOPATH: /home/runner/go
@@ -38,18 +57,23 @@ env:
   GOLANGCI_LINT_CACHE: /home/runner/go/cache/lint
   GOMODCACHE: /home/runner/go/mod
   GOPROXY: https://proxy.golang.org
-  CONFORM_TOKEN: ${{ secrets.CONFORM_TOKEN }} # GITHUB_TOKEN is not enough to query projects, so we use a special one
+  GOTOOLCHAIN: local
+  CONFORM_TOKEN: ${{ secrets.CONFORM_TOKEN }} # repo-scoped GITHUB_TOKEN is not enough to query org-level projects
 
 jobs:
   conform-pr:
     name: Conform PR
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
 
-    if: github.event_name != 'pull_request_target' || !contains(github.event.pull_request.labels.*.name, 'no ci')
+    # No `trust` label check because we don't checkout PR's code.
+    # No `not ready` label to prevent accidental auto-merges: jobs skipped with `if` conditional are considered successful.
+    if: github.event_name == 'pull_request_target'
 
     steps:
-      # Warning! Be careful about changing the steps here as it might cause some security problems
-      # (see the Attention block on the top of this file).
+      # Do not add a source code checkout step because we don't check the `trust` label.
+      # See the warning at the top of the file.
+
       - name: Setup Go
         uses: FerretDB/github-actions/setup-go@main
         with:

.github/workflows/cts.yml

@@ -0,0 +1,95 @@
+---
+name: CTS
+on:
+  pull_request:
+    types:
+      - unlabeled # if GitHub Actions stuck, add and remove "not ready" label to force rebuild
+      - opened
+      - reopened
+      - synchronize
+  push:
+    branches:
+      - main
+      - main-*
+      - releases/*
+
+env:
+  GOPATH: /home/runner/go
+  GOCACHE: /home/runner/go/cache
+  GOLANGCI_LINT_CACHE: /home/runner/go/cache/lint
+  GOMODCACHE: /home/runner/go/mod
+  GOPROXY: https://proxy.golang.org
+  GOTOOLCHAIN: local
+
+jobs:
+  run:
+    name: Run CTS tests
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+
+    if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')
+
+    permissions:
+      contents: read
+
+    steps:
+      # TODO https://github.com/FerretDB/github-actions/issues/211
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0 # for `git describe` to work
+          lfs: false # LFS is used only by website
+
+      - name: Setup Go
+        uses: FerretDB/github-actions/setup-go@main
+        with:
+          cache-key: cts
+
+      - name: Install Task
+        run: go generate -x
+        working-directory: tools
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Start environment
+        run: bin/task env-up-detach
+
+      - name: Run init
+        run: bin/task init
+
+      - name: Build bin/ferretdb
+        run: bin/task build-host
+
+      - name: Wait for and setup environment
+        run: bin/task env-setup
+
+      - name: Start FerretDB (no auth) in the background
+        run: >
+          bin/ferretdb
+          --listen-addr=:27017
+          --proxy-addr=127.0.0.1:37017
+          --no-auth
+          --mode=diff-normal
+          --postgresql-url='postgres://username:password@127.0.0.1:5432/postgres'
+          2> ferretdb.log &
+
+      - name: Run CTS
+        if: always()
+        run: bin/task cts
+
+      # we don't want them on CI
+      - name: Clean test and fuzz caches
+        if: always()
+        run: go clean -testcache -fuzzcache
+
+      - name: Check dirty
+        if: always()
+        run: |
+          git status --untracked-files --ignored
+          git status
+          git diff --exit-code

.github/workflows/debug.yml

@@ -0,0 +1,74 @@
+---
+# Temporary workflow to debug GitHub Actions.
+
+name: Debug
+on:
+  pull_request:
+    types:
+      - labeled
+      - unlabeled # if GitHub Actions stuck, add and remove "not ready" label to force rebuild
+      - opened
+      - reopened
+      - synchronize
+  push:
+    branches:
+      - main
+      - main-*
+      - releases/*
+    tags:
+      - "*"
+  schedule:
+    - cron: "12 0 * * *"
+
+# Do not run this workflow in parallel for any PR change.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
+jobs:
+  contexts:
+    name: Contexts
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+
+    # comment out to enable this job
+    if: false
+
+    permissions:
+      contents: read
+
+    steps:
+      # TODO https://github.com/FerretDB/github-actions/issues/211
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0 # for `git describe` to work
+          lfs: false # LFS is used only by website
+
+      - name: Debug git status
+        run: |
+          git status --untracked-files --ignored
+          git status
+
+      - name: Dump github context
+        run: echo "$GITHUB_CONTEXT"
+        env:
+          GITHUB_CONTEXT: ${{ toJSON(github) }}
+
+      - name: Dump env context
+        run: echo "$ENV_CONTEXT"
+        env:
+          ENV_CONTEXT: ${{ toJSON(env) }}
+
+      - name: Dump vars context
+        run: echo "$VARS_CONTEXT"
+        env:
+          VARS_CONTEXT: ${{ toJSON(vars) }}
+
+      - name: Dump environment variables
+        run: env
+
+      - name: Show current directory
+        run: |
+          pwd
+          ls -al

.github/workflows/docker.yml

@@ -1,118 +0,0 @@
----
-# This workflow is dangerous and should be handled with a lot of care to avoid security problems.
-# We use `pull_request_target` event to give pull requests access to secrets with permissions to publish Docker images, etc.
-# But rogue PR authors could try to steal our secrets.
-# We prevent that with the following:
-#
-# * We require approval for PRs from first-time contributors. That's a built-in feature for all actions.
-# * After reviewing changes, we require the `trust` label to be assigned to PRs by FerretDB maintainers.
-#   Only a few trusted people have permission to do that.
-# * Thanks to the way `pull_request_target` trigger works, PR changes in the workflow itself are not run
-#   until they are merged.
-# * We use a short-living automatic `GITHUB_TOKEN` instead of a long-living personal access token (PAT).
-#   It also has minimal permissions.
-# * We publish Docker images from PRs as a separate package that should not be run by users.
-# * We limit what third-party actions can be used.
-#
-# We also tried a different approach: build Docker image in one normal, secure `pull_request` workflow,
-# upload artifact, and then download and publish it in another workflow that has access to secrets, but treats
-# artifact as passive data. We use buildx for building multi-platform images, and there is a way to export
-# multi-platform OCI tarball: https://docs.docker.com/engine/reference/commandline/buildx_build/#output
-# Unfortunately, it seems that there is no way to import that tarball in another workflow and publish it
-# as a Docker image, as strange as it sounds: https://github.com/docker/buildx/issues/186
-#
-# Relevant GitHub documentation is scattered. The first article gives a good overview:
-# * https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
-# * https://docs.github.com/en/actions/security-guides/automatic-token-authentication
-# * https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
-# * https://docs.github.com/en/packages/learn-github-packages/configuring-a-packages-access-control-and-visibility
-# * https://docs.github.com/en/packages/managing-github-packages-using-github-actions-workflows/publishing-and-installing-a-package-with-github-action
-# * https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry
-
-name: Docker
-on:
-  pull_request_target:
-    types:
-      - labeled
-      - unlabeled
-      - opened
-      - reopened
-      - synchronize
-  push:
-    branches:
-      - main
-  schedule:
-    - cron: "42 2 * * *" # after Go workflow
-
-env:
-  GOPATH: /home/runner/go
-  GOCACHE: /home/runner/go/cache
-  GOLANGCI_LINT_CACHE: /home/runner/go/cache/lint
-  GOMODCACHE: /home/runner/go/mod
-  GOPROXY: https://proxy.golang.org
-
-jobs:
-  build:
-    name: Build
-    runs-on: ubuntu-20.04
-
-    if: >
-      github.event_name != 'pull_request_target' ||
-      (
-        !contains(github.event.pull_request.labels.*.name, 'no ci') &&
-        contains(github.event.pull_request.labels.*.name, 'trust')
-      )
-
-    permissions:
-      packages: write
-
-    steps:
-      - name: Checkout code
-        if: github.event_name != 'pull_request_target'
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-
-      - name: Checkout pull request code
-        if: github.event_name == 'pull_request_target'
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-          ref: ${{ github.event.pull_request.head.sha }}
-
-      - name: Setup Go
-        uses: FerretDB/github-actions/setup-go@main
-        with:
-          cache-key: build
-
-      - name: Install Task
-        run: go generate -x
-        working-directory: tools
-
-      - name: Run init
-        run: bin/task init
-
-      - name: Setup QEMU
-        uses: docker/setup-qemu-action@v2
-
-      - name: Initialize Docker Buildx builder
-        run: bin/task docker-init
-
-      - name: Extract Docker image name and tag
-        id: extract
-        uses: FerretDB/github-actions/extract-docker-tag@main
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v2
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build Docker image ${{ steps.extract.outputs.ghcr }}
-        run: bin/task docker-push DOCKER_IMAGE=${{ steps.extract.outputs.ghcr }}
-
-      - name: Check dirty
-        run: |
-          git status
-          git diff --exit-code

.github/workflows/docs.yml

@@ -0,0 +1,128 @@
+---
+name: Docs
+on:
+  pull_request:
+    types:
+      - unlabeled # if GitHub Actions stuck, add and remove "not ready" label to force rebuild
+      - opened
+      - reopened
+      - synchronize
+  push:
+    branches:
+      - main
+      - main-*
+      - releases/*
+  schedule:
+    - cron: "12 0 * * *"
+
+# Do not run this workflow in parallel for any PR change or branch push
+# to prevent concurrent deployments to GitHub Pages.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: false
+
+env:
+  GOPATH: /home/runner/go
+  GOCACHE: /home/runner/go/cache
+  GOLANGCI_LINT_CACHE: /home/runner/go/cache/lint
+  GOMODCACHE: /home/runner/go/mod
+  GOPROXY: https://proxy.golang.org
+  GOTOOLCHAIN: local
+
+jobs:
+  build:
+    name: Build docs
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+
+    if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')
+
+    permissions:
+      contents: read
+
+    steps:
+      # TODO https://github.com/FerretDB/github-actions/issues/211
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0 # for `git describe` to work
+          lfs: true
+
+      # This step will fail with "Error: Resource not accessible by integration"
+      # while trying to add label and comment to PR, that is not possible for PRs from forks.
+      # See https://github.com/ppremk/lfs-warning/issues/147.
+      # But the real issue will be right above that message: a list of files that should be added using Git LFS.
+      - name: Check LFS status
+        uses: ppremk/lfs-warning@v3.3
+        with:
+          filesizelimit: 102400b
+          labelName: use-git-lfs
+          exclusionPatterns: |
+            **/*.go
+            **/*.js
+            **/*.md
+            **/go.sum
+
+      - name: Setup Go
+        uses: FerretDB/github-actions/setup-go@main
+        with:
+          cache-key: docs
+
+      - name: Install Task
+        run: go generate -x
+        working-directory: tools
+
+      - name: Build tools
+        run: bin/task env-pull
+
+      - name: Build docs
+        run: bin/task docs
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # for checkdocs
+
+      - name: Archive docs
+        run: >
+          tar --directory website/build
+          --file tmp/docs.tar
+          --create
+          --verbose
+          .
+
+      # it has to be exactly "docs.tar" for actions/deploy-pages below
+      - name: Upload archive artifact
+        uses: actions/upload-artifact@v5
+        with:
+          name: docs
+          path: tmp/docs.tar
+          retention-days: 1
+          if-no-files-found: error
+
+      - name: Check dirty
+        run: |
+          git status
+          git diff --exit-code
+
+  github:
+    name: Deploy to GitHub Pages
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+
+    # exclude pull_request and schedule
+    needs: build
+    if: github.event_name == 'push'
+
+    permissions:
+      pages: write
+      id-token: write
+
+    environment:
+      name: github-pages
+      url: ${{ steps.deploy.outputs.page_url }}
+
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deploy
+        uses: actions/deploy-pages@v4
+        with:
+          artifact_name: docs
+          timeout: 300000 # 5*60*1000 milliseconds

.github/workflows/format.yml

@@ -0,0 +1,70 @@
+---
+name: Format
+on:
+  pull_request:
+    types:
+      - unlabeled # if GitHub Actions stuck, add and remove "not ready" label to force rebuild
+      - opened
+      - reopened
+      - synchronize
+  push:
+    branches:
+      - main
+      - main-*
+      - releases/*
+  schedule:
+    - cron: "12 0 * * *"
+
+# Do not run this workflow in parallel for any PR change.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
+env:
+  GOPATH: /home/runner/go
+  GOCACHE: /home/runner/go/cache
+  GOLANGCI_LINT_CACHE: /home/runner/go/cache/lint
+  GOMODCACHE: /home/runner/go/mod
+  GOPROXY: https://proxy.golang.org
+  GOTOOLCHAIN: local
+
+jobs:
+  format:
+    name: Format files
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+
+    if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')
+
+    permissions:
+      contents: read
+
+    steps:
+      # TODO https://github.com/FerretDB/github-actions/issues/211
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0 # for `git describe` to work
+          lfs: false # LFS is used only by website
+
+      - name: Setup Go
+        uses: FerretDB/github-actions/setup-go@main
+        with:
+          cache-key: format
+
+      - name: Install Task
+        run: go generate -x
+        working-directory: tools
+
+      - name: Format Go code
+        run: bin/task fmt-go
+
+      - name: Format YAML files
+        run: bin/task fmt-yaml
+
+      - name: Check dirty
+        if: always()
+        run: |
+          git status --untracked-files --ignored
+          git status
+          git diff --exit-code

.github/workflows/go.yml

@@ -3,15 +3,17 @@ name: Go
 on:
   pull_request:
     types:
-      - unlabeled # if GitHub Actions stuck, add and remove "no ci" label to force rebuild
+      - unlabeled # if GitHub Actions stuck, add and remove "not ready" label to force rebuild
       - opened
       - reopened
       - synchronize
   push:
     branches:
       - main
+      - main-*
+      - releases/*
   schedule:
-    - cron: "12 2 * * *"
+    - cron: "12 0 * * *"
 
 env:
   GOPATH: /home/runner/go
@@ -19,24 +21,43 @@ env:
   GOLANGCI_LINT_CACHE: /home/runner/go/cache/lint
   GOMODCACHE: /home/runner/go/mod
   GOPROXY: https://proxy.golang.org
+  GOTOOLCHAIN: local
 
 jobs:
   short-test:
     name: Short test
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
 
-    if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'no ci')
+    # Do not run this job in parallel for any PR change or branch push.
+    concurrency:
+      group: ${{ github.workflow }}-short-test-${{ github.head_ref || github.ref_name }}
+      cancel-in-progress: true
+
+    if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')
+
+    permissions:
+      contents: read
 
     steps:
+      # TODO https://github.com/FerretDB/github-actions/issues/211
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
         with:
-          fetch-depth: 0
+          fetch-depth: 0 # for `git describe` to work
+          lfs: false # LFS is used only by website
+
+      # for branch.txt on pull_request; the correct branch is already checked out on push / schedule
+      - name: Name branch
+        if: github.event_name == 'pull_request'
+        env:
+          BRANCH: ${{ github.head_ref }} # see https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
+        run: git checkout -b $BRANCH
 
       - name: Setup Go
         uses: FerretDB/github-actions/setup-go@main
         with:
-          cache-key: test
+          cache-key: short-test
 
       - name: Install Task
         run: go generate -x
@@ -46,25 +67,52 @@ jobs:
         run: bin/task init
 
       - name: Run short unit tests
-        run: bin/task test-unit-short
+        run: bin/task test-unit-short TEST_TIMEOUT=10m
+        env:
+          GOFLAGS: ${{ runner.debug == '1' && '-v' || '' }}
+          GITHUB_TOKEN: invalid # to test that -short is handled correctly
 
       # we don't want them on CI
       - name: Clean test and fuzz caches
+        if: always()
+        run: go clean -testcache -fuzzcache
+
+      - name: Check dirty
         if: always()
         run: |
-          go clean -testcache -fuzzcache
+          git status --untracked-files --ignored
+          git status
+          git diff --exit-code
 
   test:
     name: Test
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
 
-    if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'no ci')
+    # Do not run this job in parallel for any PR change or branch push.
+    concurrency:
+      group: ${{ github.workflow }}-test-${{ github.head_ref || github.ref_name }}
+      cancel-in-progress: true
+
+    if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')
+
+    permissions:
+      contents: read
 
     steps:
+      # TODO https://github.com/FerretDB/github-actions/issues/211
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
         with:
-          fetch-depth: 0
+          fetch-depth: 0 # for `git describe` to work
+          lfs: false # LFS is used only by website
+
+      # for branch.txt on pull_request; the correct branch is already checked out on push / schedule
+      - name: Name branch
+        if: github.event_name == 'pull_request'
+        env:
+          BRANCH: ${{ github.head_ref }} # see https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
+        run: git checkout -b $BRANCH
 
       - name: Setup Go
         uses: FerretDB/github-actions/setup-go@main
@@ -75,50 +123,249 @@ jobs:
         run: go generate -x
         working-directory: tools
 
+      # install.sh starts ollama service, stop it since we want to run with `bin/task ollama` with environment variables
+      - name: Setup Ollama
+        run: |
+          curl -fsSL https://ollama.com/install.sh | sudo -E sh
+          sudo systemctl stop ollama
+
+      - name: Start Ollama in the background
+        run: |
+          bin/task ollama &
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Start environment
+        run: bin/task env-up-detach
+
+      - name: Pull and load Ollama model
+        run: |
+          bin/task ollama-model
+
+      - name: Run init
+        run: bin/task init
+
+      - name: Wait for and setup environment
+        run: bin/task env-setup
+
+      - name: Regenerate and reformat
+        run: bin/task gen
+        env:
+          # must be a SUPERUSER to ensure parameter_default is set
+          DOCUMENTDB_GEN_URL: postgres://username:password@127.0.0.1:5432/postgres
+
+      - name: Build bin/ferretdb
+        run: bin/task build-host
+
+      - name: Run unit tests
+        run: bin/task test-unit TEST_TIMEOUT=10m
+        env:
+          GOFLAGS: ${{ runner.debug == '1' && '-v' || '' }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # for tools
+
+      - name: Upload coverage information to codecov
+        if: always()
+        uses: codecov/codecov-action@v5
+        with:
+          files: ./cover.txt
+          flags: unit
+          disable_file_fixes: true
+          fail_ci_if_error: true
+          verbose: true
+
+      - name: Upload coverage information to coveralls
+        if: always()
+        uses: coverallsapp/github-action@v2
+        with:
+          file: ./cover.txt
+          flag-name: unit
+          parallel: true
+
+      - name: Convert test results to JUnit XML format
+        if: always()
+        run: >
+          ./bin/go-junit-report
+          -in ./unit.txt
+          -out ./unit.xml
+
+      - name: Upload test results to Codecov
+        if: always()
+        uses: codecov/test-results-action@v1
+        with:
+          flags: unit
+          file: ./unit.xml
+
+      # we don't want them on CI
+      - name: Clean test and fuzz caches
+        if: always()
+        run: go clean -testcache -fuzzcache
+
+      - name: Check dirty
+        if: always()
+        run: |
+          git status --untracked-files --ignored
+          git status
+          git diff --exit-code
+
+  integration:
+    # job name must be unique; make it unique and nice
+    name: ${{ matrix.task }} ${{ matrix.shard_index }}/${{ matrix.shard_total }}
+
+    # Do not run this job in parallel for any PR change or branch push
+    # to save some resources.
+    concurrency:
+      group: ${{ github.workflow }}-integration-${{ matrix.task }}-${{ matrix.shard_index }}-${{ github.head_ref || github.ref_name }}
+      cancel-in-progress: true
+
+    if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')
+
+    strategy:
+      fail-fast: false
+      matrix:
+        task: [postgresql, yugabytedb]
+        shard_index: [1, 2, 3, 4, 5]
+        shard_total: [5]
+        include:
+          - { task: "mongodb", shard_index: 1, shard_total: 1 }
+          - { task: "yugabytedb", skip_flaky_check: true } # Too many failures for now
+
+    uses: ./.github/workflows/_integration.yml
+    with:
+      task: ${{ matrix.task }}
+      shard_index: ${{ matrix.shard_index }}
+      shard_total: ${{ matrix.shard_total }}
+      skip_flaky_check: ${{ matrix.skip_flaky_check || false }}
+
+  integration-no-xfail:
+    name: postgresql no-xfail
+
+    # Do not run this job in parallel for any PR change or branch push
+    # to save some resources.
+    concurrency:
+      group: ${{ github.workflow }}-integration-no-xfail-${{ github.head_ref || github.ref_name }}
+      cancel-in-progress: true
+
+    # disable for now
+    if: false
+    # if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')
+
+    uses: ./.github/workflows/_integration.yml
+    with:
+      task: postgresql
+      shard_index: 1
+      shard_total: 1
+      test_timeout: 5m
+      no_xfail: true
+
+  # https://github.com/lemurheavy/coveralls-public/issues/1636
+  submit-coveralls:
+    name: Submit final coveralls report
+    runs-on: ubuntu-24.04
+    needs: [test, integration]
+
+    if: always() && (github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready'))
+
+    steps:
+      - name: Submit coveralls
+        if: always()
+        uses: coverallsapp/github-action@v2
+        with:
+          parallel-finished: true
+
+  env-data:
+    name: env-data
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+
+    # Do not run this job in parallel for any PR change or branch push.
+    concurrency:
+      group: ${{ github.workflow }}-env-data-${{ github.head_ref || github.ref_name }}
+      cancel-in-progress: true
+
+    if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')
+
+    permissions:
+      contents: read
+
+    steps:
+      # TODO https://github.com/FerretDB/github-actions/issues/211
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0 # for `git describe` to work
+          lfs: false # LFS is used only by website
+
+      - name: Setup Go
+        uses: FerretDB/github-actions/setup-go@main
+        with:
+          cache-key: env-data
+
+      - name: Install Task
+        run: go generate -x
+        working-directory: tools
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Start environment
         run: bin/task env-up-detach
 
       - name: Run init
         run: bin/task init
 
-      - name: Regenerate and reformat
-        run: bin/task -p gen docs
+      - name: Build bin/ferretdb
+        run: bin/task build-host
 
       - name: Wait for and setup environment
         run: bin/task env-setup
 
-      - name: Run unit tests
-        run: bin/task test-unit
+      - name: Start FerretDB in the background
+        run: bin/task run &
 
-      - name: Upload coverage information
-        uses: codecov/codecov-action@v3
-        with:
-          files: ./cover.txt
-          flags: unit
-          fail_ci_if_error: true
-
-      # we don't want them on CI
-      - name: Clean test and fuzz caches
-        if: always()
-        run: |
-          go clean -testcache -fuzzcache
-
-      - name: Check dirty
-        run: |
-          git status
-          git diff --exit-code
+      - name: Run env-data
+        run: bin/task env-data
+        env:
+          GOFLAGS: ${{ runner.debug == '1' && '-v' || '' }}
 
   golangci-lint:
     name: golangci-lint
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
 
-    if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'no ci')
+    # Do not run this job in parallel for any PR change or branch push.
+    concurrency:
+      group: ${{ github.workflow }}-golangci-lint-${{ github.head_ref || github.ref_name }}
+      cancel-in-progress: true
+
+    if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')
+
+    permissions:
+      contents: read
+      issues: read
 
     steps:
+      # TODO https://github.com/FerretDB/github-actions/issues/211
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
         with:
-          fetch-depth: 0
+          fetch-depth: 0 # for `golangci-lint run --new` to work
+          lfs: false # LFS is used only by website
+
+      # for branch.txt on pull_request; the correct branch is already checked out on push / schedule
+      - name: Name branch
+        if: github.event_name == 'pull_request'
+        env:
+          BRANCH: ${{ github.head_ref }} # see https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
+        run: git checkout -b $BRANCH
 
       - name: Setup Go
         uses: FerretDB/github-actions/setup-go@main
@@ -127,117 +374,5 @@ jobs:
 
       - name: Run linters
         uses: FerretDB/github-actions/linters@main
-
-  fuzz-short:
-    name: Fuzz short
-    runs-on: ubuntu-20.04
-
-    if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'no ci')
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
-        with:
-          path: source
-          fetch-depth: 0
-
-      - name: Setup Go
-        uses: FerretDB/github-actions/setup-go@main
-        with:
-          cache-key: fuzz
-
-      - name: Install Task
-        run: go generate -x
-        working-directory: source/tools
-
-      # Use deploy key instead of Personal Access Token (PAT) to limit access to one repository.
-      # If secrets are not available (for example, for a pull request from a fork), GITHUB_TOKEN PAT is used automatically.
-      - name: Checkout collected fuzz corpus
-        uses: actions/checkout@v3
-        with:
-          repository: FerretDB/fuzz-corpus
-          ssh-key: ${{ secrets.FUZZ_CORPUS_DEPLOY_KEY }}
-          path: fuzz-corpus
-          fetch-depth: 0
-
-      - name: Start environment
-        run: bin/task env-up-detach
-        working-directory: source
-
-      - name: Run init
-        run: bin/task init
-        working-directory: source
-
-      - name: Setup corpus
-        run: bin/task fuzz-corpus
-        working-directory: source
-
-      - name: Wait for and setup environment
-        run: bin/task env-setup
-        working-directory: source
-
-      # precompile tests with unset GOMAXPROCS
-      - name: Init fuzzers
-        run: bin/task fuzz-init
-        working-directory: source
-
-      # TODO https://github.com/FerretDB/FerretDB/issues/238
-      # TODO https://github.com/FerretDB/FerretDB/issues/344
-      - name: Run collected fuzzing corpus
-        run: bin/task fuzz FUZZTIME=1s
-        working-directory: source
         env:
-          GOMAXPROCS: 1 # otherwise, oom-killer kills fuzzer too often
-
-      - name: Collect corpus
-        if: always()
-        run: |
-          bin/task fuzz-corpus
-          go run ./cmd/fuzztool/fuzztool.go -src=seed -dst=../fuzz-corpus
-        working-directory: source
-
-      # `secrets` are not supported in `if`, so we have to do this trick with environment variable:
-      # https://docs.github.com/en/actions/learn-github-actions/contexts#context-availability
-      # https://github.com/actions/runner/issues/520
-      - name: Push corpus
-        if: ${{ always() && env.KEY != '' }}
-        env:
-          KEY: ${{ secrets.FUZZ_CORPUS_DEPLOY_KEY }}
-        run: |
-          git config user.name ferretdb-bot
-          git config user.email ferretdb-bot@ferretdb.io
-          git add --all .
-          git diff-index --quiet HEAD || git commit --message 'Update corpus'
-          git fetch
-          git rebase origin/main
-          git push
-        working-directory: fuzz-corpus
-
-      - name: Collect Linux logs
-        if: failure()
-        run: |
-          mkdir -p /tmp/logs
-          ls -al /var/log/
-          sudo cp /var/log/syslog /tmp/logs/
-          sudo free > /tmp/logs/free.txt
-          sudo chmod 0666 /tmp/logs/*
-        working-directory: source
-
-      - name: Upload Linux logs
-        if: failure()
-        uses: actions/upload-artifact@v3
-        with:
-          name: linux-logs
-          path: /tmp/logs
-
-      # we don't want them on CI
-      - name: Clean test and fuzz caches
-        if: always()
-        run: |
-          go clean -testcache -fuzzcache
-
-      - name: Check dirty
-        run: |
-          git status
-          git diff --exit-code
-        working-directory: source
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/integration.yml

@@ -1,84 +0,0 @@
----
-name: Integration
-on:
-  pull_request:
-    types:
-      - unlabeled # if GitHub Actions stuck, add and remove "no ci" label to force rebuild
-      - opened
-      - reopened
-      - synchronize
-  push:
-    branches:
-      - main
-  schedule:
-    - cron: "12 3 * * *" # after Docker workflow
-
-env:
-  GOPATH: /home/runner/go
-  GOCACHE: /home/runner/go/cache
-  GOLANGCI_LINT_CACHE: /home/runner/go/cache/lint
-  GOMODCACHE: /home/runner/go/mod
-  GOPROXY: https://proxy.golang.org
-
-jobs:
-  test:
-    name: Test ${{ matrix.name }}
-    runs-on: ubuntu-20.04
-
-    if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'no ci')
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - {name: "PostgreSQL", handler: "pg"}
-          - {name: "Tigris", handler: "tigris"}
-          - {name: "Tigris main", handler: "tigris", tigris_dockerfile: "tigris_main"}
-          - {name: "MongoDB", handler: "mongodb"}
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-
-      - name: Setup Go
-        uses: FerretDB/github-actions/setup-go@main
-        with:
-          cache-key: test
-
-      - name: Install Task
-        run: go generate -x
-        working-directory: tools
-
-      - name: Start environment
-        run: bin/task env-up-detach
-        env:
-          TIGRIS_DOCKERFILE: ${{ matrix.tigris_dockerfile }}
-
-      - name: Run init
-        run: bin/task init
-
-      - name: Wait for and setup environment
-        run: bin/task env-setup
-
-      - name: Run ${{ matrix.handler }} tests
-        run: bin/task test-integration-${{ matrix.handler }}
-
-      - name: Upload coverage information
-        uses: codecov/codecov-action@v3
-        with:
-          files: ./integration/integration-${{ matrix.handler }}.txt
-          flags: integration,${{ matrix.handler }}
-          fail_ci_if_error: true
-
-      # we don't want them on CI
-      - name: Clean test and fuzz caches
-        if: always()
-        run: |
-          go clean -testcache -fuzzcache
-
-      - name: Check dirty
-        run: |
-          git status
-          git diff --exit-code

.github/workflows/packages.yml

@@ -1,19 +1,39 @@
 ---
+# This workflow is dangerous and should be handled with great care to avoid security problems.
+# See the warning at conform-pr.yml.
+
+# We also tried a different approach: build Docker image in one normal, secure `pull_request` workflow,
+# upload artifact, and then download and publish it in another workflow that has access to secrets, but treats
+# artifact as passive data. We use buildx for building multi-platform images, and there is a way to export
+# multi-platform OCI tarball: https://docs.docker.com/engine/reference/commandline/buildx_build/#output
+# Unfortunately, it seems that there is no way to import that tarball in another workflow and publish it
+# as a Docker image, as strange as it sounds: https://github.com/docker/buildx/issues/186
+
 name: Packages
 on:
-  pull_request:
+  pull_request_target:
     types:
-      - unlabeled # if GitHub Actions stuck, add and remove "no ci" label to force rebuild
+      # not for "labeled" to prevent two builds for "labeled" and "unlabeled" when labels are changed
+      - unlabeled # if GitHub Actions stuck, add and remove "not ready" label to force rebuild
       - opened
       - reopened
       - synchronize
   push:
     branches:
       - main
+      - main-*
+      - releases/*
     tags:
       - "*"
   schedule:
-    - cron: "12 2 * * *"
+    - cron: "10 1 * * 1" # after cleanup and DocumentDB
+
+# Do not run this workflow in parallel for any PR change or branch/tag push
+# to prevent concurrent pushes for the same Docker image tag
+# and save some resources.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: false
 
 env:
   GOPATH: /home/runner/go
@@ -21,24 +41,59 @@ env:
   GOLANGCI_LINT_CACHE: /home/runner/go/cache/lint
   GOMODCACHE: /home/runner/go/mod
   GOPROXY: https://proxy.golang.org
+  GOTOOLCHAIN: local
 
 jobs:
   build:
-    name: Build
-    runs-on: ubuntu-20.04
+    name: Build packages
+    runs-on: server
+    timeout-minutes: 40
 
-    if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'no ci')
+    if: >
+      github.event_name != 'pull_request_target' ||
+      (
+        contains(github.event.pull_request.labels.*.name, 'trust') &&
+        !contains(github.event.pull_request.labels.*.name, 'not ready') &&
+        contains(github.event.pull_request.labels.*.name, 'packages')
+      )
+
+    permissions:
+      packages: write
 
     steps:
+      # TODO https://github.com/FerretDB/github-actions/issues/211
       - name: Checkout code
-        uses: actions/checkout@v3
+        if: github.event_name != 'pull_request_target'
+        uses: actions/checkout@v5
         with:
-          fetch-depth: 0
+          fetch-depth: 0 # for `git describe` to work
+          lfs: false # LFS is used only by website
+
+      # TODO https://github.com/FerretDB/github-actions/issues/211
+      - name: Checkout pull request code
+        if: github.event_name == 'pull_request_target'
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0 # for `git describe` to work
+          lfs: false # LFS is used only by website
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      # for version.txt on push tags; see https://github.com/actions/checkout/issues/290
+      - name: Fetch annotated tags
+        run: |
+          git fetch --tags --force
+          git status
+
+      # for branch.txt on pull_request_target; the correct branch is already checked out on push / schedule
+      - name: Name branch
+        if: github.event_name == 'pull_request_target'
+        env:
+          BRANCH: ${{ github.head_ref }} # see https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
+        run: git checkout -b $BRANCH
 
       - name: Setup Go
         uses: FerretDB/github-actions/setup-go@main
-        with:
-          cache-key: packages
+        # no cache-key on server
 
       - name: Install Task
         run: go generate -x
@@ -47,19 +102,100 @@ jobs:
       - name: Run init
         run: bin/task init
 
-      - name: Build packages
+      - name: Setup QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Initialize Docker Buildx builder
+        run: bin/task docker-init
+
+      # mostly to check that this command still works
+      - name: Build local Docker image
+        run: bin/task docker-local FILE=production
+
+      - name: Define Docker image names
+        id: tag
+        run: bin/definedockertag
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ferretdbbot
+          password: ${{ secrets.DOCKER_HUB_TOKEN }}
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Login to Quay.io
+        uses: docker/login-action@v3
+        with:
+          registry: quay.io
+          username: ferretdbbot
+          password: ${{ secrets.QUAY_TOKEN }}
+
+      - name: Build and push evaluation development Docker images ${{ steps.tag.outputs.eval_dev_images }}
+        if: steps.tag.outputs.eval_dev_images != ''
+        run: bin/task docker-eval-dev-push DOCKER_IMAGES=${{ steps.tag.outputs.eval_dev_images }}
+
+      - name: Build and push evaluation Docker images ${{ steps.tag.outputs.eval_images }}
+        if: steps.tag.outputs.eval_images != ''
+        run: bin/task docker-eval-push DOCKER_IMAGES=${{ steps.tag.outputs.eval_images }}
+
+      - name: Build and push development Docker images ${{ steps.tag.outputs.development_images }}
+        if: steps.tag.outputs.development_images != ''
+        run: bin/task docker-development-push DOCKER_IMAGES=${{ steps.tag.outputs.development_images }}
+
+      - name: Build and push production Docker images ${{ steps.tag.outputs.production_images }}
+        if: steps.tag.outputs.production_images != ''
+        run: bin/task docker-production-push DOCKER_IMAGES=${{ steps.tag.outputs.production_images }}
+
+      - name: Build development binaries
+        run: bin/task build-development
+
+      - name: Upload development binaries
+        uses: actions/upload-artifact@v5
+        with:
+          name: bin-dev
+          path: tmp/bin-dev/
+          retention-days: 1
+          if-no-files-found: error
+
+      - name: Build production binaries
+        run: bin/task build-production
+
+      - name: Upload production binaries
+        uses: actions/upload-artifact@v5
+        with:
+          name: bin
+          path: tmp/bin/
+          retention-days: 1
+          if-no-files-found: error
+
+      - name: Build Linux packages
         run: bin/task packages
 
-      - name: Upload ferretdb.deb
-        uses: actions/upload-artifact@v3
+      - name: Upload .deb packages
+        uses: actions/upload-artifact@v5
         with:
-          name: ferretdb.deb
-          path: build/deb/ferretdb.deb
+          name: debs
+          path: tmp/debs/
+          retention-days: 1
           if-no-files-found: error
 
-      - name: Upload ferretdb.rpm
-        uses: actions/upload-artifact@v3
+      - name: Upload .rpm packages
+        uses: actions/upload-artifact@v5
         with:
-          name: ferretdb.rpm
-          path: build/rpm/ferretdb.rpm
+          name: rpms
+          path: tmp/rpms/
+          retention-days: 1
           if-no-files-found: error
+
+      - name: Check dirty
+        if: always()
+        run: |
+          git status --untracked-files --ignored
+          git status
+          git diff --exit-code

.github/workflows/security.yml

@@ -0,0 +1,72 @@
+---
+name: Security
+on:
+  pull_request:
+    types:
+      - unlabeled # if GitHub Actions stuck, add and remove "not ready" label to force rebuild
+      - opened
+      - reopened
+      - synchronize
+  push:
+    branches:
+      - main
+      - main-*
+      - releases/*
+  schedule:
+    - cron: "12 0 * * *"
+
+# Do not run this workflow in parallel for any PR change.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
+env:
+  GOPATH: /home/runner/go
+  GOCACHE: /home/runner/go/cache
+  GOLANGCI_LINT_CACHE: /home/runner/go/cache/lint
+  GOMODCACHE: /home/runner/go/mod
+  GOPROXY: https://proxy.golang.org
+  GOTOOLCHAIN: local
+
+jobs:
+  security-scan:
+    name: Security scan
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+
+    if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')
+
+    permissions:
+      contents: read
+
+    steps:
+      # TODO https://github.com/FerretDB/github-actions/issues/211
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0 # for `git describe` to work
+          lfs: false # LFS is used only by website
+
+      - name: Setup Go
+        uses: FerretDB/github-actions/setup-go@main
+        with:
+          cache-key: security
+
+      - name: Install Task
+        run: go generate -x
+        working-directory: tools
+
+      # https://github.com/aquasecurity/trivy/issues?q=is%3Aissue+%22permission+denied%22
+      - name: Create directory
+        run: mkdir -p tmp/trivy/fanal
+
+      - name: Scan
+        run: bin/task security
+
+      # disabled until https://github.com/actions/dependency-review-action/issues/459 is resolved
+      - name: Check dependencies for PRs
+        # if: github.event_name == 'pull_request'
+        if: false
+        uses: actions/dependency-review-action@v4
+        with:
+          allow-licenses: Apache-2.0, BSD-3-Clause, MIT

.github/workflows/testscripts.yml

@@ -0,0 +1,133 @@
+---
+name: Test scripts
+on:
+  pull_request:
+    types:
+      - unlabeled # if GitHub Actions stuck, add and remove "not ready" label to force rebuild
+      - opened
+      - reopened
+      - synchronize
+    paths:
+      - build/legacy-mongo-shell/*.js
+      - build/testscripts/*.sql
+  push:
+    branches:
+      - main
+      - main-*
+      - releases/*
+  schedule:
+    - cron: "12 0 * * *"
+
+# Do not run this workflow in parallel for any PR change.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
+env:
+  GOPATH: /home/runner/go
+  GOCACHE: /home/runner/go/cache
+  GOLANGCI_LINT_CACHE: /home/runner/go/cache/lint
+  GOMODCACHE: /home/runner/go/mod
+  GOPROXY: https://proxy.golang.org
+  GOTOOLCHAIN: local
+
+jobs:
+  run:
+    name: Run test scripts
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+
+    if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')
+
+    permissions:
+      contents: read
+
+    steps:
+      # TODO https://github.com/FerretDB/github-actions/issues/211
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0 # for `git describe` to work
+          lfs: false # LFS is used only by website
+
+      - name: Setup Go
+        uses: FerretDB/github-actions/setup-go@main
+        with:
+          cache-key: testscripts
+
+      - name: Install Task
+        run: go generate -x
+        working-directory: tools
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Start environment
+        run: bin/task env-up-detach
+
+      - name: Run init
+        run: bin/task init
+
+      - name: Build bin/ferretdb
+        run: bin/task build-host
+
+      - name: Wait for and setup environment
+        run: bin/task env-setup
+
+      - name: Start FerretDB (no auth) in the background
+        run: >
+          bin/ferretdb
+          --listen-addr=:27017
+          --proxy-addr=127.0.0.1:37017
+          --no-auth
+          --mode=diff-normal
+          --postgresql-url='postgres://username:password@127.0.0.1:5432/postgres'
+          2> ferretdb.log &
+
+      - name: Run testsql for PostgreSQL
+        if: always()
+        run: bin/task testsql
+
+      - name: Run testjs for MongoDB (no auth)
+        if: always()
+        run: bin/task testjs TESTJS_PORT=37017
+
+      - name: Run testjs for FerretDB (no auth)
+        if: always()
+        run: bin/task testjs
+
+      - name: Compress FerretDB log before upload
+        if: failure()
+        run: zip -q -9 ferretdb-log.zip ferretdb.log
+
+      - name: Upload FerretDB log
+        if: failure()
+        uses: actions/upload-artifact@v5
+        with:
+          name: ferretdb-log
+          path: ferretdb-log.zip
+          retention-days: 1
+          if-no-files-found: error
+
+      - name: Show FerretDB log
+        if: always()
+        run: |
+          echo "::remove-matcher owner=go::"
+          cat ferretdb.log
+          rm ferretdb.log
+
+      # we don't want them on CI
+      - name: Clean test and fuzz caches
+        if: always()
+        run: go clean -testcache -fuzzcache
+
+      - name: Check dirty
+        if: always()
+        run: |
+          git status --untracked-files --ignored
+          git status
+          git diff --exit-code

.github/workflows/website-preview.yml

@@ -0,0 +1,166 @@
+---
+name: Website Preview
+on:
+  pull_request_target:
+    types:
+      # not for "labeled" to prevent two builds for "labeled" and "unlabeled" when labels are changed
+      - unlabeled # if GitHub Actions stuck, add and remove "not ready" label to force rebuild
+      - opened
+      - reopened
+      - synchronize
+
+# Do not run this workflow in parallel for any PR change
+# to prevent concurrent pushes for the same Cloudflare domain alias.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: false
+
+env:
+  GOPATH: /home/runner/go
+  GOCACHE: /home/runner/go/cache
+  GOLANGCI_LINT_CACHE: /home/runner/go/cache/lint
+  GOMODCACHE: /home/runner/go/mod
+  GOPROXY: https://proxy.golang.org
+  GOTOOLCHAIN: local
+
+jobs:
+  blog-preview:
+    name: Preview blog
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+
+    if: >
+      contains(github.event.pull_request.labels.*.name, 'trust') &&
+      !contains(github.event.pull_request.labels.*.name, 'not ready') &&
+      (contains(github.event.pull_request.labels.*.name, 'blog/engineering') ||
+      contains(github.event.pull_request.labels.*.name, 'blog/marketing'))
+
+    environment:
+      name: cloudflare-dev-blog
+      url: ${{ steps.extract.outputs.extracted_url }}
+
+    permissions:
+      contents: read
+
+    steps:
+      # TODO https://github.com/FerretDB/github-actions/issues/211
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0 # for wrangler to work
+          lfs: true
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      # for Wrangler / Cloudflare Pages on pull_request_target
+      - name: Name branch
+        env:
+          BRANCH: ${{ github.head_ref }} # see https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
+        run: git checkout -b $BRANCH
+
+      # no ppremk/lfs-warning due to https://github.com/ppremk/lfs-warning/issues/150
+
+      - name: Setup Go
+        uses: FerretDB/github-actions/setup-go@main
+        with:
+          cache-key: website-preview
+
+      - name: Install Task
+        run: go generate -x
+        working-directory: tools
+
+      - name: Build tools
+        run: bin/task env-pull
+
+      - name: Build blog
+        run: bin/task blog
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # for checkdocs
+
+      - name: Check dirty
+        run: |
+          git status
+          git diff --exit-code
+
+      - name: Deploy to Cloudflare Pages
+        run: bin/task blog-cloudflare-preview | tee deploy.txt
+        env:
+          CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+
+      - name: Set GitHub deployment URL
+        id: extract
+        uses: FerretDB/github-actions/extract-first-url@main
+
+  docs-preview:
+    name: Preview docs
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+
+    if: >
+      contains(github.event.pull_request.labels.*.name, 'trust') &&
+      !contains(github.event.pull_request.labels.*.name, 'not ready') &&
+      contains(github.event.pull_request.labels.*.name, 'documentation')
+
+    environment:
+      name: cloudflare-dev-docs
+      url: ${{ steps.extract.outputs.extracted_url }}
+
+    permissions:
+      contents: read
+
+    steps:
+      # We can't easily download build results from the Docs workflow:
+      # https://github.com/actions/download-artifact/issues/172
+      # Just build them again instead.
+      # That also allows us to pass branch name, commit hash, etc from git to wrangler.
+
+      # TODO https://github.com/FerretDB/github-actions/issues/211
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0 # for wrangler to work
+          lfs: true
+          ref: ${{ github.event.pull_request.head.sha }} # TODO https://github.com/FerretDB/github-actions/issues/211
+
+      # for Wrangler / Cloudflare Pages on pull_request_target
+      - name: Name branch
+        env:
+          BRANCH: ${{ github.head_ref }} # see https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
+        run: git checkout -b $BRANCH
+
+      # no ppremk/lfs-warning due to https://github.com/ppremk/lfs-warning/issues/150
+
+      - name: Setup Go
+        uses: FerretDB/github-actions/setup-go@main
+        with:
+          cache-key: website-preview
+
+      - name: Install Task
+        run: go generate -x
+        working-directory: tools
+
+      - name: Build tools
+        run: bin/task env-pull
+
+      - name: Create directory
+        run: mkdir -p tmp/githubcache
+
+      - name: Build docs
+        run: bin/task docs
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # for checkdocs
+
+      - name: Check dirty
+        run: |
+          git status
+          git diff --exit-code
+
+      - name: Deploy to Cloudflare Pages
+        run: bin/task docs-cloudflare-preview | tee deploy.txt
+        env:
+          CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+
+      - name: Set GitHub deployment URL
+        id: extract
+        uses: FerretDB/github-actions/extract-first-url@main

.gitignore

@@ -1,27 +1,24 @@
-# Please use global .gitignore file for .vscode/, .idea/, etc.
+# This file is used only for repository-specific patterns.
+# Please use global .gitignore file for .DS_Store, .idea/, go.work, .envrc, etc.
 # See https://docs.github.com/en/get-started/getting-started-with-git/ignoring-files#configuring-ignored-files-for-all-repositories-on-your-computer
 
-# out tools
-bin/
+state.json
+telemetry.json
 
-# temporary `go mod vendor` directory
-vendor/
+*.bc
+*.o
+*.so
 
-# task cache
-.task/
-
-# packages
-*.deb
-*.rpm
-
-# test coverage results, generated files like commit.txt, etc.
+*.out
+*.tmp
 *.txt
+!website/static/*.txt
+*.xml
 
-# test coverage results
-*.html
+.task/
+bin/
+tmp/
+vendor/
+website/build/
 
-# for now
-testdata/fuzz/
-
-# for local Docker Compse changes; see https://docs.docker.com/compose/extends/#multiple-compose-files
-docker-compose.override.yml
+**/testdata/fuzz/

.gitmodules

@@ -0,0 +1,4 @@
+[submodule "documentdb"]
+	path = build/postgres-documentdb/documentdb
+	url = https://github.com/FerretDB/documentdb.git
+	branch = ferretdb

.golangci-new.yml

@@ -1,10 +1,44 @@
 ---
-# New or experimental linters that should pass (or be reconfigured) for new code (compared to `origin/main`).
+# New or experimental linters that should pass (or be reconfigured)
+# for new FerretDB and tools code (compared to `origin/main`).
 
 run:
   timeout: 3m
 
+# bin/golangci-lint linters -c .golangci-new.yml
 linters-settings:
+  asasalint:
+    exclude:
+      - ^lazyerrors\.Errorf$
+    use-builtin-exclusions: true
+    ignore-test: false
+  copyloopvar:
+    check-alias: true
+  errcheck:
+    check-type-assertions: false
+    check-blank: false
+    disable-default-exclusions: false
+    exclude-functions:
+      - (*github.com/jackc/pgx/v5.Conn).Close
+  errorlint:
+    # see caveats at https://github.com/polyfloyd/go-errorlint#fmterrorf-wrapping-verb
+    errorf: false
+    asserts: true
+    comparison: true
+  govet:
+    enable-all: true
+    settings:
+      shadow:
+        strict: true
+  revive:
+    ignore-generated-header: true
+    severity: warning
+    # TODO enable-all-rules: true https://github.com/FerretDB/FerretDB/issues/2748
+    rules:
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md
+      - name: exported
+        arguments: [checkPrivateReceivers, disableStutteringCheck]
+      - name: package-comments
   staticcheck:
     checks: ["all"]
   wsl:
@@ -28,7 +62,10 @@ linters:
     - asciicheck
     - depguard
     - exhaustive
+    - exhaustruct
+    - forbidigo
     - gci
+    - gochecksumtype
     - goconst
     - godot
     - godox
@@ -36,93 +73,102 @@ linters:
     - goimports
     - gomodguard
     - gosimple
-    - govet
     - importas
     - ineffassign
     - lll
     - misspell
     - nolintlint
-    - revive
+    - sloglint
+    - tagalign
+    - unparam
     - unused
     - whitespace
 
-    # TODO configure and enable one by one
+    # TODO https://github.com/FerretDB/FerretDB/issues/2748
     - bidichk
+    - bodyclose
+    - canonicalheader
     - containedctx
+    - contextcheck
     - cyclop
-    - deadcode
     - decorder
     - dogsled
     - dupl
+    - dupword
     - durationcheck
-    - errcheck
+    - err113
     - errchkjson
     - errname
-    - errorlint
-    - execinquery
-    - exhaustivestruct
-    - exhaustruct
-    - exportloopref
-    - forbidigo
+    - fatcontext
     - forcetypeassert
     - funlen
+    - ginkgolinter
+    - gocheckcompilerdirectives
     - gochecknoglobals
     - gochecknoinits
     - gocognit
     - gocritic
     - gocyclo
-    - goerr113
     - gofmt
     - gofumpt
-    - gomnd
     - gomoddirectives
     - goprintffuncname
     - gosec
+    - gosmopolitan
     - grouper
-    - ifshort
+    - iface
+    - inamedparam
+    - interfacebloat
+    - intrange
     - ireturn
+    - loggercheck
     - maintidx
     - makezero
+    - mirror
+    - mnd
+    - musttag
     - nakedret
     - nestif
+    - nilerr
     - nilnil
+    - noctx
     - nonamedreturns
     - nosprintfhostport
     - paralleltest
+    - perfsprint
     - prealloc
     - predeclared
     - promlinter
+    - protogetter
+    - reassign
+    - recvcheck
+    - rowserrcheck
+    - sloglint
+    - spancheck
+    - sqlclosecheck
     - stylecheck
     - tagliatelle
     - tenv
+    - testableexamples
+    - testifylint
     - thelper
+    - tparallel
     - typecheck
     - unconvert
-    - varcheck
+    - usestdlibvars
     - varnamelen
-    - wrapcheck
-
-    # TODO https://github.com/golangci/golangci-lint/issues/2649
-    - bodyclose
-    - contextcheck
-    - nilerr
-    - noctx
-    - rowserrcheck
-    - sqlclosecheck
-    - structcheck
-    - tparallel
-    - unparam
     - wastedassign
+    - wrapcheck
+    - zerologlint
 
-    - golint      # deprecated
-    - interfacer  # deprecated
-    - maligned    # deprecated
-    - nlreturn    # too annoying
-    - scopelint   # deprecated
+    - nlreturn # too annoying
     - testpackage # we test internals
 
 issues:
   max-issues-per-linter: 0
   max-same-issues: 0
-  exclude-use-default: false
+
   new-from-rev: origin/main
+  # whole-files: true
+
+  exclude-use-default: false

.golangci.yml

@@ -1,5 +1,5 @@
 ---
-# Linters that should pass for all code.
+# Linters that should pass for all FerretDB and tools code.
 
 run:
   timeout: 3m
@@ -7,28 +7,120 @@ run:
 linters-settings:
   # asciicheck
   depguard:
-    list-type: blacklist
-    packages:
-      - github.com/FerretDB/FerretDB/internal/bson
-      - github.com/FerretDB/FerretDB/internal/fjson
-      - github.com/FerretDB/FerretDB/internal/tjson
-      - github.com/FerretDB/FerretDB/internal/handlers/pg/pgdb
-      - github.com/tigrisdata/tigris-client-go/api/client/v1/api
-      - github.com/tigrisdata/tigris-client-go/filter # We use our own filter without generics (see tigris/tigrisdb/filter)
+    rules:
+      old-packages:
+        files:
+          - $all
+        deny:
+          - pkg: golang.org/x/net/context
+            desc: use `context` package instead
+          - pkg: golang.org/x/exp/slices
+            desc: use `slices` package instead
+          - pkg: golang.org/x/exp/maps
+            desc: use `maps` package instead
+
+          - pkg: github.com/jackc/pgconn
+            desc: use `github.com/jackc/pgx/v5/pgconn` package instead
+          - pkg: github.com/jackc/pgproto3
+            desc: use `github.com/jackc/pgx/v5/pgproto3` package instead
+          - pkg: github.com/jackc/pgtype
+            desc: use `github.com/jackc/pgx/v5/pgtype` package instead
+          - pkg: github.com/jackc/pgx$
+            desc: use `github.com/jackc/pgx/v5` package instead
+          - pkg: github.com/jackc/pgx/v4
+            desc: use `github.com/jackc/pgx/v5` package instead
+
+          # TODO https://github.com/FerretDB/FerretDB/issues/4798
+          # - pkg: go.mongodb.org/mongo-driver/bson
+          #   desc: use `go.mongodb.org/mongo-driver/v2/bson` package instead
+          # - pkg: go.mongodb.org/mongo-driver/mongo
+          #   desc: use `go.mongodb.org/mongo-driver/v2/mongo` package instead
+
+          # - pkg: github.com/xdg-go/scram
+          #   desc: use `github.com/FerretDB/FerretDB/v2/internal/util/scram` package instead
+      ferretdb-in-tools:
+        files:
+          - "**/tools/**/*.go"
+        deny:
+          - pkg: github.com/FerretDB/FerretDB/v2/internal/
+            desc: tools should not import FerretDB code
+      wirebson:
+        files:
+          - $all
+          - "!**/cmd/envtool/*.go"
+          - "!**/internal/clientconn/*.go"
+          - "!**/internal/dataapi/server/*.go"
+          - "!**/internal/documentdb/**.go"
+          - "!**/internal/driver/*.go"
+          - "!**/internal/handler/**.go"
+          - "!**/internal/mcp/*.go"
+          - "!**/internal/mongoerrors/*.go"
+          - "!**/internal/util/logging/*.go"
+          - "!**/internal/util/scram/*.go"
+          - "!**/internal/util/testutil/*.go"
+        deny:
+          - pkg: github.com/FerretDB/wire/wirebson
+      documentdb:
+        files:
+          - "**/internal/documentdb/genwrap/*.go"
+        deny:
+          - pkg: github.com/FerretDB/FerretDB/v2/internal/documentdb
+      cursor:
+        files:
+          - $all
+          - "!**/internal/documentdb/**.go"
+        deny:
+          - pkg: github.com/FerretDB/FerretDB/v2/internal/documentdb/cursor
   exhaustive:
     default-signifies-exhaustive: false
+  exhaustruct:
+    include:
+      - TODO
+  forbidigo:
+    forbid:
+      - p: ^\Qpgxpool.Pool.AcquireFunc\E$
+        pkg: ^\Qgithub.com/jackc/pgx/v5/pgxpool\E$
+        msg: Use `Acquire` with `defer Release()` instead.
+
+      # TODO https://github.com/FerretDB/FerretDB/issues/4798
+      - p: ^\Qbson.E\E$
+        pkg: ^\Qgo.mongodb.org/mongo-driver/bson\E$
+        msg: Use `*wirebson.Document` or `*wirebson.Array` instead.
+      - p: ^\Qbson.D\E$
+        pkg: ^\Qgo.mongodb.org/mongo-driver/bson\E$
+        msg: Use `*wirebson.Document` instead.
+      - p: ^\Qbson.M\E$
+        pkg: ^\Qgo.mongodb.org/mongo-driver/bson\E$
+        msg: Use `*wirebson.Document` instead.
+      - p: ^\Qbson.A\E$
+        pkg: ^\Qgo.mongodb.org/mongo-driver/bson\E$
+        msg: Use `*wirebson.Array` instead.
+
+      - p: ^\Qbson.E\E$
+        pkg: ^\Qgo.mongodb.org/mongo-driver/v2/bson\E$
+        msg: Use `*wirebson.Document` or `*wirebson.Array` instead.
+      - p: ^\Qbson.D\E$
+        pkg: ^\Qgo.mongodb.org/mongo-driver/v2/bson\E$
+        msg: Use `*wirebson.Document` instead.
+      - p: ^\Qbson.M\E$
+        pkg: ^\Qgo.mongodb.org/mongo-driver/v2/bson\E$
+        msg: Use `*wirebson.Document` instead.
+      - p: ^\Qbson.A\E$
+        pkg: ^\Qgo.mongodb.org/mongo-driver/v2/bson\E$
+        msg: Use `*wirebson.Array` instead.
+    exclude-godoc-examples: true
+    analyze-types: true
   gci:
     sections:
       - standard
       - default
-      - prefix(github.com/FerretDB/FerretDB)
+      - prefix(github.com/FerretDB/FerretDB/v2/)
   goconst:
     min-occurrences: 5
     ignore-tests: true
   godot:
     scope: toplevel
     exclude:
-      - go-sumtype:decl
       - check interfaces
     capital: true
   godox:
@@ -36,6 +128,8 @@ linters-settings:
       - BUG
       - FIXME
       - HACK
+      - lala
+      - lalala
   goheader:
     # Please do not update it, including bumping a year.
     template: |-
@@ -53,21 +147,41 @@ linters-settings:
       See the License for the specific language governing permissions and
       limitations under the License.
   goimports:
-    local-prefixes: github.com/FerretDB/FerretDB
+    local-prefixes: github.com/FerretDB/FerretDB/v2
   gomodguard:
     blocked:
       modules:
-        - go.mongodb.org/mongo-driver:
-            reason: "FerretDB should not depend on MongoDB Go driver."
+        - github.com/FerretDB/FerretDB:
+            reason: "Use `github.com/FerretDB/FerretDB/v2/...` instead."
   gosimple:
     checks: ["all"]
-  # govet
+  govet:
+    enable-all: true
+    disable:
+      - fieldalignment
+      - nilness
+      - shadow
   importas:
-    no-unaliased: false
-    no-extra-aliases: true
+    # https://github.com/julz/importas/issues/15
+    no-unaliased: true
+    no-extra-aliases: false
     alias:
-      - pkg: github.com/tigrisdata/tigris-client-go/api/server/v1
-        alias: api
+      - pkg: runtime/debug
+        alias: runtimedebug
+      - pkg: github.com/prometheus/client_model/go
+        alias: dto
+      - pkg: go.opentelemetry.io/otel/attribute
+        alias: otelattribute
+      - pkg: go.opentelemetry.io/otel/codes
+        alias: otelcodes
+      - pkg: go.opentelemetry.io/otel/trace
+        alias: oteltrace
+      - pkg: go.opentelemetry.io/otel/sdk/resource
+        alias: otelsdkresource
+      - pkg: go.opentelemetry.io/otel/sdk/trace
+        alias: otelsdktrace
+      - pkg: go.opentelemetry.io/otel/semconv/v1.34.0
+        alias: otelsemconv
   # ineffassign
   lll:
     line-length: 130
@@ -75,21 +189,51 @@ linters-settings:
   misspell:
     ignore-words:
       - guiness # present in the test dataset
+    extra-words: # https://go.dev/wiki/Spelling, https://github.com/golangci/misspell/issues/11
+      - typo: "iff"
+        correction: "if"
+      - typo: "cancelation"
+        correction: "cancellation"
   nolintlint:
     allow-unused: false
-    allow-leading-space: false
     allow-no-explanation: []
     require-explanation: true
     require-specific: true
   revive:
     ignore-generated-header: true
-    severity: warning
-    enableAllRules: true
+    severity: error
+    rules: []
+  sloglint:
+    no-mixed-args: true
+    kv-only: false
+    attr-only: true
+    no-global: "all"
+    context: "scope"
+    static-msg: false # TODO https://github.com/FerretDB/FerretDB/issues/3421
+    no-raw-keys: false # TODO https://github.com/FerretDB/FerretDB/issues/3421
+    key-naming-case: snake
+    args-on-sep-lines: false
   staticcheck:
     checks:
       - all
       - -SA1019 # ignore deprecation errors in existing code; new code is checked by the other configuration
-  # unused
+  tagalign:
+    sort: true
+    order:
+      - name
+      - cmd
+      - arg
+      - default
+      - help
+  unparam:
+    check-exported: false
+  unused:
+    field-writes-are-uses: false
+    post-statements-are-reads: false
+    exported-fields-are-used: false
+    parameters-are-used: true # it should be false, TODO https://github.com/FerretDB/FerretDB-DocumentDB/issues/823
+    local-variables-are-used: false
+    generated-is-used: false
   whitespace:
     multi-if: false
     multi-func: false
@@ -100,7 +244,10 @@ linters:
     - asciicheck
     - depguard
     - exhaustive
+    - exhaustruct
+    - forbidigo
     - gci
+    - gochecksumtype
     - goconst
     - godot
     - godox
@@ -115,7 +262,10 @@ linters:
     - misspell
     - nolintlint
     - revive
+    - sloglint
     - staticcheck
+    - tagalign
+    - unparam
     - unused
     - whitespace
 
@@ -125,44 +275,10 @@ issues:
 
   exclude-use-default: false
   exclude-rules:
-    # only `wire` package can import `bson` package
-    - linters: [depguard]
-      path: internal/wire
-      text: bson
+    # we don't want to introduce that constant
+    - linters: [goconst]
+      text: "^string `_id` has \\d+ occurrences, make it a constant"
 
-    # only `pg` handler can import `pgdb` package, not other handler can do that
-    - linters: [depguard]
-      path: internal/handlers/pg
-      text: pgdb
-    - linters: [depguard]
-      path: cmd/envtool
-      text: pgdb
-    - linters: [depguard]
-      path: cmd/ferretdb
-      text: pgdb
-    - linters: [depguard]
-      path: internal/util/testutil
-      text: pgdb
-    - linters: [depguard]
-      path: internal/handlers/registry
-      text: pgdb
-
-    # only `pg` handler can import `fjson` package, not other handler can do that
-    - linters: [depguard]
-      path: internal/handlers/pg
-      text: fjson
-    - linters: [depguard]
-      path: internal/wire
-      text: fjson
-    - linters: [depguard]
-      path: internal/util/testutil
-      text: fjson
-
-    # only `tigris` handler can import `tjson` package, not other handler can do that
-    - linters: [depguard]
-      path: internal/handlers/tigris
-      text: tjson
-
-    # that's a valid usage of bson.D
-    - linters: [govet]
-      text: "`go.mongodb.org/mongo-driver/bson/primitive.E` composite literal uses unkeyed fields"
+    - linters: [forbidigo]
+      path: "\\Qferretdb/ferretdb_test.go"
+      text: "\\Quse of `bson.D` forbidden"

.markdownlint.yml

@@ -1,13 +0,0 @@
----
-# https://github.com/DavidAnson/markdownlint
-# https://github.com/igorshubovych/markdownlint-cli
-# https://github.com/DavidAnson/markdownlint/blob/main/doc/Rules.md
-
-default: true
-
-MD002: false # deprecated
-MD003: {style: atx}
-MD004: {style: "asterisk"}
-MD006: false # deprecated
-MD013: false # we use https://sembr.org that could lead to long lines
-MD029: {style: ordered}

.prettierignore

@@ -0,0 +1,6 @@
+# We can't have it in build/.prettierignore due to https://github.com/prettier/prettier/issues/15428
+# Textlint uses the same format, so we re-use the file.
+build/postgres-documentdb/documentdb/**
+internal/dataapi/api/openapi.json
+internal/dataapi/api/openapi-original.json
+website/static/codapi/snippet.js

CODE_OF_CONDUCT.md

@@ -17,24 +17,19 @@ diverse, inclusive, and healthy community.
 Examples of behavior that contributes to a positive environment for our
 community include:
 
-* Demonstrating empathy and kindness toward other people
-* Being respectful of differing opinions, viewpoints, and experiences
-* Giving and gracefully accepting constructive feedback
-* Accepting responsibility and apologizing to those affected by our mistakes,
-  and learning from the experience
-* Focusing on what is best not just for us as individuals, but for the overall
-  community
+- Demonstrating empathy and kindness toward other people
+- Being respectful of differing opinions, viewpoints, and experiences
+- Giving and gracefully accepting constructive feedback
+- Accepting responsibility and apologizing to those affected by our mistakes, and learning from the experience
+- Focusing on what is best not just for us as individuals, but for the overall community
 
 Examples of unacceptable behavior include:
 
-* The use of sexualized language or imagery, and sexual attention or advances of
-  any kind
-* Trolling, insulting or derogatory comments, and personal or political attacks
-* Public or private harassment
-* Publishing others' private information, such as a physical or email address,
-  without their explicit permission
-* Other conduct which could reasonably be considered inappropriate in a
-  professional setting
+- The use of sexualized language or imagery, and sexual attention or advances of any kind
+- Trolling, insulting or derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information, such as a physical or email address, without their explicit permission
+- Other conduct which could reasonably be considered inappropriate in a professional setting
 
 ## Enforcement Responsibilities
 
@@ -60,7 +55,7 @@ representative at an online or offline event.
 
 Instances of abusive, harassing, or otherwise unacceptable behavior may be
 reported to the community leaders responsible for enforcement at
-conduct@ferretdb.io.
+<conduct@ferretdb.io>.
 All complaints will be reviewed and investigated promptly and fairly.
 
 All community leaders are obligated to respect the privacy and security of the
@@ -78,28 +73,26 @@ unprofessional or unwelcome in the community.
 
 **Consequence**: A private, written warning from community leaders, providing
 clarity around the nature of the violation and an explanation of why the
-behavior was inappropriate. A public apology may be requested.
+behavior was inappropriate.
+A public apology may be requested.
 
 ### 2. Warning
 
-**Community Impact**: A violation through a single incident or series of
-actions.
+**Community Impact**: A violation through a single incident or series of actions.
 
-**Consequence**: A warning with consequences for continued behavior. No
-interaction with the people involved, including unsolicited interaction with
-those enforcing the Code of Conduct, for a specified period of time. This
-includes avoiding interactions in community spaces as well as external channels
-like social media. Violating these terms may lead to a temporary or permanent
-ban.
+**Consequence**: A warning with consequences for continued behavior.
+No interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time.
+This includes avoiding interactions in community spaces as well as external channels like social media.
+Violating these terms may lead to a temporary or permanent ban.
 
 ### 3. Temporary Ban
 
-**Community Impact**: A serious violation of community standards, including
-sustained inappropriate behavior.
+**Community Impact**: A serious violation of community standards, including sustained inappropriate behavior.
 
 **Consequence**: A temporary ban from any sort of interaction or public
-communication with the community for a specified period of time. No public or
-private interaction with the people involved, including unsolicited interaction
+communication with the community for a specified period of time.
+No public or private interaction with the people involved, including unsolicited interaction
 with those enforcing the Code of Conduct, is allowed during this period.
 Violating these terms may lead to a permanent ban.
 
@@ -109,8 +102,7 @@ Violating these terms may lead to a permanent ban.
 standards, including sustained inappropriate behavior, harassment of an
 individual, or aggression toward or disparagement of classes of individuals.
 
-**Consequence**: A permanent ban from any sort of public interaction within the
-community.
+**Consequence**: A permanent ban from any sort of public interaction within the community.
 
 ## Attribution
 
@@ -122,7 +114,8 @@ Community Impact Guidelines were inspired by
 [Mozilla's code of conduct enforcement ladder][Mozilla CoC].
 
 For answers to common questions about this code of conduct, see the FAQ at
-[https://www.contributor-covenant.org/faq][FAQ]. Translations are available at
+[https://www.contributor-covenant.org/faq][FAQ].
+Translations are available at
 [https://www.contributor-covenant.org/translations][translations].
 
 [homepage]: https://www.contributor-covenant.org

CONTRIBUTING.md

@@ -5,44 +5,54 @@ Thank you for your interest in making FerretDB better!
 ## Finding something to work on
 
 We are interested in all contributions, big or small, in code or documentation.
-But unless you are fixing a very small issue like a typo,
-we kindly ask you first to [create an issue](https://github.com/FerretDB/FerretDB/issues/new/choose),
-to leave a comment on an existing issue if you want to work on it,
-or to [join our Slack chat](./README.md#community) and leave a message for us there.
-This way, you will get help from us and avoid wasted efforts if something can't be worked on right now
-or someone is already working on it.
+But unless you are fixing a tiny issue like a typo,
+we kindly ask you first to [create an issue](https://github.com/FerretDB/FerretDB/issues/new/choose)
+or leave a comment on an existing issue if you want to work on it.
+This way, we could assign the issue to you, marking it as being worked on,
+preventing others from wasting efforts working on it at the same time.
+Additionally, you can [join our Slack chat](./README.md#community) and leave a message for us in the `#dev` channel.
 
-You can find a list of good issues for first-time contributors [there](https://github.com/FerretDB/FerretDB/contribute).
+You can find a list of good first issues for contributors [there](https://github.com/FerretDB/FerretDB/contribute).
+Once you have some experience with contributing to FerretDB,
+feel free to pick any issue
+[that is not assigned to anyone and doesn't have `not ready` label](https://github.com/FerretDB/FerretDB/issues?q=is%3Aissue+is%3Aopen+no%3Aassignee+-label%3A%22not+ready%22).
+Still, please leave a comment on it as described above.
 
-## Contributing code
+## Setting up the environment
 
-The supported way of developing FerretDB is to modify and run it on the host (Linux, macOS, or Windows)
+### Requirements
+
+The supported way of contributing to FerretDB is to modify and run it on the host (Linux, macOS, or Windows)
 with PostgreSQL and other dependencies running inside Docker containers via Docker Compose.
-On Linux, `docker` and `docker-compose` should be installed on the host.
+On Linux, `docker` (with `docker compose` subcommand a.k.a. [Compose V2](https://docs.docker.com/compose/compose-v2/),
+not old `docker-compose` tool) should be installed on the host.
 On macOS and Windows, [Docker Desktop](https://www.docker.com/products/docker-desktop/) should be used.
 On Windows, it should be [configured to use WSL 2](https://docs.docker.com/desktop/windows/wsl/) without any distro;
 all commands should be run on the host.
 
-You will need Go 1.18 or later as FerretDB extensively uses ([fuzzing](https://go.dev/doc/tutorial/fuzz))
-and [generics](https://go.dev/doc/tutorial/generics)).
+You will need Go 1.25 or later on the host.
 If your package manager doesn't provide it yet,
 please install it from [go.dev](https://go.dev/dl/).
 
 You will also need `git` installed; the version provided by your package manager should do.
-On Windows, the simplest way to install it might be <https://gitforwindows.org>.
+On Windows, the simplest way to install it might be https://gitforwindows.org.
 
-### Cloning the Repository
+Finally, you will also need [git-lfs](https://git-lfs.github.com) installed and configured (`git lfs install`).
 
-After [forking FerretDB on GitHub](https://github.com/FerretDB/FerretDB/fork),
-you can clone the repository:
+### Making a working copy
+
+Fork the [FerretDB repository on GitHub](https://github.com/FerretDB/FerretDB/fork).
+After that, you can clone the repository and add the upstream repository as a remote:
 
 ```sh
 git clone git@github.com:<YOUR_GITHUB_USERNAME>/FerretDB.git
 cd FerretDB
 git remote add upstream https://github.com/FerretDB/FerretDB.git
+git fetch --all --tags
 ```
 
-### Setting up the development environment
+The last command would fetch all Git tags from our repository that GitHub won't copy to fork by default.
+`git describe` command uses them to determine the FerretDB version during the build process.
 
 To run development commands, you should first install the [`task`](https://taskfile.dev/) tool.
 You can do this by changing the directory to `tools` (`cd tools`) and running `go generate -x`.
@@ -53,23 +63,81 @@ or replace every invocation of `task` with explicit `bin/task`.
 You can also [install `task` globally](https://taskfile.dev/#/installation),
 but that might lead to the version skew.
 
-With `task` installed, you may do the following:
+With `task` installed,
+you can see all available tasks by running `task -l` in the root of the repository
+(not in the `tools` directory).
 
-1. Install development tools with `task init`.
-2. Download required Docker images with `task env-pull`.
-3. Start the development environment with `task env-up`.
-4. Run all tests in another terminal window with `task test`.
-5. Start FerretDB with `task run`.
-   This will start it in a development mode where all requests are handled by FerretDB, but also routed to MongoDB.
-   The differences in response are then logged and the FerretDB response is sent back to the client.
-6. Fill `values` collection in `test` database with data for experiments with `task env-data`.
-7. Run `mongosh` with `task mongosh`.
-   This allows you to run commands against FerretDB.
-   For example, you can see what data was inserted by the previous command with `db.values.find()`.
+After that, you should install development tools with `task init`
+and download required Docker images with `task env-pull`.
 
-You can see all available `task` tasks with `task -l`.
+If something does not work correctly,
+you can reset the environment with `task env-reset`.
 
-### Code Overview
+### Building a production release binaries
+
+To build a production release binaries, run `task build-production`.
+The results will be saved `tmp/bin`.
+
+### Setting a GITHUB_TOKEN
+
+Some of our development tools require access to public information on GitHub
+at a rate higher than allowed for unauthenticated requests.
+Those tools will report a problem in this case.
+It could be solved by creating a new classic or fine-grained personal access token
+[there](https://github.com/settings/tokens).
+No scopes are needed for classic tokens, not even `public_repo`.
+For fine-grained tokens, only read-only access to public repositories is needed without any additional permissions.
+After generating a token, set the `GITHUB_TOKEN` environment variable:
+
+```sh
+export GITHUB_TOKEN=ghp_XXX
+```
+
+or
+
+```sh
+export GITHUB_TOKEN=github_pat_XXX
+```
+
+## Reporting a bug
+
+We appreciate reporting a bug to us.
+To help us accurately identify the cause, we encourage you to include a pull request with test script.
+Please write the test script in [build/legacy-mongo-shell/test.js](build/legacy-mongo-shell/test.js).
+You can find an overview of the available assertions [here](build/legacy-mongo-shell/README.md).
+Use these assertions to validate your test's assumptions and invariants.
+
+With `task` installed (see above), you may test your script using following steps:
+
+1. Start the development environment with `task env-up`.
+2. Start FerretDB with `task run`.
+3. Run the test script with `task testjs`.
+
+Please create a pull request and include the link of the pull request in the bug issue.
+
+## Contributing code
+
+### Commands for contributing code
+
+With `task` installed (see above), you may do the following:
+
+1. Start the development environment with `task env-up`.
+2. Run all tests with `task test` (see [below](#running-tests)).
+3. Start FerretDB with `task run`.
+   The development environment uses `diff-normal` mode as the default mode.
+   Set preferred mode such as `task run MODE=diff-proxy`.
+   (See [Operation modes](https://docs.ferretdb.io/configuration/operation-modes/) page in our documentation.)
+4. Fill collections in the `test` database with data for experiments with `task env-data`.
+5. Run `mongosh` with `task mongosh`.
+   See what collections were created by the previous command with `show collections`.
+
+#### Commands for authenticated connection
+
+1. Start the development environment with `task env-up`.
+2. Start FerretDB with `task run-secure MODE=normal` or `task run-secure MODE=proxy`.
+3. Run `task mongosh-secure` to establish an authenticated connection.
+
+### Code overview
 
 The directory `cmd` provides commands implementation.
 Its subdirectory `ferretdb` is the main FerretDB binary; others are tools for development.
@@ -79,47 +147,72 @@ They are installed into `bin/` by `cd tools; go generate -x`.
 
 The `internal` subpackages contain most of the FerretDB code:
 
-* `types` package provides Go types matching BSON types that don't have built-in Go equivalents:
-  we use `int32` for BSON's int32, but `types.ObjectID` for BSON's ObjectId.
-* `fjson` provides converters from/to FJSON for built-in and `types` types.
-  FJSON adds some extensions to JSON for keeping object keys in order,
-  preserving BSON type information in the values themselves, etc.
-  It is used by `pg` handler.
-* `tjson` provides converters from/to JSON with JSON Schema for built-in and `types` types.
-  BSON type information is preserved either in the schema (where possible) or in the values themselves.
-  It is used by `tigris` handler.
-* `bson` package provides converters from/to BSON for built-in and `types` types.
-* `wire` package provides wire protocol implementation.
-* `clientconn` package provides client connection implementation.
-  It accepts client connections, reads `wire`/`bson` protocol messages, and passes them to `handlers`.
-  Responses are then converted to `wire`/`bson` messages and sent back to the client.
-* `handlers` handle protocol commands.
-  They use `fjson` package for storing data in PostgreSQL in jsonb columns, but they don't use `bson` package –
-  all data is represented as built-in and `types` types.
+- `handler` provides implementations of command handlers.
+  The logic of commands like `find` and `aggregate` is there.
+- `dataapi` provides an Data API wrapper for `handler`.
+  It allows FerretDB to be used over HTTP instead of MongoDB wire protocol.
+- `clientconn` provides wire protocol server implementation.
+  It accepts client connections, reads wire protocol messages, and passes them to `handler`.
+  Responses are then converted and sent back to the client.
+- `documentdb` provides DocumentDB extension integration.
+- `mongoerrors` provides MongoDB-compatible error types and codes.
+  They are used by `handler` and `documentdb`.
 
-Those packages are tested by "unit" tests that are placed inside those packages.
+The wire protocol implementation and BSON handling code were extracted into a separate repository:
+https://github.com/FerretDB/wire
+
+#### Running tests
+
+`internal` packages are tested by "unit" tests that are placed inside those packages.
 Some of them are truly hermetic and test only the package that contains them;
 you can run those "short" tests with `go test -short` or `task test-unit-short`,
 but that's typically not required.
 Other unit tests use real databases;
 you can run those with `task test-unit` after starting the environment as described above.
 
-We also have a set of "integration" tests in `integration` Go module that uses the Go MongoDB driver
-and tests either a running MongoDB-compatible database (such as FerretDB or MongoDB itself) on a given port
-or in-process FerretDB (meaning that integration tests start and stop FerretDB themselves) with given handler.
-They allow us to ensure compatibility between FerretDB and MongoDB.
+We also have a set of "integration" tests in the `integration` directory.
+They use the Go MongoDB driver like a regular user application.
+They could test any MongoDB-compatible database (such as FerretDB or MongoDB itself) via a regular TCP or TLS port
+or Unix domain socket.
+They also could test in-process FerretDB instances
+(meaning that integration tests start and stop them themselves).
+Finally, some integration tests (so-called compatibility or "compat" tests) connect to two systems
+("target" for FerretDB and "compat" for MongoDB) at the same time,
+send the same queries to both, and compare results.
 You can run them with:
 
-* `task test-integration-pg` for in-process FerretDB with `pg` handler;
-* `task test-integration-tigris` for in-process FerretDB with `tigris` handler;
-* `task test-integration-mongodb` for MongoDB running on port 37017 (as in our development environment),
-* or `task test-integration` to run all in parallel.
+- `task test-integration-postgresql` for in-process FerretDB and MongoDB;
+- `task test-integration-mongodb` for MongoDB only, skipping compat tests;
+- or `task test-integration` to run all in parallel.
 
-Finally, you may run all tests in parallel with `task test`.
+You may run all tests in parallel with `task test`.
 If tests fail and the output is too confusing, try running them sequentially by using the commands above.
 
 You can also run `task -C 1` to limit the number of concurrent tasks, which is useful for debugging.
 
+To run a subset of integration tests and test cases, you may use Task variable `TEST_RUN`.
+For example, to run all tests for the `getMore` command with in-process FerretDB
+you may use `task test-integration-postgresql TEST_RUN='(?i)GetMore'`.
+
+Finally, since all tests just run `go test` with various arguments and flags under the hood
+(for example, `TEST_RUN` just provides the value for the [`-run` flag](https://pkg.go.dev/cmd/go#hdr-Testing_flags)),
+you may also use all standard `go` tool facilities,
+including [`GOFLAGS` environment variable](https://pkg.go.dev/cmd/go#hdr-Environment_variables).
+For example:
+
+- to run all tests for the `getMore` command sequentially,
+  you may use `env GOFLAGS='-parallel=1 -p=1' task test-integration-postgresql TEST_RUN='(?i)GetMore'`;
+- to run all tests with MongoDB with [Go execution tracer](https://pkg.go.dev/runtime/trace) enabled
+  you may use `env GOFLAGS='-trace=trace.out' task test-integration-mongodb`.
+
+<!-- textlint-disable one-sentence-per-line -->
+
+> [!NOTE]
+> It is not recommended to set `GOFLAGS` and other Go environment variables with `export GOFLAGS=...`
+> or `go env -w GOFLAGS=...` because they are invisible and easy to forget about, leading to confusion.
+
+<!-- textlint-enable one-sentence-per-line -->
+
 In general, we prefer integration tests over unit tests,
 tests using real databases over short tests
 and real objects over mocks.
@@ -127,7 +220,13 @@ and real objects over mocks.
 (You might disagree with our terminology for "unit" and "integration" tests;
 let's not fight over it.)
 
-We have an additional integration testing system in another repository: <https://github.com/FerretDB/dance>.
+We have an additional integration testing system in another repository: https://github.com/FerretDB/dance.
+
+#### Observability in tests
+
+Integration tests start a debug handler with pprof profiles and execution traces on a random port
+(to allow running multiple test configurations in parallel).
+They also send telemetry traces to the local Jaeger instance that can be accessed at http://127.0.0.1:16686/.
 
 ### Code style and conventions
 
@@ -138,24 +237,174 @@ but please also tell us about it, so we can improve all of it.
 If, on the other hand, you see code that is inconsistent without apparent reason (or comment),
 please improve it as you work on it.
 
-Our code most of the standard Go conventions,
-documented on [CodeReviewComments wiki page](https://github.com/golang/go/wiki/CodeReviewComments).
-Some of our idiosyncrasies:
+Our code follows most of the standard Go conventions,
+documented on [CodeReviewComments wiki page](https://go.dev/wiki/CodeReviewComments)
+and some other pages such as [Spelling](https://go.dev/wiki/Spelling).
+Some of our idiosyncrasies are documented below.
 
 1. We use type switches over BSON types in many places in our code.
-   The order of `case`s follows this order: <https://pkg.go.dev/github.com/FerretDB/FerretDB/internal/types#hdr-Mapping>
-   It may seem random, but it is only pseudo-random and follows BSON spec: <https://bsonspec.org/spec.html>
+   The order of `case`s follows this order: https://pkg.go.dev/github.com/FerretDB/wire/wirebson#hdr-Types
+   It may seem random, but it is only pseudo-random and follows BSON spec: https://bsonspec.org/spec.html
+2. We generally pass and return `struct`s by pointers.
+   There are some exceptions like `time.Time` that have value semantics, but when in doubt – use pointers.
+
+#### Comments conventions
+
+1. All top-level declarations, even unexported, should have documentation comments.
+2. In documentation comments do not describe the name in terms of the name itself (`// Registry is a registry of …`).
+   Use other words instead; often, they could add additional information and make reading more pleasant (`// Registry stores …`).
+3. In code comments, in general, do not describe _what_ the code does: it should be clear from the code itself
+   (and when it doesn't and the code is tricky, simplify it instead).
+   Instead, describe _why_ the code does that if it is not clear from the surrounding context, names, etc.
+   There is no need to add comments just because there are no comments if everything is already clear without them.
+4. For code comments, write either
+   sentence fragments (do not start it with a capital letter, do not end it with a dot, use the simplified grammar) for short notes
+   or full sentences (do start them with capital letters, do end them with dots, do check their grammar) when a longer (2+ sentences)
+   explanation is needed (and the code could not be simplified).
+
+#### Logging conventions
+
+(See also our user documentation for notes about logging levels, logging sensitive information, etc.)
+
+1. Log messages should contain a single sentence; use a semicolon if you must.
+2. Log messages should not have leading/trailing spaces or end with punctuation.
+3. Log field names should use `snake_case`.
+4. Whatever sensitive information can be logged should be checked by calling `.Enabled(slog.LevelDebug)` on the appropriate logger,
+   not by directly comparing levels with `<` / `>` operators.
+   The same check should be applied if additional sensitive fields should be added to the log message on a different level.
+
+#### Integration tests conventions
+
+We prefer our integration tests to be straightforward and
+branchless (with a few, if any, `if` and `switch` statements).
+Ideally, the same test should work for both FerretDB and MongoDB.
+If that's impossible without some branching, use helpers exported from the `setup` package,
+such us `FailsForFerretDB`, `SkipForMongoDB`, etc.
+Please use expected failure rather than skipping the test, whenever it's possible.
+It makes tracking development progress much easier.
+
+The bar for using other ways of branching, such as checking error codes and messages, is very high.
+Writing separate tests might be much better than making a single test that checks error text.
+
+Also, we should use driver methods as much as possible instead of testing commands directly via `RunCommand`.
+
+In most cases, helpers such as `AssertEqualDocuments` are used to compare `bson.D` documents.
+The differences in field order, types, missing fields and others should be reported.
+If differences are expected such as `version` field, only the field key can be used for `bson.D` document comparison.
+Use of (deprecated) `bson.D.Map()` or converting `bson.D` to other types using helpers should be avoided when possible.
+The bar for adding new helpers is very high.
+Please check all existing ones.
+
+If there's a need to use any large number to test corner cases,
+we create constants for them with explanation what do they represent, and refer to them.
+For example:
+
+```go
+const doubleMaxPrec = float64(1<<53 - 1) // 9007199254740991.0:    largest double values that could be represented as integer exactly
+```
+
+Avoid writing tests that cannot run in parallel with other tests.
+The `integration` directory contains multiple test packages,
+and tests from other packages may run at the same time.
+Such test becomes flaky and hard to maintain.
+
+#### Integration tests naming guidelines
+
+<!-- https://github.com/FerretDB/FerretDB/issues/694 -->
+
+Use `Test<Command><Operator><Scenario>` format for test names, omitting `<Operator>` and `<Scenario>` if unnecessary.
+
+1. Include the name of the command (and the operator if any).
+   For example, `TestDistinct` for testing the distinct command.
+2. Compatibility tests should have `Compat` in the name, following the command.
+   For example, `TestDistinctCompat`.
+3. If the test runs a command directly via `RunCommand`, add the suffix `Command`.
+   For example, `TestDistinctCommand`.
+4. If the test is both compat and runs a command, add the suffix `CommandCompat`.
+   For example, `TestInsertCommandCompat`.
+5. If the file consists of compatibility tests, add the `_compat` suffix.
+   For example, `distinct_compat_test.go`.
+6. Use descriptive test names to include the condition or the specific error being tested.
+   For example, `TestAggregateCompatSortDotNotation` for compatibility tests
+   on `aggregate` command `$sort` operator on a document field.
+7. Keep test names concise, avoiding overly cryptic names.
+   Use abbreviations when appropriate.
+8. Avoid including test data in the name to maintain clarity and prevent excessively long names.
+9. Use `TitleCase` capitalization style for test case names.
+   No spaces, dashes or underscores should be used neither for test names nor for test case names.
+10. Use [BSON notation](https://bsonspec.org/spec.html) vocabulary.
+    For example, use `Double` and not `float64`.
+11. Keep the concatenation of test name segments (test, subtests) within 64 characters
+    to satisfy the maximum limit for database names.
+12. Use a package for tests in the same scope.
+    Separating into packages can reduce binary sizes and may enhance performance.
+    For example, use `users` package for user management test files.
 
 ### Submitting code changes
 
+#### Before submitting PR
+
 Before submitting a pull request, please make sure that:
 
-1. Tests are added for new functionality or fixed bugs.
-2. `task all` passes.
-3. Comments are added or updated for all new and changed top-level declarations (functions, types, etc).
-   Both exported and unexported declarations should have comments.
-4. Comments are rendered correctly in the `task godocs` output.
+1. Your changes are committed to a [new branch](https://docs.github.com/en/get-started/quickstart/github-flow)
+   created from the [current state](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork)
+   of our main branch.
+2. Tests are added or updated for new functionality or fixed bugs.
+   Typical test cases include:
+   - happy paths;
+   - dot notation for existing and non-existent paths;
+   - edge cases for invalid or unexpected values or types.
+3. Comments are added or updated for all new or changed code.
+   Please add missing comments for all (both exported and unexported)
+   new and changed top-level declarations (`package`, `var`, `const`, `func`, `type`).
+   Please also check that formatting is correct in the `task godocs` output.
+4. `task all` passes.
+
+#### Submitting PR
+
+1. Please follow the pull request template.
+2. If the pull request is related to some issue,
+   please mention the issue number in the pull request description like `Closes #<issue_number>.`
+   or `Closes FerretDB/<repo>#<issue_number>.`
+   Please do not use URLs like `https://github.com/FerretDB/<repo>/issue/<issue_number>`
+   or paths like `FerretDB/<repo>/issue/<issue_number>` even if they are rendered the same on GitHub.
+   If you propose a tiny fix, there is no needed to create a new issue.
+3. There is no need to use draft pull requests.
+   If you want to get feedback on something you are working on,
+   please create a normal pull request, even if it is not "fully" ready yet.
+4. In the pull request review conversations,
+   please either leave a new comment or resolve (close) the conversation,
+   which ensures other people can read all comments.
+   But do not do that simultaneously.
+   Conversations should typically be resolved by the conversation starter, not the PR author.
+5. During development in a branch/PR,
+   commit messages (both titles and bodies) are not important and can be anything.
+   All commits are always squashed on merge by GitHub.
+   Please **do not** squash them manually, amend them, and/or force push them -
+   that makes the review process harder.
+6. Please don't forget to click
+   ["re-request review" buttons](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/requesting-a-pull-request-review)
+   once PR is ready for re-review.
+
+If you have interest in becoming or are a long-term contributor,
+please read [PROCESS.md](.github/PROCESS.md) for more details.
 
 ## Contributing documentation
 
-Please format and lint documentation with `task docs`.
+### Commands for contributing documentation
+
+With `task` installed (see above), you may do the following:
+
+1. Format and lint documentation with `task docs-fmt`.
+2. Start Docusaurus development server with `task docs-dev`.
+3. Build Docusaurus website with `task docs`.
+
+### Submitting documentation changes
+
+Before submitting a pull request, please make sure that:
+
+1. Your changes are committed to a [new branch](https://docs.github.com/en/get-started/quickstart/github-flow)
+   created from the [current state](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork)
+   of our main branch.
+2. Documentation is formatted, linted, and built with `task docs`.
+3. Documentation is written according to our [writing guide](https://docs.ferretdb.io/contributing/writing-guide/).

Dockerfile

@@ -1,32 +0,0 @@
-ARG VERSION
-ARG COMMIT
-
-FROM golang:1.18.5 AS build
-
-WORKDIR /src
-ADD . .
-ENV CGO_ENABLED=1
-
-# split into several commands for better logging on GitHub Actions
-RUN go mod download
-RUN go build -v -o=bin/ferretdb -trimpath -tags=ferretdb_testcover,ferretdb_tigris -race                 ./cmd/ferretdb
-RUN go test  -c -o=bin/ferretdb -trimpath -tags=ferretdb_testcover,ferretdb_tigris -race -coverpkg=./... ./cmd/ferretdb
-
-FROM golang:1.18.5
-
-COPY --from=build /src/bin/ferretdb /ferretdb
-
-EXPOSE 27017
-
-ENTRYPOINT [ "/ferretdb" ]
-CMD [ "-listen-addr=:27017", "-postgresql-url=postgres://username:password@hostname:5432/ferretdb" ]
-
-# https://github.com/opencontainers/image-spec/blob/main/annotations.md
-LABEL org.opencontainers.image.description="A truly Open Source MongoDB alternative"
-LABEL org.opencontainers.image.licenses="Apache-2.0"
-LABEL org.opencontainers.image.revision="${COMMIT}"
-LABEL org.opencontainers.image.source="https://github.com/FerretDB/FerretDB"
-LABEL org.opencontainers.image.title="FerretDB"
-LABEL org.opencontainers.image.url="https://ferretdb.io/"
-LABEL org.opencontainers.image.vendor="FerretDB Inc."
-LABEL org.opencontainers.image.version="${VERSION}"

NOTICE

@@ -1,2 +0,0 @@
-FerretDB database system (https://www.ferretdb.io/).
-Copyright 2021 FerretDB Inc.

README.md

@@ -1,14 +1,35 @@
 # FerretDB
 
-[![Go Reference](https://pkg.go.dev/badge/github.com/FerretDB/FerretDB/ferretdb.svg)](https://pkg.go.dev/github.com/FerretDB/FerretDB/ferretdb)
+<!-- textlint-disable one-sentence-per-line -->
+
+> [!TIP]
+> Looking for FerretDB v1?
+> It is [there](https://github.com/FerretDB/FerretDB/tree/main-v1).
+
+<!-- textlint-enable one-sentence-per-line -->
+
+[![Go Reference](https://pkg.go.dev/badge/github.com/FerretDB/FerretDB/v2/ferretdb.svg)](https://pkg.go.dev/github.com/FerretDB/FerretDB/v2/ferretdb)
+
 [![Go](https://github.com/FerretDB/FerretDB/actions/workflows/go.yml/badge.svg?branch=main)](https://github.com/FerretDB/FerretDB/actions/workflows/go.yml)
-[![Integration](https://github.com/FerretDB/FerretDB/actions/workflows/integration.yml/badge.svg?branch=main)](https://github.com/FerretDB/FerretDB/actions/workflows/integration.yml)
-[![Docker](https://github.com/FerretDB/FerretDB/actions/workflows/docker.yml/badge.svg?branch=main)](https://github.com/FerretDB/FerretDB/actions/workflows/docker.yml)
 [![codecov](https://codecov.io/gh/FerretDB/FerretDB/branch/main/graph/badge.svg?token=JZ56XFT3DM)](https://codecov.io/gh/FerretDB/FerretDB)
 
-FerretDB (previously MangoDB) was founded to become the de-facto open-source substitute to MongoDB.
-FerretDB is an open-source proxy, converting the MongoDB 5.0+ wire protocol queries to SQL -
-using PostgreSQL as a database engine.
+[![Security](https://github.com/FerretDB/FerretDB/actions/workflows/security.yml/badge.svg?branch=main)](https://github.com/FerretDB/FerretDB/actions/workflows/security.yml)
+[![Packages](https://github.com/FerretDB/FerretDB/actions/workflows/packages.yml/badge.svg?branch=main)](https://github.com/FerretDB/FerretDB/actions/workflows/packages.yml)
+[![Docs](https://github.com/FerretDB/FerretDB/actions/workflows/docs.yml/badge.svg?branch=main)](https://github.com/FerretDB/FerretDB/actions/workflows/docs.yml)
+
+FerretDB is an open-source alternative to MongoDB.
+It is a proxy that converts MongoDB 5.0+ wire protocol queries to SQL
+and uses PostgreSQL with [DocumentDB extension](https://github.com/documentdb/documentdb) as a database engine.
+
+```mermaid
+flowchart LR
+  A["Any application<br>Any MongoDB driver"]
+  F{{FerretDB}}
+  P[(PostgreSQL<br>DocumentDB extension)]
+
+  A -- "MongoDB protocol<br>BSON" --> F
+  F -- "PostgreSQL protocol<br>SQL" --> P
+```
 
 ## Why do we need FerretDB?
 
@@ -16,102 +37,84 @@ MongoDB was originally an eye-opening technology for many of us developers,
 empowering us to build applications faster than using relational databases.
 In its early days, its ease-to-use and well-documented drivers made MongoDB one of the simplest database solutions available.
 However, as time passed, MongoDB abandoned its open-source roots;
-changing the license to SSPL - making it unusable for many open source and early-stage commercial projects.
+changing the license to [SSPL](https://www.ferretdb.com/sspl) - making it unusable for many open-source and early-stage commercial projects.
 
 Most MongoDB users do not require any advanced features offered by MongoDB;
-however, they need an easy-to-use open-source database solution.
+however, they need an easy-to-use open-source document database solution.
 Recognizing this, FerretDB is here to fill that gap.
 
 ## Scope and current state
 
-FerretDB will be compatible with MongoDB drivers and will strive to serve as a drop-in replacement for MongoDB 5.0+.
+FerretDB is compatible with MongoDB drivers and popular MongoDB tools.
+It functions as a drop-in replacement for MongoDB 5.0+ in many cases.
+Features are constantly being added to further increase compatibility and performance.
 
-Currently, the project is in its early stages and welcomes all contributors.
-See our [public roadmap](https://github.com/orgs/FerretDB/projects/2/views/1)
+We welcome all contributors.
+See our [public roadmap](https://github.com/orgs/FerretDB/projects/2/views/1),
+lists of [known differences and supported commands](https://docs.ferretdb.io/migration/compatibility/),
 and [contributing guidelines](CONTRIBUTING.md).
 
-### Known differences
-
-1. FerretDB uses the same protocol error names and codes, but the exact error messages may be different in some cases.
-2. FerretDB does not support NUL (`\0`) characters in strings.
-3. Database and collection names restrictions:
-
-* name cannot start with the reserved prefix `_ferretdb_`.
-* name must not include non-latin letters, spaces, dots, dollars or dashes.
-* collection name length must be less or equal than 120 symbols, database name length limit is 63 symbols.
-* name must not start with a number.
-* database name cannot contain capital letters.
-
-If you encounter some other difference in behavior, please [join our community](#community) to report a problem.
-
 ## Quickstart
 
-These steps describe a quick local setup.
-They are not suitable for most production use-cases because they keep all data inside containers.
-
-<!-- markdownlint-disable MD029 -->
-
-1. Store the following in the `docker-compose.yml` file:
-
-```yaml
-version: "3"
-
-services:
-  postgres:
-    image: postgres:14
-    container_name: postgres
-    ports:
-      - 5432:5432
-    environment:
-      - POSTGRES_USER=user
-      - POSTGRES_DB=ferretdb
-      - POSTGRES_HOST_AUTH_METHOD=trust
-
-  postgres_setup:
-    image: postgres:14
-    container_name: postgres_setup
-    restart: on-failure
-    entrypoint: ["sh", "-c", "psql -h postgres -U user -d ferretdb -c 'CREATE SCHEMA IF NOT EXISTS test'"]
-
-  ferretdb:
-    image: ghcr.io/ferretdb/ferretdb:latest
-    container_name: ferretdb
-    restart: on-failure
-    ports:
-      - 27017:27017
-    command: ["-listen-addr=:27017", "-postgresql-url=postgres://user@postgres:5432/ferretdb"]
-
-networks:
-  default:
-    name: ferretdb
-```
-
-* `postgres` container runs PostgreSQL 14 that would store data.
-* `postgres_setup` container creates a PostgreSQL schema `test` that would act like a FerretDB database of the same name.
-* `ferretdb` runs FerretDB.
-
-2. Start services with `docker-compose up -d`.
-
-3. If you have `mongosh` installed, just run it to connect to FerretDB database `test`.
-If not, run the following command to run `mongosh` inside the temporary MongoDB container, attaching to the same Docker network:
+Run this command to start FerretDB with PostgreSQL, make sure to update `<username>` and `<password>`:
 
 ```sh
-docker run --rm -it --network=ferretdb --entrypoint=mongosh mongo:5 mongodb://ferretdb/
+docker run -d --rm --name ferretdb -p 27017:27017 \
+  -e POSTGRES_USER=<username> \
+  -e POSTGRES_PASSWORD=<password> \
+  ghcr.io/ferretdb/ferretdb-eval:2
 ```
 
-<!-- markdownlint-enable MD029 -->
+This command will start a container with FerretDB, pre-packaged PostgreSQL with DocumentDB extension, and MongoDB Shell for quick testing and experiments.
+However, it is unsuitable for production use cases because it keeps all data inside and loses it on shutdown.
+See our [installation guides](https://docs.ferretdb.io/installation/) for instructions
+that don't have those problems.
 
-You can also install with FerretDB with the `.deb` and `.rpm` packages
-provided for each [release](https://github.com/FerretDB/FerretDB/releases).
+With that container running, you can:
+
+- Connect to it with any MongoDB client application using the MongoDB URI `mongodb://<username>:<password>@127.0.0.1:27017/`.
+- Connect to it using the MongoDB Shell by just running `mongosh`.
+  If you don't have it installed locally, you can run `docker exec -it ferretdb mongosh`.
+- For PostgreSQL, connect to it by running `docker exec -it ferretdb psql -U <username> postgres`.
+
+You can stop the container with `docker stop ferretdb`.
+
+We also provide binaries and packages for various Linux distributions.
+as well as [Go library package](https://pkg.go.dev/github.com/FerretDB/FerretDB/v2/ferretdb)
+that embeds FerretDB into your application.
+See [our documentation](https://docs.ferretdb.io/installation/) for more details.
+
+## Building and packaging
+
+<!-- textlint-disable one-sentence-per-line -->
+
+> [!NOTE]
+> We advise users not to build FerretDB themselves.
+> Instead, use binaries, Docker images, or packages provided by us.
+
+<!-- textlint-enable one-sentence-per-line -->
+
+FerretDB could be built as any other Go program,
+but a few generated files and build tags could affect it.
+See [there](https://pkg.go.dev/github.com/FerretDB/FerretDB/v2/build/version) for more details.
+
+## Managed FerretDB at cloud providers
+
+- [FerretDB Cloud](https://cloud.ferretdb.com/)
+- [Civo](https://www.civo.com/marketplace/FerretDB)
+- [Tembo](https://tembo.io/docs/tembo-stacks/mongo-alternative)
+- [Elestio](https://elest.io/open-source/ferretdb)
+- [Cozystack](https://cozystack.io/docs/components/#managed-ferretdb)
 
 ## Community
 
-* Website and blog: [https://ferretdb.io](https://ferretdb.io/).
-* Twitter: [@ferret_db](https://twitter.com/ferret_db).
-* [Slack chat](https://join.slack.com/t/ferretdb/shared_invite/zt-zqe9hj8g-ZcMG3~5Cs5u9uuOPnZB8~A) for quick questions.
-* [GitHub Discussions](https://github.com/FerretDB/FerretDB/discussions) for longer topics.
-* [GitHub Issues](https://github.com/FerretDB/FerretDB/issues) for bugs and missing features.
-* [Open Office House meeting](https://calendar.google.com/event?action=TEMPLATE&tmeid=NjNkdTkyN3VoNW5zdHRiaHZybXFtb2l1OWtfMjAyMTEyMTNUMTgwMDAwWiBjX24zN3RxdW9yZWlsOWIwMm0wNzQwMDA3MjQ0QGc&tmsrc=c_n37tquoreil9b02m0740007244%40group.calendar.google.com&scp=ALL)
-  every Monday at 18:00 UTC at [Google Meet](https://meet.google.com/mcb-arhw-qbq).
+- Website: https://www.ferretdb.com/.
+- Blog: https://blog.ferretdb.io/.
+- Documentation: https://docs.ferretdb.io/.
+- X (Twitter): [@ferret_db](https://x.com/ferret_db).
+- Mastodon: [@ferretdb@techhub.social](https://techhub.social/@ferretdb).
+- [Slack chat](https://slack.ferretdb.io/) for quick questions.
+- [GitHub Discussions](https://github.com/FerretDB/FerretDB/discussions) for longer topics.
+- [GitHub Issues](https://github.com/FerretDB/FerretDB/issues) for bugs and missing features.
 
-If you want to contact FerretDB Inc., please use [this form](https://www.ferretdb.io/contact/).
+If you want to contact FerretDB Inc., please use [this form](https://www.ferretdb.com/contact/).

SECURITY.md

@@ -0,0 +1,13 @@
+# Security Policy
+
+## Supported Versions
+
+We support two of the latest minor versions of FerretDB.
+
+## Reporting a Vulnerability
+
+Please do not use public issues for security problems.
+Instead, report them [there](https://github.com/FerretDB/FerretDB/security/advisories/new).
+You can also reach us by email at security@ferretdb.io.
+
+We should respond to you within seven days.

build/.markdownlint.yml

@@ -0,0 +1,17 @@
+---
+# https://github.com/DavidAnson/markdownlint-cli2#configuration
+# https://github.com/DavidAnson/markdownlint/blob/main/doc/Rules.md
+
+default: true
+
+MD002: false # deprecated
+MD003: { style: atx }
+MD004: { style: "dash" }
+MD006: false # deprecated
+MD013: false # we use https://sembr.org that could lead to long lines
+MD026: { punctuation: ".,;:。，；：" } # default is .,;:!。，；：！
+MD029: { style: ordered }
+MD033: false # for MDX
+MD034: false # autolink tags <link> no longer supported by MDX
+MD037: false # clashes with MDX comments
+MD059: false # not yet

build/.textlintrc

@@ -0,0 +1,41 @@
+{
+    "rules": {
+        "@0x6b/normalize-whitespaces": true,
+        "no-zero-width-spaces": true,
+        "one-sentence-per-line": true,
+        "@textlint-rule/pattern": {
+            "patterns": [
+                // mostly to keep JS/JSON snippets with correct
+                {
+                    "message": "Use straight ASCII double quotes instead of curly double quotes",
+                    "pattern": "/“|”/",
+                    "replace": "\"",
+                    "forceCode": true
+                },
+                {
+                    "message": "Use straight ASCII single quotes instead of curly single quotes",
+                    "pattern": "/‘|’/",
+                    "replace": "'",
+                    "forceCode": true
+                },
+
+                // to prevent --flags from being converted to en dashes or em dashes
+                {
+                    "message": "Use en dashes with spaces instead of em dashes",
+                    "pattern": "/—/",
+                    "replace": " – ",
+                    "forceCode": true
+                },
+                {
+                    "message": "Use en dashes with spaces",
+                    "pattern": "/(\\S)–([\\S])/",
+                    "replace": "$1 – $2",
+                    "forceCode": true
+                }
+            ]
+        }
+    },
+    "filters": {
+        "comments": true
+    }
+}

build/.trivyignore

@@ -0,0 +1,7 @@
+# https://github.com/cloudwego/eino#dependencies
+# TODO https://github.com/cloudwego/eino/issues/291
+CVE-2025-30153
+
+# https://nvd.nist.gov/vuln/detail/CVE-2025-51471
+# https://github.com/ollama/ollama/pull/10750
+CVE-2025-51471

build/buildkitd.toml

@@ -0,0 +1,5 @@
+[worker.oci]
+  gc = false
+
+[worker.containerd]
+  gc = false

build/certs/Makefile

@@ -0,0 +1,16 @@
+# see https://github.com/FiloSottile/mkcert
+
+export CAROOT=$(PWD)
+export TRUST_STORES=system
+HOSTS=localhost 127.0.0.1 ::1 host.docker.internal
+
+gen:
+	rm -f *.pem
+	mkcert -install
+	mkcert -client -cert-file client-cert.pem -key-file client-key.pem $(HOSTS)
+	cat client-cert.pem client-key.pem > client.pem
+	mkcert -cert-file server-cert.pem -key-file server-key.pem $(HOSTS)
+	cat server-cert.pem server-key.pem > server.pem
+	mkcert -uninstall
+	mv rootCA.pem rootCA-cert.pem
+	rm -f rootCA-key.pem

build/certs/client-cert.pem

@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEkzCCAvugAwIBAgIRAJQIOW0DsoWpmhRIS6qVTMkwDQYJKoZIhvcNAQELBQAw
+gZExHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTEzMDEGA1UECwwqYWxl
+a3NpQFByb2Jvb2subG9jYWwgKEFsZXhleSBQYWxhemhjaGVua28pMTowOAYDVQQD
+DDFta2NlcnQgYWxla3NpQFByb2Jvb2subG9jYWwgKEFsZXhleSBQYWxhemhjaGVu
+a28pMB4XDTI1MDQyNDA2Mjg1NVoXDTI3MDcyNDA2Mjg1NVowXjEnMCUGA1UEChMe
+bWtjZXJ0IGRldmVsb3BtZW50IGNlcnRpZmljYXRlMTMwMQYDVQQLDCphbGVrc2lA
+UHJvYm9vay5sb2NhbCAoQWxleGV5IFBhbGF6aGNoZW5rbykwggEiMA0GCSqGSIb3
+DQEBAQUAA4IBDwAwggEKAoIBAQDGNj/3rcpjgu8GZHg1AS8lAEy8tbg73+9YRPJs
+IAytaCmoQYbRZncrWa9hWT0568DGSWbHye4+ZFrYyW1vNb0ANWPGVd6ReqtJm0wt
+plfcyzbgGN4EIYgHEUjFvVfDg6fHdV5K8z6UGGfnHHtwoj649Vw3CjAIRXufB9dD
+EPAZoh2NKp+EEQiNlX8+oNIMGYmGP6QAh1l/RCrj2yhVeXqXC7s8y9HCKSa08tBO
+e3AzHfWrcksVC2HugR6+/KjinOowlL4GwtpQ9clJF8Vk9ilA+PXL37CIaTkdJOsX
+doacEC84NpeSyQYf8g4q5uHDTEc4kg5NQ04TizFpag1LWs/nAgMBAAGjgZcwgZQw
+DgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAf
+BgNVHSMEGDAWgBRMfF45cY0dizvyML/k08KmEEPhkjBCBgNVHREEOzA5gglsb2Nh
+bGhvc3SCFGhvc3QuZG9ja2VyLmludGVybmFshwR/AAABhxAAAAAAAAAAAAAAAAAA
+AAABMA0GCSqGSIb3DQEBCwUAA4IBgQBiim9kFNYL81xP6MHNJe2erc3IrpCCn7IC
+WfrhqIz89o/2gYIWqwlc7IWA+y13btUAkaXVDZvZMoFMKbvUcF89OpO8G+4XpbX4
+uu9Q5pC3cjnFymO8xTRNgOam6yySLbjwzZwQIZ/0hh9xCeQ64tlw/a4VT6+UJrYn
+SNTPI38f/MwCFkyr4vCkCUIOIwTRfDc2BwHu1CJ820Hu3Jpr10CRzBOvsDJlDg8c
+vcmbdo+jsqEFMNIZpTblZA+MALRq4eK6Bas3YQcqIGjo+lxx9eYCGzZH1ygS/K5X
+501rBpLJ4OklIVTFWuo5IVwJ9RWMPgX3htl3HzpGztEV8nB9LEjKl9Lmm7xPb8+n
+ytycvckVyFe5JtejNtiB+9v0jNyqvEe2B7hdGfSLchuCv0a3xsocnayxnJChKtqI
+vo022s1k9k7wwJ2Qeq49HfK3yY00SgXYpUljKHLZocisYBxHmNbegzSBa2x7RU+k
+YexHKXvwNHdkVNOTs9LgER0EexdK+AM=
+-----END CERTIFICATE-----

build/certs/client-key.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDGNj/3rcpjgu8G
+ZHg1AS8lAEy8tbg73+9YRPJsIAytaCmoQYbRZncrWa9hWT0568DGSWbHye4+ZFrY
+yW1vNb0ANWPGVd6ReqtJm0wtplfcyzbgGN4EIYgHEUjFvVfDg6fHdV5K8z6UGGfn
+HHtwoj649Vw3CjAIRXufB9dDEPAZoh2NKp+EEQiNlX8+oNIMGYmGP6QAh1l/RCrj
+2yhVeXqXC7s8y9HCKSa08tBOe3AzHfWrcksVC2HugR6+/KjinOowlL4GwtpQ9clJ
+F8Vk9ilA+PXL37CIaTkdJOsXdoacEC84NpeSyQYf8g4q5uHDTEc4kg5NQ04TizFp
+ag1LWs/nAgMBAAECggEBAJBcqrJFzYY0sspBGpvgROn6EenPoGNbcgMkFDxUC2ew
+2cZGE18n9duI8odAa6tn3XuNsmII3JBsnw4NhrrctM8WE5k8qWHjqiVuCkmlQZD6
+IPmOowT3Nw+OsyXyBZ3MocJP5WFJUGakb+iPgghC4tPrQEKGFP2xPZxSJaIfEABa
+HgSYTSr+n8lJUKdld00BNSWXBxsVQ8NAw/5AFjFP4R3TeCwbd34lpMpkLvOax05j
+xbdZr0MP03MT8PYMBRzqMcST0OR7bK8vyAnB/ezxhrnQaMV2NeHpisB3UbNFi+PT
+63tNV/S2hCOGDZ5V+jFQ6FRyUw1gOlJK/EMGLIEt3kECgYEA1gMXqlp5w0OIBBkS
+MbhY2LhVO0v3LBHtRCqFbKGdA3yrHrsq/YJKlJbEoiw9mWGgYq7h0jNAsvI/WLgo
+tm4AUxRdG9YZDqNEcfcODnLqFg5D7/abSXx+An3pwZ+fQgL8STGu9up/Xl1Sss1T
+JHBEOM+vqb7TQxPPvl77SUHUwX8CgYEA7RmVO6PEepnJuMGYgG9Au5SMkcFY5iK5
+AqlEHio097+KsQ+K4nxW8yvtNoXnSBsfX3t78vI6zjSeFgk/MhoVUGLKIQTwq6KO
+WvASeB1zIzSkfXISznMs/CxGMt9FODvM9PCJMpeFAvJNDn83vupo0oxagu+EUVoF
+eGoqNEMMVZkCgYEAgx+d7lhE5miH+8rIpQIIHbDDN/ORW8UYFH3hBe/3Xd2Skt+m
+tXCQ9X1yuNJWY5W3SP9RiRKx/3IBcgBToYLAXCbL7XQ+IgPSuejfCedKmXzgDzSP
+bHUEV86B3IpKb42YudfhFZQTueN/+eFnoZnPkudc/6nVkvGehUt4tyfIjU0CgYAP
+PebHB7cYvowmMWPRVdWOeXUz5X8GhFLqZeE4IzR2fLy4tywRdTbNuRQtvhvpGb1B
+kRmdu46mNOG4vu1uFhkqqr8dskiab//AvtAhIpuFNtwgKFYnKWZJ67qziIDVpZp+
+YHwhYXYug08K0IjP4BfO+TDUW/tgk23omMKPy4OeeQKBgQCiKzdHtUO6KujjueYX
+lbDVbdEiXYbGzKcMmE0E/DK73xXpXT/CQ+tjB3nZKHDwkTN6h9ZZYzjhRWmHRlRh
+WqGqmWr4D3I0B9jnxCTpDuZIlJ21G336RbsZD8yi+eyMwJXN4csItGSlMig04jvo
+5vTIN0D0uXAvDD23TEcilpQzcA==
+-----END PRIVATE KEY-----

build/certs/client.pem

@@ -0,0 +1,55 @@
+-----BEGIN CERTIFICATE-----
+MIIEkzCCAvugAwIBAgIRAJQIOW0DsoWpmhRIS6qVTMkwDQYJKoZIhvcNAQELBQAw
+gZExHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTEzMDEGA1UECwwqYWxl
+a3NpQFByb2Jvb2subG9jYWwgKEFsZXhleSBQYWxhemhjaGVua28pMTowOAYDVQQD
+DDFta2NlcnQgYWxla3NpQFByb2Jvb2subG9jYWwgKEFsZXhleSBQYWxhemhjaGVu
+a28pMB4XDTI1MDQyNDA2Mjg1NVoXDTI3MDcyNDA2Mjg1NVowXjEnMCUGA1UEChMe
+bWtjZXJ0IGRldmVsb3BtZW50IGNlcnRpZmljYXRlMTMwMQYDVQQLDCphbGVrc2lA
+UHJvYm9vay5sb2NhbCAoQWxleGV5IFBhbGF6aGNoZW5rbykwggEiMA0GCSqGSIb3
+DQEBAQUAA4IBDwAwggEKAoIBAQDGNj/3rcpjgu8GZHg1AS8lAEy8tbg73+9YRPJs
+IAytaCmoQYbRZncrWa9hWT0568DGSWbHye4+ZFrYyW1vNb0ANWPGVd6ReqtJm0wt
+plfcyzbgGN4EIYgHEUjFvVfDg6fHdV5K8z6UGGfnHHtwoj649Vw3CjAIRXufB9dD
+EPAZoh2NKp+EEQiNlX8+oNIMGYmGP6QAh1l/RCrj2yhVeXqXC7s8y9HCKSa08tBO
+e3AzHfWrcksVC2HugR6+/KjinOowlL4GwtpQ9clJF8Vk9ilA+PXL37CIaTkdJOsX
+doacEC84NpeSyQYf8g4q5uHDTEc4kg5NQ04TizFpag1LWs/nAgMBAAGjgZcwgZQw
+DgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAf
+BgNVHSMEGDAWgBRMfF45cY0dizvyML/k08KmEEPhkjBCBgNVHREEOzA5gglsb2Nh
+bGhvc3SCFGhvc3QuZG9ja2VyLmludGVybmFshwR/AAABhxAAAAAAAAAAAAAAAAAA
+AAABMA0GCSqGSIb3DQEBCwUAA4IBgQBiim9kFNYL81xP6MHNJe2erc3IrpCCn7IC
+WfrhqIz89o/2gYIWqwlc7IWA+y13btUAkaXVDZvZMoFMKbvUcF89OpO8G+4XpbX4
+uu9Q5pC3cjnFymO8xTRNgOam6yySLbjwzZwQIZ/0hh9xCeQ64tlw/a4VT6+UJrYn
+SNTPI38f/MwCFkyr4vCkCUIOIwTRfDc2BwHu1CJ820Hu3Jpr10CRzBOvsDJlDg8c
+vcmbdo+jsqEFMNIZpTblZA+MALRq4eK6Bas3YQcqIGjo+lxx9eYCGzZH1ygS/K5X
+501rBpLJ4OklIVTFWuo5IVwJ9RWMPgX3htl3HzpGztEV8nB9LEjKl9Lmm7xPb8+n
+ytycvckVyFe5JtejNtiB+9v0jNyqvEe2B7hdGfSLchuCv0a3xsocnayxnJChKtqI
+vo022s1k9k7wwJ2Qeq49HfK3yY00SgXYpUljKHLZocisYBxHmNbegzSBa2x7RU+k
+YexHKXvwNHdkVNOTs9LgER0EexdK+AM=
+-----END CERTIFICATE-----
+-----BEGIN PRIVATE KEY-----
+MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDGNj/3rcpjgu8G
+ZHg1AS8lAEy8tbg73+9YRPJsIAytaCmoQYbRZncrWa9hWT0568DGSWbHye4+ZFrY
+yW1vNb0ANWPGVd6ReqtJm0wtplfcyzbgGN4EIYgHEUjFvVfDg6fHdV5K8z6UGGfn
+HHtwoj649Vw3CjAIRXufB9dDEPAZoh2NKp+EEQiNlX8+oNIMGYmGP6QAh1l/RCrj
+2yhVeXqXC7s8y9HCKSa08tBOe3AzHfWrcksVC2HugR6+/KjinOowlL4GwtpQ9clJ
+F8Vk9ilA+PXL37CIaTkdJOsXdoacEC84NpeSyQYf8g4q5uHDTEc4kg5NQ04TizFp
+ag1LWs/nAgMBAAECggEBAJBcqrJFzYY0sspBGpvgROn6EenPoGNbcgMkFDxUC2ew
+2cZGE18n9duI8odAa6tn3XuNsmII3JBsnw4NhrrctM8WE5k8qWHjqiVuCkmlQZD6
+IPmOowT3Nw+OsyXyBZ3MocJP5WFJUGakb+iPgghC4tPrQEKGFP2xPZxSJaIfEABa
+HgSYTSr+n8lJUKdld00BNSWXBxsVQ8NAw/5AFjFP4R3TeCwbd34lpMpkLvOax05j
+xbdZr0MP03MT8PYMBRzqMcST0OR7bK8vyAnB/ezxhrnQaMV2NeHpisB3UbNFi+PT
+63tNV/S2hCOGDZ5V+jFQ6FRyUw1gOlJK/EMGLIEt3kECgYEA1gMXqlp5w0OIBBkS
+MbhY2LhVO0v3LBHtRCqFbKGdA3yrHrsq/YJKlJbEoiw9mWGgYq7h0jNAsvI/WLgo
+tm4AUxRdG9YZDqNEcfcODnLqFg5D7/abSXx+An3pwZ+fQgL8STGu9up/Xl1Sss1T
+JHBEOM+vqb7TQxPPvl77SUHUwX8CgYEA7RmVO6PEepnJuMGYgG9Au5SMkcFY5iK5
+AqlEHio097+KsQ+K4nxW8yvtNoXnSBsfX3t78vI6zjSeFgk/MhoVUGLKIQTwq6KO
+WvASeB1zIzSkfXISznMs/CxGMt9FODvM9PCJMpeFAvJNDn83vupo0oxagu+EUVoF
+eGoqNEMMVZkCgYEAgx+d7lhE5miH+8rIpQIIHbDDN/ORW8UYFH3hBe/3Xd2Skt+m
+tXCQ9X1yuNJWY5W3SP9RiRKx/3IBcgBToYLAXCbL7XQ+IgPSuejfCedKmXzgDzSP
+bHUEV86B3IpKb42YudfhFZQTueN/+eFnoZnPkudc/6nVkvGehUt4tyfIjU0CgYAP
+PebHB7cYvowmMWPRVdWOeXUz5X8GhFLqZeE4IzR2fLy4tywRdTbNuRQtvhvpGb1B
+kRmdu46mNOG4vu1uFhkqqr8dskiab//AvtAhIpuFNtwgKFYnKWZJ67qziIDVpZp+
+YHwhYXYug08K0IjP4BfO+TDUW/tgk23omMKPy4OeeQKBgQCiKzdHtUO6KujjueYX
+lbDVbdEiXYbGzKcMmE0E/DK73xXpXT/CQ+tjB3nZKHDwkTN6h9ZZYzjhRWmHRlRh
+WqGqmWr4D3I0B9jnxCTpDuZIlJ21G336RbsZD8yi+eyMwJXN4csItGSlMig04jvo
+5vTIN0D0uXAvDD23TEcilpQzcA==
+-----END PRIVATE KEY-----

build/certs/rootCA-cert.pem

@@ -0,0 +1,29 @@
+-----BEGIN CERTIFICATE-----
+MIIE9DCCA1ygAwIBAgIRAKmp4Hngu2VSn3W3/HbqhhcwDQYJKoZIhvcNAQELBQAw
+gZExHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTEzMDEGA1UECwwqYWxl
+a3NpQFByb2Jvb2subG9jYWwgKEFsZXhleSBQYWxhemhjaGVua28pMTowOAYDVQQD
+DDFta2NlcnQgYWxla3NpQFByb2Jvb2subG9jYWwgKEFsZXhleSBQYWxhemhjaGVu
+a28pMB4XDTI1MDQyNDA2Mjg1MFoXDTM1MDQyNDA2Mjg1MFowgZExHjAcBgNVBAoT
+FW1rY2VydCBkZXZlbG9wbWVudCBDQTEzMDEGA1UECwwqYWxla3NpQFByb2Jvb2su
+bG9jYWwgKEFsZXhleSBQYWxhemhjaGVua28pMTowOAYDVQQDDDFta2NlcnQgYWxl
+a3NpQFByb2Jvb2subG9jYWwgKEFsZXhleSBQYWxhemhjaGVua28pMIIBojANBgkq
+hkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAw/ZCWaFBwUs1uiVu5vwfx7CJKL10EvH7
+rBJfUnDMoK/AYUzAhvVumi1WDmT4TnVG4MSQ/Ep5RV5HsidT8Sz75NB5Vu6rRyD1
+4BVgR0R4WnyE4XQ7QX/eFvuAL1ToRWwqUtKLPaeYN1v+Xvi7HSeiwS1fPYnZ60mt
+SpTOUn3c2EptKwHSZF5g5nrlX0RNEWiqZLW8zy49psDF57883DTOOvDvreH75zRy
+jbaz2zXHdERct/zdnAOqPu5D/dT7Oi6ubtbqpp6Ytd0SYASf1DkMc+pq5ta1ZL6j
+hs9x6a2X/INYwjXIH+TVqhW6VLR15ieT960dFeJOU2kRRDoOoFegOR5DlLgXyt4c
+fap053vL5qbctAWKV0q/4oF4TNRh+9iAXm70HSfPvA8CYv2QIanmsAKlFxkw4lSY
+kh2Gycbi2te8AjA8IYYo++DJiy5Y23NWYswZv/qtnZDymaYc3zVooriCie270iiN
+Dwysl3saSQL2m2C6VimLJZy8CqyCt3HTAgMBAAGjRTBDMA4GA1UdDwEB/wQEAwIC
+BDASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBRMfF45cY0dizvyML/k08Km
+EEPhkjANBgkqhkiG9w0BAQsFAAOCAYEAKSq6dmHItnF8C4yWP6i08BHAmhqmGo/Q
+PvgnnDjNMMX888dJ+cDSTi4r6ukPsjmCj16XZ2RNg2v2nYzO4S6qjuW3vPOGBugG
+lCanj0AOZVcZY+te2z8hTxwLDVaRGTm9Tw8jEmjtiNwpChnkIBqAjlHbJZpHpjzv
+khusNY8KKH0I/uMBQfIOMKf8fBvu2k8wYlyW1pwwgmVDWbiTv3tU9px7Lh7WSd3w
+NFTC+xGAsl+tR7Z/UZB9FcI522IZm6A5LsTp4JfsQ4deUdU7iV36cqTrxG6A59BL
+P/BS711oUlei3ORBloFhSXGKVPHqHu1jGGnpIFyQx6uS/0v1M6FN5wmZxAN+YVmO
+7B7ttS3mN3PpALJIy+/P/EjtwVqzX+2HdJ+zo3JIHqtIQunBWAeeCZpltn3yd/35
+MCa9RG7ftdfVrh2SwdZkR/bhKlgbelZ4EoxHXBiJxwZwVY8rJx/n2Bp+fp7crjhC
+ZTscssX+5FbczWgIqzG5vmNescyM4XE3
+-----END CERTIFICATE-----

build/certs/server-cert.pem

@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEiTCCAvGgAwIBAgIRAMa57BhiUa7ds8bjquZeuGwwDQYJKoZIhvcNAQELBQAw
+gZExHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTEzMDEGA1UECwwqYWxl
+a3NpQFByb2Jvb2subG9jYWwgKEFsZXhleSBQYWxhemhjaGVua28pMTowOAYDVQQD
+DDFta2NlcnQgYWxla3NpQFByb2Jvb2subG9jYWwgKEFsZXhleSBQYWxhemhjaGVu
+a28pMB4XDTI1MDQyNDA2Mjg1NVoXDTI3MDcyNDA2Mjg1NVowXjEnMCUGA1UEChMe
+bWtjZXJ0IGRldmVsb3BtZW50IGNlcnRpZmljYXRlMTMwMQYDVQQLDCphbGVrc2lA
+UHJvYm9vay5sb2NhbCAoQWxleGV5IFBhbGF6aGNoZW5rbykwggEiMA0GCSqGSIb3
+DQEBAQUAA4IBDwAwggEKAoIBAQDBYwQjUTxzptQQJQl5bSSkK8bCA6wAnuzk3lOi
+h0Szk463wSsPpDWPf/NgxsB3HP2ANUtGCdCcKxCmcCJMA8+nZuvJSTdGeYMYF8Ca
+eBGRyQK1ifucZp9o0F+oK02cx36v/BzjhCEyn20IZ4LBcC6dBalox8/iUcZHQpRm
+Rejo07KrLSws8w/T21Lk7GURnHWZej+dicukxZlEZ/fDiYwQC0z0JJaG/+3OQG1p
+gRqYD6Dn/lnB8DvMZfW+EV/zyjT292WgHr9NQ+Yb/99oPLUDL7QcEqQ0yETGTx2i
+jVlN8A3DM0gwlWD7TYXorc6bTQeDiG6vJk+I11Q25TvoE0AtAgMBAAGjgY0wgYow
+DgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMB8GA1UdIwQYMBaA
+FEx8XjlxjR2LO/Iwv+TTwqYQQ+GSMEIGA1UdEQQ7MDmCCWxvY2FsaG9zdIIUaG9z
+dC5kb2NrZXIuaW50ZXJuYWyHBH8AAAGHEAAAAAAAAAAAAAAAAAAAAAEwDQYJKoZI
+hvcNAQELBQADggGBAMOYUQen1PpG34YcmdSNIO62/GFSNR0CID8R+1lvqZFyiaeA
+HTUhDfWVopY8KuqzgXgXE2nAxLf6WSa0kIJOUIE7eLU5zMBW/rLcoa6UxhT2nXjh
+gd7d2PPLSXE/ZBMkoXeQVuZVImywT7haNI0tee3ariIbXeaiaLP6NBlnFva50Tkn
+qKeQpV5UPDQcEvChDtWSvsPkb9yp1CcavBEEJ8XZwgIbV4qKB0z2Q812wsPadpXE
+VLy8KwYhjxBVJyAEH3qpiZH5N+nTnQwu3slWCIck5cskpXGPBX+WIY4nS/4y+idX
+EhnwowfDewWGum58sdUYdyUpdC7NTw4AoZ42y9PcgXu8/qhLr0N0n5/Slmlxe7oN
+zOQfOZduv8oOLW0GuccqGEPwDManU995syDOmqZbBuBt590E2Pid3dwtr/0kyLax
+SyAACTQi7Q0WUPfFj13jCqGU5z99Y6W7RudUg/+snCxiSvc+x/wphjmnGO73X9+p
+uH5dRdyAeGHFw9e2kQ==
+-----END CERTIFICATE-----

build/certs/server-key.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDBYwQjUTxzptQQ
+JQl5bSSkK8bCA6wAnuzk3lOih0Szk463wSsPpDWPf/NgxsB3HP2ANUtGCdCcKxCm
+cCJMA8+nZuvJSTdGeYMYF8CaeBGRyQK1ifucZp9o0F+oK02cx36v/BzjhCEyn20I
+Z4LBcC6dBalox8/iUcZHQpRmRejo07KrLSws8w/T21Lk7GURnHWZej+dicukxZlE
+Z/fDiYwQC0z0JJaG/+3OQG1pgRqYD6Dn/lnB8DvMZfW+EV/zyjT292WgHr9NQ+Yb
+/99oPLUDL7QcEqQ0yETGTx2ijVlN8A3DM0gwlWD7TYXorc6bTQeDiG6vJk+I11Q2
+5TvoE0AtAgMBAAECggEBAJWdVGM6g0l6hVBkRxsxbIqy75fEnXrxeZdrxkrU2jsQ
+avcRNI5qXaHCvPlfayH8RMe+85ihGUrpKn2J/Y7P2ATMZJka0u/sLJckMTeQsw8V
+88mdkhMjdiryIz+JGQe1c/cVVwhSfhibLRC2fHvJndaPvcw54kRXPc593S/u4E3X
+uc5pyoPkiyon4AzQ3piVTRrdtQRyyT1UDJ+lRyTBLuWcM50H4O50VliIrk2HVxGA
+dfL8tnYOGnW7l12xCa6OoT03/qOBS1yPd8vXFAmnbEzbzvAEIDXC0GXQ5CPHOsFu
+ZnviDmjt2I/OSygBqnaxCuE0cMgIvI7zf2ie43Onu4UCgYEA0STl3mC80lSg8Ddo
+qGj+uPck3aOtUtI0ni94rM4YwgqDakm1aMDtVbivg3F9HLjDPxCe+iyQFOvjJ+uR
+KEdp5zFmS3Sf9lB0PymCbeAicRJA6ku+9GxbYk9VNWkxrNozDn4iolio41xjZSZ4
+iXHBh/s2xeZeGfW65/MOJMjvk/cCgYEA7LZh6ueBrBJkMf3imcmz7cfEkUyzioyM
+3Gz8JMNINPsb8QTYLaAog0m7eQ6FVZB0lIQV9V+pTzbhCxSbAryL7aOr7vKmFlgb
+tB5YqsdYHGftZAqwJzFNorAA2Yh5Z5H1+xAB3i4uB4lHwIC1Sl79vor7tccvGFPK
+hWX8Mz82+/sCgYAmI3NjpQJp3JLom0ITi+n/ctofLMzbkIeV3RRFduPe5qnmRQC2
+1I+zFRW0g4qMJUk9g9tpxZyUpBttWTDERpmSVljQI7lT4oIATqKBROEi+3ApCZ0N
+14Cmoc7pCYDMg5HR78CDGGXb6Cob9PMAJWVkVbQ8THEWjNADojgPDzFZKwKBgGGN
+tIL7z9wbZEGaEUYx8z4+gwsioieqTu8U10FLXbm/9z74MSN0it24iFOWoWqm8vS2
+DtqmBv/HbS2E23FgRQa12kjKpZo1y40KqJ4RM4XZauM86GXuksFGacM81FPTup0y
+dqKbQ4sFj5WNNamlxks9ugirQwRym9coNazlE4L7AoGBAMaeWaVaRbFu+jgscPud
+k5J27o9zH8CS+xngOYEjGFpdR/52ZMhpQOrtFJX0mCOi9vpAQ5Ro0kk1HMPH0mGU
+5b75OUy6SBfnYR7mw7imc85bP+lQoe8kmb+wrIJMYx9RGGbDatDFbxCEasqNzvFf
+VQXTnh0brizumpbOfHlZXced
+-----END PRIVATE KEY-----

build/certs/server.pem

@@ -0,0 +1,55 @@
+-----BEGIN CERTIFICATE-----
+MIIEiTCCAvGgAwIBAgIRAMa57BhiUa7ds8bjquZeuGwwDQYJKoZIhvcNAQELBQAw
+gZExHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTEzMDEGA1UECwwqYWxl
+a3NpQFByb2Jvb2subG9jYWwgKEFsZXhleSBQYWxhemhjaGVua28pMTowOAYDVQQD
+DDFta2NlcnQgYWxla3NpQFByb2Jvb2subG9jYWwgKEFsZXhleSBQYWxhemhjaGVu
+a28pMB4XDTI1MDQyNDA2Mjg1NVoXDTI3MDcyNDA2Mjg1NVowXjEnMCUGA1UEChMe
+bWtjZXJ0IGRldmVsb3BtZW50IGNlcnRpZmljYXRlMTMwMQYDVQQLDCphbGVrc2lA
+UHJvYm9vay5sb2NhbCAoQWxleGV5IFBhbGF6aGNoZW5rbykwggEiMA0GCSqGSIb3
+DQEBAQUAA4IBDwAwggEKAoIBAQDBYwQjUTxzptQQJQl5bSSkK8bCA6wAnuzk3lOi
+h0Szk463wSsPpDWPf/NgxsB3HP2ANUtGCdCcKxCmcCJMA8+nZuvJSTdGeYMYF8Ca
+eBGRyQK1ifucZp9o0F+oK02cx36v/BzjhCEyn20IZ4LBcC6dBalox8/iUcZHQpRm
+Rejo07KrLSws8w/T21Lk7GURnHWZej+dicukxZlEZ/fDiYwQC0z0JJaG/+3OQG1p
+gRqYD6Dn/lnB8DvMZfW+EV/zyjT292WgHr9NQ+Yb/99oPLUDL7QcEqQ0yETGTx2i
+jVlN8A3DM0gwlWD7TYXorc6bTQeDiG6vJk+I11Q25TvoE0AtAgMBAAGjgY0wgYow
+DgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMB8GA1UdIwQYMBaA
+FEx8XjlxjR2LO/Iwv+TTwqYQQ+GSMEIGA1UdEQQ7MDmCCWxvY2FsaG9zdIIUaG9z
+dC5kb2NrZXIuaW50ZXJuYWyHBH8AAAGHEAAAAAAAAAAAAAAAAAAAAAEwDQYJKoZI
+hvcNAQELBQADggGBAMOYUQen1PpG34YcmdSNIO62/GFSNR0CID8R+1lvqZFyiaeA
+HTUhDfWVopY8KuqzgXgXE2nAxLf6WSa0kIJOUIE7eLU5zMBW/rLcoa6UxhT2nXjh
+gd7d2PPLSXE/ZBMkoXeQVuZVImywT7haNI0tee3ariIbXeaiaLP6NBlnFva50Tkn
+qKeQpV5UPDQcEvChDtWSvsPkb9yp1CcavBEEJ8XZwgIbV4qKB0z2Q812wsPadpXE
+VLy8KwYhjxBVJyAEH3qpiZH5N+nTnQwu3slWCIck5cskpXGPBX+WIY4nS/4y+idX
+EhnwowfDewWGum58sdUYdyUpdC7NTw4AoZ42y9PcgXu8/qhLr0N0n5/Slmlxe7oN
+zOQfOZduv8oOLW0GuccqGEPwDManU995syDOmqZbBuBt590E2Pid3dwtr/0kyLax
+SyAACTQi7Q0WUPfFj13jCqGU5z99Y6W7RudUg/+snCxiSvc+x/wphjmnGO73X9+p
+uH5dRdyAeGHFw9e2kQ==
+-----END CERTIFICATE-----
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDBYwQjUTxzptQQ
+JQl5bSSkK8bCA6wAnuzk3lOih0Szk463wSsPpDWPf/NgxsB3HP2ANUtGCdCcKxCm
+cCJMA8+nZuvJSTdGeYMYF8CaeBGRyQK1ifucZp9o0F+oK02cx36v/BzjhCEyn20I
+Z4LBcC6dBalox8/iUcZHQpRmRejo07KrLSws8w/T21Lk7GURnHWZej+dicukxZlE
+Z/fDiYwQC0z0JJaG/+3OQG1pgRqYD6Dn/lnB8DvMZfW+EV/zyjT292WgHr9NQ+Yb
+/99oPLUDL7QcEqQ0yETGTx2ijVlN8A3DM0gwlWD7TYXorc6bTQeDiG6vJk+I11Q2
+5TvoE0AtAgMBAAECggEBAJWdVGM6g0l6hVBkRxsxbIqy75fEnXrxeZdrxkrU2jsQ
+avcRNI5qXaHCvPlfayH8RMe+85ihGUrpKn2J/Y7P2ATMZJka0u/sLJckMTeQsw8V
+88mdkhMjdiryIz+JGQe1c/cVVwhSfhibLRC2fHvJndaPvcw54kRXPc593S/u4E3X
+uc5pyoPkiyon4AzQ3piVTRrdtQRyyT1UDJ+lRyTBLuWcM50H4O50VliIrk2HVxGA
+dfL8tnYOGnW7l12xCa6OoT03/qOBS1yPd8vXFAmnbEzbzvAEIDXC0GXQ5CPHOsFu
+ZnviDmjt2I/OSygBqnaxCuE0cMgIvI7zf2ie43Onu4UCgYEA0STl3mC80lSg8Ddo
+qGj+uPck3aOtUtI0ni94rM4YwgqDakm1aMDtVbivg3F9HLjDPxCe+iyQFOvjJ+uR
+KEdp5zFmS3Sf9lB0PymCbeAicRJA6ku+9GxbYk9VNWkxrNozDn4iolio41xjZSZ4
+iXHBh/s2xeZeGfW65/MOJMjvk/cCgYEA7LZh6ueBrBJkMf3imcmz7cfEkUyzioyM
+3Gz8JMNINPsb8QTYLaAog0m7eQ6FVZB0lIQV9V+pTzbhCxSbAryL7aOr7vKmFlgb
+tB5YqsdYHGftZAqwJzFNorAA2Yh5Z5H1+xAB3i4uB4lHwIC1Sl79vor7tccvGFPK
+hWX8Mz82+/sCgYAmI3NjpQJp3JLom0ITi+n/ctofLMzbkIeV3RRFduPe5qnmRQC2
+1I+zFRW0g4qMJUk9g9tpxZyUpBttWTDERpmSVljQI7lT4oIATqKBROEi+3ApCZ0N
+14Cmoc7pCYDMg5HR78CDGGXb6Cob9PMAJWVkVbQ8THEWjNADojgPDzFZKwKBgGGN
+tIL7z9wbZEGaEUYx8z4+gwsioieqTu8U10FLXbm/9z74MSN0it24iFOWoWqm8vS2
+DtqmBv/HbS2E23FgRQa12kjKpZo1y40KqJ4RM4XZauM86GXuksFGacM81FPTup0y
+dqKbQ4sFj5WNNamlxks9ugirQwRym9coNazlE4L7AoGBAMaeWaVaRbFu+jgscPud
+k5J27o9zH8CS+xngOYEjGFpdR/52ZMhpQOrtFJX0mCOi9vpAQ5Ro0kk1HMPH0mGU
+5b75OUy6SBfnYR7mw7imc85bP+lQoe8kmb+wrIJMYx9RGGbDatDFbxCEasqNzvFf
+VQXTnh0brizumpbOfHlZXced
+-----END PRIVATE KEY-----

build/deps/README.md

@@ -1,4 +1,4 @@
 # What's this?
 
 This directory is a workaround for the lack of support for Docker Compose in Dependabot.
-See <https://github.com/dependabot/dependabot-core/issues/390#issuecomment-1062170379>.
+See https://github.com/dependabot/dependabot-core/issues/390#issuecomment-1062170379.

build/deps/centos7.Dockerfile

@@ -1 +0,0 @@
-FROM centos:7.9.2009

build/deps/debian11.Dockerfile

@@ -1 +0,0 @@
-FROM debian:11.4

build/deps/docusaurus-docs.Dockerfile

@@ -0,0 +1 @@
+FROM ghcr.io/ferretdb/docusaurus-docs:3.7.0-4

build/deps/ferretdb-prettier.Dockerfile

@@ -0,0 +1 @@
+FROM ghcr.io/ferretdb/ferretdb-prettier:3.6.2-1

build/deps/ferretdb-textlint.Dockerfile

@@ -0,0 +1 @@
+FROM ghcr.io/ferretdb/ferretdb-textlint:15.2.0-1

build/deps/ferretdb-wrangler.Dockerfile

@@ -0,0 +1 @@
+FROM ghcr.io/ferretdb/ferretdb-wrangler:4.24.0-1

build/deps/jaeger.Dockerfile

@@ -0,0 +1 @@
+FROM jaegertracing/all-in-one:1.74.0

build/deps/legacy-mongo-shell.Dockerfile

@@ -0,0 +1,2 @@
+# TODO https://github.com/FerretDB/FerretDB/issues/5073
+FROM ghcr.io/ferretdb/legacy-mongo-shell:7.0.8-1

build/deps/markdownlint.Dockerfile

@@ -1 +1 @@
-FROM ghcr.io/igorshubovych/markdownlint-cli:v0.32.1
+FROM davidanson/markdownlint-cli2:v0.18.1

build/deps/mongo5.Dockerfile

@@ -1 +0,0 @@
-FROM mongo:5.0.10

build/deps/mongo6.Dockerfile

@@ -1,4 +0,0 @@
-# TODO https://github.com/docker-library/mongo/issues/552
-# FROM mongo:6.0.0
-
-FROM mongo

build/deps/mongodb.Dockerfile

@@ -0,0 +1,16 @@
+# syntax=docker/dockerfile:1
+
+# TODO https://github.com/FerretDB/FerretDB/issues/5073
+FROM mongo:7.0.8
+
+# If you encounter an "unknown instruction" error there,
+# please update Docker to the latest version.
+
+# see https://github.com/docker-library/mongo/issues/475
+RUN <<EOF
+set -ex
+
+echo 'topsecret' > /etc/mongod_keyfile.txt
+chmod 0400 /etc/mongod_keyfile.txt
+chown 999:999 /etc/mongod_keyfile.txt
+EOF

build/deps/postgres-documentdb.Dockerfile

@@ -0,0 +1,5 @@
+# Use development image and full tag close to the release.
+FROM ghcr.io/ferretdb/postgres-documentdb-dev:17-0.107.0-ferretdb-2.7.0
+
+# Use moving development image during development.
+# FROM ghcr.io/ferretdb/postgres-documentdb-dev:17-ferretdb

build/deps/postgres.Dockerfile

@@ -1 +0,0 @@
-FROM postgres:14.4

build/deps/tigris.Dockerfile

@@ -1 +0,0 @@
-FROM tigrisdata/tigris-local:1.0.0-alpha.26

build/deps/tigris_main.Dockerfile

@@ -1 +0,0 @@
-FROM tigrisdata/tigris-local:main

build/deps/trivy.Dockerfile

@@ -0,0 +1,2 @@
+FROM aquasec/trivy:0.67.2
+WORKDIR /workdir

build/deps/yugabytedb.Dockerfile

@@ -0,0 +1 @@
+FROM yugabytedb/yugabyte:2025.1.1.0-b197

build/ferretdb-bw/Dockerfile

@@ -0,0 +1,27 @@
+# Use production image and full tag close to the release.
+FROM --platform=linux/amd64 ghcr.io/ferretdb/postgres-documentdb:17-0.107.0-ferretdb-2.7.0
+
+# Use moving development image during development.
+# FROM --platform=linux/amd64 ghcr.io/ferretdb/postgres-documentdb-dev:17-ferretdb
+
+RUN --mount=type=cache,target=/var/cache/apt <<EOF
+
+curl -s https://packagecloud.io/install/repositories/github/git-lfs/script.deb.sh | bash
+
+curl -L https://pgp.mongodb.com/server-7.0.asc | apt-key add -
+echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/debian bookworm/mongodb-org/7.0 main" | tee /etc/apt/sources.list.d/mongodb-org-7.0.list
+
+apt update
+apt install -y git-lfs mongodb-mongosh tmux nano
+
+cd /tmp
+curl -OJL https://go.dev/dl/go1.25.4.linux-amd64.tar.gz
+tar -xf go1.25.4.linux-amd64.tar.gz
+rm go1.25.4.linux-amd64.tar.gz
+mv go /usr/local/
+ln -s /usr/local/go/bin/* /usr/local/bin/
+go version
+
+EOF
+
+WORKDIR /ferretdb/build/ferretdb-bw

build/ferretdb-bw/Makefile

@@ -0,0 +1,26 @@
+all: ferretdb_loader ferretdb
+
+ferretdb_loader:
+	$(MAKE) -C $@
+
+ferretdb:
+	$(MAKE) -C $@
+
+clean:
+	$(MAKE) -C ferretdb_loader clean
+	$(MAKE) -C ferretdb clean
+
+install:
+	$(MAKE) -C ferretdb_loader install
+	$(MAKE) -C ferretdb install
+
+docker:
+	docker buildx build --builder=ferretdb --tag=ferretdb-bw --load .
+	docker run --platform=linux/amd64 --name=ferretdb-bw --rm -it \
+		-e POSTGRES_USER=username -e POSTGRES_PASSWORD=password -e POSTGRES_DB=postgres \
+		-v $(shell pwd)/../..:/ferretdb ferretdb-bw /bin/bash
+
+docker-exec:
+	docker exec -it ferretdb-bw /bin/bash
+
+.PHONY: all ferretdb_loader ferretdb

build/ferretdb-bw/README.md

@@ -0,0 +1,4 @@
+# FerretDB as a PostgreSQL background worker
+
+Not supported.
+Do not use yet.

build/ferretdb-bw/ferretdb/Makefile

@@ -0,0 +1,21 @@
+GO ?= $(shell which go)
+PG_CONFIG ?= pg_config
+PG_INCLUDE := $(shell $(PG_CONFIG) --includedir-server)
+PG_PKGLIB := $(shell $(PG_CONFIG) --pkglibdir)
+INSTALL_BIN = $(shell which install)
+
+CGO_CFLAGS ?= "-I$(PG_INCLUDE) -Wno-implicit-function-declaration"
+CGO_LDFLAGS ?= "-shared"
+
+object = ferretdb.so
+
+all: $(object)
+
+$(object): ferretdb.go
+	CGO_CFLAGS=$(CGO_CFLAGS) CGO_LDFLAGS=$(CGO_LDFLAGS) $(GO) build -v -tags=ferretdb_bw -buildmode=c-shared -o $@ .
+
+install: $(object)
+	$(INSTALL_BIN) -c -m 755 $(object) $(PG_PKGLIB)
+
+clean:
+	rm -f $(object)

build/ferretdb-bw/ferretdb/ferretdb.go

@@ -0,0 +1,77 @@
+// Copyright 2021 FerretDB Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build ferretdb_bw
+
+package main
+
+/*
+#include "postgres.h"
+*/
+import "C"
+
+import (
+	"context"
+	"log"
+	"log/slog"
+	"os"
+
+	"github.com/FerretDB/FerretDB/v2/build/version"
+	"github.com/FerretDB/FerretDB/v2/ferretdb"
+	"github.com/FerretDB/FerretDB/v2/internal/util/ctxutil"
+)
+
+//export BackgroundWorkerMain
+func BackgroundWorkerMain(args C.Datum) {
+	log.SetPrefix("ferretdb: ")
+	log.SetFlags(0)
+
+	ctx, stop := ctxutil.SigTerm(context.Background())
+	defer stop()
+
+	f, err := ferretdb.New(&ferretdb.Config{
+		// TODO https://github.com/FerretDB/FerretDB/issues/4771
+		PostgreSQLURL: "postgres://username:password@127.0.0.1:5432/postgres",
+		ListenAddr:    "127.0.0.1:27017",
+		StateDir:      ".",
+		LogLevel:      slog.LevelDebug,
+		LogOutput:     os.Stderr,
+	})
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	version.Get().Package = "extension"
+
+	done := make(chan struct{})
+
+	// Use WaitLatch, ResetLatch, and WL_POSTMASTER_DEATH to check if `postmaster` process died and call stop().
+	// TODO https://github.com/FerretDB/FerretDB/issues/4771
+
+	go func() {
+		f.Run(ctx)
+		close(done)
+	}()
+
+	uri := f.MongoDBURI()
+	log.Printf("Running at %s", uri)
+
+	<-done
+
+	return
+}
+
+func main() {
+	panic("not reached")
+}

build/ferretdb-bw/ferretdb/ferretdb.h

@@ -0,0 +1,86 @@
+/* Code generated by cmd/cgo; DO NOT EDIT. */
+
+/* package github.com/FerretDB/FerretDB/v2/build/ferretdb-bw/ferretdb */
+
+
+#line 1 "cgo-builtin-export-prolog"
+
+#include <stddef.h>
+
+#ifndef GO_CGO_EXPORT_PROLOGUE_H
+#define GO_CGO_EXPORT_PROLOGUE_H
+
+#ifndef GO_CGO_GOSTRING_TYPEDEF
+typedef struct { const char *p; ptrdiff_t n; } _GoString_;
+#endif
+
+#endif
+
+/* Start of preamble from import "C" comments.  */
+
+
+#line 3 "ferretdb.go"
+
+#include "postgres.h"
+
+#line 1 "cgo-generated-wrapper"
+
+
+/* End of preamble from import "C" comments.  */
+
+
+/* Start of boilerplate cgo prologue.  */
+#line 1 "cgo-gcc-export-header-prolog"
+
+#ifndef GO_CGO_PROLOGUE_H
+#define GO_CGO_PROLOGUE_H
+
+typedef signed char GoInt8;
+typedef unsigned char GoUint8;
+typedef short GoInt16;
+typedef unsigned short GoUint16;
+typedef int GoInt32;
+typedef unsigned int GoUint32;
+typedef long long GoInt64;
+typedef unsigned long long GoUint64;
+typedef GoInt64 GoInt;
+typedef GoUint64 GoUint;
+typedef size_t GoUintptr;
+typedef float GoFloat32;
+typedef double GoFloat64;
+#ifdef _MSC_VER
+#include <complex.h>
+typedef _Fcomplex GoComplex64;
+typedef _Dcomplex GoComplex128;
+#else
+typedef float _Complex GoComplex64;
+typedef double _Complex GoComplex128;
+#endif
+
+/*
+  static assertion to make sure the file is being used on architecture
+  at least with matching size of GoInt.
+*/
+typedef char _check_for_64_bit_pointer_matching_GoInt[sizeof(void*)==64/8 ? 1:-1];
+
+#ifndef GO_CGO_GOSTRING_TYPEDEF
+typedef _GoString_ GoString;
+#endif
+typedef void *GoMap;
+typedef void *GoChan;
+typedef struct { void *t; void *v; } GoInterface;
+typedef struct { void *data; GoInt len; GoInt cap; } GoSlice;
+
+#endif
+
+/* End of boilerplate cgo prologue.  */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+extern void BackgroundWorkerMain(Datum args);
+
+#ifdef __cplusplus
+}
+#endif

build/ferretdb-bw/ferretdb_loader/Makefile

@@ -0,0 +1,4 @@
+MODULES = ferretdb_loader
+PG_CONFIG ?= pg_config
+PGXS := $(shell $(PG_CONFIG) --pgxs)
+include $(PGXS)

build/ferretdb-bw/ferretdb_loader/ferretdb_loader.c

@@ -0,0 +1,53 @@
+#include <dlfcn.h>
+#include "postgres.h"
+#include "pgstat.h"
+#include "postmaster/bgworker.h"
+#include "storage/ipc.h"
+#include "storage/latch.h"
+#include "storage/proc.h"
+#include "miscadmin.h"
+#include "utils/elog.h"
+#include "fmgr.h"
+
+PG_MODULE_MAGIC;
+
+static char *ferretdb_so = "ferretdb.so";
+
+PGDLLEXPORT void background_main(Datum main_arg);
+
+void background_main(Datum main_arg)
+{
+    bgworker_main_type f;
+    char *path;
+    void *h;
+
+    BackgroundWorkerUnblockSignals();
+
+    path = (char *)palloc(strlen(pkglib_path) + 1 + strlen(ferretdb_so) + 1);
+    join_path_components(path, pkglib_path, ferretdb_so);
+    elog(LOG, "ferretdb_loader: loading '%s'", path);
+
+    h = dlopen(path, RTLD_NOW | RTLD_GLOBAL);
+    pfree(path);
+
+    f = (bgworker_main_type)dlsym(h, "BackgroundWorkerMain");
+    f(main_arg);
+
+    dlclose(h);
+    proc_exit(0);
+}
+
+void _PG_init(void)
+{
+    BackgroundWorker worker;
+    MemSet(&worker, 0, sizeof(BackgroundWorker));
+
+    snprintf(worker.bgw_name, BGW_MAXLEN, "FerretDBLoader");
+    worker.bgw_flags = BGWORKER_SHMEM_ACCESS;
+    worker.bgw_start_time = BgWorkerStart_RecoveryFinished;
+    worker.bgw_restart_time = BGW_NEVER_RESTART;
+    snprintf(worker.bgw_library_name, BGW_MAXLEN, "ferretdb_loader");
+    snprintf(worker.bgw_function_name, BGW_MAXLEN, "background_main");
+
+    RegisterBackgroundWorker(&worker);
+}

build/ferretdb.service

@@ -0,0 +1,17 @@
+[Unit]
+Description=FerretDB Database
+Documentation=https://docs.ferretdb.io/
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+ExecStart=/usr/bin/ferretdb
+Restart=on-failure
+
+# Configure the FerretDB service with `systemctl edit ferretdb`.
+# For more configuration options check https://docs.ferretdb.io/configuration/flags/
+
+Environment="FERRETDB_POSTGRESQL_URL=postgres://127.0.0.1:5432/postgres"
+
+[Install]
+WantedBy=multi-user.target

build/ferretdb/development.Dockerfile

@@ -0,0 +1,143 @@
+# syntax=docker/dockerfile:1
+
+# for development releases (`ferretdb-dev` image)
+
+# While we already know commit and version from commit.txt and version.txt inside image,
+# it is not possible to use them in LABELs for the final image.
+# We need to pass them as build arguments.
+# Defining ARGs there makes them global.
+ARG LABEL_VERSION
+ARG LABEL_COMMIT
+
+
+# prepare stage
+
+# TODO https://github.com/FerretDB/FerretDB/issues/5449
+FROM --platform=$BUILDPLATFORM golang:1.25.4-bookworm AS development-prepare
+
+# use a single directory for all Go caches to simplify RUN --mount commands below
+ENV GOPATH=/cache/gopath
+ENV GOCACHE=/cache/gocache
+ENV GOMODCACHE=/cache/gomodcache
+
+# remove ",direct"
+ENV GOPROXY=https://proxy.golang.org
+
+COPY go.mod go.sum /src/
+
+WORKDIR /src
+
+RUN --mount=type=cache,target=/cache <<EOF
+set -ex
+
+go mod download
+go mod verify
+EOF
+
+
+# build stage
+
+# TODO https://github.com/FerretDB/FerretDB/issues/5449
+FROM golang:1.25.4-bookworm AS development-build
+
+ARG TARGETARCH
+
+ARG LABEL_VERSION
+ARG LABEL_COMMIT
+RUN test -n "$LABEL_VERSION"
+RUN test -n "$LABEL_COMMIT"
+
+# use the same directories for Go caches as above
+ENV GOPATH=/cache/gopath
+ENV GOCACHE=/cache/gocache
+ENV GOMODCACHE=/cache/gomodcache
+
+# modules are already downloaded
+ENV GOPROXY=off
+
+# see .dockerignore
+WORKDIR /src
+COPY . .
+
+# to add a dependency
+COPY --from=development-prepare /src/go.mod /src/go.sum /src/
+
+RUN --mount=type=cache,target=/cache <<EOF
+set -ex
+
+git status
+
+# Do not raise without providing separate builds with those values
+# because higher versions are problematic for some virtualization platforms and older hardware.
+export GOAMD64=v1
+export GOARM64=v8.0
+
+export CGO_ENABLED=1
+
+# Disable race detector on arm64 due to https://github.com/golang/go/issues/29948
+# (and that happens on GitHub-hosted Actions runners).
+RACE=false
+if test "$TARGETARCH" = "amd64"
+then
+    RACE=true
+fi
+
+go env
+
+# Do not trim paths to make debugging with delve easier.
+
+# check if stdlib was cached
+go install -v -race=$RACE std
+
+go build -v -o=bin/ferretdb -race=$RACE -tags=ferretdb_dev -coverpkg=./... ./cmd/ferretdb
+
+go version -m bin/ferretdb
+bin/ferretdb --version
+EOF
+
+
+# stage for binary only
+
+FROM scratch AS development-binary
+
+COPY --from=development-build /src/bin/ferretdb /ferretdb
+
+
+# final stage
+
+# TODO https://github.com/FerretDB/FerretDB/issues/5449
+FROM golang:1.25.4-bookworm AS development
+
+ENV GOCOVERDIR=/tmp/cover
+ENV GORACE=halt_on_error=1,history_size=2
+
+RUN mkdir /tmp/cover
+
+COPY --from=development-build /src/bin/ferretdb /ferretdb
+
+ENTRYPOINT [ "/ferretdb" ]
+
+HEALTHCHECK --interval=1m --timeout=5s --retries=1 --start-period=30s --start-interval=5s \
+  CMD ["/ferretdb", "ping"]
+
+WORKDIR /
+VOLUME /state
+EXPOSE 27017 27018 8088
+
+# don't forget to update documentation if you change defaults
+ENV FERRETDB_LISTEN_ADDR=:27017
+# ENV FERRETDB_LISTEN_TLS=:27018
+ENV FERRETDB_DEBUG_ADDR=:8088
+ENV FERRETDB_STATE_DIR=/state
+
+ARG LABEL_VERSION
+ARG LABEL_COMMIT
+
+# TODO https://github.com/FerretDB/FerretDB/issues/2212
+LABEL org.opencontainers.image.description="A truly Open Source MongoDB alternative (development image)"
+LABEL org.opencontainers.image.revision="${LABEL_COMMIT}"
+LABEL org.opencontainers.image.source="https://github.com/FerretDB/FerretDB"
+LABEL org.opencontainers.image.title="FerretDB (development image)"
+LABEL org.opencontainers.image.url="https://www.ferretdb.com/"
+LABEL org.opencontainers.image.vendor="FerretDB Inc."
+LABEL org.opencontainers.image.version="${LABEL_VERSION}"

build/ferretdb/eval-dev.Dockerfile

@@ -0,0 +1,149 @@
+# syntax=docker/dockerfile:1
+
+# evaluation image with development release (`ferretdb-eval-dev` image)
+
+# While we already know commit and version from commit.txt and version.txt inside image,
+# it is not possible to use them in LABELs for the final image.
+# We need to pass them as build arguments.
+# Defining ARGs there makes them global.
+ARG LABEL_VERSION
+ARG LABEL_COMMIT
+
+
+# prepare stage
+
+# TODO https://github.com/FerretDB/FerretDB/issues/5449
+FROM --platform=$BUILDPLATFORM golang:1.25.4-bookworm AS eval-dev-prepare
+
+# use a single directory for all Go caches to simplify RUN --mount commands below
+ENV GOPATH=/cache/gopath
+ENV GOCACHE=/cache/gocache
+ENV GOMODCACHE=/cache/gomodcache
+
+# remove ",direct"
+ENV GOPROXY=https://proxy.golang.org
+
+COPY go.mod go.sum /src/
+
+WORKDIR /src
+
+RUN --mount=type=cache,target=/cache <<EOF
+set -ex
+
+go mod download
+go mod verify
+EOF
+
+
+# build stage
+
+# TODO https://github.com/FerretDB/FerretDB/issues/5449
+FROM golang:1.25.4-bookworm AS eval-dev-build
+
+ARG TARGETARCH
+
+ARG LABEL_VERSION
+ARG LABEL_COMMIT
+RUN test -n "$LABEL_VERSION"
+RUN test -n "$LABEL_COMMIT"
+
+# use the same directories for Go caches as above
+ENV GOPATH=/cache/gopath
+ENV GOCACHE=/cache/gocache
+ENV GOMODCACHE=/cache/gomodcache
+
+# modules are already downloaded
+ENV GOPROXY=off
+
+# see .dockerignore
+WORKDIR /src
+COPY . .
+
+# to add a dependency
+COPY --from=eval-dev-prepare /src/go.mod /src/go.sum /src/
+
+RUN --mount=type=cache,target=/cache <<EOF
+set -ex
+
+git status
+
+# Do not raise without providing separate builds with those values
+# because higher versions are problematic for some virtualization platforms and older hardware.
+export GOAMD64=v1
+export GOARM64=v8.0
+
+export CGO_ENABLED=1
+
+# Disable race detector on arm64 due to https://github.com/golang/go/issues/29948
+# (and that happens on GitHub-hosted Actions runners).
+RACE=false
+if test "$TARGETARCH" = "amd64"
+then
+    RACE=true
+fi
+
+go env
+
+# Do not trim paths to make debugging with delve easier.
+
+# check if stdlib was cached
+go install -v -race=$RACE std
+
+go build -v -o=bin/ferretdb -race=$RACE -tags=ferretdb_dev -coverpkg=./... ./cmd/ferretdb
+
+go version -m bin/ferretdb
+bin/ferretdb --version
+EOF
+
+
+# final stage
+
+# Use development image and full tag close to the release.
+FROM ghcr.io/ferretdb/postgres-documentdb-dev:17-0.107.0-ferretdb-2.7.0 AS eval-dev
+
+# Use moving development image during development.
+# FROM ghcr.io/ferretdb/postgres-documentdb-dev:17-ferretdb AS eval-dev
+
+RUN --mount=type=cache,sharing=locked,target=/var/cache/apt <<EOF
+apt install -y curl supervisor
+curl -L https://pgp.mongodb.com/server-7.0.asc | apt-key add -
+echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/debian bookworm/mongodb-org/7.0 main" | tee /etc/apt/sources.list.d/mongodb-org-7.0.list
+apt update
+apt install -y mongodb-mongosh
+
+mkdir /tmp/cover
+EOF
+
+COPY --from=eval-dev-build /src/bin/ferretdb /usr/local/bin/ferretdb
+
+COPY --from=eval-dev-build /src/build/ferretdb/evaluation/supervisord.conf /etc/supervisor/conf.d/supervisord.conf
+COPY --from=eval-dev-build /src/build/ferretdb/evaluation/entrypoint.sh /usr/local/bin/entrypoint.sh
+
+ENTRYPOINT ["entrypoint.sh"]
+
+HEALTHCHECK --interval=1m --timeout=5s --retries=1 --start-period=30s --start-interval=5s \
+  CMD ["/usr/local/bin/ferretdb", "ping"]
+
+VOLUME /state
+EXPOSE 27017 27018 8088
+
+ENV GOCOVERDIR=/tmp/cover
+ENV GORACE=halt_on_error=1,history_size=2
+
+# don't forget to update documentation if you change defaults
+ENV FERRETDB_LISTEN_ADDR=:27017
+# ENV FERRETDB_LISTEN_TLS=:27018
+ENV FERRETDB_DEBUG_ADDR=:8088
+ENV FERRETDB_STATE_DIR=/state
+
+ARG LABEL_VERSION
+ARG LABEL_COMMIT
+
+# TODO https://github.com/FerretDB/FerretDB/issues/2212
+LABEL org.opencontainers.image.description="A truly Open Source MongoDB alternative (evaluation development image)"
+LABEL org.opencontainers.image.revision="${LABEL_COMMIT}"
+LABEL org.opencontainers.image.source="https://github.com/FerretDB/FerretDB"
+LABEL org.opencontainers.image.title="FerretDB (evaluation development image)"
+LABEL org.opencontainers.image.url="https://www.ferretdb.com/"
+LABEL org.opencontainers.image.vendor="FerretDB Inc."
+LABEL org.opencontainers.image.version="${LABEL_VERSION}"

build/ferretdb/eval.Dockerfile

@@ -0,0 +1,136 @@
+# syntax=docker/dockerfile:1
+
+# evaluation image (formerly "all-in-one") with production release (`ferretdb-eval` image)
+
+# While we already know commit and version from commit.txt and version.txt inside image,
+# it is not possible to use them in LABELs for the final image.
+# We need to pass them as build arguments.
+# Defining ARGs there makes them global.
+ARG LABEL_VERSION
+ARG LABEL_COMMIT
+
+
+# prepare stage
+
+# TODO https://github.com/FerretDB/FerretDB/issues/5449
+FROM --platform=$BUILDPLATFORM golang:1.25.4-bookworm AS eval-prepare
+
+# use a single directory for all Go caches to simplify RUN --mount commands below
+ENV GOPATH=/cache/gopath
+ENV GOCACHE=/cache/gocache
+ENV GOMODCACHE=/cache/gomodcache
+
+# remove ",direct"
+ENV GOPROXY=https://proxy.golang.org
+
+COPY go.mod go.sum /src/
+
+WORKDIR /src
+
+RUN --mount=type=cache,target=/cache <<EOF
+set -ex
+
+go mod download
+go mod verify
+EOF
+
+
+# build stage
+
+# TODO https://github.com/FerretDB/FerretDB/issues/5449
+FROM golang:1.25.4-bookworm AS eval-build
+
+ARG TARGETARCH
+
+ARG LABEL_VERSION
+ARG LABEL_COMMIT
+RUN test -n "$LABEL_VERSION"
+RUN test -n "$LABEL_COMMIT"
+
+# use the same directories for Go caches as above
+ENV GOPATH=/cache/gopath
+ENV GOCACHE=/cache/gocache
+ENV GOMODCACHE=/cache/gomodcache
+
+# modules are already downloaded
+ENV GOPROXY=off
+
+# see .dockerignore
+WORKDIR /src
+COPY . .
+
+# to add a dependency
+COPY --from=eval-prepare /src/go.mod /src/go.sum /src/
+
+RUN --mount=type=cache,target=/cache <<EOF
+set -ex
+
+git status
+
+# Do not raise without providing separate builds with those values
+# because higher versions are problematic for some virtualization platforms and older hardware.
+export GOAMD64=v1
+export GOARM64=v8.0
+
+export CGO_ENABLED=0
+
+go env
+
+# Trim paths mostly to check that building with `-trimpath` is supported.
+
+# check if stdlib was cached
+go install -v -trimpath std
+
+go build -v -trimpath -o=bin/ferretdb ./cmd/ferretdb
+
+go version -m bin/ferretdb
+bin/ferretdb --version
+EOF
+
+
+# final stage
+
+# Use production image and full tag close to the release.
+FROM ghcr.io/ferretdb/postgres-documentdb:17-0.107.0-ferretdb-2.7.0 AS eval
+
+# Use moving development image during development.
+# FROM ghcr.io/ferretdb/postgres-documentdb-dev:17-ferretdb AS eval
+
+RUN --mount=type=cache,sharing=locked,target=/var/cache/apt <<EOF
+apt install -y curl supervisor
+curl -L https://pgp.mongodb.com/server-7.0.asc | apt-key add -
+echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/debian bookworm/mongodb-org/7.0 main" | tee /etc/apt/sources.list.d/mongodb-org-7.0.list
+apt update
+apt install -y mongodb-mongosh
+EOF
+
+COPY --from=eval-build /src/bin/ferretdb /usr/local/bin/ferretdb
+
+COPY --from=eval-build /src/build/ferretdb/evaluation/supervisord.conf /etc/supervisor/conf.d/supervisord.conf
+COPY --from=eval-build /src/build/ferretdb/evaluation/entrypoint.sh /usr/local/bin/entrypoint.sh
+
+ENTRYPOINT ["entrypoint.sh"]
+
+HEALTHCHECK --interval=1m --timeout=5s --retries=1 --start-period=30s --start-interval=5s \
+  CMD ["/usr/local/bin/ferretdb", "ping"]
+
+VOLUME /state
+EXPOSE 27017 27018 8088
+
+# don't forget to update documentation if you change defaults
+ENV FERRETDB_LISTEN_ADDR=:27017
+# ENV FERRETDB_LISTEN_TLS=:27018
+ENV FERRETDB_DEBUG_ADDR=:8088
+ENV FERRETDB_STATE_DIR=/state
+
+ARG LABEL_VERSION
+ARG LABEL_COMMIT
+
+# TODO https://github.com/FerretDB/FerretDB/issues/2212
+LABEL org.opencontainers.image.description="A truly Open Source MongoDB alternative (evaluation image)"
+LABEL org.opencontainers.image.revision="${LABEL_COMMIT}"
+LABEL org.opencontainers.image.source="https://github.com/FerretDB/FerretDB"
+LABEL org.opencontainers.image.title="FerretDB (evaluation image)"
+LABEL org.opencontainers.image.url="https://www.ferretdb.com/"
+LABEL org.opencontainers.image.vendor="FerretDB Inc."
+LABEL org.opencontainers.image.version="${LABEL_VERSION}"

build/ferretdb/evaluation/entrypoint.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+
+set -e
+
+if [ -z "$POSTGRES_PASSWORD" ]; then
+    echo "Error: POSTGRES_PASSWORD must be set. See https://docs.ferretdb.io/installation/evaluation/"
+    exit 1
+fi
+
+if [ "${POSTGRES_DB:-postgres}" != "postgres" ]; then
+    echo "Error: POSTGRES_DB must be set to 'postgres' or unset. See https://docs.ferretdb.io/installation/evaluation/"
+    exit 1
+fi
+
+# prevent unset POSTGRES_DB using the value of POSTGRES_USER, see https://hub.docker.com/_/postgres
+export POSTGRES_DB="postgres"
+
+export FERRETDB_POSTGRESQL_URL="postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD}@127.0.0.1:5432/${POSTGRES_DB}"
+
+exec /usr/bin/supervisord -c /etc/supervisor/conf.d/supervisord.conf

build/ferretdb/evaluation/supervisord.conf

@@ -0,0 +1,24 @@
+; https://supervisord.org/configuration.html#supervisord-section-values
+[supervisord]
+nodaemon=true
+loglevel=info
+logfile=/dev/stderr
+logfile_maxbytes=0
+
+; https://supervisord.org/configuration.html#program-x-section-values
+[program:postgres]
+command=/usr/local/bin/docker-entrypoint.sh postgres
+; lower priority postgres starts before ferretdb (default priority 999)
+priority=1
+; fast shutdown https://www.postgresql.org/docs/current/server-shutdown.html
+stopsignal=INT
+stdout_logfile=/dev/stderr
+stdout_logfile_maxbytes=0
+redirect_stderr=true
+
+; https://supervisord.org/configuration.html#program-x-section-values
+[program:ferretdb]
+command=/usr/local/bin/ferretdb
+stdout_logfile=/dev/stderr
+stdout_logfile_maxbytes=0
+redirect_stderr=true

build/ferretdb/group

@@ -0,0 +1 @@
+ferretdb:x:1000:

build/ferretdb/passwd

@@ -0,0 +1 @@
+ferretdb:x:1000:1000::/nonexistent:/nonexistent

build/ferretdb/production.Dockerfile

@@ -0,0 +1,135 @@
+# syntax=docker/dockerfile:1
+
+# for production releases (`ferretdb` image)
+
+# While we already know commit and version from commit.txt and version.txt inside image,
+# it is not possible to use them in LABELs for the final image.
+# We need to pass them as build arguments.
+# Defining ARGs there makes them global.
+ARG LABEL_VERSION
+ARG LABEL_COMMIT
+
+
+# prepare stage
+
+# TODO https://github.com/FerretDB/FerretDB/issues/5449
+FROM --platform=$BUILDPLATFORM golang:1.25.4-bookworm AS production-prepare
+
+# use a single directory for all Go caches to simplify RUN --mount commands below
+ENV GOPATH=/cache/gopath
+ENV GOCACHE=/cache/gocache
+ENV GOMODCACHE=/cache/gomodcache
+
+# remove ",direct"
+ENV GOPROXY=https://proxy.golang.org
+
+COPY go.mod go.sum /src/
+
+WORKDIR /src
+
+RUN --mount=type=cache,target=/cache <<EOF
+set -ex
+
+go mod download
+go mod verify
+EOF
+
+
+# build stage
+
+# TODO https://github.com/FerretDB/FerretDB/issues/5449
+FROM golang:1.25.4-bookworm AS production-build
+
+ARG TARGETARCH
+
+ARG LABEL_VERSION
+ARG LABEL_COMMIT
+RUN test -n "$LABEL_VERSION"
+RUN test -n "$LABEL_COMMIT"
+
+# use the same directories for Go caches as above
+ENV GOPATH=/cache/gopath
+ENV GOCACHE=/cache/gocache
+ENV GOMODCACHE=/cache/gomodcache
+
+# modules are already downloaded
+ENV GOPROXY=off
+
+# see .dockerignore
+WORKDIR /src
+COPY . .
+
+# to add a dependency
+COPY --from=production-prepare /src/go.mod /src/go.sum /src/
+
+RUN --mount=type=cache,target=/cache <<EOF
+set -ex
+
+git status
+
+# Do not raise without providing separate builds with those values
+# because higher versions are problematic for some virtualization platforms and older hardware.
+export GOAMD64=v1
+export GOARM64=v8.0
+
+export CGO_ENABLED=0
+
+go env
+
+# Trim paths mostly to check that building with `-trimpath` is supported.
+
+# check if stdlib was cached
+go install -v -trimpath std
+
+go build -v -trimpath -o=bin/ferretdb ./cmd/ferretdb
+
+go version -m bin/ferretdb
+bin/ferretdb --version
+
+mkdir /state
+EOF
+
+# stage for binary only
+
+FROM scratch AS production-binary
+
+COPY --from=production-build /src/bin/ferretdb /ferretdb
+
+
+# final stage
+
+FROM scratch AS production
+
+COPY build/ferretdb/passwd /etc/passwd
+COPY build/ferretdb/group  /etc/group
+USER ferretdb:ferretdb
+
+COPY --from=production-build /src/bin/ferretdb /ferretdb
+COPY --from=production-build --chown=ferretdb:ferretdb /state /state
+
+ENTRYPOINT [ "/ferretdb" ]
+
+HEALTHCHECK --interval=1m --timeout=5s --retries=1 --start-period=30s --start-interval=5s \
+  CMD ["/ferretdb", "ping"]
+
+WORKDIR /
+VOLUME /state
+EXPOSE 27017 27018 8088
+
+# don't forget to update documentation if you change defaults
+ENV FERRETDB_LISTEN_ADDR=:27017
+# ENV FERRETDB_LISTEN_TLS=:27018
+ENV FERRETDB_DEBUG_ADDR=:8088
+ENV FERRETDB_STATE_DIR=/state
+
+ARG LABEL_VERSION
+ARG LABEL_COMMIT
+
+# TODO https://github.com/FerretDB/FerretDB/issues/2212
+LABEL org.opencontainers.image.description="A truly Open Source MongoDB alternative"
+LABEL org.opencontainers.image.revision="${LABEL_COMMIT}"
+LABEL org.opencontainers.image.source="https://github.com/FerretDB/FerretDB"
+LABEL org.opencontainers.image.title="FerretDB"
+LABEL org.opencontainers.image.url="https://www.ferretdb.com/"
+LABEL org.opencontainers.image.vendor="FerretDB Inc."
+LABEL org.opencontainers.image.version="${LABEL_VERSION}"

build/legacy-mongo-shell/README.md

@@ -0,0 +1,277 @@
+# Assertions in the `mongo` shell
+
+See [Assertions 101](https://github.com/mongodb/mongo/wiki/Write-Tests-For-Server-Code#assertions-101) for a very brief overview.
+
+The legacy `mongo` shell uses its own assertions which are defined [here](https://github.com/mongodb/mongo/blob/master/src/mongo/shell/assert.js).
+These deviate from `mongosh`, which uses the standard Node.js [assert](https://nodejs.org/api/assert.html) module.
+When you write a small reproducible test and call `task testjs` the legacy `mongo` shell will be invoked.
+
+A useful function is `assert.commandFailedWithCode` which asserts that the command failed with the expected code as the name implies.
+One should pass the result of a call to the `db.runCommand()` helper as this provides a result type that the function can parse.
+This is the preferred method to issue database commands, as it provides a consistent interface between the shell and drivers.
+
+For example, to check if the `findAndModify` command failed with the error code `ImmutableField` you would do the following:
+
+```js
+> const res = db.runCommand({findAndModify: "foo", query: {}, update: {$set: {_id: 1}}});
+> assert.commandFailedWithCode(res, ErrorCodes.ImmutableField);
+```
+
+It is not always necessary use the `db.runCommand()` helper as some write methods wrap a `writeError` which the helpers can parse.
+For example, `insert`, `update`, and `remove` will all return a `WriteResult` so the function can parse the result and look for a `writeError`.
+
+See the `WriteResult` object below:
+
+```js
+// WriteResult object
+> assert.commandWorked(db.foo.insert({a: 1}));
+WriteResult({ "nInserted" : 1 })
+> const res = db.foo.insert({a: 1});
+> res.hasWriteError();
+false
+> Object.keys(res);
+[
+  "ok",
+  "nInserted",
+  "nUpserted",
+  "nMatched",
+  "nModified",
+  "nRemoved",
+  "getUpsertedId",
+  "getRawResponse",
+  "getWriteError",
+  "hasWriteError",
+  "getWriteConcernError",
+  "hasWriteConcernError",
+  "tojson",
+  "toString",
+  "shellPrint"
+]
+> res instanceof WriteResult
+true
+>
+```
+
+The `find()` method will return an object, the properties of which will not be parsed by the various assert functions:
+
+```js
+> const res = db.foo.find({a: 1});
+> res._filter
+{ "a" : 1 }
+> res._db
+test
+> res._batchSize
+0
+// all properties are private but the shell will iterate the cursor object when called
+> Object.keys(res);
+[
+  "_mongo",
+  "_db",
+  "_collection",
+  "_ns",
+  "_filter",
+  "_projection",
+  "_limit",
+  "_skip",
+  "_batchSize",
+  "_options",
+  "_additionalCmdParams",
+  "_cursor",
+  "_numReturned"
+]
+>
+```
+
+But a `runCommand()` result will return the correct object that can be parsed:
+
+```js
+> // use a runCommand instead
+> const res = db.runCommand({find: "foo", filter: {a: 1}});
+> res.ok
+1
+> res._commandObj
+{
+  "find" : "foo",
+  "filter" : {
+    "a" : 1
+  },
+  "lsid" : {
+    "id" : UUID("cb64879f-6f69-4656-a38e-ce6dbe3ccebc")
+  }
+}
+> assert.commandFailed(res);
+uncaught exception: Error: command worked when it should have failed: {
+  "cursor" : {
+    "firstBatch" : [
+      {
+        "_id" : ObjectId("6458ec7adb858f891c0b8c68"),
+        "a" : 1
+      },
+      {
+        "_id" : ObjectId("6458ec9ddb858f891c0b8c6a"),
+        "a" : 1
+      }
+    ],
+    "id" : NumberLong(0),
+    "ns" : "test.foo"
+  },
+  "ok" : 1
+} :
+_getErrorWithCode@src/mongo/shell/utils.js:24:13
+doassert@src/mongo/shell/assert.js:18:14
+_assertCommandFailed@src/mongo/shell/assert.js:819:25
+assert.commandFailed@src/mongo/shell/assert.js:877:16
+@(shell):1:8
+```
+
+## Some useful functions
+
+`assert.eq(a, b, msg)`
+
+throws if two values are not equal (tested without strict equality).
+
+`assert.isnull(what, msg)`
+
+throws if `what` is not null.
+
+`assert.commandFailed(res, msg)`
+
+throws if the command did not fail.
+
+`assert.commandWorked(res)`
+
+throws if the result contained an error.
+
+`assert.commandFailedWithCode(res, expectedCode, msg)`
+
+throws if the command did not fail with the expected code.
+
+`assert.sameMembers(aArr, bArr, msg, compareFn = _isDocEq)`
+
+throws if the two arrays do not have the same members, in any order.
+By default, nested arrays must have the same order to be considered equal.
+Optionally accepts a `compareFn` to compare values instead of using `docEq`.
+
+`assert.writeOK(res, msg)`
+
+throws if write result contained an error.
+
+`assert.docEq(expectedDoc, actualDoc, msg)`
+
+throws if `actualDoc` object is not equal to `expectedDoc` object.
+The order of fields
+(properties) within objects is disregarded.
+Throws if object representation in BSON exceeds 16793600 bytes.
+
+`assert.retry(func, msg, num_attempts, intervalMS)`
+
+calls the given function `func` repeatedly at time intervals specified by
+`intervalMS` (milliseconds) until either `func()` returns true or the number of
+attempted function calls is equal to `num_attempts`.
+Throws an exception with
+message `msg` after all attempts are used up.
+If no `intervalMS` argument is passed, it defaults to 0.
+
+## All assert functions
+
+```js
+assert.adminCommandWorkedAllowingNetworkError
+assert.between
+assert.betweenEx
+assert.betweenIn
+assert.bind
+assert.call
+assert.close
+assert.closeWithinMS
+assert.commandFailed
+assert.commandFailedWithCode
+assert.commandWorked
+assert.commandWorkedIgnoringWriteConcernErrors
+assert.commandWorkedIgnoringWriteErrors
+assert.commandWorkedIgnoringWriteErrorsAndWriteConcernErrors
+assert.commandWorkedOrFailedWithCode
+assert.contains
+assert.containsPrefix
+assert.docEq
+assert.doesNotThrow
+assert.dropExceptionsWithCode
+assert.eq
+assert.gt
+assert.gte
+assert.hasFields
+assert.includes
+assert.isnull
+assert.lt
+assert.lte
+assert.neq
+assert.noAPIParams
+assert.retry
+assert.retryNoExcept
+assert.sameMembers
+assert.setEq
+assert.soon
+assert.soonNoExcept
+assert.throws
+assert.throwsWithCode
+assert.time
+assert.toLocaleString
+assert.toString
+assert.valueOf
+assert.writeError
+assert.writeErrorWithCode
+assert.writeOK
+```
+
+## Error Codes
+
+`ErrorCodes` is an object that is generated from various source files.
+It provides error names that correspond to their respective codes.
+
+```js
+// tab in the shell after typing the below to display all 443 error codes
+> ErrorCodes.
+Display all 443 possibilities? (y or n)
+ErrorCodes.APIDeprecationError                                          ErrorCodes.NetworkInterfaceExceededTimeLimit
+ErrorCodes.APIMismatchError                                             ErrorCodes.NetworkTimeout
+ErrorCodes.APIStrictError                                               ErrorCodes.NewReplicaSetConfigurationIncompatible
+ErrorCodes.APIVersionError                                              ErrorCodes.NoConfigPrimary
+ErrorCodes.AlarmAlreadyFulfilled                                        ErrorCodes.NoMatchParseContext
+ErrorCodes.AlreadyInitialized                                           ErrorCodes.NoMatchingDocument
+ErrorCodes.AmbiguousIndexKeyPattern                                     ErrorCodes.NoProgressMade
+ErrorCodes.AtomicityFailure                                             ErrorCodes.NoProjectionFound
+ErrorCodes.AuditingNotEnabled                                           ErrorCodes.NoQueryExecutionPlans
+ErrorCodes.AuthSchemaIncompatible                                       ErrorCodes.NoReplicationEnabled
+ErrorCodes.AuthenticationAbandoned                                      ErrorCodes.NoShardingEnabled
+ErrorCodes.AuthenticationFailed                                         ErrorCodes.NoSuchKey
+ErrorCodes.AuthenticationRestrictionUnmet                               ErrorCodes.NoSuchReshardCollection
+ErrorCodes.BSONObjectTooLarge                                           ErrorCodes.NoSuchSession
+ErrorCodes.BackgroundOperationInProgressForDatabase                     ErrorCodes.NoSuchTenantMigration
+ErrorCodes.BackgroundOperationInProgressForNamespace                    ErrorCodes.NoSuchTransaction
+ErrorCodes.BackupCursorOpenConflictWithCheckpoint                       ErrorCodes.NodeNotElectable
+ErrorCodes.BadPerfCounterPath                                           ErrorCodes.NodeNotFound
+ErrorCodes.BadValue                                                     ErrorCodes.NonConformantBSON
+ErrorCodes.BalancerInterrupted                                          ErrorCodes.NonExistentPath
+ErrorCodes.BrokenPromise                                                ErrorCodes.NonRetryableTenantMigrationConflict
+ErrorCodes.CallbackCanceled                                             ErrorCodes.NotAReplicaSet
+ErrorCodes.CanRepairToDowngrade                                         ErrorCodes.NotARetryableWriteCommand
+ErrorCodes.CannotApplyOplogWhilePrimary                                 ErrorCodes.NotExactValueField
+ErrorCodes.CannotBackfillArray                                          ErrorCodes.NotImplemented
+ErrorCodes.CannotBackup                                                 ErrorCodes.NotPrimaryNoSecondaryOk
+ErrorCodes.CannotBuildIndexKeys                                         ErrorCodes.NotPrimaryOrSecondary
+ErrorCodes.CannotConvertIndexToUnique                                   ErrorCodes.NotSecondary
+ErrorCodes.CannotCreateCollection                                       ErrorCodes.NotSingleValueField
+ErrorCodes.CannotCreateIndex                                            ErrorCodes.NotWritablePrimary
+ErrorCodes.CannotDowngrade                                              ErrorCodes.NotYetInitialized
+ErrorCodes.CannotDropShardKeyIndex                                      ErrorCodes.OBSOLETE_BalancerLostDistributedLock
+```
+
+`ErrorCodeStrings` is an object with the reverse mapping of the above.
+
+```js
+> ErrorCodeStrings[0]
+OK
+> ErrorCodeStrings[2]
+BadValue
+> ErrorCodeStrings[66]
+ImmutableField
+```