########################################
# Evergreen Template for MongoDB Drivers
########################################

# When a task that used to pass starts to fail
# Go through all versions that may have been skipped to detect
# when the task started failing
stepback: true

# Mark a failure as a system/bootstrap failure (purple box) rather then a task
# failure by default.
# Actual testing tasks are marked with `type: test`
command_type: setup

# Fail builds when pre tasks fail.
pre_error_fails_task: true

# Protect the CI from long or indefinite runtimes.
exec_timeout_secs: 3600

# What to do when evergreen hits the timeout (`post:` tasks are run automatically)
timeout:
  - command: shell.exec
    params:
      shell: "bash"
      script: |
        ls -la
functions:
  assume-test-secrets-ec2-role:
    - command: ec2.assume_role
      params:
        role_arn: ${aws_test_secrets_role}

  fetch-source:
    # Executes clone and applies the submitted patch, if any
    - command: git.get_project
      type: system
      params:
        directory: src/go.mongodb.org/mongo-driver
    # Make an evergreen expansion file with dynamic values
    - command: shell.exec
      params:
        shell: "bash"
        working_dir: src/go.mongodb.org/mongo-driver
        script: |
          set -o errexit

          # Get the current unique version of this checkout.
          if [ "${is_patch}" = "true" ]; then
             CURRENT_VERSION=$(git describe)-patch-${version_id}
          else
             CURRENT_VERSION=latest
          fi

          # Set Golang environment vars. GOROOT is wherever current Go distribution is; GOPATH is always 3
          # directories up from pwd; GOCACHE is under .cache in the pwd.
          export GOROOT="${GO_DIST}"
          export GOPATH="$(dirname $(dirname $(dirname `pwd`)))"
          export GOCACHE="$(pwd)/.cache"

          # Set other relevant variables for Evergreen processes.
          export DRIVERS_TOOLS="$(dirname $(dirname $(dirname `pwd`)))/drivers-tools"
          export PROJECT_DIRECTORY="$(pwd)"
          export MONGO_ORCHESTRATION_HOME="$DRIVERS_TOOLS/.evergreen/orchestration"
          export MONGODB_BINARIES="$DRIVERS_TOOLS/mongodb/bin"
          export UPLOAD_BUCKET="${project}"
          export PROJECT="${project}"

          # If on Windows, convert paths with cygpath. GOROOT should not be converted as Windows expects it
          # to be separated with '\'.
          if [ "Windows_NT" = "$OS" ]; then
             export GOPATH=$(cygpath -m $GOPATH)
             export GOCACHE=$(cygpath -m $GOCACHE)
             export DRIVERS_TOOLS=$(cygpath -m $DRIVERS_TOOLS)
             export PROJECT_DIRECTORY=$(cygpath -m $PROJECT_DIRECTORY)
             export MONGO_ORCHESTRATION_HOME=$(cygpath -m $MONGO_ORCHESTRATION_HOME)
             export MONGODB_BINARIES=$(cygpath -m $MONGODB_BINARIES)
             export UPLOAD_BUCKET=$(cygpath -m $UPLOAD_BUCKET)
             export PROJECT=$(cygpath -m $PROJECT)

             # Set home variables for Windows, too.
             export USERPROFILE=$(cygpath -w $(dirname $(dirname $(dirname `pwd`))))
             export HOME=$USERPROFILE
          fi

          # Set actual PATH. PATH should contain binaries from GOROOT, GOPATH, GCC_PATH and mongodb.
          export GOROOTBIN="$GOROOT/bin"
          export GOPATHBIN="$GOPATH/bin"
          if [ "Windows_NT" = "$OS" ]; then
             # Convert all Windows-style paths (e.g. C:/) to Bash-style Cygwin paths
             # (e.g. /cygdrive/c/...) because PATH is interpreted by Bash, which uses ":" as a
             # separator so doesn't support Windows-style paths. Other scripts or binaries that
             # aren't part of Cygwin still need the environment variables to use Windows-style
             # paths, so only convert them when setting PATH. Note that GCC_PATH is already a
             # Bash-style Cygwin path for all Windows tasks.
             export PATH="$(cygpath $GOROOTBIN):$(cygpath $GOPATHBIN):${GCC_PATH}:$(cygpath $MONGODB_BINARIES):$PATH"
          else
             export PATH="$GOROOTBIN:$GOPATHBIN:${GCC_PATH}:$MONGODB_BINARIES:$PATH"
          fi

          # Check Go installation.
          go version
          go env

          # Install libmongocrypt.
          bash etc/install-libmongocrypt.sh
          if [ "Windows_NT" = "$OS" ]; then
            export PATH=$PATH:/cygdrive/c/libmongocrypt/bin
          fi

          cat <<EOT > expansion.yml
          CURRENT_VERSION: "$CURRENT_VERSION"
          DRIVERS_TOOLS: "$DRIVERS_TOOLS"
          MONGO_ORCHESTRATION_HOME: "$MONGO_ORCHESTRATION_HOME"
          MONGODB_BINARIES: "$MONGODB_BINARIES"
          UPLOAD_BUCKET: "$UPLOAD_BUCKET"
          PROJECT_DIRECTORY: "$PROJECT_DIRECTORY"
          PREPARE_SHELL: |
             set -o errexit
             export SKIP_LEGACY_SHELL=1
             export GOROOT="$GOROOT"
             export GOPATH="$GOPATH"
             export GOCACHE="$GOCACHE"
             export DRIVERS_TOOLS="$DRIVERS_TOOLS"
             export PROJECT_DIRECTORY="$PROJECT_DIRECTORY"
             export MONGO_ORCHESTRATION_HOME="$MONGO_ORCHESTRATION_HOME"
             export MONGODB_BINARIES="$MONGODB_BINARIES"
             export UPLOAD_BUCKET="$UPLOAD_BUCKET"
             export PROJECT="$PROJECT"
             export TMPDIR="$MONGO_ORCHESTRATION_HOME/db"
             export PKG_CONFIG_PATH=$(pwd)/install/libmongocrypt/lib64/pkgconfig
             export LD_LIBRARY_PATH=$(pwd)/install/libmongocrypt/lib64
             export PATH="$PATH"
          EOT
          # See what we variables we've set.
          cat expansion.yml
    # Load the expansion file to make an evergreen variable with the current unique version
    - command: expansions.update
      params:
        file: src/go.mongodb.org/mongo-driver/expansion.yml

  prepare-resources:
    - command: shell.exec
      params:
        shell: "bash"
        script: |
          ${PREPARE_SHELL}
          rm -rf $DRIVERS_TOOLS
          git clone https://github.com/mongodb-labs/drivers-evergreen-tools.git $DRIVERS_TOOLS

          # Pin drivers-evergreen-tools to revision 98f6b0e (Aug 20, 2025).
          # In leu of cutting a dedicated branch, please cherry-pick any required changes inline.
          # For example:
          #   git -C $DRIVERS_TOOLS checkout 98f6b0e
          #   git -C $DRIVERS_TOOLS cherry-pick <sha> # needed for <reason>
          git -C $DRIVERS_TOOLS checkout 98f6b0e

          echo "{ \"releases\": { \"default\": \"$MONGODB_BINARIES\" }}" > $MONGO_ORCHESTRATION_HOME/orchestration.config
    - command: shell.exec
      params:
        shell: "bash"
        working_dir: src/go.mongodb.org/mongo-driver
        script: |
          ${PREPARE_SHELL}

          # initialize submodules
          git submodule init
          git submodule update
    - command: shell.exec
      params:
        shell: "bash"
        working_dir: src/go.mongodb.org/mongo-driver
        script: |
          . ${DRIVERS_TOOLS}/.evergreen/venv-utils.sh
          . ${DRIVERS_TOOLS}/.evergreen/find-python3.sh

          export PYTHON3_BINARY="$(find_python3 2>/dev/null)"
          venvcreate "$PYTHON3_BINARY" venv

          echo "PYTHON3_BINARY: $PYTHON3_BINARY" >>expansion.yml
    # Load the expansion file to make an evergreen variable with the current unique version
    - command: expansions.update
      params:
        file: src/go.mongodb.org/mongo-driver/expansion.yml

  handle-test-artifacts:
    - command: gotest.parse_files
      params:
        files:
          - "src/go.mongodb.org/mongo-driver/*.suite"
    - command: shell.exec
      params:
        shell: "bash"
        script: |
          ${PREPARE_SHELL}
          find $MONGO_ORCHESTRATION_HOME -name \*.log | xargs tar czf mongodb-logs.tar.gz
    - command: ec2.assume_role
      params:
        role_arn: ${assume_role_arn}
    - command: s3.put
      params:
        aws_key: ${AWS_ACCESS_KEY_ID}
        aws_secret: ${AWS_SECRET_ACCESS_KEY}
        aws_session_token: ${AWS_SESSION_TOKEN}
        local_file: mongodb-logs.tar.gz
        remote_file: ${build_variant}/${revision}/${version_id}/${build_id}/logs/${task_id}-${execution}-mongodb-logs.tar.gz
        bucket: ${aws_bucket}
        permissions: public-read
        content_type: ${content_type|application/x-gzip}
        display_name: "mongodb-logs.tar.gz"
    - command: s3.put
      params:
        aws_key: ${AWS_ACCESS_KEY_ID}
        aws_secret: ${AWS_SECRET_ACCESS_KEY}
        aws_session_token: ${AWS_SESSION_TOKEN}
        optional: true
        local_file: ${PROJECT_DIRECTORY}/fuzz.tgz
        remote_file: ${build_variant}/${revision}/${version_id}/${build_id}/${task_id}-${execution}-fuzz.tgz
        bucket: ${aws_bucket}
        permissions: public-read
        content_type: application/x-gzip
        display_name: "fuzz.tgz"
    - command: shell.exec
      params:
        shell: "bash"
        working_dir: src/go.mongodb.org/mongo-driver
        script: |
          ${PREPARE_SHELL}
          find . -name \*.suite | xargs tar czf test_suite.tgz
    - command: s3.put
      params:
        aws_key: ${AWS_ACCESS_KEY_ID}
        aws_secret: ${AWS_SECRET_ACCESS_KEY}
        aws_session_token: ${AWS_SESSION_TOKEN}
        local_file: src/go.mongodb.org/mongo-driver/test_suite.tgz
        optional: true
        remote_file: ${build_variant}/${revision}/${version_id}/${build_id}/logs/${task_id}-${execution}-test_suite.tgz
        bucket: ${aws_bucket}
        permissions: public-read
        content_type: ${content_type|text/plain}
        display_name: "test_suite.tgz"

  bootstrap-mongohoused:
    - command: ec2.assume_role
      params:
        role_arn: ${aws_test_secrets_role}
    - command: subprocess.exec
      params:
        binary: "bash"
        add_expansions_to_env: true
        args: 
          - ${DRIVERS_TOOLS}/.evergreen/atlas_data_lake/pull-mongohouse-image.sh
    - command: subprocess.exec
      params:
        binary: "bash"
        args: 
          - ${DRIVERS_TOOLS}/.evergreen/atlas_data_lake/run-mongohouse-image.sh

  bootstrap-mongo-orchestration:
    - command: shell.exec
      params:
        shell: "bash"
        script: |
          set -x
          ${PREPARE_SHELL}

          MONGODB_VERSION=${VERSION} \
          TOPOLOGY=${TOPOLOGY} \
          AUTH=${AUTH} \
          SSL=${SSL} \
          ORCHESTRATION_FILE=${ORCHESTRATION_FILE} \
          REQUIRE_API_VERSION=${REQUIRE_API_VERSION} \
          LOAD_BALANCER=${LOAD_BALANCER} \
          bash ${DRIVERS_TOOLS}/.evergreen/run-orchestration.sh
    - command: expansions.update
      params:
        file: mo-expansion.yml

  ocsp-bootstrap-mongo-orchestration:
    - command: shell.exec
      params:
        shell: "bash"
        script: |
          ${PREPARE_SHELL}

          MONGODB_VERSION=${VERSION} \
          TOPOLOGY=${TOPOLOGY} \
          AUTH=${AUTH} \
          SSL=${SSL} \
          ORCHESTRATION_FILE=${ORCHESTRATION_FILE} \
          bash ${DRIVERS_TOOLS}/.evergreen/run-orchestration.sh
    - command: expansions.update
      params:
        file: mo-expansion.yml

  cleanup:
    - command: shell.exec
      params:
        shell: "bash"
        script: |
          # Ensure the instance profile is reassigned for aws tests.
          cd "${DRIVERS_TOOLS}/.evergreen/auth_aws"
          if [ -f "./aws_e2e_setup.json" ]; then
            . ./activate-authawsvenv.sh
            python ./lib/aws_assign_instance_profile.py
          fi
    - command: shell.exec
      params:
        shell: "bash"
        script: |
          # Attempt to shut down a running load balancer. Ignore any errors that happen if the load
          # balancer is not running.
          DRIVERS_TOOLS=${DRIVERS_TOOLS} MONGODB_URI=${MONGODB_URI} bash ${DRIVERS_TOOLS}/.evergreen/run-load-balancer.sh stop || echo "Ignoring load balancer stop error"
    - command: shell.exec
      params:
        shell: "bash"
        script: |
          ${PREPARE_SHELL}
          # Clean up cse servers
          bash ${DRIVERS_TOOLS}/.evergreen/csfle/stop-servers.sh
    - command: shell.exec
      params:
        shell: "bash"
        script: |
          ${PREPARE_SHELL}
          # Stop orchestration and remove drivers tools.
          bash ${DRIVERS_TOOLS}/.evergreen/stop-orchestration.sh
          cd -
          rm -rf $DRIVERS_TOOLS || true


  fix-absolute-paths:
    - command: shell.exec
      params:
        shell: "bash"
        script: |
          ${PREPARE_SHELL}
          for filename in $(find ${DRIVERS_TOOLS} -name \*.json); do
            perl -p -i -e "s|ABSOLUTE_PATH_REPLACEMENT_TOKEN|${DRIVERS_TOOLS}|g" $filename
          done

  windows-fix:
    - command: shell.exec
      params:
        shell: "bash"
        script: |
          ${PREPARE_SHELL}
          for i in $(find ${DRIVERS_TOOLS}/.evergreen ${PROJECT_DIRECTORY} -name \*.sh); do
            cat $i | tr -d '\r' > $i.new
            mv $i.new $i
          done
          # Copy client certificate because symlinks do not work on Windows. Ignore any copy errors.
          cp ${DRIVERS_TOOLS}/.evergreen/x509gen/client.pem ${MONGO_ORCHESTRATION_HOME}/lib/client.pem || echo "Ignoring copy error"

  make-files-executable:
    - command: shell.exec
      params:
        shell: "bash"
        script: |
          ${PREPARE_SHELL}
          for i in $(find ${DRIVERS_TOOLS}/.evergreen ${PROJECT_DIRECTORY} -name \*.sh); do
            chmod +x $i
          done

  assume-ec2-role:
    - command: ec2.assume_role
      params:
        role_arn: ${aws_test_secrets_role}

  run-oidc-auth-test-with-test-credentials:
    - command: shell.exec
      type: test
      params:
        working_dir: src/go.mongodb.org/mongo-driver
        shell: bash
        include_expansions_in_env: ["DRIVERS_TOOLS", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN"]
        script: |
          ${PREPARE_SHELL}
          export OIDC="oidc"
          bash ${PROJECT_DIRECTORY}/etc/run-oidc-test.sh 'make -s evg-test-oidc-auth'

  run-make:
    - command: shell.exec
      type: test
      params:
        shell: "bash"
        working_dir: src/go.mongodb.org/mongo-driver
        script: |
          ${PREPARE_SHELL}
          ${BUILD_ENV|} BUILD_TAGS=${BUILD_TAGS|-tags=cse,gssapi,mongointernal} make ${targets}

  run-tests:
    - command: shell.exec
      type: test
      params:
        shell: "bash"
        working_dir: src/go.mongodb.org/mongo-driver
        include_expansions_in_env: ["TOPOLOGY", "AUTH", "SSL", "SKIP_CSOT_TESTS", "MONGODB_URI", "CRYPT_SHARED_LIB_PATH", "SKIP_CRYPT_SHARED_LIB", "RACE", "MONGO_GO_DRIVER_COMPRESSOR", "REQUIRE_API_VERSION", "LOAD_BALANCER"]
        script: |
          ${PREPARE_SHELL}
          bash ${PROJECT_DIRECTORY}/.evergreen/run-tests.sh

  create-api-report:
    - command: shell.exec
      type: test
      params:
        shell: "bash"
        working_dir: src/go.mongodb.org/mongo-driver
        add_expansions_to_env: true
        script: |
          ${PREPARE_SHELL}
          export BASE_SHA=${revision}
          export HEAD_SHA=${github_commit}
          bash etc/api_report.sh

  "backport pr":
    - command: subprocess.exec
      type: test
      params:
        binary: bash
        args:
          - ${DRIVERS_TOOLS}/.evergreen/github_app/backport-pr.sh 
          - mongodb 
          - mongo-go-driver 
          - ${github_commit}

  send-perf-data:
    - command: perf.send
      params:
        file: src/go.mongodb.org/mongo-driver/perf.json

  run-enterprise-auth-tests:
    - command: ec2.assume_role
      params:
        role_arn: "${aws_test_secrets_role}"
    - command: shell.exec
      type: test
      params:
        shell: "bash"
        working_dir: src/go.mongodb.org/mongo-driver
        include_expansions_in_env: ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN"]
        script: |
          ${PREPARE_SHELL}
          bash ./etc/run-enterprise-plain-test.sh

  run-enterprise-gssapi-auth-tests:
    - command: ec2.assume_role
      params:
        role_arn: "${aws_test_secrets_role}"
    - command: shell.exec
      type: test
      params:
        shell: "bash"
        working_dir: src/go.mongodb.org/mongo-driver
        include_expansions_in_env: ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN"]
        script: |
          ${PREPARE_SHELL}
          bash ./etc/run-enterprise-gssapi-test.sh

  run-atlas-test:
    - command: ec2.assume_role
      params:
        role_arn: "${aws_test_secrets_role}"
    - command: shell.exec
      type: test
      params:
        shell: "bash"
        working_dir: src/go.mongodb.org/mongo-driver
        include_expansions_in_env: ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN"]
        script: |
          ${PREPARE_SHELL}
          bash etc/run-atlas-test.sh

  run-ocsp-test:
    - command: shell.exec
      type: test
      params:
        shell: "bash"
        working_dir: src/go.mongodb.org/mongo-driver
        script: |
          ${PREPARE_SHELL}
          export MONGO_GO_DRIVER_CA_FILE="$DRIVERS_TOOLS/.evergreen/ocsp/${OCSP_ALGORITHM}/ca.pem"
          if [ "Windows_NT" = "$OS" ]; then # Magic variable in cygwin
            export MONGO_GO_DRIVER_CA_FILE=$(cygpath -m $MONGO_GO_DRIVER_CA_FILE)
          fi

          AUTH="auth" \
          SSL="ssl" \
          TOPOLOGY="server" \
          MONGODB_URI="${MONGODB_URI}" \
          OCSP_TLS_SHOULD_SUCCEED="${OCSP_TLS_SHOULD_SUCCEED}" \
          make evg-test-ocsp

  run-versioned-api-test:
    - command: shell.exec
      type: test
      params:
        shell: "bash"
        working_dir: src/go.mongodb.org/mongo-driver
        script: |
          ${PREPARE_SHELL}
          source ./secrets-export.sh

          if [ "${SKIP_CRYPT_SHARED_LIB}" = "true" ]; then
            CRYPT_SHARED_LIB_PATH=""
            echo "crypt_shared library is skipped"
          elif [ -z "${CRYPT_SHARED_LIB_PATH}" ]; then
            echo "crypt_shared library path is empty"
          else
            CRYPT_SHARED_LIB_PATH=${CRYPT_SHARED_LIB_PATH}
            echo "crypt_shared library will be loaded from path: $CRYPT_SHARED_LIB_PATH"
          fi

          export GOFLAGS=-mod=vendor
          AUTH="${AUTH}" \
          SSL="${SSL}" \
          MONGODB_URI="${MONGODB_URI}" \
          TOPOLOGY="${TOPOLOGY}" \
          MONGO_GO_DRIVER_COMPRESSOR=${MONGO_GO_DRIVER_COMPRESSOR} \
          BUILD_TAGS="-tags=cse" \
          REQUIRE_API_VERSION="${REQUIRE_API_VERSION}" \
          CRYPT_SHARED_LIB_PATH="$CRYPT_SHARED_LIB_PATH" \
          make evg-test-versioned-api \
          PKG_CONFIG_PATH=$PKG_CONFIG_PATH \
          LD_LIBRARY_PATH=$LD_LIBRARY_PATH

  run-load-balancer-tests:
    - command: shell.exec
      type: test
      params:
        shell: "bash"
        working_dir: src/go.mongodb.org/mongo-driver
        script: |
          ${PREPARE_SHELL}

          if [ ${SSL} = "ssl" ]; then
              export MONGO_GO_DRIVER_CA_FILE="$DRIVERS_TOOLS/.evergreen/x509gen/ca.pem"
              export MONGO_GO_DRIVER_KEY_FILE="$DRIVERS_TOOLS/.evergreen/x509gen/client.pem"
              export MONGO_GO_DRIVER_PKCS8_ENCRYPTED_KEY_FILE="$DRIVERS_TOOLS/.evergreen/x509gen/client-pkcs8-encrypted.pem"
              export MONGO_GO_DRIVER_PKCS8_UNENCRYPTED_KEY_FILE="$DRIVERS_TOOLS/.evergreen/x509gen/client-pkcs8-unencrypted.pem"
              if [ "Windows_NT" = "$OS" ]; then # Magic variable in cygwin
                  export MONGO_GO_DRIVER_CA_FILE=$(cygpath -m $MONGO_GO_DRIVER_CA_FILE)
                  export MONGO_GO_DRIVER_KEY_FILE=$(cygpath -m $MONGO_GO_DRIVER_KEY_FILE)
                  export MONGO_GO_DRIVER_PKCS8_ENCRYPTED_KEY_FILE=$(cygpath -m $MONGO_GO_DRIVER_PKCS8_ENCRYPTED_KEY_FILE)
                  export MONGO_GO_DRIVER_PKCS8_UNENCRYPTED_KEY_FILE=$(cygpath -m $MONGO_GO_DRIVER_PKCS8_UNENCRYPTED_KEY_FILE)
              fi
          fi

          # Verify that the required LB URI expansions are set to ensure that the test runner can correctly connect to
          # the LBs.
          if [ -z "${SINGLE_MONGOS_LB_URI}" ]; then
            echo "SINGLE_MONGOS_LB_URI must be set for testing against LBs"
            exit 1
          fi
          if [ -z "${MULTI_MONGOS_LB_URI}" ]; then
            echo "MULTI_MONGOS_LB_URI must be set for testing against LBs"
            exit 1
          fi

          # Per the LB testing spec, the URI of an LB fronting a single mongos should be used to configure internal
          # testing Client instances, so we set MONGODB_URI to SINGLE_MONGOS_LB_URI.
          export GOFLAGS=-mod=vendor
          AUTH="${AUTH}" \
          SSL="${SSL}" \
          MONGODB_URI="${SINGLE_MONGOS_LB_URI}" \
          SINGLE_MONGOS_LB_URI="${SINGLE_MONGOS_LB_URI}" \
          MULTI_MONGOS_LB_URI="${MULTI_MONGOS_LB_URI}" \
          TOPOLOGY="${TOPOLOGY}" \
          MONGO_GO_DRIVER_COMPRESSOR=${MONGO_GO_DRIVER_COMPRESSOR} \
          make evg-test-load-balancers

  run-atlas-data-lake-test:
    - command: shell.exec
      type: test
      params:
        shell: "bash"
        working_dir: src/go.mongodb.org/mongo-driver
        script: |
          ${PREPARE_SHELL}
          AUTH="auth" \
          SSL="nossl" \
          TOPOLOGY="server" \
          MONGODB_URI="mongodb://mhuser:pencil@localhost" \
          make evg-test-atlas-data-lake

  run-docker-test:
    - command: shell.exec
      type: test
      params:
        shell: "bash"
        working_dir: src/go.mongodb.org/mongo-driver
        script: |
          ${PREPARE_SHELL}
          bash etc/run_docker.sh
          TOPOLOGY=sharded_cluster bash etc/run_docker.sh test-short

  run-goleak-test:
    - command: shell.exec
      type: test
      params:
        shell: "bash"
        working_dir: src/go.mongodb.org/mongo-driver
        include_expansions_in_env: ["MONGODB_URI"]
        script: |
          ${PREPARE_SHELL}
          bash etc/run-goleak-test.sh

  run-valid-ocsp-server:
    - command: shell.exec
      params:
        shell: "bash"
        background: true
        script: |
          cd ${DRIVERS_TOOLS}/.evergreen/ocsp
          . ./activate-ocspvenv.sh

          python ocsp_mock.py \
          --ca_file ${OCSP_ALGORITHM}/ca.pem \
          --ocsp_responder_cert ${OCSP_ALGORITHM}/ca.crt \
          --ocsp_responder_key ${OCSP_ALGORITHM}/ca.key \
          -p 8100 -v

  run-revoked-ocsp-server:
    - command: shell.exec
      params:
        shell: "bash"
        background: true
        script: |
          cd ${DRIVERS_TOOLS}/.evergreen/ocsp
          . ./activate-ocspvenv.sh

          python ocsp_mock.py \
          --ca_file ${OCSP_ALGORITHM}/ca.pem \
          --ocsp_responder_cert ${OCSP_ALGORITHM}/ca.crt \
          --ocsp_responder_key ${OCSP_ALGORITHM}/ca.key \
          -p 8100 \
          -v \
          --fault revoked

  run-valid-delegate-ocsp-server:
    - command: shell.exec
      params:
        shell: "bash"
        background: true
        script: |
          cd ${DRIVERS_TOOLS}/.evergreen/ocsp
          . ./activate-ocspvenv.sh

          python ocsp_mock.py \
          --ca_file ${OCSP_ALGORITHM}/ca.pem \
          --ocsp_responder_cert ${OCSP_ALGORITHM}/ocsp-responder.crt \
          --ocsp_responder_key ${OCSP_ALGORITHM}/ocsp-responder.key \
          -p 8100 -v

  run-revoked-delegate-ocsp-server:
    - command: shell.exec
      params:
        shell: "bash"
        background: true
        script: |
          cd ${DRIVERS_TOOLS}/.evergreen/ocsp
          . ./activate-ocspvenv.sh

          python ocsp_mock.py \
          --ca_file ${OCSP_ALGORITHM}/ca.pem \
          --ocsp_responder_cert ${OCSP_ALGORITHM}/ocsp-responder.crt \
          --ocsp_responder_key ${OCSP_ALGORITHM}/ocsp-responder.key \
          -p 8100 \
          -v \
          --fault revoked

  run-load-balancer:
    - command: shell.exec
      params:
        shell: "bash"
        script: |
          DRIVERS_TOOLS=${DRIVERS_TOOLS} MONGODB_URI=${MONGODB_URI} bash ${DRIVERS_TOOLS}/.evergreen/run-load-balancer.sh start
    - command: expansions.update
      params:
        file: lb-expansion.yml

  run-search-index-tests:
    - command: shell.exec
      type: test
      params:
        shell: "bash"
        working_dir: src/go.mongodb.org/mongo-driver
        script: |
          ${PREPARE_SHELL}
          TEST_INDEX_URI="${TEST_INDEX_URI}" \
          make evg-test-search-index

  add-aws-auth-variables-to-file:
    - command: ec2.assume_role
      params:
        role_arn: ${aws_test_secrets_role}
    - command: subprocess.exec
      type: test
      params:
        include_expansions_in_env: ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN"]
        binary: "bash"
        args: 
          - ${DRIVERS_TOOLS}/.evergreen/auth_aws/setup-secrets.sh

  run-aws-auth-test-with-regular-aws-credentials:
    - command: shell.exec
      type: test
      params:
        shell: "bash"
        working_dir: "src"
        script: |
          ${PREPARE_SHELL}
          ${PROJECT_DIRECTORY}/.evergreen/run-mongodb-aws-test.sh regular

  run-aws-auth-test-with-assume-role-credentials:
    - command: shell.exec
      type: test
      params:
        shell: "bash"
        working_dir: "src"
        script: |
          ${PREPARE_SHELL}
          ${PROJECT_DIRECTORY}/.evergreen/run-mongodb-aws-test.sh assume-role

  run-aws-auth-test-with-aws-EC2-credentials:
    - command: shell.exec
      type: test
      params:
        shell: "bash"
        working_dir: "src"
        script: |
          ${PREPARE_SHELL}
          if [ "${SKIP_EC2_AUTH_TEST}" = "true" ]; then
            echo "This platform does not support the EC2 auth test, skipping..."
            exit 0
          fi
          ${PROJECT_DIRECTORY}/.evergreen/run-mongodb-aws-test.sh ec2

  run-aws-auth-test-with-aws-credentials-as-environment-variables:
    - command: shell.exec
      type: test
      params:
        shell: "bash"
        working_dir: "src"
        script: |
          ${PREPARE_SHELL}
          ${PROJECT_DIRECTORY}/.evergreen/run-mongodb-aws-test.sh env-creds

  run-aws-auth-test-with-aws-credentials-and-session-token-as-environment-variables:
    - command: shell.exec
      type: test
      params:
        shell: "bash"
        working_dir: "src"
        script: |
          ${PREPARE_SHELL}
          ${PROJECT_DIRECTORY}/.evergreen/run-mongodb-aws-test.sh session-creds

  run-aws-ECS-auth-test:
    - command: shell.exec
      type: test
      params:
        shell: "bash"
        working_dir: src/go.mongodb.org/mongo-driver
        script: |
          ${PREPARE_SHELL}
          if [ "${SKIP_ECS_AUTH_TEST}" = "true" ]; then
            echo "This platform does not support the ECS auth test, skipping..."
            exit 0
          fi
          make build-aws-ecs-test
    - command: shell.exec
      type: test
      params:
        shell: "bash"
        working_dir: "src"
        script: |
          ${PREPARE_SHELL}
          if [ "${SKIP_ECS_AUTH_TEST}" = "true" ]; then
            exit 0
          fi
          AUTH_AWS_DIR=${DRIVERS_TOOLS}/.evergreen/auth_aws
          ECS_SRC_DIR=$AUTH_AWS_DIR/src
          # pack up project directory to ssh it to the container
          mkdir -p $ECS_SRC_DIR/.evergreen
          cp ${PROJECT_DIRECTORY}/main $ECS_SRC_DIR
          cp ${PROJECT_DIRECTORY}/.evergreen/run-mongodb-aws-ecs-test.sh $ECS_SRC_DIR/.evergreen
          tar -czf $ECS_SRC_DIR/src.tgz -C $PROJECT_DIRECTORY .

          export PROJECT_DIRECTORY="$ECS_SRC_DIR"
          $AUTH_AWS_DIR/aws_setup.sh ecs

  run-aws-auth-test-with-aws-web-identity-credentials:
    - command: shell.exec
      type: test
      params:
        shell: "bash"
        working_dir: "src"
        script: |
          ${PREPARE_SHELL}
          if [ "${SKIP_WEB_IDENTITY_AUTH_TEST}" = "true" ]; then
             echo "This platform does not support the web identity auth test, skipping..."
             exit 0
          fi
          ${PROJECT_DIRECTORY}/.evergreen/run-mongodb-aws-test.sh web-identity
    - command: shell.exec
      type: test
      params:
        shell: "bash"
        working_dir: "src"
        script: |
          ${PREPARE_SHELL}
          if [ "${SKIP_WEB_IDENTITY_AUTH_TEST}" = "true" ]; then
             echo "This platform does not support the web identity auth test, skipping..."
             exit 0
          fi
          export AWS_ROLE_SESSION_NAME="test"
          ${PROJECT_DIRECTORY}/.evergreen/run-mongodb-aws-test.sh web-identity

  start-cse-servers:
    - command: ec2.assume_role
      params:
        role_arn: ${aws_test_secrets_role}
    - command: subprocess.exec
      params:
        working_dir: src/go.mongodb.org/mongo-driver
        binary: bash
        background: true
        include_expansions_in_env: ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "DRIVERS_TOOLS"]
        args:
          - etc/setup-encryption.sh
    - command: subprocess.exec
      params:
        working_dir: src/go.mongodb.org/mongo-driver
        binary: bash
        args:
          - ${DRIVERS_TOOLS}/.evergreen/csfle/await-servers.sh

  run-kms-tls-test:
    - command: shell.exec
      type: test
      params:
        shell: "bash"
        working_dir: src/go.mongodb.org/mongo-driver
        script: |
          ${PREPARE_SHELL}
          source ./secrets-export.sh
          export KMS_TLS_TESTCASE="${KMS_TLS_TESTCASE}"

          export GOFLAGS=-mod=vendor
          AUTH="${AUTH}" \
          SSL="${SSL}" \
          MONGODB_URI="${MONGODB_URI}" \
          TOPOLOGY="${TOPOLOGY}" \
          MONGO_GO_DRIVER_COMPRESSOR=${MONGO_GO_DRIVER_COMPRESSOR} \
          BUILD_TAGS="-tags=cse" \
          make evg-test-kms \
          PKG_CONFIG_PATH=$PKG_CONFIG_PATH \
          LD_LIBRARY_PATH=$LD_LIBRARY_PATH

  run-kmip-tests:
    - command: shell.exec
      type: test
      params:
        shell: "bash"
        working_dir: src/go.mongodb.org/mongo-driver
        script: |
          ${PREPARE_SHELL}
          source ./secrets-export.sh
          export KMS_MOCK_SERVERS_RUNNING="true"

          export GOFLAGS=-mod=vendor
          AUTH="${AUTH}" \
          SSL="${SSL}" \
          MONGODB_URI="${MONGODB_URI}" \
          TOPOLOGY="${TOPOLOGY}" \
          MONGO_GO_DRIVER_COMPRESSOR=${MONGO_GO_DRIVER_COMPRESSOR} \
          BUILD_TAGS="-tags=cse" \
          make evg-test-kmip \
          PKG_CONFIG_PATH=$PKG_CONFIG_PATH \
          LD_LIBRARY_PATH=$LD_LIBRARY_PATH

  run-fuzz-tests:
    - command: shell.exec
      type: test
      params:
        shell: "bash"
        working_dir: "src"
        script: |
          ${PREPARE_SHELL}
          ${PROJECT_DIRECTORY}/.evergreen/run-fuzz.sh

pre:
  - func: fetch-source
  - func: prepare-resources
  - func: windows-fix
  - func: fix-absolute-paths
  - func: make-files-executable

post:
  - func: handle-test-artifacts
  - func: cleanup

tasks:
  - name: static-analysis
    tags: ["static-analysis"]
    commands:
      - func: run-make
        vars:
          targets: "check-fmt check-license check-modules lint"

  - name: pull-request-helpers
    allowed_requesters: ["patch", "github_pr"]
    commands:
      - func: assume-test-secrets-ec2-role
      - func: "create-api-report"

  - name: backport-pr
    allowed_requesters: ["commit"]
    commands:
      - func: "backport pr"  

  - name: perf
    tags: ["performance"]
    exec_timeout_secs: 7200
    commands:
      - func: bootstrap-mongo-orchestration
        vars:
          TOPOLOGY: "server"
          AUTH: "noauth"
          SSL: "nossl"
      - func: run-make
        vars:
          targets: driver-benchmark
      - func: send-perf-data

  - name: test-standalone-noauth-nossl
    tags: ["test", "standalone"]
    commands:
      - func: bootstrap-mongo-orchestration
        vars:
          TOPOLOGY: "server"
          AUTH: "noauth"
          SSL: "nossl"
      - func: start-cse-servers
      - func: run-tests
        vars:
          TOPOLOGY: "server"
          AUTH: "noauth"
          SSL: "nossl"

  - name: test-standalone-noauth-nossl-snappy-compression
    tags: ["test", "standalone", "compression", "snappy"]
    commands:
      - func: bootstrap-mongo-orchestration
        vars:
          TOPOLOGY: "server"
          AUTH: "noauth"
          SSL: "nossl"
      - func: start-cse-servers
      - func: run-tests
        vars:
          TOPOLOGY: "server"
          AUTH: "noauth"
          SSL: "nossl"
          MONGO_GO_DRIVER_COMPRESSOR: "snappy"

  - name: test-standalone-noauth-nossl-zlib-compression
    tags: ["test", "standalone", "compression", "zlib"]
    commands:
      - func: bootstrap-mongo-orchestration
        vars:
          TOPOLOGY: "server"
          AUTH: "noauth"
          SSL: "nossl"
      - func: start-cse-servers
      - func: run-tests
        vars:
          TOPOLOGY: "server"
          AUTH: "noauth"
          SSL: "nossl"
          MONGO_GO_DRIVER_COMPRESSOR: "zlib"

  - name: test-standalone-noauth-nossl-zstd-compression
    tags: ["test", "standalone", "compression", "zstd"]
    commands:
      - func: bootstrap-mongo-orchestration
        vars:
          TOPOLOGY: "server"
          AUTH: "noauth"
          SSL: "nossl"
      - func: start-cse-servers
      - func: run-tests
        vars:
          TOPOLOGY: "server"
          AUTH: "noauth"
          SSL: "nossl"
          MONGO_GO_DRIVER_COMPRESSOR: "zstd"

  - name: test-standalone-auth-ssl
    tags: ["test", "standalone", "authssl"]
    commands:
      - func: bootstrap-mongo-orchestration
        vars:
          TOPOLOGY: "server"
          AUTH: "auth"
          SSL: "ssl"
      - func: start-cse-servers
      - func: run-tests
        vars:
          TOPOLOGY: "server"
          AUTH: "auth"
          SSL: "ssl"

  - name: test-standalone-auth-nossl
    tags: ["test", "standalone", "authssl"]
    commands:
      - func: bootstrap-mongo-orchestration
        vars:
          TOPOLOGY: "server"
          AUTH: "auth"
          SSL: "nossl"
      - func: start-cse-servers
      - func: run-tests
        vars:
          TOPOLOGY: "server"
          AUTH: "auth"
          SSL: "nossl"

  - name: test-standalone-auth-ssl-snappy-compression
    tags: ["test", "standalone", "authssl", "compression", "snappy"]
    commands:
      - func: bootstrap-mongo-orchestration
        vars:
          TOPOLOGY: "server"
          AUTH: "auth"
          SSL: "ssl"
      - func: start-cse-servers
      - func: run-tests
        vars:
          TOPOLOGY: "server"
          AUTH: "auth"
          SSL: "ssl"
          MONGO_GO_DRIVER_COMPRESSOR: "snappy"

  - name: test-standalone-auth-ssl-zlib-compression
    tags: ["test", "standalone", "authssl", "compression", "zlib"]
    commands:
      - func: bootstrap-mongo-orchestration
        vars:
          TOPOLOGY: "server"
          AUTH: "auth"
          SSL: "ssl"
      - func: start-cse-servers
      - func: run-tests
        vars:
          TOPOLOGY: "server"
          AUTH: "auth"
          SSL: "ssl"
          MONGO_GO_DRIVER_COMPRESSOR: "zlib"

  - name: test-standalone-auth-ssl-zstd-compression
    tags: ["test", "standalone", "authssl", "compression", "zstd"]
    commands:
      - func: bootstrap-mongo-orchestration
        vars:
          TOPOLOGY: "server"
          AUTH: "auth"
          SSL: "ssl"
      - func: start-cse-servers
      - func: run-tests
        vars:
          TOPOLOGY: "server"
          AUTH: "auth"
          SSL: "ssl"
          MONGO_GO_DRIVER_COMPRESSOR: "zstd"

  - name: test-ocsp-rsa-valid-cert-server-staples
    tags: ["ocsp", "ocsp-rsa", "ocsp-staple"]
    commands:
      - func: run-valid-ocsp-server
        vars:
          OCSP_ALGORITHM: "rsa"
      - func: ocsp-bootstrap-mongo-orchestration
        vars:
          ORCHESTRATION_FILE: "rsa-basic-tls-ocsp-mustStaple.json"
      - func: run-ocsp-test
        vars:
          OCSP_ALGORITHM: "rsa"
          OCSP_TLS_SHOULD_SUCCEED: "true"

  - name: test-ocsp-rsa-invalid-cert-server-staples
    tags: ["ocsp", "ocsp-rsa", "ocsp-staple"]
    commands:
      - func: run-revoked-ocsp-server
        vars:
          OCSP_ALGORITHM: "rsa"
      - func: ocsp-bootstrap-mongo-orchestration
        vars:
          ORCHESTRATION_FILE: "rsa-basic-tls-ocsp-mustStaple.json"
      - func: run-ocsp-test
        vars:
          OCSP_ALGORITHM: "rsa"
          OCSP_TLS_SHOULD_SUCCEED: "false"

  - name: test-ocsp-rsa-valid-cert-server-does-not-staple
    tags: ["ocsp", "ocsp-rsa"]
    commands:
      - func: run-valid-ocsp-server
        vars:
          OCSP_ALGORITHM: "rsa"
      - func: ocsp-bootstrap-mongo-orchestration
        vars:
          ORCHESTRATION_FILE: "rsa-basic-tls-ocsp-disableStapling.json"
      - func: run-ocsp-test
        vars:
          OCSP_ALGORITHM: "rsa"
          OCSP_TLS_SHOULD_SUCCEED: "true"

  - name: test-ocsp-rsa-invalid-cert-server-does-not-staple
    tags: ["ocsp", "ocsp-rsa"]
    commands:
      - func: run-revoked-ocsp-server
        vars:
          OCSP_ALGORITHM: "rsa"
      - func: ocsp-bootstrap-mongo-orchestration
        vars:
          ORCHESTRATION_FILE: "rsa-basic-tls-ocsp-disableStapling.json"
      - func: run-ocsp-test
        vars:
          OCSP_ALGORITHM: "rsa"
          OCSP_TLS_SHOULD_SUCCEED: "false"

  - name: test-ocsp-rsa-soft-fail
    tags: ["ocsp", "ocsp-rsa"]
    commands:
      - func: ocsp-bootstrap-mongo-orchestration
        vars:
          ORCHESTRATION_FILE: "rsa-basic-tls-ocsp-disableStapling.json"
      - func: run-ocsp-test
        vars:
          OCSP_ALGORITHM: "rsa"
          OCSP_TLS_SHOULD_SUCCEED: "true"

  - name: test-ocsp-rsa-malicious-invalid-cert-mustStaple-server-does-not-staple
    tags: ["ocsp", "ocsp-rsa"]
    commands:
      - func: run-revoked-ocsp-server
        vars:
          OCSP_ALGORITHM: "rsa"
      - func: ocsp-bootstrap-mongo-orchestration
        vars:
          ORCHESTRATION_FILE: "rsa-basic-tls-ocsp-mustStaple-disableStapling.json"
      - func: run-ocsp-test
        vars:
          OCSP_ALGORITHM: "rsa"
          OCSP_TLS_SHOULD_SUCCEED: "false"

  - name: test-ocsp-rsa-malicious-no-responder-mustStaple-server-does-not-staple
    tags: ["ocsp", "ocsp-rsa"]
    commands:
      - func: ocsp-bootstrap-mongo-orchestration
        vars:
          ORCHESTRATION_FILE: "rsa-basic-tls-ocsp-mustStaple-disableStapling.json"
      - func: run-ocsp-test
        vars:
          OCSP_ALGORITHM: "rsa"
          OCSP_TLS_SHOULD_SUCCEED: "false"

  - name: test-ocsp-rsa-delegate-valid-cert-server-staples
    tags: ["ocsp", "ocsp-rsa", "ocsp-staple"]
    commands:
      - func: run-valid-delegate-ocsp-server
        vars:
          OCSP_ALGORITHM: "rsa"
      - func: ocsp-bootstrap-mongo-orchestration
        vars:
          ORCHESTRATION_FILE: "rsa-basic-tls-ocsp-mustStaple.json"
      - func: run-ocsp-test
        vars:
          OCSP_ALGORITHM: "rsa"
          OCSP_TLS_SHOULD_SUCCEED: "true"

  - name: test-ocsp-rsa-delegate-invalid-cert-server-staples
    tags: ["ocsp", "ocsp-rsa", "ocsp-staple"]
    commands:
      - func: run-revoked-delegate-ocsp-server
        vars:
          OCSP_ALGORITHM: "rsa"
      - func: ocsp-bootstrap-mongo-orchestration
        vars:
          ORCHESTRATION_FILE: "rsa-basic-tls-ocsp-mustStaple.json"
      - func: run-ocsp-test
        vars:
          OCSP_ALGORITHM: "rsa"
          OCSP_TLS_SHOULD_SUCCEED: "false"

  - name: test-ocsp-rsa-delegate-valid-cert-server-does-not-staple
    tags: ["ocsp", "ocsp-rsa"]
    commands:
      - func: run-valid-delegate-ocsp-server
        vars:
          OCSP_ALGORITHM: "rsa"
      - func: ocsp-bootstrap-mongo-orchestration
        vars:
          ORCHESTRATION_FILE: "rsa-basic-tls-ocsp-disableStapling.json"
      - func: run-ocsp-test
        vars:
          OCSP_ALGORITHM: "rsa"
          OCSP_TLS_SHOULD_SUCCEED: "true"

  - name: test-ocsp-rsa-delegate-invalid-cert-server-does-not-staple
    tags: ["ocsp", "ocsp-rsa"]
    commands:
      - func: run-revoked-delegate-ocsp-server
        vars:
          OCSP_ALGORITHM: "rsa"
      - func: ocsp-bootstrap-mongo-orchestration
        vars:
          ORCHESTRATION_FILE: "rsa-basic-tls-ocsp-disableStapling.json"
      - func: run-ocsp-test
        vars:
          OCSP_ALGORITHM: "rsa"
          OCSP_TLS_SHOULD_SUCCEED: "false"

  - name: test-ocsp-rsa-delegate-malicious-invalid-cert-mustStaple-server-does-not-staple
    tags: ["ocsp", "ocsp-rsa"]
    commands:
      - func: run-revoked-delegate-ocsp-server
        vars:
          OCSP_ALGORITHM: "rsa"
      - func: ocsp-bootstrap-mongo-orchestration
        vars:
          ORCHESTRATION_FILE: "rsa-basic-tls-ocsp-mustStaple-disableStapling.json"
      - func: run-ocsp-test
        vars:
          OCSP_ALGORITHM: "rsa"
          OCSP_TLS_SHOULD_SUCCEED: "false"

  - name: test-ocsp-ecdsa-valid-cert-server-staples
    tags: ["ocsp", "ocsp-ecdsa", "ocsp-staple"]
    commands:
      - func: run-valid-ocsp-server
        vars:
          OCSP_ALGORITHM: "ecdsa"
      - func: ocsp-bootstrap-mongo-orchestration
        vars:
          ORCHESTRATION_FILE: "ecdsa-basic-tls-ocsp-mustStaple.json"
      - func: run-ocsp-test
        vars:
          OCSP_ALGORITHM: "ecdsa"
          OCSP_TLS_SHOULD_SUCCEED: "true"

  - name: test-ocsp-ecdsa-invalid-cert-server-staples
    tags: ["ocsp", "ocsp-ecdsa", "ocsp-staple"]
    commands:
      - func: run-revoked-ocsp-server
        vars:
          OCSP_ALGORITHM: "ecdsa"
      - func: ocsp-bootstrap-mongo-orchestration
        vars:
          ORCHESTRATION_FILE: "ecdsa-basic-tls-ocsp-mustStaple.json"
      - func: run-ocsp-test
        vars:
          OCSP_ALGORITHM: "ecdsa"
          OCSP_TLS_SHOULD_SUCCEED: "false"

  - name: test-ocsp-ecdsa-valid-cert-server-does-not-staple
    tags: ["ocsp", "ocsp-ecdsa"]
    commands:
      - func: run-valid-ocsp-server
        vars:
          OCSP_ALGORITHM: "ecdsa"
      - func: ocsp-bootstrap-mongo-orchestration
        vars:
          ORCHESTRATION_FILE: "ecdsa-basic-tls-ocsp-disableStapling.json"
      - func: run-ocsp-test
        vars:
          OCSP_ALGORITHM: "ecdsa"
          OCSP_TLS_SHOULD_SUCCEED: "true"

  - name: test-ocsp-ecdsa-invalid-cert-server-does-not-staple
    tags: ["ocsp", "ocsp-ecdsa"]
    commands:
      - func: run-revoked-ocsp-server
        vars:
          OCSP_ALGORITHM: "ecdsa"
      - func: ocsp-bootstrap-mongo-orchestration
        vars:
          ORCHESTRATION_FILE: "ecdsa-basic-tls-ocsp-disableStapling.json"
      - func: run-ocsp-test
        vars:
          OCSP_ALGORITHM: "ecdsa"
          OCSP_TLS_SHOULD_SUCCEED: "false"

  - name: test-ocsp-ecdsa-soft-fail
    tags: ["ocsp", "ocsp-ecdsa"]
    commands:
      - func: ocsp-bootstrap-mongo-orchestration
        vars:
          ORCHESTRATION_FILE: "ecdsa-basic-tls-ocsp-disableStapling.json"
      - func: run-ocsp-test
        vars:
          OCSP_ALGORITHM: "ecdsa"
          OCSP_TLS_SHOULD_SUCCEED: "true"

  - name: test-ocsp-ecdsa-malicious-invalid-cert-mustStaple-server-does-not-staple
    tags: ["ocsp", "ocsp-ecdsa"]
    commands:
      - func: run-revoked-ocsp-server
        vars:
          OCSP_ALGORITHM: "ecdsa"
      - func: ocsp-bootstrap-mongo-orchestration
        vars:
          ORCHESTRATION_FILE: "ecdsa-basic-tls-ocsp-mustStaple-disableStapling.json"
      - func: run-ocsp-test
        vars:
          OCSP_ALGORITHM: "ecdsa"
          OCSP_TLS_SHOULD_SUCCEED: "false"

  - name: test-ocsp-ecdsa-malicious-no-responder-mustStaple-server-does-not-staple
    tags: ["ocsp", "ocsp-ecdsa"]
    commands:
      - func: ocsp-bootstrap-mongo-orchestration
        vars:
          ORCHESTRATION_FILE: "ecdsa-basic-tls-ocsp-mustStaple-disableStapling.json"
      - func: run-ocsp-test
        vars:
          OCSP_ALGORITHM: "ecdsa"
          OCSP_TLS_SHOULD_SUCCEED: "false"

  - name: test-ocsp-ecdsa-delegate-valid-cert-server-staples
    tags: ["ocsp", "ocsp-ecdsa", "ocsp-staple"]
    commands:
      - func: run-valid-delegate-ocsp-server
        vars:
          OCSP_ALGORITHM: "ecdsa"
      - func: ocsp-bootstrap-mongo-orchestration
        vars:
          ORCHESTRATION_FILE: "ecdsa-basic-tls-ocsp-mustStaple.json"
      - func: run-ocsp-test
        vars:
          OCSP_ALGORITHM: "ecdsa"
          OCSP_TLS_SHOULD_SUCCEED: "true"

  - name: test-ocsp-ecdsa-delegate-invalid-cert-server-staples
    tags: ["ocsp", "ocsp-ecdsa", "ocsp-staple"]
    commands:
      - func: run-revoked-delegate-ocsp-server
        vars:
          OCSP_ALGORITHM: "ecdsa"
      - func: ocsp-bootstrap-mongo-orchestration
        vars:
          ORCHESTRATION_FILE: "ecdsa-basic-tls-ocsp-mustStaple.json"
      - func: run-ocsp-test
        vars:
          OCSP_ALGORITHM: "ecdsa"
          OCSP_TLS_SHOULD_SUCCEED: "false"

  - name: test-ocsp-ecdsa-delegate-valid-cert-server-does-not-staple
    tags: ["ocsp", "ocsp-ecdsa"]
    commands:
      - func: run-valid-delegate-ocsp-server
        vars:
          OCSP_ALGORITHM: "ecdsa"
      - func: ocsp-bootstrap-mongo-orchestration
        vars:
          ORCHESTRATION_FILE: "ecdsa-basic-tls-ocsp-disableStapling.json"
      - func: run-ocsp-test
        vars:
          OCSP_ALGORITHM: "ecdsa"
          OCSP_TLS_SHOULD_SUCCEED: "true"

  - name: test-ocsp-ecdsa-delegate-invalid-cert-server-does-not-staple
    tags: ["ocsp", "ocsp-ecdsa"]
    commands:
      - func: run-revoked-delegate-ocsp-server
        vars:
          OCSP_ALGORITHM: "ecdsa"
      - func: ocsp-bootstrap-mongo-orchestration
        vars:
          ORCHESTRATION_FILE: "ecdsa-basic-tls-ocsp-disableStapling.json"
      - func: run-ocsp-test
        vars:
          OCSP_ALGORITHM: "ecdsa"
          OCSP_TLS_SHOULD_SUCCEED: "false"

  - name: test-ocsp-ecdsa-delegate-malicious-invalid-cert-mustStaple-server-does-not-staple
    tags: ["ocsp", "ocsp-ecdsa"]
    commands:
      - func: run-revoked-delegate-ocsp-server
        vars:
          OCSP_ALGORITHM: "ecdsa"
      - func: ocsp-bootstrap-mongo-orchestration
        vars:
          ORCHESTRATION_FILE: "ecdsa-basic-tls-ocsp-mustStaple-disableStapling.json"
      - func: run-ocsp-test
        vars:
          OCSP_ALGORITHM: "ecdsa"
          OCSP_TLS_SHOULD_SUCCEED: "false"

  - name: test-atlas-data-lake
    commands:
      - func: bootstrap-mongohoused
      - func: run-atlas-data-lake-test

  - name: test-docker-runner
    commands:
      - func: bootstrap-mongo-orchestration
      - func: run-docker-test

  - name: test-goroutine-leaks-replicaset
    tags: ["goleak"]
    commands:
      - func: bootstrap-mongo-orchestration
        vars:
          TOPOLOGY: "replica_set"
          AUTH: "noauth"
          SSL: "nossl"
      - func: run-goleak-test

  - name: test-goroutine-leaks-sharded
    tags: ["goleak"]
    commands:
      - func: bootstrap-mongo-orchestration
        vars:
          TOPOLOGY: "sharded_cluster"
          AUTH: "noauth"
          SSL: "nossl"
      - func: run-goleak-test

  - name: test-load-balancer-noauth-nossl
    tags: ["load-balancer"]
    commands:
      - func: bootstrap-mongo-orchestration
        vars:
          TOPOLOGY: "sharded_cluster"
          AUTH: "noauth"
          SSL: "nossl"
          LOAD_BALANCER: "true"
      - func: run-load-balancer
      - func: run-load-balancer-tests
        vars:
          AUTH: "noauth"
          SSL: "nossl"

  - name: test-load-balancer-auth-ssl
    tags: ["load-balancer"]
    commands:
      - func: bootstrap-mongo-orchestration
        vars:
          TOPOLOGY: "sharded_cluster"
          AUTH: "auth"
          SSL: "ssl"
          LOAD_BALANCER: "true"
      - func: run-load-balancer
      - func: run-load-balancer-tests
        vars:
          AUTH: "auth"
          SSL: "ssl"

  - name: test-race
    tags: ["race"]
    commands:
      - func: bootstrap-mongo-orchestration
        vars:
          TOPOLOGY: "replica_set"
          AUTH: "noauth"
          SSL: "nossl"
      - func: start-cse-servers
      - func: run-tests
        vars:
          TOPOLOGY: "replica_set"
          AUTH: "noauth"
          SSL: "nossl"
          RACE: "-race"

  - name: test-replicaset-noauth-nossl
    tags: ["test", "replicaset"]
    commands:
      - func: bootstrap-mongo-orchestration
        vars:
          TOPOLOGY: "replica_set"
          AUTH: "noauth"
          SSL: "nossl"
      - func: start-cse-servers
      - func: run-tests
        vars:
          TOPOLOGY: "replica_set"
          AUTH: "noauth"
          SSL: "nossl"

  - name: test-replicaset-auth-ssl
    tags: ["test", "replicaset", "authssl"]
    commands:
      - func: bootstrap-mongo-orchestration
        vars:
          TOPOLOGY: "replica_set"
          AUTH: "auth"
          SSL: "ssl"
      - func: start-cse-servers
      - func: run-tests
        vars:
          TOPOLOGY: "replica_set"
          AUTH: "auth"
          SSL: "ssl"

  - name: test-replicaset-auth-ssl-mongocryptd
    tags: ["test", "replicaset", "authssl", "mongocryptd"]
    commands:
      - func: bootstrap-mongo-orchestration
        vars:
          TOPOLOGY: "replica_set"
          AUTH: "auth"
          SSL: "ssl"
      - func: start-cse-servers
      - func: run-tests
        vars:
          TOPOLOGY: "replica_set"
          AUTH: "auth"
          SSL: "ssl"
          # Don't use the crypt_shared library, which should cause all of the tests to fall
          # back to using mongocryptd instead of crypt_shared.
          SKIP_CRYPT_SHARED_LIB: "true"

  - name: test-replicaset-auth-nossl
    tags: ["test", "replicaset", "authssl"]
    commands:
      - func: bootstrap-mongo-orchestration
        vars:
          TOPOLOGY: "replica_set"
          AUTH: "auth"
          SSL: "nossl"
      - func: start-cse-servers
      - func: run-tests
        vars:
          TOPOLOGY: "replica_set"
          AUTH: "auth"
          SSL: "nossl"

  - name: test-sharded-noauth-nossl
    tags: ["test", "sharded"]
    commands:
      - func: bootstrap-mongo-orchestration
        vars:
          TOPOLOGY: "sharded_cluster"
          AUTH: "noauth"
          SSL: "nossl"
      - func: start-cse-servers
      - func: run-tests
        vars:
          TOPOLOGY: "sharded_cluster"
          AUTH: "noauth"
          SSL: "nossl"

  - name: test-sharded-noauth-nossl-snappy-compression
    tags: ["test", "sharded", "compression", "snappy"]
    commands:
      - func: bootstrap-mongo-orchestration
        vars:
          TOPOLOGY: "sharded_cluster"
          AUTH: "noauth"
          SSL: "nossl"
      - func: start-cse-servers
      - func: run-tests
        vars:
          TOPOLOGY: "sharded_cluster"
          AUTH: "noauth"
          SSL: "nossl"
          MONGO_GO_DRIVER_COMPRESSOR: "snappy"

  - name: test-sharded-noauth-nossl-zlib-compression
    tags: ["test", "sharded", "compression", "zlib"]
    commands:
      - func: bootstrap-mongo-orchestration
        vars:
          TOPOLOGY: "sharded_cluster"
          AUTH: "noauth"
          SSL: "nossl"
      - func: start-cse-servers
      - func: run-tests
        vars:
          TOPOLOGY: "sharded_cluster"
          AUTH: "noauth"
          SSL: "nossl"
          MONGO_GO_DRIVER_COMPRESSOR: "zlib"

  - name: test-sharded-noauth-nossl-zstd-compression
    tags: ["test", "sharded", "compression", "zstd"]
    commands:
      - func: bootstrap-mongo-orchestration
        vars:
          TOPOLOGY: "sharded_cluster"
          AUTH: "noauth"
          SSL: "nossl"
      - func: start-cse-servers
      - func: run-tests
        vars:
          TOPOLOGY: "sharded_cluster"
          AUTH: "noauth"
          SSL: "nossl"
          MONGO_GO_DRIVER_COMPRESSOR: "zstd"

  - name: test-sharded-auth-ssl
    tags: ["test", "sharded", "authssl"]
    commands:
      - func: bootstrap-mongo-orchestration
        vars:
          TOPOLOGY: "sharded_cluster"
          AUTH: "auth"
          SSL: "ssl"
      - func: start-cse-servers
      - func: run-tests
        vars:
          TOPOLOGY: "sharded_cluster"
          AUTH: "auth"
          SSL: "ssl"

  - name: test-sharded-auth-ssl-snappy-compression
    tags: ["test", "sharded", "authssl", "compression", "snappy"]
    commands:
      - func: bootstrap-mongo-orchestration
        vars:
          TOPOLOGY: "sharded_cluster"
          AUTH: "auth"
          SSL: "ssl"
      - func: start-cse-servers
      - func: run-tests
        vars:
          TOPOLOGY: "sharded_cluster"
          AUTH: "auth"
          SSL: "ssl"
          MONGO_GO_DRIVER_COMPRESSOR: "snappy"

  - name: test-sharded-auth-ssl-zlib-compression
    tags: ["test", "sharded", "authssl", "compression", "zlib"]
    commands:
      - func: bootstrap-mongo-orchestration
        vars:
          TOPOLOGY: "sharded_cluster"
          AUTH: "auth"
          SSL: "ssl"
      - func: start-cse-servers
      - func: run-tests
        vars:
          TOPOLOGY: "sharded_cluster"
          AUTH: "auth"
          SSL: "ssl"
          MONGO_GO_DRIVER_COMPRESSOR: "zlib"

  - name: test-sharded-auth-ssl-zstd-compression
    tags: ["test", "sharded", "authssl", "compression", "zstd"]
    commands:
      - func: bootstrap-mongo-orchestration
        vars:
          TOPOLOGY: "sharded_cluster"
          AUTH: "auth"
          SSL: "ssl"
      - func: start-cse-servers
      - func: run-tests
        vars:
          TOPOLOGY: "sharded_cluster"
          AUTH: "auth"
          SSL: "ssl"
          MONGO_GO_DRIVER_COMPRESSOR: "zstd"

  - name: test-sharded-auth-nossl
    tags: ["test", "sharded", "authssl"]
    commands:
      - func: bootstrap-mongo-orchestration
        vars:
          TOPOLOGY: "sharded_cluster"
          AUTH: "auth"
          SSL: "nossl"
      - func: start-cse-servers
      - func: run-tests
        vars:
          TOPOLOGY: "sharded_cluster"
          AUTH: "auth"
          SSL: "nossl"

  - name: test-enterprise-auth-plain
    tags: ["test", "enterprise-auth"]
    commands:
      - func: run-enterprise-auth-tests

  - name: test-enterprise-auth-gssapi
    tags: ["test", "enterprise-auth"]
    commands:
      - func: run-enterprise-gssapi-auth-tests
        vars:
            MONGO_GO_DRIVER_COMPRESSOR: "snappy"

  # Build with the oldest supported version of Go.
  - name: go1.18-build
    tags: ["compile-check"]
    commands:
      - func: run-make
        vars:
          targets: "build-compile-check"
          BUILD_ENV: "PATH=/opt/golang/go1.18/bin:$PATH GOROOT=/opt/golang/go1.18"

  # Build with the same Go version that we're using for tests.
  - name: build
    tags: ["compile-check"]
    commands:
      - func: run-make
        vars:
          targets: "build"

  - name: "atlas-test"
    commands:
      - func: "run-atlas-test"

  - name: "aws-auth-test"
    commands:
      - func: bootstrap-mongo-orchestration
        vars:
          AUTH: "auth"
          ORCHESTRATION_FILE: "auth-aws.json"
          TOPOLOGY: "server"
      - func: add-aws-auth-variables-to-file
      - func: run-aws-auth-test-with-regular-aws-credentials
      - func: run-aws-auth-test-with-assume-role-credentials
      - func: run-aws-auth-test-with-aws-credentials-as-environment-variables
      - func: run-aws-auth-test-with-aws-credentials-and-session-token-as-environment-variables
      - func: run-aws-auth-test-with-aws-EC2-credentials
      - func: run-aws-ECS-auth-test
      - func: run-aws-auth-test-with-aws-web-identity-credentials

  - name: "test-standalone-versioned-api"
    tags: ["versioned-api"]
    commands:
      - func: bootstrap-mongo-orchestration
        vars:
          TOPOLOGY: "server"
          AUTH: "auth"
          SSL: "nossl"
          REQUIRE_API_VERSION: true
      - func: start-cse-servers
      - func: run-versioned-api-test
        vars:
          TOPOLOGY: "server"
          AUTH: "auth"
          SSL: "nossl"
          REQUIRE_API_VERSION: true

  - name: "test-standalone-versioned-api-test-commands"
    tags: ["versioned-api"]
    commands:
      - func: bootstrap-mongo-orchestration
        vars:
          TOPOLOGY: "server"
          AUTH: "noauth"
          SSL: "nossl"
          ORCHESTRATION_FILE: "versioned-api-testing.json"
      - func: start-cse-servers
      - func: run-versioned-api-test
        vars:
          TOPOLOGY: "server"
          AUTH: "noauth"
          SSL: "nossl"

  - name: "test-kms-tls-invalid-cert"
    tags: ["kms-tls"]
    commands:
      - func: bootstrap-mongo-orchestration
        vars:
          TOPOLOGY: "server"
          AUTH: "noauth"
          SSL: "nossl"
      - func: start-cse-servers
      - func: run-kms-tls-test
        vars:
          KMS_TLS_TESTCASE: "INVALID_CERT"
          TOPOLOGY: "server"
          AUTH: "noauth"
          SSL: "nossl"

  - name: "test-kms-tls-invalid-hostname"
    tags: ["kms-tls"]
    commands:
      - func: bootstrap-mongo-orchestration
        vars:
          TOPOLOGY: "server"
          AUTH: "noauth"
          SSL: "nossl"
      - func: start-cse-servers
      - func: run-kms-tls-test
        vars:
          KMS_TLS_TESTCASE: "INVALID_HOSTNAME"
          TOPOLOGY: "server"
          AUTH: "noauth"
          SSL: "nossl"

  - name: "test-kms-kmip"
    tags: ["kms-kmip"]
    commands:
      - func: bootstrap-mongo-orchestration
        vars:
          TOPOLOGY: "server"
          AUTH: "noauth"
          SSL: "nossl"
      - func: start-cse-servers
      - func: run-kmip-tests
        vars:
          TOPOLOGY: "server"
          AUTH: "noauth"
          SSL: "nossl"

  - name: "testgcpkms-task"
    commands:
    - command: shell.exec
      type: test
      params:
        shell: "bash"
        working_dir: src/go.mongodb.org/mongo-driver
        script: |
          ${PREPARE_SHELL}
          echo "Building build-kms-test ... begin"
          BUILD_TAGS="-tags=cse" \
          PKG_CONFIG_PATH=$PKG_CONFIG_PATH \
            make build-kms-test
          echo "Building build-kms-test ... end"
          source $DRIVERS_TOOLS/.evergreen/csfle/gcpkms/secrets-export.sh
          echo "Copying files ... begin"
          tar czf testgcpkms.tgz ./testkms ./install/libmongocrypt/lib64/libmongocrypt.*
          GCPKMS_SRC=testgcpkms.tgz GCPKMS_DST=$GCPKMS_INSTANCENAME: $DRIVERS_TOOLS/.evergreen/csfle/gcpkms/copy-file.sh
          echo "Copying files ... end"

          echo "Untarring file ... begin"
          GCPKMS_CMD="tar xf testgcpkms.tgz" $DRIVERS_TOOLS/.evergreen/csfle/gcpkms/run-command.sh
          echo "Untarring file ... end"

    - command: shell.exec
      type: test
      params:
        shell: "bash"
        working_dir: src/go.mongodb.org/mongo-driver
        script: |
          ${PREPARE_SHELL}
          source $DRIVERS_TOOLS/.evergreen/csfle/gcpkms/secrets-export.sh
          GCPKMS_CMD="LD_LIBRARY_PATH=./install/libmongocrypt/lib64 MONGODB_URI='mongodb://localhost:27017' PROVIDER='gcp' ./testkms" $DRIVERS_TOOLS/.evergreen/csfle/gcpkms/run-command.sh

  - name: "testgcpkms-fail-task"
    # testgcpkms-fail-task runs in a non-GCE environment.
    # It is expected to fail to obtain GCE credentials.
    commands:
      - command: shell.exec
        type: test
        params:
          shell: "bash"
          working_dir: src/go.mongodb.org/mongo-driver
          script: |
            ${PREPARE_SHELL}
            echo "Building build-kms-test ... begin"
            BUILD_TAGS="-tags=cse" \
            PKG_CONFIG_PATH=$PKG_CONFIG_PATH \
              make build-kms-test
            echo "Building build-kms-test ... end"
            LD_LIBRARY_PATH=./install/libmongocrypt/lib64 \
            MONGODB_URI='mongodb://localhost:27017/' \
            EXPECT_ERROR='unable to retrieve GCP credentials' \
            PROVIDER='gcp' \
              ./testkms

  - name: "testawskms-task"
    commands:
    - func: assume-test-secrets-ec2-role
    - command: shell.exec
      type: test
      params:
        shell: "bash"
        add_expansions_to_env: true
        working_dir: src/go.mongodb.org/mongo-driver
        script: |
          ${PREPARE_SHELL}
          bash etc/run-awskms-test.sh

  - name: "testawskms-fail-task"
    # testawskms-fail-task runs without environment variables.
    # It is expected to fail to obtain credentials.
    commands:
    - func: assume-test-secrets-ec2-role
    - command: shell.exec
      type: test
      params:
        shell: "bash"
        add_expansions_to_env: true
        working_dir: src/go.mongodb.org/mongo-driver
        script: |
          ${PREPARE_SHELL}
          export EXPECT_ERROR='status=400'
          bash etc/run-awskms-test.sh

  - name: "testazurekms-task"
    commands:
    - command: shell.exec
      type: test
      params:
        shell: "bash"
        add_expansions_to_env: true
        working_dir: src/go.mongodb.org/mongo-driver
        script: |
          ${PREPARE_SHELL}
          echo "Building build-kms-test ... begin"
          BUILD_TAGS="-tags=cse" \
          PKG_CONFIG_PATH=$PKG_CONFIG_PATH \
            make build-kms-test
          echo "Building build-kms-test ... end"

          echo "Copying files ... begin"
          source $DRIVERS_TOOLS/.evergreen/csfle/azurekms/secrets-export.sh
          tar czf testazurekms.tgz ./testkms ./install/libmongocrypt/lib64/libmongocrypt.*
          AZUREKMS_SRC=testazurekms.tgz AZUREKMS_DST=/tmp $DRIVERS_TOOLS/.evergreen/csfle/azurekms/copy-file.sh
          echo "Copying files ... end"
          echo "Untarring file ... begin"
          AZUREKMS_CMD="tar xf /tmp/testazurekms.tgz" $DRIVERS_TOOLS/.evergreen/csfle/azurekms/run-command.sh
          echo "Untarring file ... end"

    - command: shell.exec
      type: test
      params:
        shell: "bash"
        working_dir: src/go.mongodb.org/mongo-driver
        script: |
          ${PREPARE_SHELL}
          source ${DRIVERS_TOOLS}/.evergreen/csfle/azurekms/secrets-export.sh
          AZUREKMS_CMD="LD_LIBRARY_PATH=./install/libmongocrypt/lib64 MONGODB_URI='mongodb://localhost:27017' PROVIDER='azure' AZUREKMS_KEY_NAME=$AZUREKMS_KEYNAME AZUREKMS_KEY_VAULT_ENDPOINT=$AZUREKMS_KEYVAULTENDPOINT ./testkms" $DRIVERS_TOOLS/.evergreen/csfle/azurekms/run-command.sh

  - name: "testazurekms-fail-task"
    # testazurekms-fail-task runs without environment variables.
    # It is expected to fail to obtain credentials.
    commands:
    - func: assume-test-secrets-ec2-role
    - command: shell.exec
      type: test
      params:
        shell: "bash"
        add_expansions_to_env: true
        working_dir: src/go.mongodb.org/mongo-driver
        script: |
          ${PREPARE_SHELL}
          echo "Building build-kms-test ... begin"
          BUILD_TAGS="-tags=cse" \
          PKG_CONFIG_PATH=$PKG_CONFIG_PATH \
            make build-kms-test
          echo "Building build-kms-test ... end"

          . ${DRIVERS_TOOLS}/.evergreen/csfle/azurekms/setup-secrets.sh
          
          LD_LIBRARY_PATH=./install/libmongocrypt/lib64 \
          MONGODB_URI='mongodb://localhost:27017' \
          EXPECT_ERROR='unable to retrieve azure credentials' \
          PROVIDER='azure' AZUREKMS_KEY_NAME=$AZUREKMS_KEYNAME AZUREKMS_KEY_VAULT_ENDPOINT=$AZUREKMS_KEYVAULTENDPOINT \
            ./testkms

  - name: "test-fuzz"
    commands:
      - func: bootstrap-mongo-orchestration
      - func: run-fuzz-tests

  - name: "test-aws-lambda-deployed"
    commands:
      - command: shell.exec
        type: test
        params:
          working_dir: src/go.mongodb.org/mongo-driver
          shell: bash
          add_expansions_to_env: true
          env:
            TEST_LAMBDA_DIRECTORY: ${PROJECT_DIRECTORY}/internal/test/faas/awslambda
            LAMBDA_STACK_NAME: dbx-go-lambda
            AWS_REGION: us-east-1
          script: |
            ${PREPARE_SHELL}
            pushd $TEST_LAMBDA_DIRECTORY/mongodb
            go mod tidy
            popd
            ./.evergreen/run-deployed-lambda-aws-tests.sh

  - name: "oidc-auth-test"
    commands:
      - func: "run-oidc-auth-test-with-test-credentials"

  - name: "oidc-auth-test-azure"
    commands:
    - command: shell.exec
      type: test
      params:
        working_dir: src/go.mongodb.org/mongo-driver
        shell: bash
        script: |-
          set -o errexit
          ${PREPARE_SHELL}
          export AZUREOIDC_DRIVERS_TAR_FILE=/tmp/mongo-go-driver.tar.gz
          # we need to statically link libc to avoid the situation where the VM has a different
          # version of libc
          go build -tags osusergo,netgo -ldflags '-w -extldflags "-static -lgcc -lc"' -o test ./cmd/testoidcauth/main.go
          rm "$AZUREOIDC_DRIVERS_TAR_FILE" || true
          tar -cf $AZUREOIDC_DRIVERS_TAR_FILE ./test
          tar -uf $AZUREOIDC_DRIVERS_TAR_FILE ./etc
          rm "$AZUREOIDC_DRIVERS_TAR_FILE".gz || true
          gzip $AZUREOIDC_DRIVERS_TAR_FILE
          export AZUREOIDC_DRIVERS_TAR_FILE=/tmp/mongo-go-driver.tar.gz
          # Define the command to run on the azure VM.
          # Ensure that we source the environment file created for us, set up any other variables we need,
          # and then run our test suite on the vm.
          export AZUREOIDC_TEST_CMD="PROJECT_DIRECTORY='.' OIDC_ENV=azure OIDC=oidc ./etc/run-oidc-test.sh ./test"
          bash $DRIVERS_TOOLS/.evergreen/auth_oidc/azure/run-driver-test.sh

  - name: "oidc-auth-test-gcp"
    commands:
    - command: shell.exec
      type: test
      params:
        working_dir: src/go.mongodb.org/mongo-driver
        shell: bash
        script: |-
          set -o errexit
          ${PREPARE_SHELL}
          export GCPOIDC_DRIVERS_TAR_FILE=/tmp/mongo-go-driver.tar.gz
          # we need to statically link libc to avoid the situation where the VM has a different
          # version of libc
          go build -tags osusergo,netgo -ldflags '-w -extldflags "-static -lgcc -lc"' -o test ./cmd/testoidcauth/main.go
          rm "$GCPOIDC_DRIVERS_TAR_FILE" || true
          tar -cf $GCPOIDC_DRIVERS_TAR_FILE ./test
          tar -uf $GCPOIDC_DRIVERS_TAR_FILE ./etc
          rm "$GCPOIDC_DRIVERS_TAR_FILE".gz || true
          gzip $GCPOIDC_DRIVERS_TAR_FILE
          export GCPOIDC_DRIVERS_TAR_FILE=/tmp/mongo-go-driver.tar.gz
          # Define the command to run on the gcp VM.
          # Ensure that we source the environment file created for us, set up any other variables we need,
          # and then run our test suite on the vm.
          export GCPOIDC_TEST_CMD="PROJECT_DIRECTORY='.' OIDC_ENV=gcp OIDC=oidc ./etc/run-oidc-test.sh ./test"
          bash $DRIVERS_TOOLS/.evergreen/auth_oidc/gcp/run-driver-test.sh

  - name: "test-search-index"
    commands:
      - func: "bootstrap-mongo-orchestration"
        vars:
          VERSION: "8.0"
          TOPOLOGY: "replica_set"
      - func: "run-search-index-tests"

axes:
  - id: version
    display_name: MongoDB Version
    values:
      - id: "8.0"
        display_name: "8.0"
        variables:
          VERSION: "8.0"
      - id: "7.0"
        display_name: "7.0"
        variables:
          VERSION: "7.0"
      - id: "6.0"
        display_name: "6.0"
        variables:
          VERSION: "6.0"
      - id: "5.0"
        display_name: "5.0"
        variables:
          VERSION: "5.0"
      - id: "4.4"
        display_name: "4.4"
        variables:
          VERSION: "4.4"
      - id: "4.2"
        display_name: "4.2"
        variables:
          VERSION: "4.2"
      - id: "4.0"
        display_name: "4.0"
        variables:
          VERSION: "4.0"
      - id: "3.6"
        display_name: "3.6"
        variables:
          VERSION: "3.6"
      - id: "rapid"
        display_name: "rapid"
        variables:
          VERSION: "rapid"

  # OSes that require >= 3.2 for SSL
  - id: os-ssl-32
    display_name: OS
    values:
      - id: "windows-64"
        display_name: "Windows 64-bit"
        run_on:
          - windows-vsCurrent-small
        variables:
          GCC_PATH: "/cygdrive/c/ProgramData/chocolatey/lib/mingw/tools/install/mingw64/bin"
          GO_DIST: "C:\\golang\\go1.22"
          VENV_BIN_DIR: "Scripts"
          # CSOT tests are unreliable on our slow Windows hosts.
          SKIP_CSOT_TESTS: true
      - id: "rhel87-64"
        display_name: "RHEL 8.7"
        run_on: rhel8.7-large
        variables:
          GO_DIST: "/opt/golang/go1.22"
      - id: "macos11"
        display_name: "MacOS 11.0"
        run_on: macos-1100
        batchtime: 1440 # Run at most once per 24 hours.
        variables:
          GO_DIST: "/opt/golang/go1.22"
          # CSOT tests are unreliable on our slow macOS hosts.
          SKIP_CSOT_TESTS: true

  # OSes that require >= 4.0 for SSL
  - id: os-ssl-40
    display_name: OS
    values:
      - id: "windows-64"
        display_name: "Windows 64-bit"
        run_on:
          - windows-vsCurrent-small
        variables:
          GCC_PATH: "/cygdrive/c/ProgramData/chocolatey/lib/mingw/tools/install/mingw64/bin"
          GO_DIST: "C:\\golang\\go1.22"
          VENV_BIN_DIR: "Scripts"
          # CSOT tests are unreliable on our slow Windows hosts.
          SKIP_CSOT_TESTS: true
      - id: "rhel87-64"
        display_name: "RHEL 8.7"
        run_on: rhel8.7-large
        variables:
          GO_DIST: "/opt/golang/go1.22"
      - id: "macos11"
        display_name: "MacOS 11.0"
        run_on: macos-1100
        batchtime: 1440 # Run at most once per 24 hours.
        variables:
          GO_DIST: "/opt/golang/go1.22"
          # CSOT tests are unreliable on our slow macOS hosts.
          SKIP_CSOT_TESTS: true

  - id: ocsp-rhel-87
    display_name: OS
    values:
      - id: "rhel87"
        display_name: "RHEL 8.7"
        run_on: rhel8.7-large
        variables:
          GO_DIST: "/opt/golang/go1.22"

  - id: os-aws-auth
    display_name: OS
    values:
      - id: "windows-64-vsCurrent-latest-small"
        display_name: "Windows 64-bit"
        run_on:
          - windows-vsCurrent-small
        variables:
          GCC_PATH: "/cygdrive/c/ProgramData/chocolatey/lib/mingw/tools/install/mingw64/bin"
          GO_DIST: "C:\\golang\\go1.22"
          SKIP_ECS_AUTH_TEST: true
          # CSOT tests are unreliable on our slow Windows hosts.
          SKIP_CSOT_TESTS: true
      - id: "ubuntu2004-64"
        display_name: "Ubuntu 20.04"
        run_on: ubuntu2004-test
        variables:
          GO_DIST: "/opt/golang/go1.22"
      - id: "macos11"
        display_name: "MacOS 11.0"
        run_on: macos-1100
        batchtime: 1440 # Run at most once per 24 hours.
        variables:
          GO_DIST: "/opt/golang/go1.22"
          SKIP_ECS_AUTH_TEST: true
          SKIP_EC2_AUTH_TEST: true
          SKIP_WEB_IDENTITY_AUTH_TEST: true
          # CSOT tests are unreliable on our slow macOS hosts.
          SKIP_CSOT_TESTS: true

  - id: os-faas-80
    display_name: OS
    values:
      - id: "rhel87-large"
        display_name: "RHEL 8.7"
        run_on: rhel8.7-large
        variables:
          GO_DIST: "/opt/golang/go1.22"

task_groups:
  - name: testgcpkms_task_group
    setup_group_can_fail_task: true
    setup_group_timeout_secs: 1800 # 30 minutes
    setup_group:
      - func: fetch-source
      - func: prepare-resources
      - func: fix-absolute-paths
      - func: make-files-executable
      - func: assume-test-secrets-ec2-role
      - command: shell.exec
        params:
          shell: "bash"
          add_expansions_to_env: true
          script: |
            ${PREPARE_SHELL}
            $DRIVERS_TOOLS/.evergreen/csfle/gcpkms/setup.sh
    teardown_group:
      - command: shell.exec
        params:
          shell: "bash"
          script: |
            ${PREPARE_SHELL}
            $DRIVERS_TOOLS/.evergreen/csfle/gcpkms/teardown.sh
      - func: handle-test-artifacts
      - func: cleanup
    tasks:
      - testgcpkms-task

  - name: testazurekms_task_group
    setup_group_can_fail_task: true
    teardown_group_can_fail_task: true
    setup_group_timeout_secs: 1800 # 30 minutes
    setup_group:
      - func: fetch-source
      - func: prepare-resources
      - func: fix-absolute-paths
      - func: make-files-executable
      - func: assume-test-secrets-ec2-role
      - command: shell.exec
        params:
          shell: "bash"
          add_expansions_to_env: true
          script: |
            ${PREPARE_SHELL}
            export AZUREKMS_VMNAME_PREFIX="GODRIVER"
            export AZUREKMS_DRIVERS_TOOLS=$DRIVERS_TOOLS
            # Get azurekms credentials from the vault.
            . ${DRIVERS_TOOLS}/.evergreen/csfle/azurekms/setup-secrets.sh
            ${DRIVERS_TOOLS}/.evergreen/csfle/azurekms/create-and-setup-vm.sh
    teardown_group:
      - command: subprocess.exec
        params:
          binary: "bash"
          args:
           - ${DRIVERS_TOOLS}/.evergreen/csfle/azurekms/teardown.sh

      - func: handle-test-artifacts
      - func: cleanup
    tasks:
      - testazurekms-task

  - name: testoidc_task_group
    setup_group:
      - func: fetch-source
      - func: prepare-resources
      - func: fix-absolute-paths
      - func: make-files-executable
      - func: assume-ec2-role
      - command: subprocess.exec
        params:
          binary: bash
          include_expansions_in_env: ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN"]
          env:
            MONGODB_VERSION: "8.0"
          args:
            - ${DRIVERS_TOOLS}/.evergreen/auth_oidc/setup.sh
    teardown_task:
      - command: subprocess.exec
        params:
          binary: bash
          args:
            - ${DRIVERS_TOOLS}/.evergreen/auth_oidc/teardown.sh
    setup_group_can_fail_task: true
    setup_group_timeout_secs: 1800
    tasks:
      - oidc-auth-test

  - name: testazureoidc_task_group
    setup_group:
      - func: fetch-source
      - func: prepare-resources
      - func: fix-absolute-paths
      - func: make-files-executable
      - func: assume-test-secrets-ec2-role
      - command: subprocess.exec
        params:
          binary: bash
          add_expansions_to_env: true
          env:
            AZUREOIDC_VMNAME_PREFIX: "GO_DRIVER"
          args:
            - ${DRIVERS_TOOLS}/.evergreen/auth_oidc/azure/create-and-setup-vm.sh
    teardown_task:
      - command: subprocess.exec
        params:
          binary: bash
          args:
            - ${DRIVERS_TOOLS}/.evergreen/auth_oidc/azure/delete-vm.sh
    setup_group_can_fail_task: true
    setup_group_timeout_secs: 1800
    tasks:
      - oidc-auth-test-azure

  - name: testgcpoidc_task_group
    setup_group:
      - func: fetch-source
      - func: prepare-resources
      - func: fix-absolute-paths
      - func: make-files-executable
      - func: assume-test-secrets-ec2-role
      - command: subprocess.exec
        params:
          binary: bash
          add_expansions_to_env: true
          env:
            AZUREOIDC_VMNAME_PREFIX: "GO_DRIVER"
          args:
            - ${DRIVERS_TOOLS}/.evergreen/auth_oidc/gcp/setup.sh
    teardown_task:
      - command: subprocess.exec
        params:
          binary: bash
          args:
            - ${DRIVERS_TOOLS}/.evergreen/auth_oidc/gcp/teardown.sh
    setup_group_can_fail_task: true
    setup_group_timeout_secs: 1800
    tasks:
      - oidc-auth-test-gcp

  - name: test-aws-lambda-task-group
    setup_group:
      - func: fetch-source
      - func: prepare-resources
      - func: assume-test-secrets-ec2-role
      - command: subprocess.exec
        params:
          working_dir: src/go.mongodb.org/mongo-driver
          binary: bash
          add_expansions_to_env: true
          env:
            LAMBDA_STACK_NAME: dbx-go-lambda
            AWS_REGION: us-east-1
            task_id: ${task_id}
            execution: ${execution}
          args:
            - ${DRIVERS_TOOLS}/.evergreen/atlas/setup-atlas-cluster.sh
    teardown_group:
      - command: subprocess.exec
        params:
          working_dir: src/go.mongodb.org/mongo-driver
          binary: bash
          add_expansions_to_env: true
          env:
            LAMBDA_STACK_NAME: dbx-go-lambda
            AWS_REGION: us-east-1
          args:
            - ${DRIVERS_TOOLS}/.evergreen/atlas/teardown-atlas-cluster.sh
      - func: handle-test-artifacts
      - func: cleanup
    setup_group_can_fail_task: true
    setup_group_timeout_secs: 1800
    tasks:
      - test-aws-lambda-deployed

  - name: test-search-index-task-group
    setup_group:
      - func: fetch-source
      - func: prepare-resources
      - command: subprocess.exec
        params:
          working_dir: src/go.mongodb.org/mongo-driver
          binary: bash
          env:
            MONGODB_VERSION: "7.0"
            LAMBDA_STACK_NAME: dbx-go-lambda
            AWS_REGION: us-east-1
            task_id: ${task_id}
            execution: ${execution}
          args:
            - ${DRIVERS_TOOLS}/.evergreen/atlas/setup-atlas-cluster.sh
      - command: expansions.update
        params:
          file: src/go.mongodb.org/mongo-driver/atlas-expansion.yml
      - command: shell.exec
        params:
          working_dir: src/go.mongodb.org/mongo-driver
          shell: bash
          script: |-
            echo "TEST_INDEX_URI: ${MONGODB_URI}" > atlas-expansion.yml
      - command: expansions.update
        params:
          file: src/go.mongodb.org/mongo-driver/atlas-expansion.yml
    teardown_group:
      - command: subprocess.exec
        params:
          working_dir: src/go.mongodb.org/mongo-driver
          binary: bash
          args:
            - ${DRIVERS_TOOLS}/.evergreen/atlas/teardown-atlas-cluster.sh
      - func: handle-test-artifacts
      - func: cleanup
    setup_group_can_fail_task: true
    setup_group_timeout_secs: 1800
    tasks:
      - test-search-index

buildvariants:
  - name: static-analysis
    tags: ["pullrequest"]
    display_name: "Static Analysis"
    run_on:
      - rhel8.7-large
    expansions:
      GO_DIST: "/opt/golang/go1.22"
    tasks:
      - name: ".static-analysis"

  - name: pull-request-helpers
    tags: ["pullrequest"]
    display_name: "Pull Request Helpers"
    run_on:
      - rhel8.7-small
    expansions:
      GO_DIST: "/opt/golang/go1.22"
    tasks:
      - name: "pull-request-helpers"

  - name: perf
    display_name: "Performance"
    run_on:
      - rhel8.7-large
    expansions:
      GO_DIST: "/opt/golang/go1.22"
    tasks:
      - name: ".performance"

  - name: build-check
    tags: ["pullrequest"]
    display_name: "Compile Only Checks"
    run_on:
      - rhel8.7-large
    expansions:
      GO_DIST: "/opt/golang/go1.22"
    tasks:
      - name: ".compile-check"

  - name: backport-pr
    display_name: "Backport PR"
    run_on:
      - rhel8.7-large
    expansions:
      GO_DIST: "/opt/golang/go1.22"
    tasks: 
      - name: "backport-pr"

  - name: atlas-test
    tags: ["pullrequest"]
    display_name: "Atlas test"
    run_on:
      - rhel8.7-large
    expansions:
      GO_DIST: "/opt/golang/go1.22"
    tasks:
      - name: "atlas-test"

  - name: atlas-data-lake-test
    tags: ["pullrequest"]
    display_name: "Atlas Data Lake Test"
    run_on:
      - ubuntu2004-large
    expansions:
      GO_DIST: "/opt/golang/go1.22"
    tasks:
      - name: "test-atlas-data-lake"

  - name: docker-runner-test
    tags: ["pullrequest"]
    display_name: "Docker Runner Test"
    run_on:
      - ubuntu2204-large
    expansions:
      GO_DIST: "/opt/golang/go1.22"
    tasks:
      - name: "test-docker-runner"

  - name: goroutine-leaks-test
    tags: ["pullrequest"]
    display_name: "Goroutine Leaks Test"
    run_on:
      - ubuntu2204-large
    expansions:
      GO_DIST: "/opt/golang/go1.22"
    tasks:
      - name: ".goleak"

  - matrix_name: "tests-rhel-36-with-zlib-support"
    tags: ["pullrequest"]
    matrix_spec: { version: ["3.6"], os-ssl-32: ["rhel87-64"] }
    display_name: "${version} ${os-ssl-32}"
    tasks:
      - name: ".test !.enterprise-auth !.snappy !.zstd"

  - matrix_name: "tests-windows-36-with-zlib-support"
    matrix_spec: { version: ["3.6"], os-ssl-32: ["windows-64"] }
    display_name: "${version} ${os-ssl-32}"
    tasks:
      - name: ".test !.enterprise-auth !.snappy !.zstd"

  - matrix_name: "tests-rhel-40-with-zlib-support"
    tags: ["pullrequest"]
    matrix_spec: { version: ["4.0"], os-ssl-40: ["rhel87-64"] }
    display_name: "${version} ${os-ssl-40}"
    tasks:
      - name: ".test !.enterprise-auth !.snappy !.zstd"

  - matrix_name: "tests-windows-40-with-zlib-support"
    matrix_spec: { version: ["4.0"], os-ssl-40: ["windows-64"] }
    display_name: "${version} ${os-ssl-40}"
    tasks:
      - name: ".test !.enterprise-auth !.snappy !.zstd"

  - matrix_name: "tests-rhel-42-plus-zlib-zstd-support"
    tags: ["pullrequest"]
    matrix_spec: { version: ["4.2", "4.4", "5.0", "6.0", "7.0", "8.0"], os-ssl-40: ["rhel87-64"] }
    display_name: "${version} ${os-ssl-40}"
    tasks:
      - name: ".test !.enterprise-auth !.snappy"

  - matrix_name: "tests-windows-42-plus-zlib-zstd-support"
    matrix_spec: { version: ["4.2", "4.4", "5.0", "6.0", "7.0"], os-ssl-40: ["windows-64"] }
    display_name: "${version} ${os-ssl-40}"
    tasks:
      - name: ".test !.enterprise-auth !.snappy"

  - matrix_name: "tests-windows-80-zlib-zstd-support"
    tags: ["pullrequest"]
    matrix_spec: { version: ["8.0"], os-ssl-40: ["windows-64"] }
    display_name: "${version} ${os-ssl-40}"
    tasks:
      - name: ".test !.enterprise-auth !.snappy"

  - matrix_name: "enterprise-auth-tests"
    matrix_spec: { os-ssl-32: "*" }
    display_name: "Enterprise Auth - ${os-ssl-32}"
    tasks:
      - name: ".test .enterprise-auth"

  - matrix_name: "aws-auth-test"
    matrix_spec: { version: ["4.4", "5.0", "6.0", "7.0", "8.0"], os-aws-auth: "*" }
    display_name: "MONGODB-AWS Auth ${version} ${os-aws-auth}"
    tasks:
      - name: "aws-auth-test"

  - matrix_name: "ocsp-test"
    matrix_spec: { version: ["4.4", "5.0", "6.0", "7.0", "8.0"], ocsp-rhel-87: ["rhel87"] }
    display_name: "OCSP ${version} ${ocsp-rhel-87}"
    batchtime: 20160 # Use a batchtime of 14 days as suggested by the OCSP test README
    tasks:
      - name: ".ocsp"

  - matrix_name: "ocsp-test-windows"
    matrix_spec: { version: ["4.4", "5.0", "6.0", "7.0", "8.0"], os-ssl-40: ["windows-64"] }
    display_name: "OCSP ${version} ${os-ssl-40}"
    batchtime: 20160 # Use a batchtime of 14 days as suggested by the OCSP test README
    tasks:
      # Windows MongoDB servers do not staple OCSP responses and only support RSA.
      - name: ".ocsp-rsa !.ocsp-staple"

  - matrix_name: "ocsp-test-macos"
    matrix_spec: { version: ["4.4", "5.0", "6.0", "7.0", "8.0"], os-ssl-40: ["macos11"] }
    display_name: "OCSP ${version} ${os-ssl-40}"
    batchtime: 20160 # Use a batchtime of 14 days as suggested by the OCSP test README
    tasks:
      # macos MongoDB servers do not staple OCSP responses and only support RSA.
      - name: ".ocsp-rsa !.ocsp-staple"

  - matrix_name: "race-test"
    tags: ["pullrequest"]
    matrix_spec: { version: ["7.0"], os-ssl-40: ["rhel87-64"] }
    display_name: "Race Detector Test"
    tasks:
      - name: ".race"

  - matrix_name: "versioned-api-test"
    tags: ["pullrequest"]
    matrix_spec: { version: ["5.0", "6.0", "7.0", "8.0"], os-ssl-40: ["windows-64", "rhel87-64"] }
    display_name: "API Version ${version} ${os-ssl-40}"
    tasks:
      - name: ".versioned-api"

  - matrix_name: "kms-tls-test"
    matrix_spec: { version: ["7.0"], os-ssl-40: ["rhel87-64"] }
    display_name: "KMS TLS ${os-ssl-40}"
    tasks:
      - name: ".kms-tls"

  - matrix_name: "load-balancer-test"
    tags: ["pullrequest"]
    matrix_spec: { version: ["5.0", "6.0", "7.0", "8.0"], os-ssl-40: ["rhel87-64"] }
    display_name: "Load Balancer Support ${version} ${os-ssl-40}"
    tasks:
      - name: ".load-balancer"

  - matrix_name: "kms-kmip-test"
    matrix_spec: { version: ["7.0"], os-ssl-40: ["rhel87-64"] }
    display_name: "KMS KMIP ${os-ssl-40}"
    tasks:
      - name: ".kms-kmip"

  - matrix_name: "fuzz-test"
    matrix_spec: { version: ["5.0"], os-ssl-40: ["rhel87-64"] }
    display_name: "Fuzz ${version} ${os-ssl-40}"
    tasks:
      - name: "test-fuzz"
        batchtime: 1440 # Run at most once per 24 hours.

  - matrix_name: "faas-test"
    matrix_spec: { version: ["7.0"], os-faas-80: ["rhel87-large"] }
    display_name: "FaaS ${version} ${os-faas-80}"
    tasks:
      - test-aws-lambda-task-group

  - matrix_name: "searchindex-test"
    matrix_spec: { version: ["7.0"], os-faas-80: ["rhel87-large"] }
    display_name: "Search Index ${version} ${os-faas-80}"
    tasks:
      - test-search-index-task-group

  - name: testgcpkms-variant
    display_name: "GCP KMS"
    run_on:
      - rhel8.7-small
    expansions:
      GO_DIST: "/opt/golang/go1.22"
    tasks:
      - name: testgcpkms_task_group
        batchtime: 20160 # Use a batchtime of 14 days as suggested by the CSFLE test README
      - testgcpkms-fail-task

  - name: testawskms-variant
    display_name: "AWS KMS"
    run_on:
      - rhel8.7-small
    expansions:
      GO_DIST: "/opt/golang/go1.22"
    tasks:
      - testawskms-task
      - testawskms-fail-task

  - name: testazurekms-variant
    display_name: "AZURE KMS"
    run_on:
      - rhel8.7-small
    expansions:
      GO_DIST: "/opt/golang/go1.22"
    tasks:
      - name: testazurekms_task_group
        batchtime: 20160 # Use a batchtime of 14 days as suggested by the CSFLE test README
      - testazurekms-fail-task

  - name: testoidc-variant
    display_name: "OIDC"
    run_on:
      - ubuntu2204-small
    expansions:
      GO_DIST: "/opt/golang/go1.22"
    tasks:
      - name: testoidc_task_group
        batchtime: 20160 # Use a batchtime of 14 days as suggested by the CSFLE test README
      - name: testazureoidc_task_group
        batchtime: 20160 # Use a batchtime of 14 days as suggested by the CSFLE test README
      - name: testgcpoidc_task_group
        batchtime: 20160 # Use a batchtime of 14 days as suggested by the CSFLE test README
