integration_tests.yml

name: Integration Tests

on:
  push:
    branches: [master]
  pull_request:
    branches: [master]
  schedule:
    # Run nightly at 2am UTC
    - cron: '0 2 * * *'
  workflow_dispatch:

jobs:
  sandbox-test:
    name: Sandbox (${{ matrix.mysql-version }})
    runs-on: ubuntu-22.04
    strategy:
      fail-fast: false
      matrix:
        mysql-version:
          - '5.6.51'
          - '8.0.42'
          - '8.4.4'
          - '9.1.0'
          - '9.5.0'
          - '9.7.2'
          - '26.7.0'
    env:
      GO111MODULE: on
      SANDBOX_BINARY: ${{ github.workspace }}/opt/mysql
      MYSQL_VERSION: ${{ matrix.mysql-version }}
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: '1.23'

      - name: Install system libraries
        run: |
          sudo apt-get update
          sudo apt-get install -y libaio1 libnuma1 libncurses5 libldap-2.5-0

      - name: Build dbdeployer
        run: go build -o dbdeployer .

      - name: Cache MySQL tarball
        uses: actions/cache@v4
        with:
          path: /tmp/mysql-tarball
          key: mysql-${{ matrix.mysql-version }}-linux-x86_64-v1

      - name: Resolve tarball name
        run: |
          SHORT_VER=$(echo "$MYSQL_VERSION" | grep -oP '^\d+\.\d+')
          # MySQL 5.6 ships as .tar.gz built against glibc2.12; 5.7+ ships
          # as .tar.xz built against glibc2.17; 9.6+ only against glibc2.28.
          if [ "$SHORT_VER" = "5.6" ]; then
            TARBALL="mysql-${MYSQL_VERSION}-linux-glibc2.12-x86_64.tar.gz"
          else
            case "$SHORT_VER" in 5.*|8.*|9.[0-5]) GLIBC=2.17 ;; *) GLIBC=2.28 ;; esac
            TARBALL="mysql-${MYSQL_VERSION}-linux-glibc${GLIBC}-x86_64.tar.xz"
          fi
          echo "SHORT_VER=$SHORT_VER" >> "$GITHUB_ENV"
          echo "TARBALL=$TARBALL" >> "$GITHUB_ENV"

      - name: Download MySQL
        run: |
          mkdir -p /tmp/mysql-tarball
          if [ ! -f "/tmp/mysql-tarball/$TARBALL" ]; then
            echo "Downloading $TARBALL..."
            curl -L -f -o "/tmp/mysql-tarball/$TARBALL" \
              "https://dev.mysql.com/get/Downloads/MySQL-${SHORT_VER}/$TARBALL" \
              || curl -L -f -o "/tmp/mysql-tarball/$TARBALL" \
              "https://downloads.mysql.com/archives/get/p/23/file/$TARBALL"
          fi
          ls -lh "/tmp/mysql-tarball/$TARBALL"

      - name: Unpack MySQL
        run: |
          mkdir -p "$SANDBOX_BINARY"
          ./dbdeployer unpack "/tmp/mysql-tarball/$TARBALL" \
            --sandbox-binary="$SANDBOX_BINARY"

      - name: Test single sandbox
        run: |
          ./dbdeployer deploy single "$MYSQL_VERSION" \
            --sandbox-binary="$SANDBOX_BINARY"
          ~/sandboxes/msb_*/use -e "SELECT VERSION()"
          ./dbdeployer delete all --skip-confirm

      - name: Test replication sandbox
        run: |
          ./dbdeployer deploy replication "$MYSQL_VERSION" \
            --sandbox-binary="$SANDBOX_BINARY"
          ~/sandboxes/rsandbox_*/check_slaves
          ~/sandboxes/rsandbox_*/test_replication
          ./dbdeployer delete all --skip-confirm

      - name: Cleanup
        if: always()
        run: |
          ./dbdeployer delete all --skip-confirm 2>/dev/null || true
          pkill -9 -u "$USER" mysqld 2>/dev/null || true

  # Time-bounded deploy test: verifies that "deploy replication" completes
  # within MAX_DEPLOY_SECONDS and replicas serve queries immediately after
  # deploy (regression test for issue #131).
  deploy-time-budget:
    name: Deploy time budget (8.4)
    runs-on: ubuntu-22.04
    env:
      GO111MODULE: on
      SANDBOX_BINARY: ${{ github.workspace }}/opt/mysql
      MAX_DEPLOY_SECONDS: 45
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false

      - uses: actions/setup-go@v5
        with:
          go-version: '1.23'

      - name: Install system libraries
        run: |
          sudo apt-get update
          sudo apt-get install -y libaio1 libnuma1 libncurses5 libldap-2.5-0

      - name: Build dbdeployer
        run: go build -o dbdeployer .

      - name: Cache MySQL tarball
        uses: actions/cache@v4
        with:
          path: /tmp/mysql-tarball
          key: mysql-8.4.4-linux-x86_64-v1

      - name: Download MySQL 8.4.4
        run: |
          mkdir -p /tmp/mysql-tarball
          TARBALL="mysql-8.4.4-linux-glibc2.17-x86_64.tar.xz"
          curl -L -f -o "/tmp/mysql-tarball/$TARBALL" \
            "https://dev.mysql.com/get/Downloads/MySQL-8.4/$TARBALL" \
            || curl -L -f -o "/tmp/mysql-tarball/$TARBALL" \
            "https://downloads.mysql.com/archives/get/p/23/file/$TARBALL"
          ls -lh "/tmp/mysql-tarball/$TARBALL"

      - name: Unpack MySQL
        run: |
          mkdir -p "$SANDBOX_BINARY"
          ./dbdeployer unpack "/tmp/mysql-tarball/mysql-8.4.4-linux-glibc2.17-x86_64.tar.xz" \
            --sandbox-binary="$SANDBOX_BINARY"

      - name: Run deploy time budget test
        run: ./test/deploy-time-budget.sh

      - name: Cleanup
        if: always()
        run: |
          ./dbdeployer delete all --skip-confirm 2>/dev/null || true
          pkill -9 -u "$USER" mysqld 2>/dev/null || true

  # Test Percona Server: single + replication with data verification
  percona-test:
    name: Percona Server (${{ matrix.percona-version }})
    runs-on: ubuntu-22.04
    strategy:
      fail-fast: false
      matrix:
        percona-version:
          - '8.0.36-28'
          - '8.4.2-2'
    env:
      GO111MODULE: on
      SANDBOX_BINARY: ${{ github.workspace }}/opt/mysql
      PERCONA_VERSION: ${{ matrix.percona-version }}
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: '1.23'

      - name: Install system libraries
        run: |
          sudo apt-get update
          sudo apt-get install -y libaio1 libnuma1 libncurses5 libldap-2.5-0

      - name: Build dbdeployer
        run: go build -o dbdeployer .

      - name: Download and unpack Percona Server
        run: |
          # Extract major.minor from version (e.g., "8.0.36-28" -> "8.0")
          MAJOR_MINOR=$(echo "$PERCONA_VERSION" | grep -oP '^\d+\.\d+')
          GLIBC="glibc2.35"
          TARBALL="Percona-Server-${PERCONA_VERSION}-Linux.x86_64.${GLIBC}-minimal.tar.gz"
          URL="https://downloads.percona.com/downloads/Percona-Server-${MAJOR_MINOR}/Percona-Server-${PERCONA_VERSION}/binary/tarball/${TARBALL}"
          echo "Downloading Percona Server ${PERCONA_VERSION} (${GLIBC})..."
          mkdir -p "$SANDBOX_BINARY"
          curl -L -f -o "/tmp/$TARBALL" "$URL" || {
            GLIBC="glibc2.17"
            TARBALL="Percona-Server-${PERCONA_VERSION}-Linux.x86_64.${GLIBC}-minimal.tar.gz"
            URL="https://downloads.percona.com/downloads/Percona-Server-${MAJOR_MINOR}/Percona-Server-${PERCONA_VERSION}/binary/tarball/${TARBALL}"
            echo "Retrying with glibc2.17..."
            curl -L -f -o "/tmp/$TARBALL" "$URL"
          }
          ./dbdeployer unpack "/tmp/$TARBALL" --sandbox-binary="$SANDBOX_BINARY"

      - name: Test single sandbox
        run: |
          # Extract version without build suffix for deploy
          VERSION=$(ls "$SANDBOX_BINARY" | head -1)
          echo "Deploying Percona Server $VERSION..."
          ./dbdeployer deploy single "$VERSION" --sandbox-binary="$SANDBOX_BINARY"
          # SELECT VERSION() returns "8.0.36-28" — "Percona" appears in @@version_comment
          ~/sandboxes/msb_*/use -e "SELECT @@version_comment" | grep -i percona
          echo "OK: Percona Server single sandbox works"
          ./dbdeployer delete all --skip-confirm

      - name: Test replication with data verification
        run: |
          VERSION=$(ls "$SANDBOX_BINARY" | head -1)
          echo "Deploying Percona Server $VERSION replication..."
          ./dbdeployer deploy replication "$VERSION" --sandbox-binary="$SANDBOX_BINARY"
          ~/sandboxes/rsandbox_*/test_replication
          echo "OK: Percona Server replication works"
          ./dbdeployer delete all --skip-confirm

      - name: Cleanup
        if: always()
        run: |
          ./dbdeployer delete all --skip-confirm 2>/dev/null || true
          pkill -9 -u "$USER" mysqld 2>/dev/null || true

  # Test MariaDB: single + replication with data verification.
  # One entry per MariaDB release line dbdeployer is verified against.
  # ubuntu-22.04 (glibc 2.35) doubles as the glibc check: 12.x and 13.x
  # binaries need glibc >= 2.28, 11.4 needs >= 2.17.
  mariadb-test:
    name: MariaDB (${{ matrix.mariadb-version }})
    runs-on: ubuntu-22.04
    strategy:
      fail-fast: false
      matrix:
        mariadb-version:
          - '10.11.9'
          - '11.4.13'  # #141: guards the #82 fix against a real 11.4
          - '12.3.3'   # #139
          - '13.0.2'   # #140
    env:
      GO111MODULE: on
      SANDBOX_BINARY: ${{ github.workspace }}/opt/mysql
      MARIADB_VERSION: ${{ matrix.mariadb-version }}
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: '1.23'

      - name: Install system libraries
        run: |
          sudo apt-get update
          sudo apt-get install -y libaio1 libnuma1 libncurses5 socat

      - name: Build dbdeployer
        run: go build -o dbdeployer .

      - name: Download and unpack MariaDB
        run: |
          TARBALL="mariadb-${MARIADB_VERSION}-linux-systemd-x86_64.tar.gz"
          URL="https://archive.mariadb.org/mariadb-${MARIADB_VERSION}/bintar-linux-systemd-x86_64/${TARBALL}"
          echo "Downloading MariaDB ${MARIADB_VERSION}..."
          mkdir -p "$SANDBOX_BINARY"
          curl -L -f -o "/tmp/$TARBALL" "$URL"
          ./dbdeployer unpack "/tmp/$TARBALL" --sandbox-binary="$SANDBOX_BINARY" \
            --unpack-version="$MARIADB_VERSION" --flavor=mariadb

      - name: Test single sandbox
        run: |
          echo "Deploying MariaDB ${MARIADB_VERSION}..."
          ./dbdeployer deploy single "$MARIADB_VERSION" --sandbox-binary="$SANDBOX_BINARY"
          # SELECT VERSION() returns "11.4.9-MariaDB"; use @@version_comment as fallback
          ~/sandboxes/msb_*/use -e "SELECT VERSION()" | grep -i mariadb \
            || ~/sandboxes/msb_*/use -e "SELECT @@version_comment" | grep -i mariadb
          echo "OK: MariaDB single sandbox works"
          ./dbdeployer delete all --skip-confirm

      - name: Test replication with data verification
        run: |
          echo "Deploying MariaDB ${MARIADB_VERSION} replication..."
          ./dbdeployer deploy replication "$MARIADB_VERSION" --sandbox-binary="$SANDBOX_BINARY"
          SBDIR=$(ls -d ~/sandboxes/rsandbox_*)
          # MariaDB rejects CHANGE REPLICATION SOURCE TO (issue #82): the
          # generated script must use the legacy syntax on every major line.
          grep -q "CHANGE MASTER TO" $SBDIR/initialize_slaves \
            || { echo "FAIL: initialize_slaves does not use CHANGE MASTER TO"; exit 1; }
          if grep -q "CHANGE REPLICATION SOURCE" $SBDIR/initialize_slaves; then
            echo "FAIL: initialize_slaves uses MySQL-only CHANGE REPLICATION SOURCE TO"; exit 1
          fi
          # Write on master, verify on slave
          $SBDIR/m -e "CREATE DATABASE ci_test; USE ci_test; CREATE TABLE t1(id INT PRIMARY KEY, val VARCHAR(50)); INSERT INTO t1 VALUES (1, 'mariadb_repl_test');"
          # Wait for replication with retries
          for i in $(seq 1 10); do
            RESULT=$($SBDIR/s1 -BN -e "SELECT val FROM ci_test.t1;" 2>/dev/null) || true
            echo "$RESULT" | grep -q "mariadb_repl_test" && break
            echo "  Waiting for replication... ($i/10)"
            sleep 2
          done
          echo "Replica result: $RESULT"
          echo "$RESULT" | grep -q "mariadb_repl_test" || { echo "FAIL: data not replicated after 20s"; exit 1; }
          echo "OK: MariaDB replication works"
          ./dbdeployer delete all --skip-confirm

      # MariaDB reports wsrep_ready OFF without Galera; issue #142 made every
      # node wait ~120s for it. With 2 nodes the regression takes ~4 minutes.
      - name: Deploy time budget
        env:
          DEPLOY_VERSION: ${{ matrix.mariadb-version }}
          MAX_DEPLOY_SECONDS: 90
        run: ./test/deploy-time-budget.sh

      - name: Cleanup
        if: always()
        run: |
          ./dbdeployer delete all --skip-confirm 2>/dev/null || true
          pkill -9 -u "$USER" mysqld 2>/dev/null || true

  # Test Percona XtraDB Cluster: replication deployment with data verification
  pxc-test:
    name: PXC (${{ matrix.pxc-version }})
    runs-on: ubuntu-22.04
    strategy:
      fail-fast: false
      matrix:
        include:
          - pxc-version: '8.0.27-18.1'
            pxc-tarball-glibc: '2.17'
            pxc-download-series: 'Percona-XtraDB-Cluster-LATEST'
            pxc-download-version: 'Percona-XtraDB-Cluster-8.0.27'
          - pxc-version: '8.4.8-8.1'
            pxc-tarball-glibc: '2.35'
            pxc-download-series: 'Percona-XtraDB-Cluster-84'
            pxc-download-version: 'Percona-XtraDB-Cluster-8.4.8'
    env:
      GO111MODULE: on
      SANDBOX_BINARY: ${{ github.workspace }}/opt/mysql
      PXC_VERSION: ${{ matrix.pxc-version }}
      PXC_TARBALL_GLIBC: ${{ matrix.pxc-tarball-glibc }}
      PXC_DOWNLOAD_SERIES: ${{ matrix.pxc-download-series }}
      PXC_DOWNLOAD_VERSION: ${{ matrix.pxc-download-version }}
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: '1.23'

      - name: Install system libraries
        run: |
          sudo apt-get update
          sudo apt-get install -y libaio1 libnuma1 libncurses5 libldap-2.5-0 socat

      - name: Provide LDAP compatibility shim
        run: |
          sudo ldconfig
          LDAP_LIB=$(ldconfig -p | awk '
            /libldap[^ ]*\.so\./ && $NF !~ /libldap_r-2\.4\.so\.2$/ {
              print $NF
              exit
            }')
          if [ -z "$LDAP_LIB" ] || [ ! -e "$LDAP_LIB" ]; then
            LDAP_LIB=$(find /usr/lib /lib -type f -name 'libldap*.so*' ! -name 'libldap_r-2.4.so.2' | sort | head -1)
          fi
          if [ -z "$LDAP_LIB" ] || [ ! -e "$LDAP_LIB" ]; then
            echo "Unable to locate a libldap shared object" >&2
            ldconfig -p | grep ldap >&2 || true
            find /usr/lib /lib -name 'libldap*.so*' | sort >&2 || true
            exit 1
          fi
          sudo ln -sf "$LDAP_LIB" /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2
          sudo ln -sf "$LDAP_LIB" /lib/x86_64-linux-gnu/libldap_r-2.4.so.2
          sudo ldconfig

      - name: Build dbdeployer
        run: go build -o dbdeployer .

      - name: Download and unpack PXC
        run: |
          TARBALL="Percona-XtraDB-Cluster_${PXC_VERSION}_Linux.x86_64.glibc${PXC_TARBALL_GLIBC}-minimal.tar.gz"
          URL="https://downloads.percona.com/downloads/${PXC_DOWNLOAD_SERIES}/${PXC_DOWNLOAD_VERSION}/binary/tarball/$TARBALL"
          echo "Downloading Percona XtraDB Cluster ${PXC_VERSION}..."
          mkdir -p "$SANDBOX_BINARY"
          curl -L -f --retry 5 --retry-all-errors --retry-delay 2 -o "/tmp/$TARBALL" "$URL"
          ./dbdeployer unpack "/tmp/$TARBALL" --sandbox-binary="$SANDBOX_BINARY"

      - name: Test replication deployment
        run: |
          VERSION=$(ls "$SANDBOX_BINARY" | head -1)
          echo "Deploying PXC $VERSION..."
          ./dbdeployer deploy replication "$VERSION" --topology=pxc --sandbox-binary="$SANDBOX_BINARY"
          SBDIR=$(ls -d ~/sandboxes/pxc_msb_*)
          echo "Waiting for PXC nodes to be ready..."
          for i in $(seq 1 30); do
            "$SBDIR/check_nodes" && break
            sleep 2
          done
          "$SBDIR/check_nodes"
          # Ensure the primary is application-ready before any grants/DML
          for i in $(seq 1 30); do
            "$SBDIR/n1" -BN -e "SHOW STATUS LIKE 'wsrep_ready';" 2>/dev/null | grep -qi 'ON' && break
            echo "  Waiting for wsrep_ready on n1... ($i/30)"
            sleep 2
          done
          "$SBDIR/n1" -e "CREATE DATABASE ci_test; USE ci_test; CREATE TABLE t1(id INT PRIMARY KEY, val VARCHAR(50)); INSERT INTO t1 VALUES (1, 'pxc_ci_test');"
          for i in $(seq 1 10); do
            RESULT=$("$SBDIR/n3" -BN -e "SELECT val FROM ci_test.t1;" 2>/dev/null) || true
            echo "$RESULT" | grep -q "pxc_ci_test" && break
            echo "  Waiting for PXC replication... ($i/10)"
            sleep 2
          done
          echo "$RESULT" | grep -q "pxc_ci_test" || { echo "FAIL: data not replicated after 20s"; exit 1; }
          echo "OK: PXC replication works"

      - name: Cleanup
        if: always()
        run: |
          ./dbdeployer delete all --skip-confirm 2>/dev/null || true
          pkill -9 -u "$USER" mysqld 2>/dev/null || true

  # Test MariaDB Galera: replication deployment with data verification
  mariadb-galera-test:
    name: MariaDB Galera (${{ matrix.mariadb-galera-version }})
    runs-on: ubuntu-22.04
    strategy:
      fail-fast: false
      matrix:
        include:
          - mariadb-galera-version: '10.11.16'
            legacy-openssl: true
          - mariadb-galera-version: '11.8.6'
            legacy-openssl: true
    env:
      GO111MODULE: on
      SANDBOX_BINARY: ${{ github.workspace }}/opt/mysql
      MARIADB_GALERA_VERSION: ${{ matrix.mariadb-galera-version }}
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: '1.23'

      - name: Install system libraries
        run: |
          sudo apt-get update
          sudo apt-get install -y libaio1 libnuma1 libncurses5 libldap-2.5-0 socat

      - name: Install legacy OpenSSL 1.0
        if: ${{ matrix.legacy-openssl }}
        run: |
          echo "deb [trusted=yes] http://archive.ubuntu.com/ubuntu bionic-security main" | sudo tee /etc/apt/sources.list.d/bionic-security.list
          sudo apt-get update
          sudo apt-get install -y libssl1.0.0

      - name: Provide LDAP compatibility shim
        run: |
          sudo ldconfig
          LDAP_LIB=$(ldconfig -p | awk '
            /libldap[^ ]*\.so\./ && $NF !~ /libldap_r-2\.4\.so\.2$/ {
              print $NF
              exit
            }')
          if [ -z "$LDAP_LIB" ] || [ ! -e "$LDAP_LIB" ]; then
            LDAP_LIB=$(find /usr/lib /lib -type f -name 'libldap*.so*' ! -name 'libldap_r-2.4.so.2' | sort | head -1)
          fi
          if [ -z "$LDAP_LIB" ] || [ ! -e "$LDAP_LIB" ]; then
            echo "Unable to locate a libldap shared object" >&2
            ldconfig -p | grep ldap >&2 || true
            find /usr/lib /lib -name 'libldap*.so*' | sort >&2 || true
            exit 1
          fi
          sudo ln -sf "$LDAP_LIB" /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2
          sudo ln -sf "$LDAP_LIB" /lib/x86_64-linux-gnu/libldap_r-2.4.so.2
          sudo ldconfig

      - name: Build dbdeployer
        run: go build -o dbdeployer .

      - name: Download and unpack MariaDB Galera tarball
        run: |
          TARBALL="mariadb-${MARIADB_GALERA_VERSION}-linux-systemd-x86_64.tar.gz"
          URL="https://archive.mariadb.org/mariadb-${MARIADB_GALERA_VERSION}/bintar-linux-systemd-x86_64/$TARBALL"
          echo "Downloading MariaDB Galera ${MARIADB_GALERA_VERSION}..."
          mkdir -p "$SANDBOX_BINARY"
          curl -L -f --retry 5 --retry-all-errors --retry-delay 2 -o "/tmp/$TARBALL" "$URL"
          ./dbdeployer unpack "/tmp/$TARBALL" --sandbox-binary="$SANDBOX_BINARY"

      - name: Test replication deployment
        run: |
          VERSION=$(ls "$SANDBOX_BINARY" | head -1)
          echo "Deploying MariaDB Galera $VERSION..."
          ./dbdeployer deploy replication "$VERSION" --topology=galera --sandbox-binary="$SANDBOX_BINARY"
          SBDIR=$(ls -d ~/sandboxes/galera_msb_*)
          echo "Waiting for Galera nodes to be ready..."
          for i in $(seq 1 30); do
            "$SBDIR/check_nodes" && break
            sleep 2
          done
          "$SBDIR/check_nodes"
          # Ensure the primary is application-ready before grants/DML
          for i in $(seq 1 30); do
            "$SBDIR/n1" -BN -e "SHOW STATUS LIKE 'wsrep_ready';" 2>/dev/null | grep -qi 'ON' && break
            echo "  Waiting for wsrep_ready on n1... ($i/30)"
            sleep 2
          done
          "$SBDIR/n1" -e "CREATE DATABASE ci_test; USE ci_test; CREATE TABLE t1(id INT PRIMARY KEY, val VARCHAR(50)); INSERT INTO t1 VALUES (1, 'galera_ci_test');"
          for i in $(seq 1 10); do
            RESULT=$("$SBDIR/n3" -BN -e "SELECT val FROM ci_test.t1;" 2>/dev/null) || true
            echo "$RESULT" | grep -q "galera_ci_test" && break
            sleep 2
          done
          echo "$RESULT" | grep -q "galera_ci_test" || { echo "FAIL: data not replicated after 20s"; exit 1; }
          echo "OK: MariaDB Galera replication works"

      - name: Cleanup
        if: always()
        run: |
          ./dbdeployer delete all --skip-confirm 2>/dev/null || true
          pkill -9 -u "$USER" mysqld 2>/dev/null || true

  # Run the ts (testscript) replication suite against multiple MySQL versions.
  # This tests replication, replication-gtid, and semisync across versions.
  ts-replication-test:
    name: ts Replication Tests
    runs-on: ubuntu-22.04
    env:
      GO111MODULE: on
      SANDBOX_BINARY: ${{ github.workspace }}/opt/mysql
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: '1.23'

      - name: Install system libraries
        run: |
          sudo apt-get update
          sudo apt-get install -y libaio1 libnuma1 libncurses5

      - name: Provide LDAP compatibility shim
        run: |
          sudo ldconfig
          LDAP_LIB=$(ldconfig -p | awk '
            /libldap[^ ]*\.so\./ && $NF !~ /libldap_r-2\.4\.so\.2$/ {
              print $NF
              exit
            }')
          if [ -z "$LDAP_LIB" ] || [ ! -e "$LDAP_LIB" ]; then
            LDAP_LIB=$(find /usr/lib /lib -type f -name 'libldap*.so*' ! -name 'libldap_r-2.4.so.2' | sort | head -1)
          fi
          if [ -z "$LDAP_LIB" ] || [ ! -e "$LDAP_LIB" ]; then
            echo "Unable to locate a libldap shared object" >&2
            ldconfig -p | grep ldap >&2 || true
            find /usr/lib /lib -name 'libldap*.so*' | sort >&2 || true
            exit 1
          fi
          sudo ln -sf "$LDAP_LIB" /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2
          sudo ln -sf "$LDAP_LIB" /lib/x86_64-linux-gnu/libldap_r-2.4.so.2
          sudo ldconfig

      - name: Build dbdeployer
        run: go build -o dbdeployer .

      - name: Download MySQL versions
        run: |
          mkdir -p "$SANDBOX_BINARY"
          for VER in 8.0.42 8.4.8 9.5.0 9.7.2 26.7.0; do
            SHORT="${VER%.*}"
            # MySQL 9.6+ ships Linux tarballs built against glibc2.28 only
            case "$SHORT" in 5.*|8.*|9.[0-5]) GLIBC=2.17 ;; *) GLIBC=2.28 ;; esac
            TARBALL="mysql-${VER}-linux-glibc${GLIBC}-x86_64-minimal.tar.xz"
            echo "Downloading $VER..."
            curl -L -f -s -o "/tmp/$TARBALL" \
              "https://dev.mysql.com/get/Downloads/MySQL-${SHORT}/$TARBALL" \
              || curl -L -f -s -o "/tmp/$TARBALL" \
              "https://downloads.mysql.com/archives/get/p/23/file/$TARBALL"
            ./dbdeployer unpack "/tmp/$TARBALL" --sandbox-binary="$SANDBOX_BINARY"
            rm -f "/tmp/$TARBALL"
          done
          echo "Available versions:"
          ls "$SANDBOX_BINARY"

      - name: Run ts replication tests (MySQL)
        env:
          TEST_SHORT_VERSIONS: "8.0,8.4,9.5,9.7,26.7"
        run: |
          export HOME="$GITHUB_WORKSPACE/home"
          mkdir -p "$HOME/sandboxes" "$HOME/.dbdeployer"
          echo '{}' > "$HOME/.dbdeployer/sandboxes.json"
          # Symlink so ts tests find binaries at ~/opt/mysql
          mkdir -p "$HOME/opt"
          ln -sf "$SANDBOX_BINARY" "$HOME/opt/mysql"
          export PATH="$GITHUB_WORKSPACE:$PATH"
          go test ./ts/ -v -count=1 -run TestReplication -timeout 45m

      - name: Cleanup MySQL
        if: always()
        run: |
          export HOME="$GITHUB_WORKSPACE/home"
          ./dbdeployer delete all --skip-confirm 2>/dev/null || true
          pkill -9 -u "$USER" mysqld 2>/dev/null || true
          rm -rf "$HOME/sandboxes"/*
          echo '{}' > "$HOME/.dbdeployer/sandboxes.json"

      - name: Download and unpack PostgreSQL debs for ts tests (no system install)
        run: |
          # Add PostgreSQL apt repo (PGDG) — required for postgresql-16 on ubuntu-22.04
          sudo apt-get install -y curl ca-certificates
          sudo install -d /usr/share/postgresql-common/pgdg
          sudo curl -o /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc --fail https://www.postgresql.org/media/keys/ACCC4CF8.asc
          echo "deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc] https://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" | sudo tee /etc/apt/sources.list.d/pgdg.list
          sudo apt-get update

          # Install libpq5 only — psql links against it dynamically. We do
          # NOT install postgresql-16 itself, since that would put
          # /usr/share/postgresql/16/ on the runner and mask issue #112.
          sudo apt-get install -y libpq5

          # Documented user flow: download the debs, then unpack via dbdeployer.
          export HOME="$GITHUB_WORKSPACE/home"
          mkdir -p "$HOME"
          apt-get download postgresql-16 postgresql-client-16 libpq5
          ./dbdeployer unpack --provider=postgresql \
            postgresql-16_*.deb postgresql-client-16_*.deb libpq5_*.deb

          # Sanity: confirm no system PG install snuck in via dependencies.
          if [ -d "/usr/share/postgresql/16" ]; then
            echo "FAIL: /usr/share/postgresql/16/ exists — system PG install is masking issue #112"
            exit 1
          fi

      - name: Run ts PostgreSQL tests
        env:
          TEST_SHORT_VERSIONS: "8.4"
        run: |
          export HOME="$GITHUB_WORKSPACE/home"
          mkdir -p "$HOME/sandboxes"
          echo '{}' > "$HOME/.dbdeployer/sandboxes.json"
          export PATH="$GITHUB_WORKSPACE:$PATH"
          go test ./ts/ -v -count=1 -run TestPostgreSQL -timeout 10m

      - name: Cleanup
        if: always()
        run: |
          export HOME="$GITHUB_WORKSPACE/home"
          ./dbdeployer delete all --skip-confirm 2>/dev/null || true
          pkill -9 -u "$USER" mysqld 2>/dev/null || true
          pkill -9 -u "$USER" postgres 2>/dev/null || true

  # Test PostgreSQL provider: deb extraction, single sandbox, replication,
  # cross-database validation.
  postgresql-test:
    name: PostgreSQL ${{ matrix.pg-version }}
    runs-on: ubuntu-22.04
    strategy:
      fail-fast: false
      matrix:
        pg-version: ['16']
    env:
      GO111MODULE: on
      PG_VERSION: ${{ matrix.pg-version }}
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: '1.23'

      - name: Add PostgreSQL apt repo
        run: |
          sudo apt-get update
          sudo apt-get install -y curl ca-certificates
          sudo install -d /usr/share/postgresql-common/pgdg
          sudo curl -o /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc --fail https://www.postgresql.org/media/keys/ACCC4CF8.asc
          echo "deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc] https://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" | sudo tee /etc/apt/sources.list.d/pgdg.list
          sudo apt-get update

      - name: Build dbdeployer
        run: go build -o dbdeployer .

      - name: Download and unpack PostgreSQL debs (no system install)
        run: |
          # Install libpq5 only — psql links against it dynamically at runtime.
          # Deliberately DO NOT install postgresql-${PG_VERSION} or
          # postgresql-client-${PG_VERSION}: that would create
          # /usr/share/postgresql/${PG_VERSION}/ on the runner, which masks
          # issue #112 by letting PG fall back to the absolute compiled-in
          # SHAREDIR rather than exercising dbdeployer's relocation layout.
          sudo apt-get install -y libpq5

          # Documented user flow from README:
          #   apt-get download postgresql-NN postgresql-client-NN libpq5
          #   dbdeployer unpack --provider=postgresql ...
          apt-get download postgresql-${PG_VERSION} postgresql-client-${PG_VERSION} libpq5
          ./dbdeployer unpack --provider=postgresql \
            postgresql-${PG_VERSION}_*.deb \
            postgresql-client-${PG_VERSION}_*.deb \
            libpq5_*.deb
          ls ~/opt/postgresql/

          # Sanity: confirm we did NOT install postgresql-server side-effects.
          # If /usr/share/postgresql/${PG_VERSION}/ exists, the test is no
          # longer exercising the relocation path that issue #112 was about.
          if [ -d "/usr/share/postgresql/${PG_VERSION}" ]; then
            echo "FAIL: /usr/share/postgresql/${PG_VERSION}/ exists — system PG install is masking issue #112"
            exit 1
          fi

      - name: Test init --provider=postgresql
        run: |
          # Run init against isolated dirs, verify it creates them and
          # prints the PostgreSQL setup instructions.
          OUT=$(./dbdeployer init --provider=postgresql \
            --sandbox-binary=/tmp/init-pg-bin \
            --sandbox-home=/tmp/init-pg-home \
            --skip-shell-completion 2>&1)
          echo "$OUT"

          # Verify directories were created
          [ -d /tmp/init-pg-bin ] || { echo "FAIL: sandbox-binary not created"; exit 1; }
          [ -d /tmp/init-pg-home ] || { echo "FAIL: sandbox-home not created"; exit 1; }

          # Verify the Linux-specific PostgreSQL setup instructions were printed
          echo "$OUT" | grep -q "PostgreSQL binaries are not auto-downloaded on Linux" || {
            echo "FAIL: expected Linux PostgreSQL setup instructions in output"
            exit 1
          }
          echo "$OUT" | grep -q "dbdeployer unpack --provider=postgresql" || {
            echo "FAIL: expected unpack instructions in output"
            exit 1
          }

          # Verify it didn't try to download a MySQL tarball
          echo "$OUT" | grep -q "mysql-" && {
            echo "FAIL: output references mysql tarball"
            exit 1
          }

          # Sanity: invalid provider should fail
          ./dbdeployer init --provider=oracle --dry-run \
            --sandbox-binary=/tmp/init-bad \
            --sandbox-home=/tmp/init-bad-home 2>&1 | grep -q "unknown provider" || {
            echo "FAIL: invalid provider did not error as expected"
            exit 1
          }

          # Cleanup init side-effects so the rest of the job uses its own dirs
          rm -rf /tmp/init-pg-bin /tmp/init-pg-home /tmp/init-bad /tmp/init-bad-home
          # Restore sandbox defaults so subsequent steps find ~/opt/postgresql
          ./dbdeployer defaults update sandbox-binary "$HOME/opt/mysql"
          ./dbdeployer defaults update sandbox-home "$HOME/sandboxes"
          echo "OK: dbdeployer init --provider=postgresql works"

      - name: Test deploy postgresql (single)
        run: |
          PG_FULL=$(ls ~/opt/postgresql/ | head -1)
          echo "=== Deploying PostgreSQL $PG_FULL single ==="
          ./dbdeployer deploy postgresql "$PG_FULL"
          echo "=== Connecting ==="
          ~/sandboxes/pg_sandbox_*/use -c "SELECT version();"
          echo "=== Status ==="
          ~/sandboxes/pg_sandbox_*/status
          echo "=== Stop + Start ==="
          ~/sandboxes/pg_sandbox_*/stop
          ~/sandboxes/pg_sandbox_*/start
          # Wait for PostgreSQL to be ready with retries
          for i in $(seq 1 10); do
            ~/sandboxes/pg_sandbox_*/use -c "SELECT 1;" 2>/dev/null && break
            echo "  Waiting for PostgreSQL to start... ($i/10)"
            sleep 2
          done
          ~/sandboxes/pg_sandbox_*/use -c "SELECT 1;" || { echo "FAIL: PostgreSQL not ready after 20s"; exit 1; }
          echo "=== Cleanup ==="
          ~/sandboxes/pg_sandbox_*/stop
          rm -rf ~/sandboxes/pg_sandbox_*

      - name: Test deploy replication --provider=postgresql
        run: |
          PG_FULL=$(ls ~/opt/postgresql/ | head -1)
          echo "=== Deploying PostgreSQL $PG_FULL replication ==="
          ./dbdeployer deploy replication "$PG_FULL" --provider=postgresql --nodes=3
          echo "=== Checking topology dir ==="
          ls ~/sandboxes/postgresql_repl_*/
          echo "=== Check replication ==="
          bash ~/sandboxes/postgresql_repl_*/check_replication || true
          echo "=== Check recovery ==="
          bash ~/sandboxes/postgresql_repl_*/check_recovery || true
          echo "=== Primary: write test ==="
          ~/sandboxes/postgresql_repl_*/primary/use -c "CREATE TABLE test_repl(id serial, val text); INSERT INTO test_repl(val) VALUES ('hello');"
          echo "=== Replica 1: read test ==="
          # Wait for replication to replica1 with retries
          for i in $(seq 1 10); do
            RESULT=$(~/sandboxes/postgresql_repl_*/replica1/use -c "SELECT val FROM test_repl;" 2>/dev/null) || true
            echo "$RESULT" | grep -q "hello" && break
            echo "  Waiting for replication to replica1... ($i/10)"
            sleep 2
          done
          echo "$RESULT" | grep -q "hello" || { echo "FAIL: data not replicated to replica1 after 20s"; exit 1; }
          ~/sandboxes/postgresql_repl_*/replica1/use -c "SELECT * FROM test_repl;"
          echo "=== Replica 2: read test ==="
          # Wait for replication to replica2 with retries
          for i in $(seq 1 10); do
            RESULT=$(~/sandboxes/postgresql_repl_*/replica2/use -c "SELECT val FROM test_repl;" 2>/dev/null) || true
            echo "$RESULT" | grep -q "hello" && break
            echo "  Waiting for replication to replica2... ($i/10)"
            sleep 2
          done
          echo "$RESULT" | grep -q "hello" || { echo "FAIL: data not replicated to replica2 after 20s"; exit 1; }
          ~/sandboxes/postgresql_repl_*/replica2/use -c "SELECT * FROM test_repl;"

      - name: Cleanup replication before multiple test
        run: |
          pkill -9 -u "$USER" postgres 2>/dev/null || true
          rm -rf ~/sandboxes/postgresql_repl_*
          sleep 3

      - name: Test deploy multiple --provider=postgresql
        run: |
          PG_FULL=$(ls ~/opt/postgresql/ | head -1)
          echo "=== Deploying PostgreSQL $PG_FULL multiple (3 nodes) ==="
          ./dbdeployer deploy multiple "$PG_FULL" --provider=postgresql --nodes=3
          echo "=== Waiting for nodes to start ==="
          sleep 5
          echo "=== Checking sandbox dirs ==="
          ls ~/sandboxes/postgresql_multi_*/
          echo "=== Connect to node1 ==="
          ~/sandboxes/postgresql_multi_*/node1/use -c "SELECT version();"
          echo "=== Connect to node2 ==="
          ~/sandboxes/postgresql_multi_*/node2/use -c "SELECT version();"
          echo "=== Connect to node3 ==="
          ~/sandboxes/postgresql_multi_*/node3/use -c "SELECT version();"
          echo "=== Cleanup ==="
          for dir in ~/sandboxes/postgresql_multi_*; do
            [ -d "$dir" ] && bash "$dir/stop" 2>/dev/null || true
            rm -rf "$dir"
          done

      - name: Test cross-database validation
        run: |
          PG_FULL=$(ls ~/opt/postgresql/ | head -1)
          echo "=== Test: --flavor with --provider=postgresql should fail ==="
          if ./dbdeployer deploy single "$PG_FULL" --provider=postgresql --flavor=ndb 2>&1; then
            echo "ERROR: should have failed"
            exit 1
          else
            echo "OK: correctly rejected --flavor with --provider=postgresql"
          fi

      - name: Cleanup
        if: always()
        run: |
          for dir in ~/sandboxes/pg_sandbox_* ~/sandboxes/postgresql_*; do
            [ -d "$dir" ] && bash "$dir/stop" 2>/dev/null || true
            rm -rf "$dir"
          done 2>/dev/null || true
          pkill -9 -u "$USER" postgres 2>/dev/null || true

  # Test PostgreSQL support on macOS via Postgres.app (#85).
  # `dbdeployer init --provider=postgresql` on macOS downloads a Postgres.app
  # single-version .dmg, mounts it with hdiutil, and extracts bin/lib/share
  # into ~/opt/postgresql/<major>/. This job verifies the full happy path
  # end-to-end: init → directory layout → deploy single → SELECT.
  postgresql-macos-test:
    name: PostgreSQL on ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [macos-14, macos-15]
    env:
      GO111MODULE: on
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: '1.23'

      - name: Build dbdeployer
        run: go build -o dbdeployer .

      - name: init --provider=postgresql (downloads Postgres.app)
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Clean slate — no ~/opt/postgresql yet.
          rm -rf "$HOME/opt/postgresql" "$HOME/sandboxes-pg-mac"
          ./dbdeployer init --provider=postgresql \
            --sandbox-home="$HOME/sandboxes-pg-mac" \
            --skip-shell-completion

          # Verify binaries landed under ~/opt/postgresql/<X.Y>/bin
          INSTALL_DIR=$(ls -d "$HOME/opt/postgresql"/*/ 2>/dev/null | head -1)
          [ -n "$INSTALL_DIR" ] || { echo "FAIL: no version directory under ~/opt/postgresql"; exit 1; }
          echo "Install dir: $INSTALL_DIR"
          for bin in postgres initdb pg_ctl psql pg_basebackup; do
            [ -x "${INSTALL_DIR}bin/$bin" ] || { echo "FAIL: missing $bin at ${INSTALL_DIR}bin/"; exit 1; }
          done
          "${INSTALL_DIR}bin/postgres" --version
          "${INSTALL_DIR}bin/psql" --version

          # Check the directory name is in X.Y format
          PG_VERSION=$(basename "${INSTALL_DIR%/}")
          echo "$PG_VERSION" | grep -Eq '^[0-9]+\.[0-9]+$' || {
            echo "FAIL: expected X.Y version dir, got: $PG_VERSION"
            exit 1
          }

      - name: Deploy PostgreSQL single sandbox
        run: |
          # Discover the X.Y version that init installed
          PG_VERSION=$(basename "$(ls -d "$HOME/opt/postgresql"/*/ | head -1 | sed 's:/$::')")
          echo "Deploying PostgreSQL $PG_VERSION"
          ./dbdeployer deploy postgresql "$PG_VERSION" \
            --sandbox-home="$HOME/sandboxes-pg-mac"
          # Discover the sandbox directory
          SBDIR=$(ls -d "$HOME/sandboxes-pg-mac"/pg_sandbox_* | head -1)
          echo "Sandbox: $SBDIR"
          "$SBDIR/use" -c "SELECT version();"
          "$SBDIR/status"

      - name: Write + read smoke test
        run: |
          SBDIR=$(ls -d "$HOME/sandboxes-pg-mac"/pg_sandbox_* | head -1)
          "$SBDIR/use" -c "CREATE TABLE mac_smoke(id serial, val text); INSERT INTO mac_smoke(val) VALUES ('hello_from_macos');"
          RESULT=$("$SBDIR/use" -c "SELECT val FROM mac_smoke;" 2>&1)
          echo "$RESULT"
          echo "$RESULT" | grep -q "hello_from_macos" || { echo "FAIL: select did not return inserted row"; exit 1; }

      - name: Cleanup
        if: always()
        run: |
          for dir in "$HOME"/sandboxes-pg-mac/pg_sandbox_*; do
            [ -d "$dir" ] && bash "$dir/stop" 2>/dev/null || true
          done 2>/dev/null || true
          pkill -9 -u "$USER" postgres 2>/dev/null || true

  # Test InnoDB Cluster topology with MySQL Shell + MySQL Router
  innodb-cluster-test:
    name: InnoDB Cluster (${{ matrix.mysql-version }})
    runs-on: ubuntu-22.04
    strategy:
      fail-fast: false
      matrix:
        mysql-version:
          - '8.4.8'
          - '9.5.0'
          # Shell and Router 9.7.2 were not released (9.7.1 is the latest)
          - '26.7.0'
    env:
      GO111MODULE: on
      SANDBOX_BINARY: ${{ github.workspace }}/opt/mysql
      MYSQL_VERSION: ${{ matrix.mysql-version }}
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: '1.23'

      - name: Install system libraries
        run: |
          sudo apt-get update
          sudo apt-get install -y libaio1 libnuma1 libncurses5 libprotobuf-lite23

      - name: Build dbdeployer
        run: go build -o dbdeployer .

      - name: Cache MySQL tarball
        uses: actions/cache@v4
        with:
          path: /tmp/mysql-tarball
          key: mysql-${{ matrix.mysql-version }}-linux-x86_64-v2

      - name: Download MySQL Server
        env:
          SHORT_VER_ENV: ${{ matrix.mysql-version }}
        run: |
          SHORT_VER="${SHORT_VER_ENV%.*}"
          # MySQL 9.6+ ships Linux tarballs built against glibc2.28 only
          case "$SHORT_VER" in 5.*|8.*|9.[0-5]) GLIBC=2.17 ;; *) GLIBC=2.28 ;; esac
          TARBALL="mysql-${MYSQL_VERSION}-linux-glibc${GLIBC}-x86_64.tar.xz"
          mkdir -p /tmp/mysql-tarball
          if [ ! -f "/tmp/mysql-tarball/$TARBALL" ]; then
            curl -L -f -o "/tmp/mysql-tarball/$TARBALL" \
              "https://dev.mysql.com/get/Downloads/MySQL-${SHORT_VER}/$TARBALL"
          fi
          mkdir -p "$SANDBOX_BINARY"
          ./dbdeployer unpack "/tmp/mysql-tarball/$TARBALL" --sandbox-binary="$SANDBOX_BINARY"

      - name: Download and install MySQL Shell
        env:
          SHORT_VER_ENV: ${{ matrix.mysql-version }}
        run: |
          SHORT_VER="${SHORT_VER_ENV%.*}"
          case "$SHORT_VER" in 5.*|8.*|9.[0-5]) GLIBC=2.17 ;; *) GLIBC=2.28 ;; esac
          SHELL_TARBALL="mysql-shell-${MYSQL_VERSION}-linux-glibc${GLIBC}-x86-64bit.tar.gz"
          echo "Downloading MySQL Shell ${MYSQL_VERSION}..."
          curl -L -f -o "/tmp/$SHELL_TARBALL" \
            "https://dev.mysql.com/get/Downloads/MySQL-Shell-${SHORT_VER}/$SHELL_TARBALL"
          tar xzf "/tmp/$SHELL_TARBALL" -C /tmp/
          SHELL_DIR=$(ls -d /tmp/mysql-shell-${MYSQL_VERSION}* | head -1)
          cp "$SHELL_DIR/bin/mysqlsh" "$SANDBOX_BINARY/${MYSQL_VERSION}/bin/"
          # Copy mysqlsh bundled directories (mysqlsh expects lib/mysqlsh/ and libexec/ to exist)
          cp -a "$SHELL_DIR/lib/mysqlsh" "$SANDBOX_BINARY/${MYSQL_VERSION}/lib/mysqlsh"
          mkdir -p "$SANDBOX_BINARY/${MYSQL_VERSION}/libexec"
          cp -a "$SHELL_DIR/libexec/mysqlsh" "$SANDBOX_BINARY/${MYSQL_VERSION}/libexec/mysqlsh"
          mkdir -p "$SANDBOX_BINARY/${MYSQL_VERSION}/share"
          cp -a "$SHELL_DIR/share/mysqlsh" "$SANDBOX_BINARY/${MYSQL_VERSION}/share/mysqlsh" 2>/dev/null || true
          echo "mysqlsh installed at $SANDBOX_BINARY/${MYSQL_VERSION}/bin/mysqlsh"

      - name: Download and install MySQL Router
        env:
          SHORT_VER_ENV: ${{ matrix.mysql-version }}
        run: |
          SHORT_VER="${SHORT_VER_ENV%.*}"
          case "$SHORT_VER" in 5.*|8.*|9.[0-5]) GLIBC=2.17 ;; *) GLIBC=2.28 ;; esac
          ROUTER_TARBALL="mysql-router-${MYSQL_VERSION}-linux-glibc${GLIBC}-x86_64.tar.xz"
          echo "Downloading MySQL Router ${MYSQL_VERSION}..."
          curl -L -f -o "/tmp/$ROUTER_TARBALL" \
            "https://dev.mysql.com/get/Downloads/MySQL-Router-${SHORT_VER}/$ROUTER_TARBALL"
          tar xJf "/tmp/$ROUTER_TARBALL" -C /tmp/
          ROUTER_DIR=$(ls -d /tmp/mysql-router-${MYSQL_VERSION}* | head -1)
          cp "$ROUTER_DIR/bin/mysqlrouter" "$SANDBOX_BINARY/${MYSQL_VERSION}/bin/"
          cp -r "$ROUTER_DIR/lib/." "$SANDBOX_BINARY/${MYSQL_VERSION}/lib/" 2>/dev/null || true
          echo "mysqlrouter installed at $SANDBOX_BINARY/${MYSQL_VERSION}/bin/mysqlrouter"

      - name: Install ProxySQL
        run: |
          PROXYSQL_VERSION="3.0.6"
          wget -nv -O /tmp/proxysql.deb \
            "https://github.com/sysown/proxysql/releases/download/v${PROXYSQL_VERSION}/proxysql_${PROXYSQL_VERSION}-ubuntu22_amd64.deb"
          mkdir -p /tmp/proxysql-extract
          dpkg-deb -x /tmp/proxysql.deb /tmp/proxysql-extract
          sudo cp /tmp/proxysql-extract/usr/bin/proxysql /usr/local/bin/proxysql
          sudo chmod +x /usr/local/bin/proxysql

      - name: Test InnoDB Cluster with MySQL Router
        run: |
          echo "=== Deploy InnoDB Cluster ${MYSQL_VERSION} with Router ==="
          ./dbdeployer deploy replication "$MYSQL_VERSION" \
            --topology=innodb-cluster \
            --sandbox-binary="$SANDBOX_BINARY" \
            --nodes=3 \
            || { cat ~/sandboxes/ic_msb_*/init_cluster.log 2>/dev/null; exit 1; }

          echo "=== Verify cluster status ==="
          ~/sandboxes/ic_msb_*/check_cluster

          echo "=== Functional test: write on primary, read on all nodes ==="
          # Find the primary node (node1)
          SBDIR=$(ls -d ~/sandboxes/ic_msb_*)
          $SBDIR/node1/use -e "CREATE DATABASE ic_test; USE ic_test; CREATE TABLE t1 (id INT AUTO_INCREMENT PRIMARY KEY, val VARCHAR(100)); INSERT INTO t1 (val) VALUES ('hello_from_primary');"
          echo "--- Read from node2 (should see replicated data) ---"
          # Wait for replication with retries
          for i in $(seq 1 10); do
            RESULT=$($SBDIR/node2/use -e "SELECT val FROM ic_test.t1;" 2>/dev/null) || true
            echo "$RESULT" | grep -q "hello_from_primary" && break
            echo "  Waiting for replication... ($i/10)"
            sleep 2
          done
          echo "$RESULT"
          echo "$RESULT" | grep -q "hello_from_primary" || { echo "FAIL: data not replicated to node2 after 20s"; exit 1; }
          echo "--- Read from node3 ---"
          # Wait for replication with retries
          for i in $(seq 1 10); do
            RESULT=$($SBDIR/node3/use -e "SELECT val FROM ic_test.t1;" 2>/dev/null) || true
            echo "$RESULT" | grep -q "hello_from_primary" && break
            echo "  Waiting for replication... ($i/10)"
            sleep 2
          done
          echo "$RESULT"
          echo "$RESULT" | grep -q "hello_from_primary" || { echo "FAIL: data not replicated to node3 after 20s"; exit 1; }

          echo "=== Functional test: connect through MySQL Router (R/W) ==="
          ROUTER_RW_PORT=$(grep -A5 '\[routing:bootstrap_rw\]' $SBDIR/router/mysqlrouter.conf 2>/dev/null | grep 'bind_port' | awk -F= '{print $2}' | tr -d ' ')
          if [ -n "$ROUTER_RW_PORT" ]; then
            echo "Router R/W port: $ROUTER_RW_PORT"
            $SBDIR/node1/use -h 127.0.0.1 -P "$ROUTER_RW_PORT" -e "INSERT INTO ic_test.t1 (val) VALUES ('via_router');"
            # Wait for replication with retries
            for i in $(seq 1 10); do
              RESULT=$($SBDIR/node2/use -e "SELECT val FROM ic_test.t1 WHERE val='via_router';" 2>/dev/null) || true
              echo "$RESULT" | grep -q "via_router" && break
              echo "  Waiting for replication... ($i/10)"
              sleep 2
            done
            echo "$RESULT"
            echo "$RESULT" | grep -q "via_router" || { echo "FAIL: write through Router not replicated after 20s"; exit 1; }
            echo "OK: Router R/W connection works and replication verified"
          else
            echo "WARN: Could not determine Router R/W port, skipping Router R/W connection test"
          fi

          echo "=== Functional test: connect through MySQL Router (R/O) ==="
          ROUTER_RO_PORT=$(grep -A5 '\[routing:bootstrap_ro\]' $SBDIR/router/mysqlrouter.conf 2>/dev/null | grep 'bind_port' | awk -F= '{print $2}' | tr -d ' ')
          if [ -n "$ROUTER_RO_PORT" ]; then
            echo "Router R/O port: $ROUTER_RO_PORT"
            RESULT=$($SBDIR/node1/use -h 127.0.0.1 -P "$ROUTER_RO_PORT" -e "SELECT val FROM ic_test.t1 WHERE val='hello_from_primary';" 2>&1) || true
            echo "$RESULT"
            echo "$RESULT" | grep -q "hello_from_primary" || { echo "FAIL: SELECT through Router R/O port failed"; exit 1; }
            echo "OK: Router R/O SELECT succeeded"
          else
            echo "WARN: Could not determine Router R/O port, skipping Router R/O connection test"
          fi

          echo "=== Cleanup ==="
          ./dbdeployer delete all --skip-confirm

      - name: Test InnoDB Cluster with --skip-router + write/read verification
        run: |
          echo "=== Deploy InnoDB Cluster ${MYSQL_VERSION} without Router ==="
          ./dbdeployer deploy replication "$MYSQL_VERSION" \
            --topology=innodb-cluster \
            --skip-router \
            --sandbox-binary="$SANDBOX_BINARY" \
            --nodes=3 \
            || { cat ~/sandboxes/ic_msb_*/init_cluster.log 2>/dev/null; exit 1; }

          echo "=== Verify cluster status ==="
          ~/sandboxes/ic_msb_*/check_cluster

          echo "=== Functional test: write/read across cluster ==="
          SBDIR=$(ls -d ~/sandboxes/ic_msb_*)
          $SBDIR/node1/use -e "CREATE DATABASE skiprt_test; USE skiprt_test; CREATE TABLE t1 (id INT AUTO_INCREMENT PRIMARY KEY, msg TEXT); INSERT INTO t1 (msg) VALUES ('skip_router_test');"
          # Wait for replication with retries
          for i in $(seq 1 10); do
            RESULT=$($SBDIR/node3/use -e "SELECT msg FROM skiprt_test.t1;" 2>/dev/null) || true
            echo "$RESULT" | grep -q "skip_router_test" && break
            echo "  Waiting for replication... ($i/10)"
            sleep 2
          done
          echo "$RESULT"
          echo "$RESULT" | grep -q "skip_router_test" || { echo "FAIL: data not replicated after 20s"; exit 1; }
          echo "OK: InnoDB Cluster replication works without Router"

          echo "=== Cleanup ==="
          ./dbdeployer delete all --skip-confirm

      - name: Test InnoDB Cluster with ProxySQL (instead of Router)
        run: |
          echo "=== Deploy InnoDB Cluster ${MYSQL_VERSION} + ProxySQL ==="
          ./dbdeployer deploy replication "$MYSQL_VERSION" \
            --topology=innodb-cluster \
            --skip-router \
            --with-proxysql \
            --sandbox-binary="$SANDBOX_BINARY" \
            --nodes=3 \
            || { cat ~/sandboxes/ic_msb_*/init_cluster.log 2>/dev/null; exit 1; }

          echo "=== Verify cluster status ==="
          ~/sandboxes/ic_msb_*/check_cluster

          echo "=== Verify ProxySQL sees the backend servers ==="
          SBDIR=$(ls -d ~/sandboxes/ic_msb_*)
          SERVERS=$($SBDIR/proxysql/use -e "SELECT hostname, port, hostgroup_id, status FROM runtime_mysql_servers;" 2>&1)
          echo "$SERVERS"
          # Verify at least 2 servers are ONLINE
          ONLINE_COUNT=$(echo "$SERVERS" | grep -c "ONLINE" || true)
          echo "Online servers: $ONLINE_COUNT"
          [ "$ONLINE_COUNT" -ge 2 ] || { echo "FAIL: expected at least 2 ONLINE servers in ProxySQL"; exit 1; }

          echo "=== Functional test: write through ProxySQL ==="
          $SBDIR/proxysql/use_proxy -e "CREATE DATABASE proxy_ic_test; USE proxy_ic_test; CREATE TABLE t1 (id INT AUTO_INCREMENT PRIMARY KEY, val VARCHAR(100)); INSERT INTO t1 (val) VALUES ('via_proxysql');"
          echo "--- Verify on node2 directly ---"
          # Wait for replication with retries
          for i in $(seq 1 10); do
            RESULT=$($SBDIR/node2/use -e "SELECT val FROM proxy_ic_test.t1;" 2>/dev/null) || true
            echo "$RESULT" | grep -q "via_proxysql" && break
            echo "  Waiting for replication... ($i/10)"
            sleep 2
          done
          echo "$RESULT"
          echo "$RESULT" | grep -q "via_proxysql" || { echo "FAIL: write through ProxySQL not replicated after 20s"; exit 1; }
          echo "OK: ProxySQL -> InnoDB Cluster write + replication verified"

      - name: Cleanup
        if: always()
        run: |
          ./dbdeployer delete all --skip-confirm 2>/dev/null || true
          pkill -9 -u "$USER" mysqld 2>/dev/null || true
          pkill -9 -u "$USER" mysqlrouter 2>/dev/null || true
          pkill -9 -u "$USER" proxysql 2>/dev/null || true

  # Test the "downloads get-by-version" + "unpack" flow that users follow
  # from the quickstart guide. This catches registry gaps and download issues.
  downloads-test:
    name: Downloads get-by-version (${{ matrix.short-version }})
    runs-on: ubuntu-22.04
    strategy:
      fail-fast: false
      matrix:
        short-version:
          - '8.4'
          - '9.5'
          - '9.7'
          - '26.7'
    env:
      GO111MODULE: on
      SANDBOX_BINARY: ${{ github.workspace }}/opt/mysql
      SHORT_VERSION: ${{ matrix.short-version }}
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: '1.23'

      - name: Install system libraries
        run: |
          sudo apt-get update
          sudo apt-get install -y libaio1 libnuma1 libncurses5

      - name: Build dbdeployer
        run: go build -o dbdeployer .

      - name: Test downloads get-by-version
        run: |
          echo "=== Testing: dbdeployer downloads get-by-version $SHORT_VERSION ==="
          ./dbdeployer downloads get-by-version "$SHORT_VERSION" --newest --minimal
          echo "=== Download complete ==="
          ls -lh mysql-*.tar.*

      - name: Test unpack
        run: |
          TARBALL=$(ls mysql-*.tar.* | head -1)
          echo "=== Unpacking: $TARBALL ==="
          mkdir -p "$SANDBOX_BINARY"
          ./dbdeployer unpack "$TARBALL" --sandbox-binary="$SANDBOX_BINARY"
          echo "=== Available versions ==="
          ./dbdeployer versions --sandbox-binary="$SANDBOX_BINARY"

      - name: Test deploy from downloaded binary
        run: |
          VERSION=$(./dbdeployer versions --sandbox-binary="$SANDBOX_BINARY" | grep -oP '\d+\.\d+\.\d+' | head -1)
          echo "=== Deploying: $VERSION ==="
          ./dbdeployer deploy single "$VERSION" --sandbox-binary="$SANDBOX_BINARY"
          ~/sandboxes/msb_*/use -e "SELECT VERSION()"
          ./dbdeployer delete all --skip-confirm

      - name: Cleanup
        if: always()
        run: |
          ./dbdeployer delete all --skip-confirm 2>/dev/null || true
          pkill -9 -u "$USER" mysqld 2>/dev/null || true

  # Test group replication topologies: single-primary and multi-primary (#64)
  group-replication-test:
    name: Group Replication (${{ matrix.mysql-version }})
    runs-on: ubuntu-22.04
    strategy:
      fail-fast: false
      matrix:
        mysql-version:
          - '8.4.8'
          - '9.7.2'
          - '26.7.0'
    env:
      GO111MODULE: on
      SANDBOX_BINARY: ${{ github.workspace }}/opt/mysql
      MYSQL_VERSION: ${{ matrix.mysql-version }}
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: '1.23'

      - name: Install system libraries
        run: |
          sudo apt-get update
          sudo apt-get install -y libaio1 libnuma1 libncurses5

      - name: Build dbdeployer
        run: go build -o dbdeployer .

      - name: Cache MySQL tarball
        uses: actions/cache@v4
        with:
          path: /tmp/mysql-tarball
          key: mysql-${{ matrix.mysql-version }}-linux-x86_64-v1

      - name: Download and unpack MySQL
        env:
          SHORT_VER_ENV: ${{ matrix.mysql-version }}
        run: |
          SHORT_VER="${SHORT_VER_ENV%.*}"
          # MySQL 9.6+ ships Linux tarballs built against glibc2.28 only
          case "$SHORT_VER" in 5.*|8.*|9.[0-5]) GLIBC=2.17 ;; *) GLIBC=2.28 ;; esac
          TARBALL="mysql-${MYSQL_VERSION}-linux-glibc${GLIBC}-x86_64.tar.xz"
          mkdir -p /tmp/mysql-tarball
          if [ ! -f "/tmp/mysql-tarball/$TARBALL" ]; then
            curl -L -f -o "/tmp/mysql-tarball/$TARBALL" \
              "https://dev.mysql.com/get/Downloads/MySQL-${SHORT_VER}/$TARBALL"
          fi
          mkdir -p "$SANDBOX_BINARY"
          ./dbdeployer unpack "/tmp/mysql-tarball/$TARBALL" --sandbox-binary="$SANDBOX_BINARY"

      - name: Test group replication (single-primary)
        run: |
          echo "=== Deploy group replication single-primary ${MYSQL_VERSION} ==="
          ./dbdeployer deploy replication "$MYSQL_VERSION" \
            --topology=group \
            --sandbox-binary="$SANDBOX_BINARY" \
            --nodes=3

          SBDIR=$(ls -d ~/sandboxes/group_msb_*)
          echo "=== Verify all nodes ONLINE ==="
          ONLINE_COUNT=$($SBDIR/node1/use -BN -e "SELECT COUNT(*) FROM performance_schema.replication_group_members WHERE MEMBER_STATE='ONLINE';" 2>&1)
          echo "Online members: $ONLINE_COUNT"
          [ "$ONLINE_COUNT" -eq 3 ] || { echo "FAIL: expected 3 ONLINE members, got $ONLINE_COUNT"; exit 1; }

          echo "=== Identify primary ==="
          PRIMARY_PORT=$($SBDIR/node1/use -BN -e "SELECT @@port;" 2>&1)
          IS_PRIMARY=$($SBDIR/node1/use -BN -e "SELECT COUNT(*) FROM performance_schema.replication_group_members WHERE MEMBER_ROLE='PRIMARY' AND MEMBER_PORT=$PRIMARY_PORT;" 2>&1)
          echo "node1 is primary: $IS_PRIMARY"

          echo "=== Write on primary (node1), read on secondary (node2) ==="
          $SBDIR/node1/use -e "CREATE DATABASE gr_test; USE gr_test; CREATE TABLE t1 (id INT AUTO_INCREMENT PRIMARY KEY, val VARCHAR(100)); INSERT INTO t1 (val) VALUES ('single_primary_write');"
          # Wait for replication to node2 with retries
          for i in $(seq 1 10); do
            RESULT=$($SBDIR/node2/use -BN -e "SELECT val FROM gr_test.t1;" 2>/dev/null) || true
            echo "$RESULT" | grep -q "single_primary_write" && break
            echo "  Waiting for replication... ($i/10)"
            sleep 2
          done
          echo "node2 result: $RESULT"
          echo "$RESULT" | grep -q "single_primary_write" || { echo "FAIL: data not replicated to node2 after 20s"; exit 1; }
          # Wait for replication to node3 with retries
          for i in $(seq 1 10); do
            RESULT=$($SBDIR/node3/use -BN -e "SELECT val FROM gr_test.t1;" 2>/dev/null) || true
            echo "$RESULT" | grep -q "single_primary_write" && break
            echo "  Waiting for replication... ($i/10)"
            sleep 2
          done
          echo "node3 result: $RESULT"
          echo "$RESULT" | grep -q "single_primary_write" || { echo "FAIL: data not replicated to node3 after 20s"; exit 1; }
          echo "OK: group replication single-primary write+read verified"

          echo "=== Cleanup ==="
          ./dbdeployer delete all --skip-confirm

      - name: Test group replication (multi-primary)
        run: |
          echo "=== Deploy group replication multi-primary ${MYSQL_VERSION} ==="
          ./dbdeployer deploy replication "$MYSQL_VERSION" \
            --topology=group \
            --single-primary=false \
            --sandbox-binary="$SANDBOX_BINARY" \
            --nodes=3

          SBDIR=$(ls -d ~/sandboxes/group_msb_*)
          echo "=== Verify all nodes ONLINE ==="
          ONLINE_COUNT=$($SBDIR/node1/use -BN -e "SELECT COUNT(*) FROM performance_schema.replication_group_members WHERE MEMBER_STATE='ONLINE';" 2>&1)
          echo "Online members: $ONLINE_COUNT"
          [ "$ONLINE_COUNT" -eq 3 ] || { echo "FAIL: expected 3 ONLINE members, got $ONLINE_COUNT"; exit 1; }

          echo "=== Verify multi-primary: all nodes are PRIMARY ==="
          PRIMARY_COUNT=$($SBDIR/node1/use -BN -e "SELECT COUNT(*) FROM performance_schema.replication_group_members WHERE MEMBER_ROLE='PRIMARY';" 2>&1)
          echo "Primary count: $PRIMARY_COUNT"
          [ "$PRIMARY_COUNT" -eq 3 ] || { echo "FAIL: expected 3 PRIMARY members in multi-primary mode, got $PRIMARY_COUNT"; exit 1; }

          echo "=== Write on node1, read on node3 ==="
          $SBDIR/node1/use -e "CREATE DATABASE gr_mp_test; USE gr_mp_test; CREATE TABLE t1 (id INT AUTO_INCREMENT PRIMARY KEY, val VARCHAR(100)); INSERT INTO t1 (val) VALUES ('write_from_node1');"
          # Wait for replication to node3 with retries
          for i in $(seq 1 10); do
            RESULT=$($SBDIR/node3/use -BN -e "SELECT val FROM gr_mp_test.t1 WHERE val='write_from_node1';" 2>/dev/null) || true
            echo "$RESULT" | grep -q "write_from_node1" && break
            echo "  Waiting for replication... ($i/10)"
            sleep 2
          done
          echo "node3 sees node1 write: $RESULT"
          echo "$RESULT" | grep -q "write_from_node1" || { echo "FAIL: node1 write not replicated to node3 after 20s"; exit 1; }

          echo "=== Write on node3, read on node1 ==="
          $SBDIR/node3/use -e "INSERT INTO gr_mp_test.t1 (val) VALUES ('write_from_node3');"
          # Wait for replication to node1 with retries
          for i in $(seq 1 10); do
            RESULT=$($SBDIR/node1/use -BN -e "SELECT val FROM gr_mp_test.t1 WHERE val='write_from_node3';" 2>/dev/null) || true
            echo "$RESULT" | grep -q "write_from_node3" && break
            echo "  Waiting for replication... ($i/10)"
            sleep 2
          done
          echo "node1 sees node3 write: $RESULT"
          echo "$RESULT" | grep -q "write_from_node3" || { echo "FAIL: node3 write not replicated to node1 after 20s"; exit 1; }
          echo "OK: group replication multi-primary write+read verified"

          echo "=== Cleanup ==="
          ./dbdeployer delete all --skip-confirm

      - name: Cleanup
        if: always()
        run: |
          ./dbdeployer delete all --skip-confirm 2>/dev/null || true
          pkill -9 -u "$USER" mysqld 2>/dev/null || true

  # Test fan-in and all-masters replication topologies (#67)
  fan-in-all-masters-test:
    name: Fan-in and All-masters (${{ matrix.mysql-version }})
    runs-on: ubuntu-22.04
    strategy:
      fail-fast: false
      matrix:
        mysql-version:
          - '8.4.8'
          - '9.7.2'
          - '26.7.0'
    env:
      GO111MODULE: on
      SANDBOX_BINARY: ${{ github.workspace }}/opt/mysql
      MYSQL_VERSION: ${{ matrix.mysql-version }}
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: '1.23'

      - name: Install system libraries
        run: |
          sudo apt-get update
          sudo apt-get install -y libaio1 libnuma1 libncurses5

      - name: Build dbdeployer
        run: go build -o dbdeployer .

      - name: Cache MySQL tarball
        uses: actions/cache@v4
        with:
          path: /tmp/mysql-tarball
          key: mysql-${{ matrix.mysql-version }}-linux-x86_64-v1

      - name: Download and unpack MySQL
        env:
          SHORT_VER_ENV: ${{ matrix.mysql-version }}
        run: |
          SHORT_VER="${SHORT_VER_ENV%.*}"
          # MySQL 9.6+ ships Linux tarballs built against glibc2.28 only
          case "$SHORT_VER" in 5.*|8.*|9.[0-5]) GLIBC=2.17 ;; *) GLIBC=2.28 ;; esac
          TARBALL="mysql-${MYSQL_VERSION}-linux-glibc${GLIBC}-x86_64.tar.xz"
          mkdir -p /tmp/mysql-tarball
          if [ ! -f "/tmp/mysql-tarball/$TARBALL" ]; then
            curl -L -f -o "/tmp/mysql-tarball/$TARBALL" \
              "https://dev.mysql.com/get/Downloads/MySQL-${SHORT_VER}/$TARBALL"
          fi
          mkdir -p "$SANDBOX_BINARY"
          ./dbdeployer unpack "/tmp/mysql-tarball/$TARBALL" --sandbox-binary="$SANDBOX_BINARY"

      - name: Test fan-in topology
        run: |
          echo "=== Deploy fan-in ${MYSQL_VERSION} (3 nodes) ==="
          # Fan-in: multiple masters feed into one slave (the last node)
          ./dbdeployer deploy replication "$MYSQL_VERSION" \
            --topology=fan-in \
            --sandbox-binary="$SANDBOX_BINARY" \
            --nodes=3

          SBDIR=$(ls -d ~/sandboxes/fan_in_msb_*)
          echo "=== Verify replication ==="
          bash "$SBDIR/check_slaves" || bash "$SBDIR/check_replication" || true

          echo "=== Write on master1 (node1), read on common node (node3) ==="
          $SBDIR/node1/use -e "CREATE DATABASE fanin_test; USE fanin_test; CREATE TABLE t1 (id INT AUTO_INCREMENT PRIMARY KEY, val VARCHAR(100), src VARCHAR(20)); INSERT INTO t1 (val, src) VALUES ('from_master1', 'node1');"
          # Fan-in uses multi-source replication; allow up to 30s per source
          for i in $(seq 1 15); do
            RESULT=$($SBDIR/node3/use -BN -e "SELECT val FROM fanin_test.t1 WHERE src='node1';" 2>/dev/null) || true
            echo "$RESULT" | grep -q "from_master1" && break
            echo "  Waiting for replication from node1... ($i/15)"
            sleep 2
          done
          echo "node3 sees node1 write: $RESULT"
          echo "$RESULT" | grep -q "from_master1" || { echo "FAIL: node1 write not replicated to node3 after 30s"; exit 1; }

          echo "=== Write on master2 (node2), read on common node (node3) ==="
          # Use a DIFFERENT database to avoid multi-source conflict with node1's database
          $SBDIR/node2/use -e "CREATE DATABASE fanin_test2; USE fanin_test2; CREATE TABLE t1 (id INT AUTO_INCREMENT PRIMARY KEY, val VARCHAR(100)); INSERT INTO t1 (val) VALUES ('from_master2');"
          # Fan-in uses multi-source replication; allow up to 30s per source
          for i in $(seq 1 15); do
            RESULT=$($SBDIR/node3/use -BN -e "SELECT val FROM fanin_test2.t1;" 2>/dev/null) || true
            echo "$RESULT" | grep -q "from_master2" && break
            echo "  Waiting for replication from node2... ($i/15)"
            sleep 2
          done
          echo "node3 sees node2 write: $RESULT"
          echo "$RESULT" | grep -q "from_master2" || { echo "FAIL: node2 write not replicated to node3 after 30s"; exit 1; }
          echo "OK: fan-in topology write+read verified"

          echo "=== Cleanup ==="
          ./dbdeployer delete all --skip-confirm

      - name: Test all-masters topology
        run: |
          echo "=== Deploy all-masters ${MYSQL_VERSION} (3 nodes) ==="
          ./dbdeployer deploy replication "$MYSQL_VERSION" \
            --topology=all-masters \
            --sandbox-binary="$SANDBOX_BINARY" \
            --nodes=3

          SBDIR=$(ls -d ~/sandboxes/all_masters_msb_*)
          echo "=== Verify replication ==="
          bash "$SBDIR/check_slaves" || bash "$SBDIR/check_replication" || true

          echo "=== Write on node1, read on node3 ==="
          $SBDIR/node1/use -e "CREATE DATABASE allm_test; USE allm_test; CREATE TABLE t1 (id INT AUTO_INCREMENT PRIMARY KEY, val VARCHAR(100)); INSERT INTO t1 (val) VALUES ('write_from_node1');"
          # Wait for replication to node3 with retries
          for i in $(seq 1 10); do
            RESULT=$($SBDIR/node3/use -BN -e "SELECT val FROM allm_test.t1 WHERE val='write_from_node1';" 2>/dev/null) || true
            echo "$RESULT" | grep -q "write_from_node1" && break
            echo "  Waiting for replication... ($i/10)"
            sleep 2
          done
          echo "node3 sees node1 write: $RESULT"
          echo "$RESULT" | grep -q "write_from_node1" || { echo "FAIL: node1 write not replicated to node3 after 20s"; exit 1; }

          echo "=== Write on node3, read on node1 ==="
          $SBDIR/node3/use -e "INSERT INTO allm_test.t1 (val) VALUES ('write_from_node3');"
          # Wait for replication to node1 with retries
          for i in $(seq 1 10); do
            RESULT=$($SBDIR/node1/use -BN -e "SELECT val FROM allm_test.t1 WHERE val='write_from_node3';" 2>/dev/null) || true
            echo "$RESULT" | grep -q "write_from_node3" && break
            echo "  Waiting for replication... ($i/10)"
            sleep 2
          done
          echo "node1 sees node3 write: $RESULT"
          echo "$RESULT" | grep -q "write_from_node3" || { echo "FAIL: node3 write not replicated to node1 after 20s"; exit 1; }
          echo "OK: all-masters topology write+read verified"

          echo "=== Cleanup ==="
          ./dbdeployer delete all --skip-confirm

      - name: Cleanup
        if: always()
        run: |
          ./dbdeployer delete all --skip-confirm 2>/dev/null || true
          pkill -9 -u "$USER" mysqld 2>/dev/null || true