feat: migrate CI to formancehq/ci shared workflows

[sofiasimdianova]

No description provided.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (4)

• .github/actions/default/action.yml is excluded by !**/*.yml
• .github/actions/env/action.yml is excluded by !**/*.yml
• .github/workflows/main.yml is excluded by !**/*.yml
• .github/workflows/releases.yml is excluded by !**/*.yml

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e4764645-487b-43a9-9dec-4691c7214eb1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 0.00%. Comparing base (2f61bb3) to head (cbb62e4).

Additional details and impacted files

@@     Coverage Diff     @@
##   main   #210   +/-   ##
===========================
===========================

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[NumaryBot]

✅ Approve — automated review

The previously reported deployment permission issue is fixed by explicitly granting contents read access. No other actionable defects were found.

No findings.

[NumaryBot]

NumaryBot posted 1 new inline finding.

Summary: #210 (comment)

[NumaryBot]

NumaryBot review complete: no remaining inline findings.

Resolved 1 stale NumaryBot review thread (1 fixed, 0 outdated).

Summary: #210 (comment)

[gfyrag]

Review status: not ready for approval yet.

The unit/integration split is preserved and green, but the privileged migration is not yet safe or demonstrated:

• Shared workflows/actions are referenced through mutable formancehq/ci@main, contrary to EN-1606's immutable-version requirement.
• GoReleaser executes PR code with release credentials when a persistent build-images label is present.
• GoReleaser depends only on Dirty; it can publish before TestsUnit, TestsIntegration and the aggregate Tests job complete.
• The shared deploy action fetches ArgoCD from releases/latest without a checksum.
• GoReleaser and Deploy were skipped on the current PR, and the tag-release path was not run.

Please pin the shared CI version, isolate untrusted PR builds from credentials/publication, gate GoReleaser on the complete Tests job, pin/verify ArgoCD, and exercise build/release/deploy before approval.

[gfyrag]

Re-reviewed the current SHA and green checks. The migration is acceptable within the explicitly agreed phase-1 scope. Approved; immutable CI pinning and the deferred publication hardening remain follow-up work.