diff --git a/.github/actions/default/action.yml b/.github/actions/default/action.yml deleted file mode 100644 index 8dcfce3..0000000 --- a/.github/actions/default/action.yml +++ /dev/null @@ -1,22 +0,0 @@ -name: Setup Env -description: Setup Env for Linux x64 -inputs: - token: - description: 'A Github PAT' - required: true -runs: - using: composite - steps: - - name: Install Nix - uses: cachix/install-nix-action@v31 - - name: go env - id: go-env - shell: bash - run: | - nix develop --command bash -c "go env | sed -E \"s/^([^=]+)='(.*)'\$/\1=\2/\"" >> "$GITHUB_OUTPUT" - - uses: namespacelabs/nscloud-cache-action@v1 - with: - path: | - ${{ steps.go-env.outputs.GOCACHE }} - ${{ steps.go-env.outputs.GOMODCACHE }} - ~/.cache/golangci-lint diff --git a/.github/actions/env/action.yml b/.github/actions/env/action.yml deleted file mode 100644 index 5de81ac..0000000 --- a/.github/actions/env/action.yml +++ /dev/null @@ -1,27 +0,0 @@ -name: Setup Env -description: Setup Env for Linux x64 -inputs: - token: - description: 'A Github PAT' - required: true -runs: - using: composite - steps: - - uses: earthly/actions-setup@v1 - with: - github-token: ${{ inputs.token }} - version: "latest" - use-cache: true - - name: Set up Docker Buildx - uses: namespacelabs/nscloud-setup-buildx-action@v0 - - name: "Put back the git branch into git (Earthly uses it for tagging)" - shell: bash - run: | - branch="" - if [ -n "$GITHUB_HEAD_REF" ]; then - branch="$GITHUB_HEAD_REF" - else - branch="${GITHUB_REF##*/}" - fi - git checkout -b "$branch" || true - diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index c32d88f..f2eb210 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -5,169 +5,133 @@ on: branches: - main - releases/* + - release/* pull_request: types: [ assigned, opened, synchronize, reopened, labeled ] concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} cancel-in-progress: true -permissions: - id-token: write - contents: read + jobs: PR: if: github.event_name == 'pull_request' - name: Check PR Title - runs-on: namespace-profile-linux-amd64-2vcpu + uses: formancehq/ci/.github/workflows/go-pr.yml@main permissions: + pull-requests: read statuses: write - steps: - - uses: amannn/action-semantic-pull-request@v6 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} Dirty: runs-on: namespace-profile-linux-amd64-4vcpu steps: - - uses: "namespacelabs/nscloud-checkout-action@v9" + - uses: namespacelabs/nscloud-checkout-action@v9 with: fetch-depth: 0 - - name: Setup Nix - uses: ./.github/actions/default - with: - token: ${{ secrets.NUMARY_GITHUB_TOKEN }} - - name: Pre-commit + dissociate: true + + - uses: formancehq/ci/actions/setup-nix@main + + - run: nix develop --impure --command just pc env: GITHUB_TOKEN: ${{ secrets.NUMARY_GITHUB_TOKEN }} - run: nix develop --impure --command just pc + - name: Get changed files - id: changed-files shell: bash run: | - hasChanged=$(git status --porcelain) + hasChanged=$(git status --porcelain) if (( $(echo ${#hasChanged}) != 0 )); then git status echo "There are changes in the repository" exit 1 fi + TestsUnit: + name: Tests (Unit) + needs: [Dirty] + runs-on: namespace-profile-linux-amd64-4vcpu + steps: + - uses: namespacelabs/nscloud-checkout-action@v9 + with: + fetch-depth: 0 + dissociate: true + + - uses: formancehq/ci/actions/setup-nix@main + + - run: nix develop --impure --command just tests-unit + + - uses: actions/upload-artifact@v7 + with: + name: coverage-unit-report + path: ./coverage/unit_filtered.txt + + TestsIntegration: + name: Tests (Integration) + needs: [Dirty] + runs-on: namespace-profile-linux-amd64-4vcpu + steps: + - uses: namespacelabs/nscloud-checkout-action@v9 + with: + fetch-depth: 0 + dissociate: true + + - uses: formancehq/ci/actions/setup-nix@main + + - run: nix develop --impure --command just tests-integration + + - uses: actions/upload-artifact@v7 + with: + name: coverage-integration-report + path: ./coverage/integration_filtered.txt Tests: - runs-on: "namespace-profile-linux-amd64-2vcpu" + runs-on: namespace-profile-linux-amd64-2vcpu needs: - TestsUnit - TestsIntegration steps: - - name: Download a report artifact - uses: actions/download-artifact@v8 + - uses: actions/download-artifact@v8 with: pattern: coverage-* merge-multiple: true - - name: Upload coverage reports to Codecov with GitHub Action - uses: codecov/codecov-action@v7.0.0 + + - uses: codecov/codecov-action@v7.0.0 env: CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} with: files: unit_filtered.txt,integration_filtered.txt - - TestsUnit: - name: Tests (Unit) - runs-on: namespace-profile-linux-amd64-4vcpu - steps: - - uses: "namespacelabs/nscloud-checkout-action@v9" - with: - fetch-depth: 0 - - name: Setup Nix - uses: ./.github/actions/default - with: - token: ${{ secrets.NUMARY_GITHUB_TOKEN }} - - name: Pre-commit - run: nix develop --impure --command just tests-unit - - name: Archive code coverage results - uses: actions/upload-artifact@v7 - with: - name: coverage-unit-report - path: ./coverage/unit_filtered.txt - - TestsIntegration: - name: Tests (Integration) - runs-on: namespace-profile-linux-amd64-4vcpu - steps: - - uses: "namespacelabs/nscloud-checkout-action@v9" - with: - fetch-depth: 0 - - name: Setup Nix - uses: ./.github/actions/default - with: - token: ${{ secrets.NUMARY_GITHUB_TOKEN }} - - name: Pre-commit - run: nix develop --impure --command just tests-integration - - name: Archive code coverage results - uses: actions/upload-artifact@v7 - with: - name: coverage-integration-report - path: ./coverage/integration_filtered.txt GoReleaser: - runs-on: "namespace-profile-linux-amd64-4vcpu" - if: contains(github.event.pull_request.labels.*.name, 'build-images') || github.ref == 'refs/heads/main' || github.event_name == 'merge_group' - steps: - - uses: "namespacelabs/nscloud-checkout-action@v9" - with: - fetch-depth: 0 - - name: Setup Nix - uses: ./.github/actions/default - with: - token: ${{ secrets.NUMARY_GITHUB_TOKEN }} - - name: Login to GitHub Container Registry - uses: docker/login-action@v4 - with: - registry: ghcr.io - username: "NumaryBot" - password: ${{ secrets.NUMARY_GITHUB_TOKEN }} - - run: > - nix develop --impure --command just release-ci + needs: [Dirty] + uses: formancehq/ci/.github/workflows/go-build.yml@main + with: + build-condition: main-and-label + build-label: build-images + secrets: + NUMARY_GITHUB_TOKEN: ${{ secrets.NUMARY_GITHUB_TOKEN }} + GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }} - env: - GITHUB_TOKEN: ${{ secrets.NUMARY_GITHUB_TOKEN }} - GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }} - Deploy: - runs-on: ubuntu-24.04 + runs-on: namespace-profile-linux-amd64-2vcpu if: github.ref == 'refs/heads/main' environment: staging + permissions: + contents: read + id-token: write needs: - GoReleaser - Dirty - Tests steps: - - uses: earthly/actions-setup@v1 - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - version: "latest" - - uses: 'actions/checkout@v7' + - uses: formancehq/ci/actions/deploy-staging@main with: - fetch-depth: 0 - - name: Tailscale - uses: tailscale/github-action@v4 - with: - oauth-client-id: ${{ secrets.TS_OIDC_OAUTH_CLIENT_ID }} - audience: ${{ secrets.TS_OIDC_AUDIENCE }} - tags: ${{ vars.TS_TAGS }} - version: ${{ vars.TS_VERSION }} - args: ${{ vars.TS_ARGS }} - retry: ${{ vars.TS_RETRY }} - timeout: ${{ vars.TS_TIMEOUT }} - ping: ${{ vars.TS_PING }} - - name: "Deploy in staging" - env: - TAG: ${{ github.sha }} - COMPONENT: agent - ARGOCD_REGION_AUTH_TOKEN: ${{ secrets.ARGOCD_REGION_AUTH_TOKEN }} - run: > - earthly - --no-output - --secret AUTH_TOKEN=$ARGOCD_REGION_AUTH_TOKEN - +deploy-staging - --TAG=$TAG - --COMPONENT=$COMPONENT + component: agent + tag: ${{ github.sha }} + auth-token: ${{ secrets.ARGOCD_REGION_AUTH_TOKEN }} + ts-oauth-client-id: ${{ secrets.TS_OIDC_OAUTH_CLIENT_ID }} + ts-audience: ${{ secrets.TS_OIDC_AUDIENCE }} + ts-tags: ${{ vars.TS_TAGS }} + ts-version: ${{ vars.TS_VERSION }} + ts-args: ${{ vars.TS_ARGS }} + ts-retry: ${{ vars.TS_RETRY }} + ts-timeout: ${{ vars.TS_TIMEOUT }} + ts-ping: ${{ vars.TS_PING }} diff --git a/.github/workflows/releases.yml b/.github/workflows/releases.yml index a9bc892..91b5fef 100644 --- a/.github/workflows/releases.yml +++ b/.github/workflows/releases.yml @@ -5,30 +5,21 @@ on: - 'v*.*.*' permissions: contents: write + packages: write jobs: Release: - name: Release runs-on: namespace-profile-linux-amd64-4vcpu steps: - - name: Checkout - uses: namespacelabs/nscloud-checkout-action@v9 + - uses: namespacelabs/nscloud-checkout-action@v9 with: fetch-depth: 0 - - name: Setup Nix - uses: ./.github/actions/default + dissociate: true + + - uses: formancehq/ci/actions/setup-release@main with: token: ${{ secrets.NUMARY_GITHUB_TOKEN }} - - name: Configure Git - run: | - git config user.name "$GITHUB_ACTOR" - git config user.email "$GITHUB_ACTOR@users.noreply.github.com" - - name: Login to GitHub Container Registry - uses: docker/login-action@v4 - with: - registry: ghcr.io - username: "NumaryBot" - password: ${{ secrets.NUMARY_GITHUB_TOKEN }} + - name: Release run: nix develop --impure --command just release env: