feat: migrate CI to formancehq/ci shared workflows

.github/workflows/main.yml

@@ -5,169 +5,133 @@ on:
     branches:
       - main
       - releases/*
+      - release/*
   pull_request:
     types: [ assigned, opened, synchronize, reopened, labeled ]
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
-permissions:
-  id-token: write
-  contents: read
+
 jobs:
   PR:
     if: github.event_name == 'pull_request'
-    name: Check PR Title
-    runs-on: namespace-profile-linux-amd64-2vcpu
+    uses: formancehq/ci/.github/workflows/go-pr.yml@main
     permissions:
+      pull-requests: read
       statuses: write
-    steps:
-      - uses: amannn/action-semantic-pull-request@v6
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   Dirty:
     runs-on: namespace-profile-linux-amd64-4vcpu
     steps:
-      - uses: "namespacelabs/nscloud-checkout-action@v9"
+      - uses: namespacelabs/nscloud-checkout-action@v9
         with:
           fetch-depth: 0
-      - name: Setup Nix
-        uses: ./.github/actions/default
-        with:
-          token: ${{ secrets.NUMARY_GITHUB_TOKEN }}
-      - name: Pre-commit
+          dissociate: true
+
+      - uses: formancehq/ci/actions/setup-nix@main
+
+      - run: nix develop --impure --command just pc
         env:
           GITHUB_TOKEN: ${{ secrets.NUMARY_GITHUB_TOKEN }}
-        run: nix develop --impure --command just pc
+
       - name: Get changed files
-        id: changed-files
         shell: bash
         run: |
-          hasChanged=$(git status --porcelain) 
+          hasChanged=$(git status --porcelain)
           if (( $(echo ${#hasChanged}) != 0 )); then
             git status
             echo "There are changes in the repository"
             exit 1
           fi
 
+  TestsUnit:
+    name: Tests (Unit)
+    needs: [Dirty]
+    runs-on: namespace-profile-linux-amd64-4vcpu
+    steps:
+      - uses: namespacelabs/nscloud-checkout-action@v9
+        with:
+          fetch-depth: 0
+          dissociate: true
+
+      - uses: formancehq/ci/actions/setup-nix@main
+
+      - run: nix develop --impure --command just tests-unit
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: coverage-unit-report
+          path: ./coverage/unit_filtered.txt
+
+  TestsIntegration:
+    name: Tests (Integration)
+    needs: [Dirty]
+    runs-on: namespace-profile-linux-amd64-4vcpu
+    steps:
+      - uses: namespacelabs/nscloud-checkout-action@v9
+        with:
+          fetch-depth: 0
+          dissociate: true
+
+      - uses: formancehq/ci/actions/setup-nix@main
+
+      - run: nix develop --impure --command just tests-integration
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: coverage-integration-report
+          path: ./coverage/integration_filtered.txt
 
   Tests:
-    runs-on: "namespace-profile-linux-amd64-2vcpu"
+    runs-on: namespace-profile-linux-amd64-2vcpu
     needs:
       - TestsUnit
       - TestsIntegration
     steps:
-      - name: Download a report artifact
-        uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@v8
         with:
           pattern: coverage-*
           merge-multiple: true
-      - name: Upload coverage reports to Codecov with GitHub Action
-        uses: codecov/codecov-action@v7.0.0
+
+      - uses: codecov/codecov-action@v7.0.0
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
         with:
           files: unit_filtered.txt,integration_filtered.txt
-
-  TestsUnit:
-    name: Tests (Unit)
-    runs-on: namespace-profile-linux-amd64-4vcpu
-    steps:
-    - uses: "namespacelabs/nscloud-checkout-action@v9"
-      with:
-        fetch-depth: 0
-    - name: Setup Nix
-      uses: ./.github/actions/default
-      with:
-        token: ${{ secrets.NUMARY_GITHUB_TOKEN }}
-    - name: Pre-commit
-      run: nix develop --impure --command just tests-unit
-    - name: Archive code coverage results
-      uses: actions/upload-artifact@v7
-      with:
-        name: coverage-unit-report
-        path: ./coverage/unit_filtered.txt
-
-  TestsIntegration:
-    name: Tests (Integration)
-    runs-on: namespace-profile-linux-amd64-4vcpu
-    steps:
-    - uses: "namespacelabs/nscloud-checkout-action@v9"
-      with:
-        fetch-depth: 0
-    - name: Setup Nix
-      uses: ./.github/actions/default
-      with:
-        token: ${{ secrets.NUMARY_GITHUB_TOKEN }}
-    - name: Pre-commit
-      run: nix develop --impure --command just tests-integration
-    - name: Archive code coverage results
-      uses: actions/upload-artifact@v7
-      with:
-        name: coverage-integration-report
-        path: ./coverage/integration_filtered.txt
 
   GoReleaser:
-    runs-on: "namespace-profile-linux-amd64-4vcpu"
-    if: contains(github.event.pull_request.labels.*.name, 'build-images') || github.ref == 'refs/heads/main' || github.event_name == 'merge_group'
-    steps:
-      - uses: "namespacelabs/nscloud-checkout-action@v9"
-        with:
-          fetch-depth: 0
-      - name: Setup Nix
-        uses: ./.github/actions/default
-        with:
-          token: ${{ secrets.NUMARY_GITHUB_TOKEN }}
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
-        with:
-          registry: ghcr.io
-          username: "NumaryBot"
-          password: ${{ secrets.NUMARY_GITHUB_TOKEN }}
-      - run: >
-          nix develop --impure --command just release-ci
+    needs: [Dirty]
+    uses: formancehq/ci/.github/workflows/go-build.yml@main
+    with:
+      build-condition: main-and-label
+      build-label: build-images
+    secrets:
+      NUMARY_GITHUB_TOKEN: ${{ secrets.NUMARY_GITHUB_TOKEN }}
+      GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
 
-        env:
-          GITHUB_TOKEN: ${{ secrets.NUMARY_GITHUB_TOKEN }}
-          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
-
   Deploy:
-    runs-on: ubuntu-24.04
+    runs-on: namespace-profile-linux-amd64-2vcpu
     if: github.ref == 'refs/heads/main'
     environment: staging
+    permissions:
+      contents: read
+      id-token: write
     needs:
       - GoReleaser
       - Dirty
       - Tests
     steps:
-      - uses: earthly/actions-setup@v1
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          version: "latest"
-      - uses: 'actions/checkout@v7'
+      - uses: formancehq/ci/actions/deploy-staging@main
         with:
-          fetch-depth: 0
-      - name: Tailscale
-        uses: tailscale/github-action@v4
-        with:
-          oauth-client-id: ${{ secrets.TS_OIDC_OAUTH_CLIENT_ID }}
-          audience: ${{ secrets.TS_OIDC_AUDIENCE }}
-          tags: ${{ vars.TS_TAGS }}
-          version: ${{ vars.TS_VERSION }}
-          args: ${{ vars.TS_ARGS }}
-          retry: ${{ vars.TS_RETRY }}
-          timeout: ${{ vars.TS_TIMEOUT }}
-          ping: ${{ vars.TS_PING }}
-      - name: "Deploy in staging"
-        env:
-          TAG: ${{ github.sha }}
-          COMPONENT: agent
-          ARGOCD_REGION_AUTH_TOKEN: ${{ secrets.ARGOCD_REGION_AUTH_TOKEN }}
-        run: >
-          earthly
-          --no-output
-          --secret AUTH_TOKEN=$ARGOCD_REGION_AUTH_TOKEN
-          +deploy-staging
-          --TAG=$TAG
-          --COMPONENT=$COMPONENT
+          component: agent
+          tag: ${{ github.sha }}
+          auth-token: ${{ secrets.ARGOCD_REGION_AUTH_TOKEN }}
+          ts-oauth-client-id: ${{ secrets.TS_OIDC_OAUTH_CLIENT_ID }}
+          ts-audience: ${{ secrets.TS_OIDC_AUDIENCE }}
+          ts-tags: ${{ vars.TS_TAGS }}
+          ts-version: ${{ vars.TS_VERSION }}
+          ts-args: ${{ vars.TS_ARGS }}
+          ts-retry: ${{ vars.TS_RETRY }}
+          ts-timeout: ${{ vars.TS_TIMEOUT }}
+          ts-ping: ${{ vars.TS_PING }}

.github/workflows/releases.yml

@@ -5,30 +5,21 @@ on:
       - 'v*.*.*'
 permissions:
   contents: write
+  packages: write
 
 jobs:
   Release:
-    name: Release
     runs-on: namespace-profile-linux-amd64-4vcpu
     steps:
-      - name: Checkout
-        uses: namespacelabs/nscloud-checkout-action@v9
+      - uses: namespacelabs/nscloud-checkout-action@v9
         with:
           fetch-depth: 0
-      - name: Setup Nix
-        uses: ./.github/actions/default
+          dissociate: true
+
+      - uses: formancehq/ci/actions/setup-release@main
         with:
           token: ${{ secrets.NUMARY_GITHUB_TOKEN }}
-      - name: Configure Git
-        run: |
-          git config user.name "$GITHUB_ACTOR"
-          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
-        with:
-          registry: ghcr.io
-          username: "NumaryBot"
-          password: ${{ secrets.NUMARY_GITHUB_TOKEN }}
+
       - name: Release
         run: nix develop --impure --command just release
         env: