From d443c7a8a9768d693453569f80c5a0700cb7448a Mon Sep 17 00:00:00 2001 From: Sofia Simdianova Date: Wed, 5 Aug 2026 18:49:09 +0200 Subject: [PATCH] feat: migrate CI to formancehq/ci shared workflows --- .github/actions/env/action.yml | 36 ---------- .github/workflows/main.yml | 117 +++++++++++++-------------------- .github/workflows/releases.yml | 24 ++----- 3 files changed, 52 insertions(+), 125 deletions(-) delete mode 100644 .github/actions/env/action.yml diff --git a/.github/actions/env/action.yml b/.github/actions/env/action.yml deleted file mode 100644 index 1048ab7..0000000 --- a/.github/actions/env/action.yml +++ /dev/null @@ -1,36 +0,0 @@ -name: Setup Env -description: Setup Env for Linux x64 -inputs: - token: - description: 'A Github PAT' - required: true - nscloud-cache: - description: 'Enable Namespace.so Git caching (requires namespace-profile-* runner)' - required: false - default: 'true' -runs: - using: composite - steps: - - name: Install Nix - uses: cachix/install-nix-action@v31 - - name: Install Earthly - uses: earthly/actions-setup@v1 - with: - github-token: ${{ inputs.token }} - version: "latest" - - name: Login to GitHub Container Registry - uses: docker/login-action@v4 - with: - registry: ghcr.io - username: "NumaryBot" - password: ${{ inputs.token }} - - name: Set up QEMU - uses: docker/setup-qemu-action@v4 - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 - - uses: namespacelabs/nscloud-cache-action@v1 - if: inputs.nscloud-cache != 'false' - with: - path: | - ~/.cache/go-build - /tmp/go/pkg/mod/ diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index f726269..46a4c47 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -5,6 +5,7 @@ on: branches: - main - releases/* + - release/* pull_request: types: [ assigned, opened, synchronize, reopened, labeled ] @@ -15,34 +16,29 @@ concurrency: jobs: PR: if: github.event_name == 'pull_request' - name: Check PR Title - runs-on: ubuntu-latest + uses: formancehq/ci/.github/workflows/go-pr.yml@main permissions: + pull-requests: read statuses: write - steps: - - uses: amannn/action-semantic-pull-request@v6 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} Dirty: - runs-on: "namespace-profile-linux-amd64-4vcpu" + runs-on: namespace-profile-linux-amd64-4vcpu steps: - - uses: 'namespacelabs/nscloud-checkout-action@v9' + - uses: namespacelabs/nscloud-checkout-action@v9 with: fetch-depth: 0 - - name: Setup Env - uses: ./.github/actions/env - with: - token: ${{ secrets.NUMARY_GITHUB_TOKEN }} - - run: > - nix develop --impure --command just pre-commit + dissociate: true + + - uses: formancehq/ci/actions/setup-nix@main + + - run: nix develop --impure --command just pre-commit env: SPEAKEASY_API_KEY: ${{ secrets.SPEAKEASY_API_KEY }} + - name: Get changed files - id: changed-files shell: bash run: | - hasChanged=$(git status --porcelain) + hasChanged=$(git status --porcelain) if (( $(echo ${#hasChanged}) != 0 )); then git status echo "There are changes in the repository" @@ -50,74 +46,53 @@ jobs: fi Tests: - runs-on: "namespace-profile-linux-amd64-4vcpu" - needs: - - Dirty + needs: [Dirty] + runs-on: namespace-profile-linux-amd64-4vcpu steps: - - uses: 'namespacelabs/nscloud-checkout-action@v9' + - uses: namespacelabs/nscloud-checkout-action@v9 with: fetch-depth: 0 - - name: Setup Env - uses: ./.github/actions/env - with: - token: ${{ secrets.NUMARY_GITHUB_TOKEN }} - - run: > - nix develop --impure --command just tests + dissociate: true + + - uses: formancehq/ci/actions/setup-nix@main + + - run: nix develop --impure --command just tests env: SPEAKEASY_API_KEY: ${{ secrets.SPEAKEASY_API_KEY }} GoReleaser: - runs-on: "namespace-profile-linux-amd64-4vcpu" - if: contains(github.event.pull_request.labels.*.name, 'build-images') || github.ref == 'refs/heads/main' || github.event_name == 'merge_group' - needs: - - Dirty - steps: - - uses: 'namespacelabs/nscloud-checkout-action@v9' - with: - fetch-depth: 0 - - name: Setup Env - uses: ./.github/actions/env - with: - token: ${{ secrets.NUMARY_GITHUB_TOKEN }} - - run: > - nix develop --impure --command just release-ci - env: - GITHUB_TOKEN: ${{ secrets.NUMARY_GITHUB_TOKEN }} - SPEAKEASY_API_KEY: ${{ secrets.SPEAKEASY_API_KEY }} - FURY_TOKEN: ${{ secrets.FURY_TOKEN }} - GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }} + needs: [Dirty] + uses: formancehq/ci/.github/workflows/go-build.yml@main + with: + build-condition: main-and-label + build-label: build-images + secrets: + NUMARY_GITHUB_TOKEN: ${{ secrets.NUMARY_GITHUB_TOKEN }} + SPEAKEASY_API_KEY: ${{ secrets.SPEAKEASY_API_KEY }} + FURY_TOKEN: ${{ secrets.FURY_TOKEN }} + GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }} Deploy: - runs-on: "ubuntu-latest" + runs-on: namespace-profile-linux-amd64-2vcpu if: github.ref == 'refs/heads/main' environment: staging + permissions: + contents: read + id-token: write needs: - GoReleaser - Tests steps: - - uses: 'actions/checkout@v7' - with: - fetch-depth: 0 - - name: Install Earthly - uses: earthly/actions-setup@v1 + - uses: formancehq/ci/actions/deploy-staging@main with: - github-token: ${{ secrets.NUMARY_GITHUB_TOKEN }} - version: "latest" - - name: Tailscale - uses: tailscale/github-action@v4 - with: - oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }} - oauth-secret: ${{ secrets.TS_OAUTH_SECRET }} - tags: tag:ci - - name: "Deploy in staging" - env: - TAG: ${{ github.sha }} - COMPONENT: orchestration - ARGOCD_REGION_AUTH_TOKEN: ${{ secrets.ARGOCD_REGION_AUTH_TOKEN }} - run: > - earthly - --no-output - --secret AUTH_TOKEN=$ARGOCD_REGION_AUTH_TOKEN - +deploy-staging - --TAG=$TAG - --COMPONENT=$COMPONENT \ No newline at end of file + component: orchestration + tag: ${{ github.sha }} + auth-token: ${{ secrets.ARGOCD_REGION_AUTH_TOKEN }} + ts-oauth-client-id: ${{ secrets.TS_OIDC_OAUTH_CLIENT_ID }} + ts-audience: ${{ secrets.TS_OIDC_AUDIENCE }} + ts-tags: ${{ vars.TS_TAGS }} + ts-version: ${{ vars.TS_VERSION }} + ts-args: ${{ vars.TS_ARGS }} + ts-retry: ${{ vars.TS_RETRY }} + ts-timeout: ${{ vars.TS_TIMEOUT }} + ts-ping: ${{ vars.TS_PING }} diff --git a/.github/workflows/releases.yml b/.github/workflows/releases.yml index bd9dcfe..b4ebf3a 100644 --- a/.github/workflows/releases.yml +++ b/.github/workflows/releases.yml @@ -3,24 +3,12 @@ on: push: tags: - 'v*.*.*' -permissions: - contents: write jobs: GoReleaser: - runs-on: "namespace-profile-linux-amd64-4vcpu" - steps: - - uses: 'namespacelabs/nscloud-checkout-action@v9' - with: - fetch-depth: 0 - - name: Setup Env - uses: ./.github/actions/env - with: - token: ${{ secrets.NUMARY_GITHUB_TOKEN }} - - run: > - nix develop --impure --command just release - env: - GITHUB_TOKEN: ${{ secrets.NUMARY_GITHUB_TOKEN }} - SPEAKEASY_API_KEY: ${{ secrets.SPEAKEASY_API_KEY }} - FURY_TOKEN: ${{ secrets.FURY_TOKEN }} - GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }} \ No newline at end of file + uses: formancehq/ci/.github/workflows/go-release.yml@main + secrets: + NUMARY_GITHUB_TOKEN: ${{ secrets.NUMARY_GITHUB_TOKEN }} + SPEAKEASY_API_KEY: ${{ secrets.SPEAKEASY_API_KEY }} + FURY_TOKEN: ${{ secrets.FURY_TOKEN }} + GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}