feat: migrate CI to formancehq/ci shared workflows

.github/workflows/main.yml

@@ -5,6 +5,7 @@ on:
     branches:
       - main
       - releases/*
+      - release/*
   pull_request:
     types: [ assigned, opened, synchronize, reopened, labeled ]
 
@@ -15,109 +16,83 @@ concurrency:
 jobs:
   PR:
     if: github.event_name == 'pull_request'
-    name: Check PR Title
-    runs-on: ubuntu-latest
+    uses: formancehq/ci/.github/workflows/go-pr.yml@main
     permissions:
+      pull-requests: read
       statuses: write
-    steps:
-      - uses: amannn/action-semantic-pull-request@v6
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   Dirty:
-    runs-on: "namespace-profile-linux-amd64-4vcpu"
+    runs-on: namespace-profile-linux-amd64-4vcpu
     steps:
-      - uses: 'namespacelabs/nscloud-checkout-action@v9'
+      - uses: namespacelabs/nscloud-checkout-action@v9
         with:
           fetch-depth: 0
-      - name: Setup Env
-        uses: ./.github/actions/env
-        with:
-          token: ${{ secrets.NUMARY_GITHUB_TOKEN }}
-      - run: >
-          nix develop --impure --command just pre-commit
+          dissociate: true
+
+      - uses: formancehq/ci/actions/setup-nix@main
+
+      - run: nix develop --impure --command just pre-commit
         env:
           SPEAKEASY_API_KEY: ${{ secrets.SPEAKEASY_API_KEY }}
+
       - name: Get changed files
-        id: changed-files
         shell: bash
         run: |
-          hasChanged=$(git status --porcelain) 
+          hasChanged=$(git status --porcelain)
           if (( $(echo ${#hasChanged}) != 0 )); then
             git status
             echo "There are changes in the repository"
             exit 1
           fi
 
   Tests:
-    runs-on: "namespace-profile-linux-amd64-4vcpu"
-    needs:
-      - Dirty
+    needs: [Dirty]
+    runs-on: namespace-profile-linux-amd64-4vcpu
     steps:
-      - uses: 'namespacelabs/nscloud-checkout-action@v9'
+      - uses: namespacelabs/nscloud-checkout-action@v9
         with:
           fetch-depth: 0
-      - name: Setup Env
-        uses: ./.github/actions/env
-        with:
-          token: ${{ secrets.NUMARY_GITHUB_TOKEN }}
-      - run: >
-          nix develop --impure --command just tests
+          dissociate: true
+
+      - uses: formancehq/ci/actions/setup-nix@main
+
+      - run: nix develop --impure --command just tests
         env:
           SPEAKEASY_API_KEY: ${{ secrets.SPEAKEASY_API_KEY }}
 
   GoReleaser:
-    runs-on: "namespace-profile-linux-amd64-4vcpu"
-    if: contains(github.event.pull_request.labels.*.name, 'build-images') || github.ref == 'refs/heads/main' || github.event_name == 'merge_group'
-    needs:
-      - Dirty
-    steps:
-      - uses: 'namespacelabs/nscloud-checkout-action@v9'
-        with:
-          fetch-depth: 0
-      - name: Setup Env
-        uses: ./.github/actions/env
-        with:
-          token: ${{ secrets.NUMARY_GITHUB_TOKEN }}
-      - run: >
-          nix develop --impure --command just release-ci
-        env:
-          GITHUB_TOKEN: ${{ secrets.NUMARY_GITHUB_TOKEN }}
-          SPEAKEASY_API_KEY: ${{ secrets.SPEAKEASY_API_KEY }}
-          FURY_TOKEN: ${{ secrets.FURY_TOKEN }}
-          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
+    needs: [Dirty]
+    uses: formancehq/ci/.github/workflows/go-build.yml@main
+    with:
+      build-condition: main-and-label
+      build-label: build-images
+    secrets:
+      NUMARY_GITHUB_TOKEN: ${{ secrets.NUMARY_GITHUB_TOKEN }}
+      SPEAKEASY_API_KEY: ${{ secrets.SPEAKEASY_API_KEY }}
+      FURY_TOKEN: ${{ secrets.FURY_TOKEN }}
+      GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
 
   Deploy:
-    runs-on: "ubuntu-latest"
+    runs-on: namespace-profile-linux-amd64-2vcpu
     if: github.ref == 'refs/heads/main'
     environment: staging
+    permissions:
+      contents: read
+      id-token: write
     needs:
       - GoReleaser
       - Tests
     steps:
-      - uses: 'actions/checkout@v7'
-        with:
-          fetch-depth: 0
-      - name: Install Earthly
-        uses: earthly/actions-setup@v1
+      - uses: formancehq/ci/actions/deploy-staging@main
         with:
-          github-token: ${{ secrets.NUMARY_GITHUB_TOKEN }}
-          version: "latest"
-      - name: Tailscale
-        uses: tailscale/github-action@v4
-        with:
-          oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
-          oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}
-          tags: tag:ci
-      - name: "Deploy in staging"
-        env:
-          TAG: ${{ github.sha }}
-          COMPONENT: orchestration
-          ARGOCD_REGION_AUTH_TOKEN: ${{ secrets.ARGOCD_REGION_AUTH_TOKEN }}
-        run: >
-          earthly  
-          --no-output 
-          --secret AUTH_TOKEN=$ARGOCD_REGION_AUTH_TOKEN
-          +deploy-staging
-          --TAG=$TAG
-          --COMPONENT=$COMPONENT
+          component: orchestration
+          tag: ${{ github.sha }}
+          auth-token: ${{ secrets.ARGOCD_REGION_AUTH_TOKEN }}
+          ts-oauth-client-id: ${{ secrets.TS_OIDC_OAUTH_CLIENT_ID }}
+          ts-audience: ${{ secrets.TS_OIDC_AUDIENCE }}
+          ts-tags: ${{ vars.TS_TAGS }}
+          ts-version: ${{ vars.TS_VERSION }}
+          ts-args: ${{ vars.TS_ARGS }}
+          ts-retry: ${{ vars.TS_RETRY }}
+          ts-timeout: ${{ vars.TS_TIMEOUT }}
+          ts-ping: ${{ vars.TS_PING }}

.github/workflows/releases.yml

@@ -3,24 +3,12 @@ on:
   push:
     tags:
       - 'v*.*.*'
-permissions:
-  contents: write
 
 jobs:
   GoReleaser:
-    runs-on: "namespace-profile-linux-amd64-4vcpu"
-    steps:
-      - uses: 'namespacelabs/nscloud-checkout-action@v9'
-        with:
-          fetch-depth: 0
-      - name: Setup Env
-        uses: ./.github/actions/env
-        with:
-          token: ${{ secrets.NUMARY_GITHUB_TOKEN }}
-      - run: >
-          nix develop --impure --command just release
-        env:
-          GITHUB_TOKEN: ${{ secrets.NUMARY_GITHUB_TOKEN }}
-          SPEAKEASY_API_KEY: ${{ secrets.SPEAKEASY_API_KEY }}
-          FURY_TOKEN: ${{ secrets.FURY_TOKEN }}
-          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
+    uses: formancehq/ci/.github/workflows/go-release.yml@main
+    secrets:
+      NUMARY_GITHUB_TOKEN: ${{ secrets.NUMARY_GITHUB_TOKEN }}
+      SPEAKEASY_API_KEY: ${{ secrets.SPEAKEASY_API_KEY }}
+      FURY_TOKEN: ${{ secrets.FURY_TOKEN }}
+      GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}