Skip to content

Commit ea9b1aa

Browse files
phelmaphelma
committed
migrate pipeline from circleci to github actions
1 parent 361591a commit ea9b1aa

25 files changed

Lines changed: 326 additions & 455 deletions

‎.circleci/config.yml‎

Lines changed: 0 additions & 176 deletions
This file was deleted.

.circleci/gpg.private.enc renamed to .github/gpg.private.enc

File renamed without changes.

‎.github/workflows/main.yaml‎

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
name: Main
2+
on:
3+
push:
4+
branches:
5+
- main
6+
7+
permissions:
8+
contents: read
9+
10+
# Every run publishes an rc image and tags the repo; serialise so
11+
# close-together merges cannot race on version tags. queue: max keeps every
12+
# queued run (the default keeps only the newest pending), so a slow release
13+
# approval delays later prereleases instead of cancelling them.
14+
# 'queue: max' — GA 2026-05-07: https://github.blog/changelog/2026-05-07-github-actions-concurrency-groups-now-allow-larger-queues/
15+
concurrency:
16+
group: main
17+
cancel-in-progress: false
18+
queue: max
19+
20+
jobs:
21+
skip-ci-check:
22+
runs-on: ubuntu-latest
23+
outputs:
24+
should_skip_ci: ${{ steps.skip_ci_check.outputs.should_skip_ci }}
25+
steps:
26+
- id: skip_ci_check
27+
env:
28+
HEAD_COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
29+
run: |
30+
if [[ "$HEAD_COMMIT_MESSAGE" == *"[no ci]"* ]] \
31+
|| [[ "$HEAD_COMMIT_MESSAGE" == *"[skip ci]"* ]] \
32+
|| [[ "$HEAD_COMMIT_MESSAGE" == *"[ci skip]"* ]]; then
33+
echo "should_skip_ci=true" >> "$GITHUB_OUTPUT"
34+
else
35+
echo "should_skip_ci=false" >> "$GITHUB_OUTPUT"
36+
fi
37+
38+
check:
39+
needs: [skip-ci-check]
40+
if: needs.skip-ci-check.outputs.should_skip_ci != 'true'
41+
runs-on: ubuntu-latest
42+
steps:
43+
- uses: actions/checkout@v4
44+
- name: Install tools
45+
uses: infrablocks/github-actions/asdf_install@v1
46+
- name: Check
47+
run: ./go test:code:check
48+
- name: Notify Slack
49+
if: ${{ !cancelled() }}
50+
continue-on-error: true
51+
run: ./go "slack:notify[${{ job.status }}]"
52+
env:
53+
SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
54+
55+
test:
56+
needs: [skip-ci-check]
57+
if: needs.skip-ci-check.outputs.should_skip_ci != 'true'
58+
runs-on: ubuntu-latest
59+
steps:
60+
- uses: actions/checkout@v4
61+
with:
62+
fetch-depth: 0
63+
- name: Install tools
64+
uses: infrablocks/github-actions/asdf_install@v1
65+
- name: Ensure docker-compose is available
66+
run: |
67+
if ! command -v docker-compose >/dev/null 2>&1; then
68+
sudo curl -fsSL \
69+
"https://github.com/docker/compose/releases/latest/download/docker-compose-linux-x86_64" \
70+
-o /usr/local/bin/docker-compose
71+
sudo chmod +x /usr/local/bin/docker-compose
72+
fi
73+
- name: Test
74+
run: ./go test:integration
75+
- name: Notify Slack
76+
if: ${{ !cancelled() }}
77+
continue-on-error: true
78+
run: ./go "slack:notify[${{ job.status }}]"
79+
env:
80+
SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
81+
82+
prerelease:
83+
needs: [check, test]
84+
runs-on: ubuntu-latest
85+
timeout-minutes: 30
86+
permissions:
87+
contents: write
88+
steps:
89+
- uses: actions/checkout@v4
90+
with:
91+
fetch-depth: 0
92+
- name: Install tools
93+
uses: infrablocks/github-actions/asdf_install@v1
94+
- name: Install secrets tools
95+
run: sudo apt-get update && sudo apt-get install -y git-crypt gnupg
96+
- name: Unlock git-crypt
97+
run: ./go git_crypt:unlock_with_encrypted_gpg_key
98+
env:
99+
ENCRYPTION_PASSPHRASE: ${{ secrets.ENCRYPTION_PASSPHRASE }}
100+
- name: Set CI git author
101+
run: ./go repository:set_ci_author
102+
- name: Prerelease
103+
run: ./go "version:bump[rc]" && ./go image:publish
104+
- name: Notify Slack of release hold
105+
continue-on-error: true
106+
run: ./go "slack:notify[success,on_hold]"
107+
env:
108+
SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
109+
- name: Notify Slack
110+
if: ${{ !cancelled() }}
111+
continue-on-error: true
112+
run: ./go "slack:notify[${{ job.status }}]"
113+
env:
114+
SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
115+
116+
release:
117+
needs: [prerelease]
118+
runs-on: ubuntu-latest
119+
timeout-minutes: 30
120+
environment: release
121+
permissions:
122+
contents: write
123+
steps:
124+
- uses: actions/checkout@v4
125+
with:
126+
ref: main
127+
fetch-depth: 0
128+
- name: Pull latest main
129+
# Approval can land long after the run starts; release publishes main
130+
# as of approval time, not the tested SHA — parity with the old
131+
# release.sh, which also pulled. prerelease.sh never pulled, so the
132+
# prerelease job deliberately has no pull.
133+
run: git pull
134+
- name: Install tools
135+
uses: infrablocks/github-actions/asdf_install@v1
136+
- name: Install secrets tools
137+
run: sudo apt-get update && sudo apt-get install -y git-crypt gnupg
138+
- name: Unlock git-crypt
139+
run: ./go git_crypt:unlock_with_encrypted_gpg_key
140+
env:
141+
ENCRYPTION_PASSPHRASE: ${{ secrets.ENCRYPTION_PASSPHRASE }}
142+
- name: Set CI git author
143+
run: ./go repository:set_ci_author
144+
- name: Release
145+
run: ./go version:release && ./go image:publish
146+
- name: Notify Slack
147+
if: ${{ !cancelled() }}
148+
continue-on-error: true
149+
run: ./go "slack:notify[${{ job.status }}]"
150+
env:
151+
SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}

‎.github/workflows/pr.yaml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
name: Pull Request
2+
on:
3+
pull_request:
4+
5+
permissions:
6+
contents: read
7+
8+
jobs:
9+
check:
10+
runs-on: ubuntu-latest
11+
steps:
12+
- uses: actions/checkout@v4
13+
- name: Install tools
14+
uses: infrablocks/github-actions/asdf_install@v1
15+
- name: Check
16+
run: ./go test:code:check
17+
- name: Notify Slack
18+
if: ${{ !cancelled() }}
19+
continue-on-error: true
20+
run: ./go "slack:notify[${{ job.status }}]"
21+
env:
22+
SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
23+
24+
test:
25+
runs-on: ubuntu-latest
26+
steps:
27+
- uses: actions/checkout@v4
28+
with:
29+
fetch-depth: 0
30+
- name: Install tools
31+
uses: infrablocks/github-actions/asdf_install@v1
32+
- name: Ensure docker-compose is available
33+
run: |
34+
if ! command -v docker-compose >/dev/null 2>&1; then
35+
sudo curl -fsSL \
36+
"https://github.com/docker/compose/releases/latest/download/docker-compose-linux-x86_64" \
37+
-o /usr/local/bin/docker-compose
38+
sudo chmod +x /usr/local/bin/docker-compose
39+
fi
40+
- name: Test
41+
run: ./go test:integration
42+
- name: Notify Slack
43+
if: ${{ !cancelled() }}
44+
continue-on-error: true
45+
run: ./go "slack:notify[${{ job.status }}]"
46+
env:
47+
SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
48+
49+
merge-pull-request:
50+
needs: [check, test]
51+
runs-on: ubuntu-latest
52+
if: github.actor == 'dependabot[bot]'
53+
permissions:
54+
contents: write
55+
pull-requests: write
56+
steps:
57+
- name: Merge pull request
58+
run: gh pr merge --merge "$PR_URL"
59+
env:
60+
PR_URL: ${{ github.event.pull_request.html_url }}
61+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

0 commit comments

Comments
 (0)