From 7a37779eb799af7906fa377a57578bc10097076c Mon Sep 17 00:00:00 2001 From: Lukasz Raczylo Date: Fri, 2 Oct 2026 04:41:50 +0100 Subject: [PATCH] ci: migrate to shared workflows (#1) Replace the generic ci.yml jobs with the shared go-pr and go-release workflows. Add autoupdate through shared go-autoupdate. Keep golangci-lint in a separate lint.yaml, because the shared workflows do not run it. Add a build-less .goreleaser.yaml so the shared release flow can tag and publish the library. --- .github/workflows/autoupdate.yaml | 20 +++ .github/workflows/ci.yml | 215 ------------------------------ .github/workflows/lint.yaml | 28 ++++ .github/workflows/pr.yaml | 22 +++ .github/workflows/release.yaml | 24 ++++ .goreleaser.yaml | 13 ++ 6 files changed, 107 insertions(+), 215 deletions(-) create mode 100644 .github/workflows/autoupdate.yaml delete mode 100644 .github/workflows/ci.yml create mode 100644 .github/workflows/lint.yaml create mode 100644 .github/workflows/pr.yaml create mode 100644 .github/workflows/release.yaml create mode 100644 .goreleaser.yaml diff --git a/.github/workflows/autoupdate.yaml b/.github/workflows/autoupdate.yaml new file mode 100644 index 0000000..c80f230 --- /dev/null +++ b/.github/workflows/autoupdate.yaml @@ -0,0 +1,20 @@ +name: Autoupdate go.mod and go.sum + +on: + workflow_dispatch: + schedule: + - cron: "0 3 * * *" + +permissions: + contents: write + actions: write + pull-requests: write + security-events: write + +jobs: + autoupdate: + uses: lukaszraczylo/shared-actions/.github/workflows/go-autoupdate.yaml@main + with: + go-version: ">=1.22" + release-workflow: "release.yaml" + secrets: inherit diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml deleted file mode 100644 index eeca015..0000000 --- a/.github/workflows/ci.yml +++ /dev/null @@ -1,215 +0,0 @@ -name: ci - -on: - push: - branches: [main] - pull_request: - workflow_dispatch: - inputs: - dry-run-release: - description: "Compute release version, do not tag or release" - type: boolean - default: false - -permissions: - contents: write - pull-requests: read - -# Cancel any in-flight CI runs for the same branch when a new push lands. -concurrency: - group: ci-${{ github.ref }} - cancel-in-progress: true - -jobs: - vet: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v6 - - uses: actions/setup-go@v6 - with: - go-version: '1.25.x' - check-latest: true - - uses: actions/cache@v5 - with: - path: | - ~/go/pkg/mod - ~/.cache/go-build - key: ${{ runner.os }}-go-1.25-${{ hashFiles('**/go.sum') }} - - run: go vet ./... - - staticcheck: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v6 - - uses: actions/setup-go@v6 - with: - go-version: '1.25.x' - check-latest: true - - uses: actions/cache@v5 - with: - path: | - ~/go/pkg/mod - ~/.cache/go-build - key: ${{ runner.os }}-go-1.25-${{ hashFiles('**/go.sum') }} - - run: go install honnef.co/go/tools/cmd/staticcheck@v0.7.0 - - run: staticcheck ./... - - govulncheck: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v6 - - uses: actions/setup-go@v6 - with: - go-version: '1.25.x' - check-latest: true - - uses: actions/cache@v5 - with: - path: | - ~/go/pkg/mod - ~/.cache/go-build - key: ${{ runner.os }}-go-1.25-${{ hashFiles('**/go.sum') }} - - run: go install golang.org/x/vuln/cmd/govulncheck@latest - - run: govulncheck ./... - - gosec: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v6 - - uses: actions/setup-go@v6 - with: - go-version: '1.25.x' - check-latest: true - - uses: actions/cache@v5 - with: - path: | - ~/go/pkg/mod - ~/.cache/go-build - key: ${{ runner.os }}-go-1.25-${{ hashFiles('**/go.sum') }} - - run: go install github.com/securego/gosec/v2/cmd/gosec@latest - - run: gosec -quiet ./... - - test: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v6 - - uses: actions/setup-go@v6 - with: - go-version: '1.25.x' - check-latest: true - - uses: actions/cache@v5 - with: - path: | - ~/go/pkg/mod - ~/.cache/go-build - key: ${{ runner.os }}-go-1.25-${{ hashFiles('**/go.sum') }} - - run: go test -race -coverprofile=coverage.out ./... - - uses: actions/upload-artifact@v7 - with: - name: coverage - path: coverage.out - - golangci-lint: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v6 - - uses: actions/setup-go@v6 - with: - go-version: '1.25.x' - check-latest: true - - uses: golangci/golangci-lint-action@v7 - with: - version: v2.9.0 - - # Aggregate gate — depends on every check above. Used as a single required - # status check in branch protection AND as a dependency for the release job. - ci-success: - runs-on: ubuntu-latest - needs: [vet, staticcheck, govulncheck, gosec, test, golangci-lint] - if: always() - steps: - - name: All checks passed - if: ${{ !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled') }} - run: echo "ci-success" - - name: At least one check failed - if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }} - run: | - echo "Failed/cancelled jobs:" - echo '${{ toJSON(needs) }}' - exit 1 - - # Auto-release fires on every clean push to main (and on manual - # workflow_dispatch for testing). Computes next SemVer from commit history - # via lukaszraczylo/semver-generator and creates a GitHub release. - # oss-telemetry is a pure library, so there are no binaries to publish — - # consumers `go get github.com/lukaszraczylo/oss-telemetry@`. - release: - needs: ci-success - if: | - (github.event_name == 'push' && github.ref == 'refs/heads/main') || - github.event_name == 'workflow_dispatch' - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v6 - with: - fetch-depth: 0 # full history so semver-generator sees all tags + commits - - - uses: actions/setup-go@v6 - with: - go-version: '1.25.x' - check-latest: true - - # Action interface from - # https://github.com/lukaszraczylo/semver-generator/blob/main/action.yml - # Inputs: repository_local: true (use already-cloned repo) - # existing: true (respect existing tags as base) - # Output: semantic_version (bare version string, no "v" prefix) - - name: Compute next SemVer - id: semver - uses: lukaszraczylo/semver-generator@v1 - with: - repository_local: true - existing: true - config_file: .semver.yaml - - - name: Check if tag already exists - id: tag_check - run: | - TAG="v${{ steps.semver.outputs.semantic_version }}" - if git rev-parse "$TAG" >/dev/null 2>&1; then - echo "exists=true" >> "$GITHUB_OUTPUT" - echo "Tag $TAG already exists; nothing to release." - else - echo "exists=false" >> "$GITHUB_OUTPUT" - echo "tag=$TAG" >> "$GITHUB_OUTPUT" - fi - - - name: Dry-run summary - if: github.event_name == 'workflow_dispatch' && inputs.dry-run-release == true - run: | - echo "Would release: v${{ steps.semver.outputs.semantic_version }}" - echo "Skipping tag + release (dry-run)." - - - name: Tag release - if: | - steps.tag_check.outputs.exists == 'false' && - (github.event_name != 'workflow_dispatch' || inputs.dry-run-release == false) - env: - TAG: ${{ steps.tag_check.outputs.tag }} - run: | - git config user.name "github-actions[bot]" - git config user.email "github-actions[bot]@users.noreply.github.com" - git tag -a "$TAG" -m "Release $TAG" - git push origin "$TAG" - - - name: Create GitHub Release - if: | - steps.tag_check.outputs.exists == 'false' && - (github.event_name != 'workflow_dispatch' || inputs.dry-run-release == false) - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - TAG: ${{ steps.tag_check.outputs.tag }} - run: | - gh release create "$TAG" \ - --title "$TAG" \ - --generate-notes \ - --verify-tag diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml new file mode 100644 index 0000000..1c1e0e6 --- /dev/null +++ b/.github/workflows/lint.yaml @@ -0,0 +1,28 @@ +name: Lint + +on: + pull_request: + branches: + - main + push: + branches: + - main + +permissions: + contents: read + +concurrency: + group: lint-${{ github.ref }} + cancel-in-progress: true + +jobs: + golangci-lint: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v6 + - uses: actions/setup-go@v6 + with: + go-version: ">=1.22" + - uses: golangci/golangci-lint-action@v7 + with: + version: v2.9.0 diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml new file mode 100644 index 0000000..8551101 --- /dev/null +++ b/.github/workflows/pr.yaml @@ -0,0 +1,22 @@ +name: Pull Request + +on: + pull_request: + branches: + - main + push: + branches: + - "**" + - "!main" + +permissions: + contents: write + actions: write + pull-requests: write + security-events: write + +jobs: + pr-checks: + uses: lukaszraczylo/shared-actions/.github/workflows/go-pr.yaml@main + with: + go-version: ">=1.22" diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml new file mode 100644 index 0000000..87caf2a --- /dev/null +++ b/.github/workflows/release.yaml @@ -0,0 +1,24 @@ +name: Release + +on: + push: + branches: + - main + paths: + - "**.go" + - "go.mod" + - "go.sum" + workflow_dispatch: + +permissions: + contents: write + packages: write + id-token: write + +jobs: + release: + uses: lukaszraczylo/shared-actions/.github/workflows/go-release.yaml@main + with: + go-version: ">=1.22" + semver-config: ".semver.yaml" + secrets: inherit diff --git a/.goreleaser.yaml b/.goreleaser.yaml new file mode 100644 index 0000000..e46b52c --- /dev/null +++ b/.goreleaser.yaml @@ -0,0 +1,13 @@ +version: 2 +project_name: oss-telemetry + +builds: + - skip: true + +changelog: + sort: asc + filters: + exclude: + - "^docs:" + - "^test:" + - "^style:"