ci: migrate to shared workflows (#1)

Replace the generic ci.yml jobs with the shared go-pr and go-release workflows.
Add autoupdate through shared go-autoupdate.
Keep golangci-lint in a separate lint.yaml, because the shared workflows do not run it.
Add a build-less .goreleaser.yaml so the shared release flow can tag and publish the library.

.github/workflows/autoupdate.yaml

@@ -0,0 +1,20 @@
+name: Autoupdate go.mod and go.sum
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 3 * * *"
+
+permissions:
+  contents: write
+  actions: write
+  pull-requests: write
+  security-events: write
+
+jobs:
+  autoupdate:
+    uses: lukaszraczylo/shared-actions/.github/workflows/go-autoupdate.yaml@main
+    with:
+      go-version: ">=1.22"
+      release-workflow: "release.yaml"
+    secrets: inherit

.github/workflows/ci.yml

@@ -1,215 +0,0 @@
-name: ci
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-  workflow_dispatch:
-    inputs:
-      dry-run-release:
-        description: "Compute release version, do not tag or release"
-        type: boolean
-        default: false
-
-permissions:
-  contents: write
-  pull-requests: read
-
-# Cancel any in-flight CI runs for the same branch when a new push lands.
-concurrency:
-  group: ci-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  vet:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version: '1.25.x'
-          check-latest: true
-      - uses: actions/cache@v5
-        with:
-          path: |
-            ~/go/pkg/mod
-            ~/.cache/go-build
-          key: ${{ runner.os }}-go-1.25-${{ hashFiles('**/go.sum') }}
-      - run: go vet ./...
-
-  staticcheck:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version: '1.25.x'
-          check-latest: true
-      - uses: actions/cache@v5
-        with:
-          path: |
-            ~/go/pkg/mod
-            ~/.cache/go-build
-          key: ${{ runner.os }}-go-1.25-${{ hashFiles('**/go.sum') }}
-      - run: go install honnef.co/go/tools/cmd/[email protected]
-      - run: staticcheck ./...
-
-  govulncheck:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version: '1.25.x'
-          check-latest: true
-      - uses: actions/cache@v5
-        with:
-          path: |
-            ~/go/pkg/mod
-            ~/.cache/go-build
-          key: ${{ runner.os }}-go-1.25-${{ hashFiles('**/go.sum') }}
-      - run: go install golang.org/x/vuln/cmd/govulncheck@latest
-      - run: govulncheck ./...
-
-  gosec:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version: '1.25.x'
-          check-latest: true
-      - uses: actions/cache@v5
-        with:
-          path: |
-            ~/go/pkg/mod
-            ~/.cache/go-build
-          key: ${{ runner.os }}-go-1.25-${{ hashFiles('**/go.sum') }}
-      - run: go install github.com/securego/gosec/v2/cmd/gosec@latest
-      - run: gosec -quiet ./...
-
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version: '1.25.x'
-          check-latest: true
-      - uses: actions/cache@v5
-        with:
-          path: |
-            ~/go/pkg/mod
-            ~/.cache/go-build
-          key: ${{ runner.os }}-go-1.25-${{ hashFiles('**/go.sum') }}
-      - run: go test -race -coverprofile=coverage.out ./...
-      - uses: actions/upload-artifact@v7
-        with:
-          name: coverage
-          path: coverage.out
-
-  golangci-lint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version: '1.25.x'
-          check-latest: true
-      - uses: golangci/golangci-lint-action@v7
-        with:
-          version: v2.9.0
-
-  # Aggregate gate — depends on every check above. Used as a single required
-  # status check in branch protection AND as a dependency for the release job.
-  ci-success:
-    runs-on: ubuntu-latest
-    needs: [vet, staticcheck, govulncheck, gosec, test, golangci-lint]
-    if: always()
-    steps:
-      - name: All checks passed
-        if: ${{ !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled') }}
-        run: echo "ci-success"
-      - name: At least one check failed
-        if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
-        run: |
-          echo "Failed/cancelled jobs:"
-          echo '${{ toJSON(needs) }}'
-          exit 1
-
-  # Auto-release fires on every clean push to main (and on manual
-  # workflow_dispatch for testing). Computes next SemVer from commit history
-  # via lukaszraczylo/semver-generator and creates a GitHub release.
-  # oss-telemetry is a pure library, so there are no binaries to publish —
-  # consumers `go get github.com/lukaszraczylo/oss-telemetry@<tag>`.
-  release:
-    needs: ci-success
-    if: |
-      (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
-      github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          fetch-depth: 0   # full history so semver-generator sees all tags + commits
-
-      - uses: actions/setup-go@v6
-        with:
-          go-version: '1.25.x'
-          check-latest: true
-
-      # Action interface from
-      # https://github.com/lukaszraczylo/semver-generator/blob/main/action.yml
-      #   Inputs:  repository_local: true   (use already-cloned repo)
-      #            existing: true           (respect existing tags as base)
-      #   Output:  semantic_version         (bare version string, no "v" prefix)
-      - name: Compute next SemVer
-        id: semver
-        uses: lukaszraczylo/semver-generator@v1
-        with:
-          repository_local: true
-          existing: true
-          config_file: .semver.yaml
-
-      - name: Check if tag already exists
-        id: tag_check
-        run: |
-          TAG="v${{ steps.semver.outputs.semantic_version }}"
-          if git rev-parse "$TAG" >/dev/null 2>&1; then
-            echo "exists=true" >> "$GITHUB_OUTPUT"
-            echo "Tag $TAG already exists; nothing to release."
-          else
-            echo "exists=false" >> "$GITHUB_OUTPUT"
-            echo "tag=$TAG" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Dry-run summary
-        if: github.event_name == 'workflow_dispatch' && inputs.dry-run-release == true
-        run: |
-          echo "Would release: v${{ steps.semver.outputs.semantic_version }}"
-          echo "Skipping tag + release (dry-run)."
-
-      - name: Tag release
-        if: |
-          steps.tag_check.outputs.exists == 'false' &&
-          (github.event_name != 'workflow_dispatch' || inputs.dry-run-release == false)
-        env:
-          TAG: ${{ steps.tag_check.outputs.tag }}
-        run: |
-          git config user.name  "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git tag -a "$TAG" -m "Release $TAG"
-          git push origin "$TAG"
-
-      - name: Create GitHub Release
-        if: |
-          steps.tag_check.outputs.exists == 'false' &&
-          (github.event_name != 'workflow_dispatch' || inputs.dry-run-release == false)
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          TAG: ${{ steps.tag_check.outputs.tag }}
-        run: |
-          gh release create "$TAG" \
-            --title "$TAG" \
-            --generate-notes \
-            --verify-tag

.github/workflows/lint.yaml

@@ -0,0 +1,28 @@
+name: Lint
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: lint-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  golangci-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
+        with:
+          go-version: ">=1.22"
+      - uses: golangci/golangci-lint-action@v7
+        with:
+          version: v2.9.0

.github/workflows/pr.yaml

@@ -0,0 +1,22 @@
+name: Pull Request
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - "**"
+      - "!main"
+
+permissions:
+  contents: write
+  actions: write
+  pull-requests: write
+  security-events: write
+
+jobs:
+  pr-checks:
+    uses: lukaszraczylo/shared-actions/.github/workflows/go-pr.yaml@main
+    with:
+      go-version: ">=1.22"

.github/workflows/release.yaml

@@ -0,0 +1,24 @@
+name: Release
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "**.go"
+      - "go.mod"
+      - "go.sum"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  packages: write
+  id-token: write
+
+jobs:
+  release:
+    uses: lukaszraczylo/shared-actions/.github/workflows/go-release.yaml@main
+    with:
+      go-version: ">=1.22"
+      semver-config: ".semver.yaml"
+    secrets: inherit

.goreleaser.yaml

@@ -0,0 +1,13 @@
+version: 2
+project_name: oss-telemetry
+
+builds:
+  - skip: true
+
+changelog:
+  sort: asc
+  filters:
+    exclude:
+      - "^docs:"
+      - "^test:"
+      - "^style:"