feat: add reusable workflows

.circleci/config.yml

@@ -257,8 +257,6 @@ workflows:
       - test:db:migration:
           requires:
             - build:local
-
-# Don't build on master because build is just a gorelease without the release
       - build:
           requires:
             - test:golang
@@ -267,8 +265,6 @@ workflows:
           filters:
             branches:
               ignore: master
-
-# Dev deploys require all tests to pass and app builds
       - deploy:dev:
           requires:
             - build
@@ -276,16 +272,12 @@ workflows:
           filters:
             branches:
               only: develop
-
-# Production deploys only happen if everything passes
-# and we have a tag starting with v
       - release:
           filters:
             branches:
               ignore: /.*/
             tags:
               only: /^v.*/
-
       - deploy:prod:
           filters:
             branches:

.github/workflows/common.yml

@@ -0,0 +1,10 @@
+on:
+  workflow_call:
+jobs:
+  - uses: actions/checkout@v3
+  - uses: actions/setup-go@v3
+    with: { go-version: 1.17 }
+  - uses: actions/setup-node@v3
+    with: { node-version: '14' }
+  - name: Install task binary
+    run: go get github.com/go-task/task/v3/cmd/task

.github/workflows/main.yml

@@ -0,0 +1,30 @@
+name: Main
+on:
+  push:
+    branches:
+      - develop
+jobs:
+  build-local:
+    runs-on: [ubuntu-latest]
+    steps:
+      - uses: ./.github/workflows/common.yml
+      - run: task deps
+      - run: task compile
+      - uses: ./.github/workflows/test-compile-changes.yml
+      - run: task build:local
+
+  build:
+    runs-on: [ubuntu-latest]
+    steps:
+      - uses: ./.github/workflows/common.yml
+      - run: sudo apt update && sudo apt-get install rpm
+      - run: task deps
+      - run: task compile
+      - uses: ./.github/workflows/test-compile-changes.yml
+      - uses: ./.github/workflows/unlock-gpg.yml
+      - run: task build
+
+  release:
+    runs-on: [ubuntu-latest]
+    steps:
+      - uses: ./.github/workflows/unlock-gpg.yml

.github/workflows/test-compile-changes.yml

@@ -0,0 +1,5 @@
+on:
+  workflow_call:
+jobs:
+  - name: Test that compile did not create/modify untracked files
+    run: git diff --exit-code --stat -- . ':(exclude)web2/package.json' ':(exclude)web2/package-lock.json' ':(exclude)go.mod' ':(exclude)go.sum'

.github/workflows/unlock-gpg.yml

@@ -0,0 +1,15 @@
+on:
+  workflow_call:
+    secrets:
+      gpg_key: { required: true }
+      gpg_pass: { required: true }
+jobs:
+  unlock_gpg:
+    runs-on: [ubuntu-latest]
+    steps:
+      - name: Unlock
+        run: |
+          echo ${{ ${{ secrets.gpg_key }} }} | tr " " "\n" | base64 -d | gpg --import --batch
+          gpg --sign -u "8CDE D132 5E96 F1D9 EABF 17D4 2C96 CF7D D27F AB82" --pinentry-mode loopback --yes --batch --passphrase "${{ secrets.gpg_pass }}" --output unlock.sig --detach-sign README.md
+          rm -f unlock.sig
+