setup GHA based CI for grpc

.github/workflows/ci.yml

@@ -1,62 +1,271 @@
-name: CI
+name: Elixir CI Checks
+
+env:
+  DEBIAN_FRONTEND: noninteractive
+  DEPENDENCY_FILE: mix.lock
+  ELIXIR_VERSION: 1.11.4 # Elixir version used during package publishing
+  JOB_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+  OTP_VERSION: 23.3.4.7 # OTP version used during package publishing
+  RELEVANT_FILES: "mix.lock mix.exs lib priv config test" # Important, this controls the caching, make sure to keep this right
+  REPOSITORY: grpc
+  RUNNER_OS: ubuntu20 # Must match Elixir/OTP version in described in action erlef/setup-beam@v1
+  SHA: ${{ github.sha }}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 on:
-  pull_request:
-    branches:
-      - '**'
   push:
     branches:
       - master
+  pull_request:
+    types:
+      - synchronize
+      - opened
+      - reopened
 
 jobs:
-  check_format:
-    runs-on: ubuntu-latest
-    name: Check format
-    container:
-      image: elixir:1.9-slim
+  static:
+    name: Static Checks (Elixir ${{ matrix.elixir }})
+    runs-on: runs-on,runner=2cpu-linux-x64
+    outputs:
+      HASH: ${{ steps.hash.outputs.HASH }}
+    strategy:
+      fail-fast: false
+      matrix:
+        otp: [20.x, 21.x, 22.x]
+        elixir: [1.7.x, 1.8.x, 1.9.x, 1.10.x]
+        runner-os: [ubuntu20]
+        exclude:
+          - otp: 20.x
+            elixir: 1.10.x
     steps:
-      - uses: actions/checkout@v1
-      - name: Install Dependencies
+      - name: Checkout latest codebase
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ env.SHA }}
+          clean: false
+          persist-credentials: true
+      - name: Setup Elixir
+        uses: erlef/setup-beam@v1
+        env:
+          ImageOS: ${{ matrix.runner-os }}
+        with:
+          elixir-version: ${{ matrix.elixir }}
+          otp-version: ${{ matrix.otp }}
+          version-type: strict
+      - name: Get SHA sum (HASH) of relevant files
+        id: hash
         run: |
-          mix local.rebar --force
-          mix local.hex --force
+          git config --global --add safe.directory /__w/${{ env.repository }}/${{ env.repository }}
+          echo "Get SHA sum (HASH) of relevant files"
+          HASH="$(git ls-tree ${{ env.SHA }} -- ${{ env.RELEVANT_FILES }} | sha1sum | cut -d' ' -f1)"
+          echo "BUILD HASH FOR THE CODEBASE IS: $HASH"
+          echo "HASH=$HASH" >> $GITHUB_OUTPUT
+      - name: Hex auth
+        run: mix hex.organization auth fresha --key ${{ secrets.HEX_ORGANIZATION_WRITE_KEY }}
+      - uses: runs-on/cache@v4
+        id: deps-cache
+        with:
+          path: |
+            deps
+            _build/dev
+          key: ${{ runner.os }}-${{ matrix.elixir }}-${{ matrix.otp }}-precompile-deps-dev-${{ hashFiles('mix.lock') }}
+      - name: Install dependencies
+        if: steps.deps-cache.outputs.cache-hit != 'true'
+        env:
+          MIX_ENV: dev
+        run: |
+          echo "Installing dependencies"
           mix deps.get
-      - name: Check format
-        run: mix format --check-formatted
-
-  tests:
-    runs-on: ubuntu-latest
-    name: OTP ${{matrix.otp}} / Elixir ${{matrix.elixir}}
+          mix deps.compile
+      - uses: runs-on/cache@v4
+        id: build-cache
+        with:
+          path: '**/*'
+          key: ${{ runner.os }}-${{ matrix.elixir }}-${{ matrix.otp }}-compile-dev-${{ steps.hash.outputs.HASH }}
+      - name: Compile with warning as --warnings-as-errors
+        if: steps.build-cache.outputs.cache-hit != 'true'
+        run: |
+          echo "Compiling the app with --warnings-as-errors"
+          mix compile --warnings-as-errors --force
+      - name: Run credo
+        run: |
+          echo "Running credo"
+          mix credo --strict
+      - name: Run format
+        run: |
+          echo "Running format"
+          mix format --check-formatted --dry-run
+      - name: Run publish --dry-run
+        env:
+          HEX_API_KEY: ${{ secrets.HEX_ORGANIZATION_WRITE_KEY }}
+        run: |
+          echo "Running publish --dry-run"
+          mix hex.publish --dry-run
+  test:
+    name: Unit Tests (Elixir ${{ matrix.elixir }})
+    runs-on: runs-on,runner=2cpu-linux-x64
     strategy:
+      fail-fast: false
       matrix:
         otp: [20.x, 21.x, 22.x]
         elixir: [1.7.x, 1.8.x, 1.9.x, 1.10.x]
+        runner-os: [ubuntu20]
         exclude:
           - otp: 20.x
             elixir: 1.10.x
-    needs: check_format
     steps:
-    - uses: actions/checkout@v1
-    - uses: actions/[email protected]
-      with:
-        otp-version: ${{matrix.otp}}
-        elixir-version: ${{matrix.elixir}}
-    - name: Install Dependencies
-      run: |
-        mix local.rebar --force
-        mix local.hex --force
-        mix deps.get
-    - name: Run Tests
-      run: mix test
+      - name: Checkout latest codebase
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ env.SHA }}
+          clean: false
+          persist-credentials: true
+      - name: Setup Elixir
+        uses: erlef/setup-beam@v1
+        env:
+          ImageOS: ${{ matrix.runner-os }}
+        with:
+          elixir-version: ${{ matrix.elixir }}
+          otp-version: ${{ matrix.otp }}
+          version-type: strict
+      - name: Get SHA sum (HASH) of relevant files
+        id: hash
+        run: |
+          git config --global --add safe.directory /__w/${{ env.repository }}/${{ env.repository }}
+          echo "Get SHA sum (HASH) of relevant files"
+          HASH="$(git ls-tree ${{ env.SHA }} -- ${{ env.RELEVANT_FILES }} | sha1sum | cut -d' ' -f1)"
+          echo "BUILD HASH FOR THE CODEBASE IS: $HASH"
+          echo "HASH=$HASH" >> $GITHUB_OUTPUT
+      - name: Hex auth
+        run: mix hex.organization auth fresha --key ${{ secrets.HEX_ORGANIZATION_WRITE_KEY }}
+      - uses: runs-on/cache@v4
+        id: deps-cache
+        with:
+          path: |
+            deps
+            _build/test
+          key: ${{ runner.os }}-${{ matrix.elixir }}-${{ matrix.otp }}-precompile-deps-test-${{ hashFiles('mix.lock') }}
+      - name: Install dependencies
+        if: steps.deps-cache.outputs.cache-hit != 'true'
+        env:
+          MIX_ENV: test
+        run: |
+          echo "Installing dependencies"
+          mix deps.get
+          mix deps.compile
+      - uses: runs-on/cache@v4
+        id: build-cache
+        with:
+          path: '**/*'
+          key: ${{ runner.os }}-${{ matrix.elixir }}-${{ matrix.otp }}-compile-test-${{ steps.hash.outputs.HASH }}
+      - name: Compile with MIX_ENV=test
+        if: steps.build-cache.outputs.cache-hit != 'true'
+        env:
+          MIX_ENV: test
+        run: |
+          echo "Compiling the app with MIX_ENV=test"
+          mix compile --force
+      - name: Run tests
+        run: |
+          echo "Running tests"
+          mix test --cover
+  permit:
+    name: Permit Package Publishing
+    needs: [static, test]
+    runs-on: runs-on,runner=1cpu-linux-x64
+    outputs:
+      PUBLISH: ${{ steps.version.outputs.PUBLISH }}
+    steps:
+      - name: Checkout latest codebase
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
+          ref: ${{ env.SHA }}
+          clean: false
+          persist-credentials: true
+      - name: Create Approval File
+        shell: bash
+        run: |
+          echo "CI Checks Passed for SHA ${{ env.SHA }} and HASH ${{ needs.static.outputs.HASH }}" > approval.txt
+      - name: Process Package Version
+        shell: bash
+        id: version
+        run: |
+          echo "==============================================="
+          echo ""
+          git show HEAD~1:mix.exs > mix.old.exs
+          diff mix.old.exs mix.exs > diff.txt || true
+          old_version=$(grep -oP 'version: "\K[^"]+' mix.old.exs)
+          new_version=$(grep -oP 'version: "\K[^"]+' mix.exs)
+          echo "Old Version: $old_version | New Version: $new_version"
+          if [ "$new_version" != "$old_version" ]; then
+            if [ "$new_version" \> "$old_version" ]; then
+              echo "Version is upped - WILL publish upon merging the PR"
+              echo "PUBLISH=true" >> $GITHUB_OUTPUT
+            else
+              echo "Version is lower than the original version - blocking publication"
+              echo "PUBLISH=false" >> $GITHUB_OUTPUT
+              exit 1
+            fi
+          else
+            echo "PUBLISH=false" >> $GITHUB_OUTPUT
+            echo "Version is unchanged - WONT publish upon merging the PR"
+          fi
+          echo ""
+          echo "==============================================="
+      - name: Cache Approval File
+        uses: runs-on/cache/save@v4
+        with:
+          path: approval.txt
+          key: ${{ runner.os }}-${{ env.REPOSITORY }}-approval-${{ needs.static.outputs.HASH }}
+
+  publish:
+    name: Publish Hex Package
+    needs: [permit]
+    runs-on: runs-on,runner=2cpu-linux-x64
+    if: needs.permit.outputs.PUBLISH == 'true' && github.event_name == 'push'
+    steps:
+      - name: Checkout latest codebase
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ env.SHA }}
+          clean: false
+          persist-credentials: true
+      - name: Setup Elixir
+        uses: erlef/setup-beam@v1
+        env:
+          ImageOS: ${{ env.RUNNER_OS }}
+        with:
+          elixir-version: ${{ env.ELIXIR_VERSION }}
+          otp-version: ${{ env.OTP_VERSION }}
+          version-type: strict
+      - name: Hex auth
+        run: mix hex.organization auth fresha --key ${{ secrets.HEX_ORGANIZATION_WRITE_KEY }}
+        shell: bash
+      - name: Get dependencies
+        shell: bash
+        run: |
+          echo "Getting dependencies"
+          mix deps.get
+      - name: Publish dev package
+        shell: bash
+        env:
+          HEX_API_KEY: ${{ secrets.HEX_ORGANIZATION_WRITE_KEY }}
+        run: |
+          echo "Publishing package"
+          mix hex.publish --yes
+
 
   interop-tests:
     runs-on: ubuntu-latest
     name: Interop tests
     container:
       image: elixir:1.9-slim
-    needs: check_format
     steps:
-    - uses: actions/checkout@v1
+    - uses: actions/checkout@v4
     - name: Install Dependencies
       run: |
         mix local.rebar --force
@@ -70,11 +279,10 @@ jobs:
   check_release:
     runs-on: ubuntu-latest
     name: Check release
-    needs: check_format
     container:
       image: elixir:1.9-slim
     steps:
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@v4
       - name: Install Dependencies
         run: |
           mix local.rebar --force

.github/workflows/dev-publish.yaml

@@ -0,0 +1,76 @@
+name: Elixir Dev Publish
+
+env:
+  DEBIAN_FRONTEND: noninteractive
+  DEPENDENCY_FILE: mix.lock
+  ELIXIR_VERSION: 1.11.4 # Elixir version used during package publishing
+  JOB_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+  OTP_VERSION: 23.3.4.7 # OTP version used during package publishing
+  RELEVANT_FILES: "mix.lock mix.exs lib priv config test" # Important, this controls the caching, make sure to keep this right
+  REPOSITORY: grpc
+  RUNNER_OS: ubuntu20 # Must match Elixir/OTP version in described in action erlef/setup-beam@v1
+  SHA: ${{ github.sha }}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  workflow_dispatch:
+    inputs: {}
+
+jobs:
+  dev-publish:
+    name: Dev Publish
+    runs-on: runs-on,runner=4cpu-linux-x64
+    steps:
+      - name: Checkout latest codebase
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ env.sha }}
+          clean: false
+          persist-credentials: true
+      - name: Get SHA sum (HASH) of relevant files
+        id: hash
+        shell: bash
+        run: |
+          git config --global --add safe.directory /__w/${{ env.REPOSITORY }}/${{ env.REPOSITORY }}
+          echo "Get SHA sum (HASH) of relevant files"
+          HASH="$(git ls-tree ${{ env.SHA }} -- ${{ env.RELEVANT_FILES }} | sha1sum | cut -d' ' -f1)"
+          echo "BUILD HASH FOR THE CODEBASE IS: $HASH"
+          echo "IT WILL BE USED TO DETERMINE ELIGIBILITY OF THE CODEBASE FOR THE RELEASE"
+          echo "APPROVAL PRODUCED BY SUCCESSFULL CHECKS EXECUTION WILL LAND IN CACHE"
+          echo "HASH=$HASH" >> $GITHUB_OUTPUT
+      - name: Check for CI successes
+        uses: runs-on/cache/restore@v4
+        with:
+          key: ${{ runner.os }}-${{ env.repository }}-approval-${{ steps.hash.outputs.HASH }}
+          path: approval.txt
+          fail-on-cache-miss: true
+      - name: Setup Elixir
+        uses: erlef/setup-beam@v1
+        env:
+          ImageOS: ${{ env.RUNNER_OS }}
+        with:
+          elixir-version: ${{ env.ELIXIR_VERSION }}
+          otp-version: ${{ env.OTP_VERSION }}
+          version-type: strict
+      - name: Hex auth
+        run: mix hex.organization auth fresha --key ${{ secrets.HEX_ORGANIZATION_WRITE_KEY }}
+        shell: bash
+      - name: Get dependencies
+        shell: bash
+        run: |
+          echo "Getting dependencies"
+          mix deps.get
+      - name: Mark package version with dev suffix
+        shell: bash
+        run: |
+          sed -i "s/version: \"[[:digit:]]\+\.[[:digit:]]\+\.[[:digit:]]\+/&-git-$(git rev-parse --verify --short=4 HEAD)/" mix.exs
+      - name: Publish dev package
+        shell: bash
+        env:
+          HEX_API_KEY: ${{ secrets.HEX_ORGANIZATION_WRITE_KEY }}
+        run: |
+          echo "Publishing dev package"
+          mix hex.publish --yes