setup continuous integration

Continuous integration runs in two simultaneous jobs. One for make ci,
which runs cargo build, test, fmt and clippy. The other, make image,
builds the updater container image.

Caching for make ci speeds up the build time from over 10 minutes to
just a minute or two. cargo install cargo-deny took five minutes on its
own before caching CARGO_HOME.

Caching for the make image build required some hacks and ended up being
slower that running with no caching (due to all the compressing and
decompressing of docker image layers, CPU-bound), so no caching there.

.github/workflows/updater-ci.yaml

@@ -0,0 +1,55 @@
+name: Updater CI
+on:
+  pull_request:
+    branches: [*]
+  push:
+    branches: [develop]
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+
+      - name: Cargo Home Cache
+        uses: actions/cache@v2
+        env:
+          cache-name: cargo-home
+        with:
+          path: /usr/share/rust/.cargo
+          key: ${{ runner.os }}-${{ hashFiles('/usr/share/rust/.cargo/bin/cargo') }}-${{ hashFiles('/usr/share/rust/.cargo/bin/cargo-deny') }}-${{ hashFiles('Makefile') }}-${{ hashFiles('updater/Cargo.lock') }}-${{ hashFiles('integ/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-${{ hashFiles('/usr/share/rust/.cargo/bin/cargo') }}-${{ hashFiles('/usr/share/rust/.cargo/bin/cargo-deny') }}-${{ hashFiles('Makefile') }}-${{ hashFiles('updater/Cargo.lock') }}-
+            ${{ runner.os }}-${{ hashFiles('/usr/share/rust/.cargo/bin/cargo') }}-${{ hashFiles('/usr/share/rust/.cargo/bin/cargo-deny') }}-${{ hashFiles('Makefile') }}-
+            ${{ runner.os }}-${{ hashFiles('/usr/share/rust/.cargo/bin/cargo') }}-${{ hashFiles('/usr/share/rust/.cargo/bin/cargo-deny') }}-
+            ${{ runner.os }}-${{ hashFiles('/usr/share/rust/.cargo/bin/cargo') }}-
+
+      - name: Updater Build Cache
+        uses: actions/cache@v2
+        env:
+          cache-name: updater-target
+        with:
+          path: updater/target
+          key: ${{ runner.os }}-${{ hashFiles('updater/Cargo.toml') }}-${{ hashFiles('updater/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-${{ hashFiles('updater/Cargo.toml') }}-
+            ${{ runner.os }}-
+
+      - name: Integ Build Cache
+        uses: actions/cache@v2
+        env:
+          cache-name: integ-target
+        with:
+          path: integ/target
+          key: ${{ runner.os }}-${{ hashFiles('integ/Cargo.toml') }}-${{ hashFiles('integ/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-${{ hashFiles('integ/Cargo.toml') }}-
+            ${{ runner.os }}-
+
+      - run: rustup update stable && cargo install cargo-deny
+      - run: make ci
+
+  image:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - run: make image

Makefile

@@ -20,7 +20,7 @@ image: fetch-sdk
 
 .PHONY: fetch-sdk
 fetch-sdk: # fetches and loads the we use to build the updater docker image
-	set -eou pipefail; \
+	set -eou; \
 	if ! docker image inspect ${BUILDER_IMAGE} >/dev/null 2>&1; then \
 	  if ! curl --fail --show-error https://${BOTTLEROCKET_SDK_SITE}/${BUILDER_IMAGE}.tar.gz \
 		| gunzip | docker load; then \
@@ -35,3 +35,23 @@ fetch-sdk: # fetches and loads the we use to build the updater docker image
 check-licenses:
 	cd updater && cargo deny check licenses
 	cd integ && cargo deny check licenses
+
+.PHONY: unit-tests
+unit-tests:
+	cd updater && cargo test --locked
+	cd integ && cargo test --locked
+
+.PHONY: build
+build:
+	cd updater && cargo build --locked
+	cd integ && cargo build --locked
+
+.PHONY: lint
+lint:
+	cd updater && cargo fmt -- --check
+	cd updater && cargo clippy --locked -- -D warnings
+	cd integ && cargo fmt -- --check
+	cd integ && cargo clippy --locked -- -D warnings
+
+.PHONY: ci # these are all of the checks (except for image) that we run for ci
+ci: check-licenses lint build unit-tests