setup continuous integration

Continuous integration runs in two simultaneous jobs. One for make ci,
which runs cargo build, test, fmt and clippy. The other, make image,
builds the updater container image.

Caching for make ci speeds up the build time from over 10 minutes to
just a minute or two. cargo install cargo-deny took five minutes on its
own before caching CARGO_HOME.

Caching for the make image build required some hacks and ended up being
slower that running with no caching (due to all the compressing and
decompressing of docker image layers, CPU-bound), so no caching there.

.github/cache-bust

@@ -0,0 +1,4 @@
+# this file provides a manual way to clear out github actions caches. any change
+# to this file will cause all github action caches to miss. increment the number
+# below by 1 if you need to clear the caches.
+1

.github/workflows/updater-ci.yaml

@@ -0,0 +1,55 @@
+name: Updater CI
+on:
+  pull_request:
+    paths-ignore:
+      - '**.md'
+    branches: ['*']
+  push:
+    paths-ignore:
+      - '**.md'
+    branches: [develop]
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+
+      - name: Cargo Home Cache
+        uses: actions/cache@v2
+        env:
+          cache-name: cargo-home
+        with:
+          path: /usr/share/rust/.cargo
+          key: ${{ hashFiles('.github/cache-bust', '/usr/share/rust/.cargo/bin/cargo') }}-${{ hashFiles('updater/Cargo.lock', 'integ/Cargo.lock') }}
+          restore-keys: |
+            ${{ hashFiles('.github/cache-bust', '/usr/share/rust/.cargo/bin/cargo') }}-${{ hashFiles('updater/Cargo.lock', 'integ/Cargo.lock') }}
+            ${{ hashFiles('.github/cache-bust', '/usr/share/rust/.cargo/bin/cargo') }}-
+
+      - name: Updater Build Cache
+        uses: actions/cache@v2
+        env:
+          cache-name: updater-target
+        with:
+          path: updater/target
+          key: ${{ hashFiles('.github/cache-bust') }}-${{ hashFiles('updater/Cargo.lock') }}
+          restore-keys: |
+            ${{ hashFiles('.github/cache-bust') }}-
+
+      - name: Integ Build Cache
+        uses: actions/cache@v2
+        env:
+          cache-name: integ-target
+        with:
+          path: integ/target
+          key: ${{ hashFiles('.github/cache-bust') }}-${{ hashFiles('integ/Cargo.lock') }}
+          restore-keys: |
+            ${{ hashFiles('.github/cache-bust') }}-
+
+      - run: rustup update stable && cargo install cargo-deny
+      - run: make ci
+
+  image:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - run: make image

Makefile

@@ -26,3 +26,23 @@ fetch-sdk: # fetches and loads the image we use to build the updater docker imag
 check-licenses:
 	cd updater && cargo deny check licenses
 	cd integ && cargo deny check licenses
+
+.PHONY: unit-tests
+unit-tests:
+	cd updater && cargo test --locked
+	cd integ && cargo test --locked
+
+.PHONY: build
+build:
+	cd updater && cargo build --locked
+	cd integ && cargo build --locked
+
+.PHONY: lint
+lint:
+	cd updater && cargo fmt -- --check
+	cd updater && cargo clippy --locked -- -D warnings
+	cd integ && cargo fmt -- --check
+	cd integ && cargo clippy --locked -- -D warnings
+
+.PHONY: ci # these are all of the checks (except for image) that we run for ci
+ci: check-licenses lint build unit-tests