Merge pull request #480 from simondeziel/github-4.0-edge

github: add .github/ content from latest-edge branch (4.0-edge)

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @tomponline

.github/dependabot.yml

@@ -0,0 +1,29 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    labels: []
+    schedule:
+      interval: "weekly"
+
+  # XXX: also check on other (non-default) edge branches
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    labels: []
+    schedule:
+      interval: "weekly"
+    target-branch: "5.21-edge"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    labels: []
+    schedule:
+      interval: "weekly"
+    target-branch: "5.0-edge"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    labels: []
+    schedule:
+      interval: "weekly"
+    target-branch: "4.0-edge"

.github/labeler.yml

@@ -0,0 +1,8 @@
+"5.21 LTS":
+- base-branch: '^5\.21-.+$'
+
+"5.0 LTS":
+- base-branch: '^5\.0-.+$'
+
+"4.0 LTS":
+- base-branch: '^4\.0-.+$'

.github/workflows/builds.yml

@@ -0,0 +1,86 @@
+name: Builds
+on:
+  pull_request:
+  push:
+    branches:
+      - 4.0-edge
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lxd-migrate:
+    name: Test lxd-migrate build
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: 1.18.x
+
+      - name: Test lxd-migrate build
+        run: |
+          set -eux
+          cd ~/work/lxd-pkg-snap/lxd-pkg-snap/lxd-migrate
+          CGO_ENABLED=0 go build -v -tags netgo
+
+  snap:
+    name: Trigger snap build
+    runs-on: ubuntu-22.04
+    needs: lxd-migrate
+    if: ${{ github.repository == 'canonical/lxd-pkg-snap' && github.event_name == 'push' && github.actor != 'dependabot[bot]' }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Launchpad SSH access
+        env:
+          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
+          LAUNCHPAD_LXD_BOT_KEY: ${{ secrets.LAUNCHPAD_LXD_BOT_KEY }}
+        run: |
+          set -eux
+          mkdir -m 0700 -p ~/.ssh/
+          ssh-agent -a "${SSH_AUTH_SOCK}" > /dev/null
+          ssh-add - <<< "${{ secrets.LAUNCHPAD_LXD_BOT_KEY }}"
+          ssh-add -L > ~/.ssh/id_ed25519.pub
+          # In ephemeral environments like GitHub Action runners, relying on TOFU isn't providing any security
+          # so require the key obtained by `ssh-keyscan` to match the expected hash from https://help.launchpad.net/SSHFingerprints
+          ssh-keyscan git.launchpad.net >> ~/.ssh/known_hosts
+          ssh-keygen -qlF git.launchpad.net | grep -xF 'git.launchpad.net RSA SHA256:UNOzlP66WpDuEo34Wgs8mewypV0UzqHLsIFoqwe8dYo'
+
+      - name: Install Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: 1.22.x
+
+      - name: Trigger Launchpad snap build
+        env:
+          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
+          TARGET: ${{ github.ref_name }}
+        run: |
+          set -eux
+          git config --global transfer.fsckobjects true
+          git config --global user.name "Canonical LXD Bot"
+          git config --global user.email "[email protected]"
+          git config --global commit.gpgsign true
+          git config --global gpg.format "ssh"
+          git config --global user.signingkey ~/.ssh/id_ed25519.pub
+          localRev="$(git rev-parse HEAD)"
+          go install github.com/canonical/lxd-ci/lxd-snapcraft@latest
+          git clone -b "${TARGET}" git+ssh://[email protected]/~canonical-lxd/lxd ~/lxd-pkg-snap-lp
+          # XXX: `ver` contains an array with the 2 versions
+          ver=($(lxd-snapcraft -package lxd -get-version -file ~/lxd-pkg-snap-lp/snapcraft.yaml))
+          rsync -a --exclude .git --delete . ~/lxd-pkg-snap-lp/
+          cd ~/lxd-pkg-snap-lp
+          lxd-snapcraft -package lxd -set-version "${ver[0]}" -set-source-commit "${ver[1]}"
+          git add --all
+          git commit --all --quiet -s --allow-empty -m "Automatic upstream build (${TARGET})" -m "Upstream commit: ${localRev}"
+          git show
+          git push --quiet

.github/workflows/commits.yml

@@ -0,0 +1,29 @@
+name: Commits
+on:
+  - pull_request
+
+permissions:
+  contents: read
+
+jobs:
+  commits:
+    name: Branch target
+    runs-on: ubuntu-22.04
+    steps:
+    - name: Check branch target
+      env:
+        TARGET: ${{ github.event.pull_request.base.ref }}
+        TITLE: ${{ github.event.pull_request.title }}
+      if: ${{ github.actor != 'dependabot[bot]' }}
+      run: |
+        set -eux
+        TARGET_FROM_PR_TITLE="$(echo "${TITLE}" | sed -n 's/.*(\(\(latest\|[0-9]\+\.[0-9]\+\)-\(edge\|candidate\)\))$/\1/p')"
+        if [ -z "${TARGET_FROM_PR_TITLE}" ]; then
+          TARGET_FROM_PR_TITLE="latest-edge"
+        else
+          echo "Branch target overridden from PR title"
+        fi
+        [ "${TARGET}" = "${TARGET_FROM_PR_TITLE}" ] && exit 0
+
+        echo "Invalid branch target: ${TARGET} != ${TARGET_FROM_PR_TITLE}"
+        exit 1

.github/workflows/tests.yml

@@ -0,0 +1,42 @@
+name: Tests
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    # Make sure bash is always invoked with `-eo pipefail`
+    # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsshell
+    shell: bash
+
+jobs:
+  code-tests:
+    name: Code
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          # A non-shallow clone is needed for the Differential ShellCheck
+          fetch-depth: 0
+
+      - id: ShellCheck
+        name: Differential ShellCheck
+        uses: redhat-plumbers-in-action/differential-shellcheck@v5
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+        if: github.event_name == 'pull_request'
+
+      - name: Upload artifact with ShellCheck defects in SARIF format
+        uses: actions/upload-artifact@v4
+        with:
+          name: Differential ShellCheck SARIF
+          path: ${{ steps.ShellCheck.outputs.sarif }}
+        if: github.event_name == 'pull_request'