Migrate CI from Cirrus CI to GitHub Actions (#52)

* Migrate CI to GitHub Actions

* Publish Homebrew formula with release app

* Keep release dry runs outside publish environment

* Use GitHub-hosted macOS 26 runners

* Address CI migration review feedback

.cirrus.yml

@@ -1,91 +0,0 @@
-task:
-  name: Lint
-  container:
-    image: golangci/golangci-lint:latest
-    cpu: 2
-    memory: 4096
-  prepare_script:
-    - apt-get update
-    - apt-get install -y libx11-dev
-  lint_script:
-    - golangci-lint run -v --output.json.path golangci.json
-  always:
-    report_artifacts:
-      path: golangci.json
-      type: text/json
-      format: golangci
-
-task:
-  name: Test (Linux)
-  alias: Tests
-  container:
-    image: golang:latest
-
-  prepare_script:
-    - apt-get update
-    - apt-get install -y libx11-dev
-  test_script: go test -v ./...
-
-task:
-  name: Test (macOS)
-  alias: Tests
-  macos_instance:
-    image: ghcr.io/cirruslabs/macos-runner:sequoia
-
-  prepare_script: brew install go
-  test_script: go test -v ./...
-
-task:
-  name: Check for lacking "buf generate" invocation
-
-  container:
-    image: golang:latest
-
-  install_buf_script: go install github.com/bufbuild/buf/cmd/buf@v1.50.0
-  generate_script: buf generate
-  check_script: git diff --exit-code
-
-task:
-  only_if: $CIRRUS_BRANCH != '' && $CIRRUS_PR == '' && $CIRRUS_REPO_OWNER == 'cirruslabs'
-  name: buf push
-
-  container:
-    image: bufbuild/buf
-
-  login_script: echo "$BUF_TOKEN" | buf registry login --token-stdin
-  push_script: buf push --git-metadata
-
-  env:
-    BUF_TOKEN: ENCRYPTED[!8ee7eb2504cc84b08d4a7c0dacbe103640b1feaa26d06f0df010784e872d39e65a0cdea3fc7c09b065a917a77113b96b!]
-
-task:
-  name: Release (Dry Run)
-  only_if: $CIRRUS_TAG == ''
-  macos_instance:
-    image: ghcr.io/cirruslabs/macos-runner:sequoia
-  depends_on:
-    - Lint
-    - Tests
-  install_script:
-    - brew install go
-    - brew install --cask goreleaser/tap/goreleaser-pro
-  release_script: goreleaser release --clean --snapshot
-  goreleaser_artifacts:
-    path: "dist/**"
-
-task:
-  name: Release
-  only_if: $CIRRUS_TAG != ''
-  macos_instance:
-    image: ghcr.io/cirruslabs/macos-runner:sequoia
-  depends_on:
-    - Lint
-    - Tests
-  env:
-    GITHUB_TOKEN: ENCRYPTED[!98ace8259c6024da912c14d5a3c5c6aac186890a8d4819fad78f3e0c41a4e0cd3a2537dd6e91493952fb056fa434be7c!]
-    FURY_TOKEN: ENCRYPTED[!97fe4497d9aca60a3d64904883b81e21f19706c6aedda625c97f62f67ec46b8efa74c55699956158bbf0a23726e7d9f6!]
-    GORELEASER_KEY: ENCRYPTED[!9b80b6ef684ceaf40edd4c7af93014ee156c8aba7e6e5795f41c482729887b5c31f36b651491d790f1f668670888d9fd!]
-  install_script:
-    - brew install go
-    - brew install --cask goreleaser/tap/goreleaser-pro
-  release_script: goreleaser

.github/workflows/ci.yml

@@ -0,0 +1,59 @@
+name: CI
+
+on:
+  merge_group:
+  pull_request:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install --yes libx11-dev
+      - uses: golangci/golangci-lint-action@v9
+        with:
+          version: v2.12.0
+          only-new-issues: true
+
+  test-linux:
+    name: Test (Linux)
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install --yes libx11-dev
+      - name: Run tests
+        run: go test -v ./...
+
+  test-macos:
+    name: Test (macOS)
+    runs-on: macos-26
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+      - name: Run tests
+        run: go test -v ./...

.github/workflows/release.yml

@@ -0,0 +1,82 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "*"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    name: Release
+    if: github.ref_type == 'tag'
+    runs-on: macos-26
+    timeout-minutes: 60
+    environment: publish
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+      - name: Create release app token for this repository
+        id: release-token
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        with:
+          app-id: ${{ secrets.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+          permission-contents: write
+      - name: Create release app token for homebrew-tools
+        id: tap-token
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        with:
+          app-id: ${{ secrets.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+          owner: openai
+          repositories: homebrew-tools
+          permission-contents: write
+          permission-pull-requests: write
+      - name: Release
+        uses: goreleaser/goreleaser-action@v7
+        with:
+          distribution: goreleaser-pro
+          version: "~> v2"
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ steps.release-token.outputs.token }}
+          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
+          HOMEBREW_TAP_GITHUB_TOKEN: ${{ steps.tap-token.outputs.token }}
+
+  dry-run:
+    name: Release (Dry Run)
+    if: github.ref_type != 'tag'
+    runs-on: macos-26
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+      - name: Release dry run
+        uses: goreleaser/goreleaser-action@v7
+        with:
+          distribution: goreleaser-pro
+          version: "~> v2"
+          args: release --skip=publish --snapshot --clean
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+      - name: Upload dry-run artifacts
+        uses: actions/upload-artifact@v6
+        with:
+          name: tart-guest-agent-snapshot
+          path: dist/**

.golangci.yml

@@ -1,9 +1,12 @@
-version: 2
+version: "2"
 
 run:
   timeout: 5m
 
-linters-settings:
+linters:
+  default: all
+
+  settings:
     # Even in Rust you can get away with partial matching,
     # so make sure that the linter respects the programmer's
     # intent expressed in the form of "default" case.
@@ -14,9 +17,6 @@ linters-settings:
       excludes:
         - G115
 
-linters:
-  enable-all: true
-
   disable:
     # We don't have high-performance requirements at this moment, so sacrificing
     # the code readability for marginal performance gains is not worth it.

.goreleaser.yml

@@ -50,10 +50,15 @@ release:
 
 brews:
   - name: "{{ .ProjectName }}"
+    directory: Formula
     repository:
-      owner: cirruslabs
+      owner: openai
-      name: homebrew-cli
+      name: homebrew-tools
-    homepage: https://github.com/cirruslabs/tart-guest-agent
+      token: "{{ .Env.HOMEBREW_TAP_GITHUB_TOKEN }}"
+      branch: "{{ .ProjectName }}-{{ .Version }}"
+      pull_request:
+        enabled: true
+    homepage: https://github.com/openai/tart-guest-agent
     license: FSL-1.1-Apache-2.0
     description: Guest agent for Tart VMs
     skip_upload: auto
@@ -79,6 +84,3 @@ nfpms:
       postinstall: packaging/postinstall.sh
       preremove: packaging/preremove.sh
       postremove: packaging/postremove.sh
-
-furies:
-  - account: cirruslabs