ci: replace legacy deployment workflow

.github/dependabot.yml

@@ -0,0 +1,13 @@
+version: 2
+updates:
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/workflows/codesee-arch-diagram.yml

@@ -1,87 +0,0 @@
-on:
-  push:
-    branches:
-      - master
-  pull_request_target:
-    types: [opened, synchronize, reopened]
-
-name: CodeSee Map
-
-jobs:
-  test_map_action:
-    runs-on: ubuntu-latest
-    continue-on-error: true
-    name: Run CodeSee Map Analysis
-    steps:
-      - name: checkout
-        id: checkout
-        uses: actions/checkout@v2
-        with:
-          repository: ${{ github.event.pull_request.head.repo.full_name }}
-          ref: ${{ github.event.pull_request.head.ref }}
-          fetch-depth: 0
-
-      # codesee-detect-languages has an output with id languages.
-      - name: Detect Languages
-        id: detect-languages
-        uses: Codesee-io/codesee-detect-languages-action@latest
-
-      - name: Configure JDK 16
-        uses: actions/setup-java@v2
-        if: ${{ fromJSON(steps.detect-languages.outputs.languages).java }}
-        with:
-          java-version: '16'
-          distribution: 'zulu'
-
-      # CodeSee Maps Go support uses a static binary so there's no setup step required.
-
-      - name: Configure Node.js 14
-        uses: actions/setup-node@v2
-        if: ${{ fromJSON(steps.detect-languages.outputs.languages).javascript }}
-        with:
-          node-version: '14'
-
-      - name: Configure Python 3.x
-        uses: actions/setup-python@v2
-        if: ${{ fromJSON(steps.detect-languages.outputs.languages).python }}
-        with:
-          python-version: '3.10'
-          architecture: 'x64'
-
-      - name: Configure Ruby '3.x'
-        uses: ruby/setup-ruby@v1
-        if: ${{ fromJSON(steps.detect-languages.outputs.languages).ruby }}
-        with:
-          ruby-version: '3.0'
-
-      # We need the rust toolchain because it uses rustc and cargo to inspect the package
-      - name: Configure Rust 1.x stable
-        uses: actions-rs/toolchain@v1
-        if: ${{ fromJSON(steps.detect-languages.outputs.languages).rust }} 
-        with:
-          toolchain: stable
-
-      - name: Generate Map
-        id: generate-map
-        uses: Codesee-io/codesee-map-action@latest
-        with:
-          step: map
-          api_token: ${{ secrets.CODESEE_ARCH_DIAG_API_TOKEN }}
-          github_ref: ${{ github.ref }}
-          languages: ${{ steps.detect-languages.outputs.languages }}
-
-      - name: Upload Map
-        id: upload-map
-        uses: Codesee-io/codesee-map-action@latest
-        with:
-          step: mapUpload
-          api_token: ${{ secrets.CODESEE_ARCH_DIAG_API_TOKEN }}
-          github_ref: ${{ github.ref }}
-
-      - name: Insights
-        id: insights
-        uses: Codesee-io/codesee-map-action@latest
-        with:
-          step: insights
-          api_token: ${{ secrets.CODESEE_ARCH_DIAG_API_TOKEN }}
-          github_ref: ${{ github.ref }}

.github/workflows/push.yml

@@ -1,76 +1,48 @@
-name: Push
-# TODO: Need to be changed into separate configs after
-on: [push, release]
+name: CI
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
 
 jobs:
-  build:
+  verify:
     runs-on: ubuntu-latest
-
     steps:
-    - name: Checkout
-      uses: actions/checkout@v2
-    - name: Install Go
-      uses: actions/setup-go@v2
-      with:
-        go-version: '1.17'
-    - name: Build
-      run: GO111MODULE=on CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build .
-    - name: Upload build
-      uses: actions/upload-artifact@v2
-      with:
-        name: micrach
-        path: micrach
-        retention-days: 1
+      - name: Checkout
+        uses: actions/checkout@v6
 
-  release:
-    needs: build
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: "1.26.5"
+          cache: true
+          cache-dependency-path: go.sum
 
-    runs-on: ubuntu-latest
+      - name: Verify formatting
+        run: |
+          files="$(gofmt -l .)"
+          test -z "$files" || { printf '%s\n' "$files"; exit 1; }
 
-    # TODO: Need to be removed after separate configs are made
-    if: github.ref == 'refs/heads/master'
+      - name: Test
+        run: go test ./...
 
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v2
-    - name: Download build
-      uses: actions/download-artifact@v2
-      with:
-        name: micrach
-        path: micrach
-    - name: Build docker image and push to GitHub registry
-      uses: docker/build-push-action@v1
-      with:
-        username: ${{ github.actor }}
-        password: ${{ secrets.GITHUB_TOKEN }}
-        registry: docker.pkg.github.com
-        repository: yanislav-igonin/micrach-go/micrach
-        dockerfile: Dockerfile
-        tags: latest
-        # build_args: CI_COMMIT_TAG=${{ github.event.release.tag_name }}
+      - name: Vet
+        run: go vet ./...
 
+      - name: Build
+        run: go build ./...
 
-  deploy:
-    needs: release
+      - name: Build Linux binary
+        run: CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o /tmp/micrach-linux-amd64 .
 
-    runs-on: ubuntu-latest
+      - name: Install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@v1.6.0
 
-    # TODO: Need to be removed after separate configs are made
-    if: github.ref == 'refs/heads/master'
+      - name: Scan reachable vulnerabilities
+        run: govulncheck ./...
 
-    steps:
-    - name: Deploy
-      uses: appleboy/ssh-action@master
-      env:
-        REGISTRY: ghcr.io/yanislav-igonin/micrach-go/micrach
-        SERVICE_NAME: micrach_app
-      with:
-        host: ${{ secrets.VPS_HOST }}
-        username: ${{ secrets.VPS_SSH_USERNAME }}
-        key: ${{ secrets.VPS_SSH_PRIVATE_KEY }}
-        script: |
-          docker login -u ${{ github.actor }} -p ${{ secrets.GITHUB_TOKEN }} ${{ env.REGISTRY }}
-          # docker pull ${{ env.REGISTRY }}:${{ github.event.release.tag_name }}
-          docker pull ${{ env.REGISTRY }}:latest
-          # docker service update --image ${{ env.REGISTRY }}:${{ github.event.release.tag_name }} ${{ env.SERVICE_NAME }}
-          docker service update --image ${{ env.REGISTRY }}:latest ${{ env.SERVICE_NAME }}
+      - name: Build container image
+        run: docker build --tag micrach:ci .