ci: Use GitHub Actions for CI/CD

.github/get_cirrusci_freebsd

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Get the FreeBSD PostgREST executable built by CirrusCI for the given GITHUB_COMMIT in GITHUB_REPOSITORY
+
+# We use the GitHub API for 'check suites' to find the corresponding CirrusCI job, see:
+# https://docs.github.com/en/rest/reference/checks#list-check-suites-for-a-git-reference
+
+cirrus_artifact_name=bin
+gh_accept_header="Accept: application/vnd.github.v3+json"
+
+get_gh_check_runs_url() {
+  gh_checks_list_url="https://api.github.com/repos/$GITHUB_REPOSITORY/commits/$GITHUB_COMMIT/check-suites"
+  >&2 echo "Getting list of check-suites from $gh_checks_list_url ..."
+  curl --fail -H "$gh_accept_header"  "$gh_checks_list_url" \
+    | jq -r '.check_suites[] | select(.app.slug == "cirrus-ci") | .check_runs_url'
+}
+
+wait_for_cirrusci() {
+  gh_check_runs_url="$(get_gh_check_runs_url)"
+  >&2 echo "Waiting to CirrusCI run to complete (two hours maximum)..."
+  for _ in $(seq 1 120); do
+    echo "Checking for CirrusCI task status at $gh_check_runs_url ..."
+    status=$(curl --fail "$gh_check_runs_url" | jq -r '.check_runs[] | .status')
+    if [ "$status" == "completed" ]; then
+      break
+    else
+      echo "CirrusCI task is still $status, waiting..."
+      sleep 60
+    fi
+  done
+}
+
+# The CirrusCI taskid can change if a new check run is started for the same commit,
+# e.g. when pushing both a branch and tag. We make sure that we have the very
+# latest taskid by re-loading the 'gh_check_runs_url' and the 'check run' itself.
+get_cirrus_taskid() {
+  gh_check_runs_url="$(get_gh_check_runs_url)"
+  >&2 echo "Getting the CirrusCI task id from $gh_check_runs_url ..."
+  curl --fail -H "$gh_accept_header" "$gh_check_runs_url" \
+    | jq -r '.check_runs[] | .external_id'
+}
+
+download_artifact() {
+  cirrus_task_id="$(get_cirrus_taskid)"
+  cirrus_artifact_url="https://api.cirrus-ci.com/v1/artifact/task/$cirrus_task_id/$cirrus_artifact_name.zip"
+  >&2 echo "Attemping to download the CirrusCI artifact from $cirrus_artifact_url ..."
+  curl --fail "$cirrus_artifact_url" -o freebsd.zip
+}
+
+wait_for_cirrusci
+download_artifact
+
+echo "Unpacking executable..."
+unzip freebsd.zip -d .
+rm -rf freebsd.zip

.github/workflows/ci.yaml

@@ -0,0 +1,358 @@
+name: CI
+on:
+  - push
+  - pull_request
+
+jobs:
+  Lint-Style:
+    name: Lint & check code style
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - uses: cachix/install-nix-action@v13
+      - name: Install linting and styling scripts
+        run: nix-env -f default.nix -iA style
+      - name: Run linter (check locally with `nix-shell --run postgrest-lint`)
+        run: postgrest-lint
+      - name: Run style check (auto-format with `nix-shell --run postgrest-style`)
+        run: postgrest-style-check
+
+  Test-Nix:
+    name: Test (Nix)
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        # Hack for enabling color output, see:
+        # https://github.com/actions/runner/issues/241#issuecomment-842566950
+        shell: script -qec "bash --noprofile --norc -eo pipefail {0}"
+    steps:
+      - uses: actions/checkout@v2
+      - uses: cachix/install-nix-action@v13
+      - uses: cachix/cachix-action@v10
+        with:
+          name: postgrest
+      - name: Install testing scripts
+        run: nix-env -f default.nix -iA tests withTools
+
+      - name: Run coverage (IO tests and Spec tests against PostgreSQL 13)
+        run: postgrest-coverage
+      - name: Upload coverage to codecov
+        uses: codecov/codecov-action@v2
+        with:
+          files: ./coverage/codecov.json
+
+      - name: Run the spec tests against PostgreSQL 12
+        if: always()
+        run: postgrest-with-postgresql-12 postgrest-test-spec
+      - name: Run the spec tests against PostgreSQL 11
+        if: always()
+        run: postgrest-with-postgresql-11 postgrest-test-spec
+      - name: Run the spec tests against PostgreSQL 10
+        if: always()
+        run: postgrest-with-postgresql-10 postgrest-test-spec
+      - name: Run the spec tests against PostgreSQL 9.6
+        if: always()
+        run: postgrest-with-postgresql-9.6 postgrest-test-spec
+      - name: Run the spec tests against PostgreSQL 9.5
+        if: always()
+        run: postgrest-with-postgresql-9.5 postgrest-test-spec
+
+      - name: Check the spec tests for idempotence
+        if: always()
+        run: postgrest-test-spec-idempotence
+
+  Test-Memory-Nix:
+    name: Test memory (Nix)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - uses: cachix/install-nix-action@v13
+      - uses: cachix/cachix-action@v10
+        with:
+          name: postgrest
+      - name: Install testing script
+        run: nix-env -f default.nix -iA memory
+      - name: Run memory tests
+        run: postgrest-test-memory
+
+  Build-Linux-Nix:
+    name: Build Linux static (Nix)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - uses: cachix/install-nix-action@v13
+      - uses: cachix/cachix-action@v10
+        with:
+          name: postgrest
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+
+      - name: Build static executable
+        run: nix-build -A postgrestStatic
+      - name: Save built executable as artifact
+        uses: actions/upload-artifact@v2
+        with:
+          name: postgrest-linux-static-x64
+          path: result/bin/postgrest
+          if-no-files-found: error
+
+      - name: Build Docker image
+        run: nix-build -A docker.image --out-link postgrest-docker.tar.gz
+      - name: Save built Docker image as artifact
+        uses: actions/upload-artifact@v2
+        with:
+          name: postgrest-docker-x64
+          path: postgrest-docker.tar.gz
+          if-no-files-found: error
+
+      - name: Build and push everything to Cachix (main branch only)
+        if: ${{ github.ref == 'refs/heads/main' }}
+        run: |
+          nix-build
+          nix-env -f default.nix -iA devTools
+          postgrest-push-cachix
+
+  Build-Linux-Stack:
+    name: Build Ubuntu & test (Stack)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Stack working files cache
+        uses: actions/cache@v2
+        with:
+          path: |
+            ~/.stack
+            .stack-work
+          key: ${{ runner.os }}-${{ hashFiles('stack.yaml.lock') }}
+      - name: Build with Stack
+        run: stack build --local-bin-path result --copy-bins
+      - name: Run Spec tests with Stack
+        run: |
+          postgresql_bin="$(find /usr/lib/postgresql -maxdepth 2 -type d -name bin | head -n 1)"
+          echo "Using PostgreSQL binaries at $postgresql_bin ..."
+          PATH="$postgresql_bin:$PATH" test/with_tmp_db stack test
+      - name: Save built executable as artifact
+        uses: actions/upload-artifact@v2
+        with:
+          name: postgrest-ubuntu-x64
+          path: result/postgrest
+          if-no-files-found: error
+
+  Build-MacOS-Stack:
+    name: Build MacOS & test (Stack)
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Stack working files cache
+        uses: actions/cache@v2
+        with:
+          path: |
+            ~/.stack
+            .stack-work
+          key: ${{ runner.os }}-${{ hashFiles('stack.yaml.lock') }}
+      - name: Build with Stack
+        run: stack build --local-bin-path result --copy-bins
+      - name: Run Spec tests with Stack
+        run: |
+          postgresql_bin="$(find /usr/local/Cellar/postgresql -maxdepth 2 -type d -name bin | head -n 1)"
+          echo "Using PostgreSQL binaries at $postgresql_bin ..."
+          PATH="$postgresql_bin:$PATH" test/with_tmp_db stack test
+      - name: Save built executable as artifact
+        uses: actions/upload-artifact@v2
+        with:
+          name: postgrest-macos-x64
+          path: result/postgrest
+          if-no-files-found: error
+
+  Build-Windows-Stack:
+    name: Build Windows (Stack)
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Stack working files cache
+        uses: actions/cache@v2
+        with:
+          path: |
+            ~\AppData\Roaming\stack
+            ~\AppData\Local\Programs\stack
+            .stack-work
+          key: ${{ runner.os }}-${{ hashFiles('stack.yaml.lock') }}
+      - name: Install dependencies
+        run: stack exec -- pacman -S mingw64/mingw-w64-x86_64-postgresql --noconfirm
+      - name: Build with Stack
+        run: stack build --local-bin-path result --copy-bins
+      - name: Save built executable as artifact
+        uses: actions/upload-artifact@v2
+        with:
+          name: postgrest-windows-x64
+          path: result/postgrest.exe
+          if-no-files-found: error
+
+  Get-FreeBSD-CirrusCI:
+    name: Get FreeBSD build from CirrusCI
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Get FreeBSD executable from CirrusCI
+        env:
+          # GITHUB_SHA does weird things for pull request, so we roll our own:
+          GITHUB_COMMIT: ${{github.event.pull_request.head.sha || github.sha}}
+        run: .github/get_cirrusci_freebsd
+      - name: Save executable as artifact
+        uses: actions/upload-artifact@v2
+        with:
+          name: postgrest-freebsd-x64
+          path: postgrest
+          if-no-files-found: error
+
+  Prepare-Release:
+    name: Prepare release
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    needs:
+      - Lint-Style
+      - Test-Nix
+      - Test-Memory-Nix
+      - Build-Linux-Nix
+      - Build-Linux-Stack
+      - Build-MacOS-Stack
+      - Build-Windows-Stack
+      - Get-FreeBSD-CirrusCI
+    outputs:
+      version: ${{ steps.Identify-Version.outputs.version }}
+      isprerelease: ${{ steps.Identify-Version.outputs.isprerelease }}
+    steps:
+      - uses: actions/checkout@v2
+      - id: Identify-Version
+        name: Identify the version to be released
+        run: |
+          tag_version="${GITHUB_REF##*/}"
+          cabal_version="$(grep -oP '^version:\s*\K.*' postgrest.cabal)"
+
+          if [ "$tag_version" != "v$cabal_version" ]; then
+            echo "Tagged version ($tag_version) does not match the one in postgrest.cabal (v$cabal_version). Aborting release..."
+            exit 1
+          else
+            echo "Version to be released is $cabal_version"
+            echo "::set-output name=version::$cabal_version"
+          fi
+
+          if [[ "$cabal_version" != *-* ]]; then
+            echo "Version is for a full release (no '-' in version)"
+          else
+            echo "Version is for a pre-release (version contains a '-', as in v1.0.0-a2)"
+            echo "::set-output name=isprerelease::1"
+          fi
+      - name: Identify changes from CHANGELOG.md
+        run: |
+          version="${{ steps.Identify-Version.outputs.version }}"
+          isprerelease="${{ steps.Identify-Version.outputs.isprerelease }}"
+
+          if [ -n "$isprerelease" ]; then
+            echo "Getting unreleased changes..."
+            sed -n "1,/## Unreleased/d;/## \[/q;p" CHANGELOG.md > CHANGES.md
+          else
+            echo "Full release (no '-' in version), getting changes for version $version ..."
+            sed -n "1,/## \[$version\]/d;/## \[/q;p" CHANGELOG.md > CHANGES.md
+          fi
+
+          echo "Relevant extract from CHANGELOG.md:"
+          cat CHANGES.md
+      - name: Save CHANGES.md as artifact
+        uses: actions/upload-artifact@v2
+        with:
+          name: release-changes
+          path: CHANGES.md
+          if-no-files-found: error
+
+  Release-GitHub:
+    name: Release on GitHub
+    permissions: write-all
+    runs-on: ubuntu-latest
+    needs: Prepare-Release
+    env:
+      VERSION: ${{ needs.Prepare-Release.outputs.version }}
+    steps:
+      - uses: actions/checkout@v2
+      - name: Download all artifacts
+        uses: actions/download-artifact@v2
+        with:
+          path: artifacts
+      - name: Create release bundle with archives for all builds
+        run: |
+          mkdir -p release-bundle
+          
+          tar cfvz "release-bundle/postgrest-v$VERSION-linux-static-x64.tar.gz" \
+            -C artifacts/postgrest-linux-static-x64 postgrest
+
+          # No need to release Ubuntu, as the static Linux binary built with Nix
+          # covers all Linux use-cases
+          #tar cfvz "release-bundle/postgrest-v$VERSION-ubuntu-x64.tar.gz" \
+          #  -C artifacts/postgrest-ubuntu-x64 postgrest
+          
+          tar cfvz "release-bundle/postgrest-v$VERSION-macos-x64.tar.gz" \
+            -C artifacts/postgrest-macos-x64 postgrest
+          
+          tar cfvz "release-bundle/postgrest-v$VERSION-freebsd-x64.tar.gz" \
+            -C artifacts/postgrest-freebsd-x64 postgrest
+          
+          zip "release-bundle/postgrest-v$VERSION-windows-x64.zip" \
+            artifacts/postgrest-windows-x64/postgrest.exe
+
+      - name: Save release bundle
+        uses: actions/upload-artifact@v2
+        with:
+          name: release-bundle
+          path: release-bundle
+          if-no-files-found: error
+
+      - name: Publish release on GitHub
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          isprerelease="${{ needs.Prepare-Release.outputs.isprerelease }}"
+          echo "Releasing version v$VERSION on GitHub (isprerelease=$isprerelease)..."
+
+          gh release delete "v$VERSION" || true
+          gh release create "v$VERSION" \
+            -F artifacts/release-changes/CHANGES.md \
+            ${isprerelease:+"--prerelease"} \
+            release-bundle/*
+  
+  Release-Docker:
+    name: Release on Docker Hub
+    runs-on: ubuntu-latest
+    needs: Prepare-Release
+    env:
+      DOCKER_REPO: postgrest
+      DOCKER_USER: postgrest-bot
+      VERSION: ${{ needs.Prepare-Release.outputs.version }}
+      ISPRERELEASE: ${{ needs.Prepare-Release.outputs.isprerelease }}
+    steps:
+      - uses: actions/checkout@v2
+      - uses: cachix/install-nix-action@v13
+      - name: Install release scripts
+        run: nix-env -f default.nix -iA release
+      - name: Download Docker image
+        uses: actions/download-artifact@v2
+        with:
+          name: postgrest-docker-x64
+      - name: Publish images on Docker Hub
+        run: |
+          docker login -u "$DOCKER_USER" -p "${{ secrets.DOCKER_PASS }}"
+          docker load -i postgrest-docker.tar.gz
+
+          docker tag postgrest:latest "$DOCKER_REPO/postgrest:v$VERSION"
+          docker push "$DOCKER_REPO/postgrest:v$VERSION"
+
+          # Only tag 'latest' for full releases
+          if [[ -z "$ISPRERELEASE" ]]; then
+            echo "Pushing to 'latest' tag for full release of v$VERSION ..."
+            docker tag postgrest:latest "$DOCKER_REPO"/postgrest:latest
+            docker push "$DOCKER_REPO"/postgrest:latest
+          else
+            echo "Skipping pushing to 'latest' tag for v$VERSION pre-release..."
+          fi
+      - name: Update descriptions on Docker Hub
+        env:
+          DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+        run: postgrest-release-dockerhub-description