TCN-463 rebuild CI in GitHub actions (#640)

Signed-off-by: Elliot Jackson <elliot@buf.build>

.circleci/settings.xml → .github/settings.xml

@@ -35,6 +35,12 @@
             </properties>
         </profile>
     </profiles>
+    <configuration>
+        <gpgArguments>
+            <arg>--pinentry-mode</arg>
+            <arg>loopback</arg>
+        </gpgArguments>
+    </configuration>
     <activeProfiles>
         <activeProfile>ci</activeProfile>
         <activeProfile>signing</activeProfile>

.github/workflows/ci.yaml

@@ -0,0 +1,28 @@
+name: ci
+
+on:
+  pull_request:
+
+env:
+  TEST_TAG: protoc-gen-validate:${{ github.sha }}
+
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+      - name: Build and export to Docker
+        uses: docker/build-push-action@v3
+        with:
+          context: .
+          load: true
+          push: false
+          tags: ${{ env.TEST_TAG }}
+      - name: Run
+        run: |
+          docker run --rm ${{ env.TEST_TAG }} ci

.github/workflows/maven-publish.yaml

@@ -0,0 +1,66 @@
+# This workflow will build a package using Maven and then publish it to GitHub packages when a release is created
+## For more information see: https://github.com/actions/setup-java/blob/main/docs/advanced-usage.md#apache-maven-with-a-settings-path
+
+name: Maven Package
+
+on:
+  pull_request:
+  release:
+    types: [ created ]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v3
+      - name: Set up JDK 17
+        uses: actions/setup-java@v3
+        with:
+          java-version: "17"
+          distribution: "temurin"
+
+      - name: Verify with Maven
+        working-directory: ${{ github.workspace }}/java
+        run: mvn -B verify
+
+  deploy:
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    env:
+      SONATYPE_USER: ${{secrets.SONATYPE_USER}}
+      SONATYPE_PASSWORD: ${{secrets.SONATYPE_PASSWORD}}
+      GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+      GPG_KEY_NAME: ${{secrets.GPG_KEY_NAME}}
+      GPG_PASSPHRASE: ${{secrets.GPG_PASSPHRASE}}
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - uses: actions/checkout@v3
+      - name: Set up JDK 17
+        uses: actions/setup-java@v3
+        with:
+          java-version: "17"
+          distribution: "temurin"
+          server-id: sonatype-nexus-snapshots
+          server-username: ${{ env.SONATYPE_USER }}
+          server-password: ${{ env.SONATYPE_PASSWORD }}
+          gpg-private-key: ${{ env.GPG_PRIVATE_KEY }}
+          gpg-passphrase: ${{ env.GPG_PASSPHRASE }}
+
+      - name: Configure Git User
+        run: |
+          git config --global user.email "envoy-bot@users.noreply.github.com"
+          git config --global user.name "envoy-bot"
+
+      - name: Publish to Apache Maven Central
+        working-directory: ${{ github.workspace }}/java
+        run: mvn release:prepare
+        env:
+          MAVEN_USERNAME: ${{ env.SONATYPE_USER }}
+          MAVEN_CENTRAL_TOKEN: ${{ env.SONATYPE_PASSWORD }}
+          MAVEN_GPG_PASSPHRASE: ${{ env.GPG_PASSPHRASE }}

.github/workflows/python-package.yaml

@@ -0,0 +1,19 @@
+name: Release Python Package
+
+on:
+  release:
+    types: [created]
+
+jobs:
+  build-linux:
+    runs-on: ubuntu-latest
+    environment: production
+    steps:
+      - uses: actions/checkout@v3
+      - name: Set up Python 3.10
+        uses: actions/setup-python@v3
+        run: |
+          docker run --rm \
+          --env PYPI_REPO=pypi \
+          --env PGV_PYPI_TOKEN="${{secrets.PGV_PYPI_TOKEN}}" \
+          protoc-gen-validate python-release

java/RELEASING.md

@@ -40,7 +40,7 @@ Manually releasing from git history is a more involved process, but allows you
 to release from any point in the history.
 
 1. Create a new `release/x.y.z` branch at the point you want to release.
-1. Copy `.circleci\settings.xml` to a scratch location.
+1. Copy `.github\settings.xml` to a scratch location.
 1. Fill out the parameters in `settings.xml`. You will need a published GPG key
    for code signing and the EnvoyReleaseBot sonatype username and password.
 1. Execute the release command, substituting the path to `settings.xml`, the