feat(ci): try github actions

.github/ci-tools/audit

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+cargo install --locked cargo-audit
+
+cargo audit --color always

.github/ci-tools/format

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+rustup component add rustfmt
+
+cargo fmt -- --check

.github/ci-tools/get_version

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+
+# Dependencies: jq
+
+set -eo pipefail
+
+# Print version of given workspace package.
+get_version() {
+    if [[ -z $1 ]]; then
+        echo >&2 "name argument is mandatory"
+        exit 1
+    fi
+    local name="$1"
+    version=$(cargo metadata --format-version 1 --no-deps | jq '.packages[] | select(.name == "'"$name"'") | {version}' | jq --exit-status -r .version)
+    if [[ ! $version =~ ^[0-9] ]]; then
+        echo >&2 "invalid version for ${name}: ${version}"
+        exit 1
+    fi
+    echo "$version"
+}
+
+main() {
+    get_version "$1"
+}
+
+main "$@"

.github/ci-tools/outdated

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+cargo install --locked cargo-outdated
+
+cargo outdated --root-deps-only --exit-code 1

.github/ci-tools/semver

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+CI_TOOLS_DIR="$(dirname "${BASH_SOURCE[0]}")"
+BASELINE_GIT_REF_FILE="${CI_TOOLS_DIR}/../../.semver-baseline"
+
+apt-get update
+apt-get install -y --no-install-recommends cmake
+cargo install --locked cargo-semver-checks
+
+baseline="$(cat "${BASELINE_GIT_REF_FILE}")"
+echo "Baseline Git rev: ${baseline}"
+env SQLX_OFFLINE="true" cargo semver-checks --baseline-rev "$baseline"

.github/ci-tools/test

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+export CI="true" # https://insta.rs/docs/quickstart/#continuous-integration
+
+sysinfo() {
+    echo "System information:"
+    uname -a
+    rustc --version
+    cargo --version
+    echo "CARGO_HOME=${CARGO_HOME}"
+    echo ".cargo/config.toml content:"
+    echo "---"
+    cat "${CARGO_HOME}/config.toml"
+    echo "---"
+    echo "Environment variables:"
+    printenv | sort
+}
+
+install_test_deps() {
+    echo "Initialising test dependencies"
+    apt-get update -yq
+    apt-get install -yq --no-install-recommends wireguard-tools
+}
+
+lint() {
+    echo "Linting"
+    rustup component add clippy
+    cargo clippy --all-features --color always -- --deny warnings --forbid unsafe_code
+}
+
+tests() {
+    echo "Testing"
+    install_test_deps
+    cargo test --color=always -- --color=always           # <https://github.com/rust-lang/cargo/issues/11581#issuecomment-1382870899>
+    cargo test --color=always -- --color=always --ignored # slow tests
+}
+
+build() {
+    cargo build --color always
+}
+
+main() {
+    sysinfo
+    build
+    lint
+    tests
+}
+
+main "$@"

.github/workflows/checks.yaml

@@ -0,0 +1,37 @@
+name: GitHub Actions Demo
+on: [push]
+# env:
+#   CARGO_HOME: "${CI_PROJECT_DIR}/.cargo" # necessary for dependency caching
+
+# default:
+#   cache:
+#     key: "$CI_JOB_NAME" # not using Cargo.lock as key file: it changes too often
+#     paths: [ .cargo/ ]
+#     unprotect: true # publish job is "protected" because it runs only on main
+defaults:
+  run:
+    working-directory: ./.github/ci-tools
+
+jobs:
+  format:
+    runs-on: rust-1.82
+    # NOTE: Rust compiler versions are backward compatible, but updated clippy
+    # can block a previously working job, pinning version to grant more reproducibility
+    steps:
+      - name: Check formatting
+        run: ./format
+    # cache: []
+
+  semver:
+    runs-on: rust-1.82
+    if: github.ref == 'refs/heads/master' # only on `master` branch
+    steps:
+      - name: Check semver
+        run: ./semver
+
+  test:
+    runs-on: rust-1.82
+    steps:
+      - name: Run tests
+        run: ./test
+        # not splitting lint (clippy) and test in two jobs to avoid wasting environment preparation time