build: Switch PR/commit quick checks to GitHub Actions

This is a backport of the move away from CircleCI from the main branch to the
v1.1 branch, just so we will still have checks when backporting other code
to the release branch.

This is an amalgam of the following commits from the main branch:
49d7c87
9210ce6
67fedd4
95f26b3
42a618f
bbf540e
1e56e1f

.github/actions/go-version/action.yml

@@ -0,0 +1,23 @@
+name: 'Determine Go Toolchain Version'
+description: 'Uses the .go-version file to determine which Go toolchain to use for any Go-related actions downstream.'
+outputs:
+  version:
+    description: "Go toolchain version"
+    value: ${{ steps.go.outputs.version }}
+runs:
+  using: "composite"
+  steps:
+    # We use goenv to make sure we're always using the same Go version we'd
+    # use for releases, as recorded in the .go-version file.
+    - name: "Determine Go version"
+      id: go
+      shell: bash
+      # We use .go-version as our source of truth for current Go
+      # version, because "goenv" can react to it automatically.
+      # However, we don't actually use goenv for our automated
+      # steps in GitHub Actions, because it's primarily for
+      # interactive use in shells and makes things unnecessarily
+      # complex for automation.
+      run: |
+        echo "Building with Go $(cat .go-version)"
+        echo "::set-output name=version::$(cat .go-version)"

.github/workflows/build.yml

@@ -68,17 +68,13 @@ jobs:
     name: "Determine Go toolchain version"
     runs-on: ubuntu-latest
     outputs:
-      go-version: ${{ steps.get-go-version.outputs.go-version }}
+      go-version: ${{ steps.get-go-version.outputs.version }}
 
     steps:
       - uses: actions/checkout@v2
       - name: Determine Go version
         id: get-go-version
-        # We use .go-version as our source of truth for current Go
-        # version, because "goenv" can react to it automatically.
-        run: |
-          echo "Building with Go $(cat .go-version)"
-          echo "::set-output name=go-version::$(cat .go-version)"
+        uses: ./.github/actions/go-version
 
   generate-metadata-file:
     name: "Generate release metadata"

.github/workflows/checks.yml

@@ -0,0 +1,147 @@
+# This workflow is a collection of "quick checks" that should be reasonable
+# to run for any new commit to this repository in principle.
+#
+# The main purpose of this workflow is to represent checks that we want to
+# run prior to reviewing and merging a pull request. We should therefore aim
+# for these checks to complete in no more than a few minutes in the common
+# case.
+#
+# The build.yml workflow includes some additional checks we run only for
+# already-merged changes to release branches and tags, as a compromise to
+# keep the PR feedback relatively fast. The intent is that checks.yml should
+# catch most problems but that build.yml might occasionally by the one to catch
+# more esoteric situations, such as architecture-specific or OS-specific
+# misbehavior.
+
+name: Quick Checks
+
+on:
+  push:
+
+# This workflow runs for not-yet-reviewed external contributions and so it
+# intentionally has no write access and only limited read access to the
+# repository.
+permissions:
+  contents: read
+
+jobs:
+  unit-tests:
+    name: "Unit Tests"
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: "Fetch source code"
+        uses: actions/checkout@v2
+
+      - name: Determine Go version
+        id: go
+        uses: ./.github/actions/go-version
+
+      - name: Install Go toolchain
+        uses: actions/setup-go@v2
+        with:
+          go-version: ${{ steps.go.outputs.version }}
+
+      # NOTE: This cache is shared so the following step must always be
+      # identical across the unit-tests, e2e-tests, and consistency-checks
+      # jobs, or else weird things could happen.
+      - name: Cache Go modules
+        uses: actions/cache@v3
+        with:
+          path: "~/go/pkg"
+          key: go-mod-${{ hashFiles('go.sum') }}
+          restore-keys: |
+            go-mod-
+
+      - name: "Unit tests"
+        run: |
+          go test ./...
+
+  e2e-tests:
+    # This is an intentionally-limited form of our E2E test run which only
+    # covers Terraform running on Linux. The build.yml workflow runs these
+    # tests across various other platforms in order to catch the rare exception
+    # that might leak through this.
+    name: "End-to-end Tests"
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: "Fetch source code"
+        uses: actions/checkout@v2
+
+      - name: Determine Go version
+        id: go
+        uses: ./.github/actions/go-version
+
+      - name: Install Go toolchain
+        uses: actions/setup-go@v2
+        with:
+          go-version: ${{ steps.go.outputs.version }}
+
+      # NOTE: This cache is shared so the following step must always be
+      # identical across the unit-tests, e2e-tests, and consistency-checks
+      # jobs, or else weird things could happen.
+      - name: Cache Go modules
+        uses: actions/cache@v3
+        with:
+          path: "~/go/pkg"
+          key: go-mod-${{ hashFiles('go.sum') }}
+          restore-keys: |
+            go-mod-
+
+      - name: "End-to-end tests"
+        run: |
+          TF_ACC=1 go test -v ./internal/command/e2etest
+
+  consistency-checks:
+    name: "Code Consistency Checks"
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: "Fetch source code"
+        uses: actions/checkout@v2
+
+      - name: Determine Go version
+        id: go
+        uses: ./.github/actions/go-version
+
+      - name: Install Go toolchain
+        uses: actions/setup-go@v2
+        with:
+          go-version: ${{ steps.go.outputs.version }}
+
+      # NOTE: This cache is shared so the following step must always be
+      # identical across the unit-tests, e2e-tests, and consistency-checks
+      # jobs, or else weird things could happen.
+      - name: Cache Go modules
+        uses: actions/cache@v3
+        with:
+          path: "~/go/pkg"
+          key: go-mod-${{ hashFiles('go.sum') }}
+          restore-keys: |
+            go-mod-
+
+      - name: "go.mod and go.sum consistency check"
+        run: |
+          go mod tidy
+          if [[ -n "$(git status --porcelain)" ]]; then
+            echo >&2 "ERROR: go.mod/go.sum are not up-to-date. Run 'go mod tidy' and then commit the updated files."
+            exit 1
+          fi
+
+      - name: Cache protobuf tools
+        uses: actions/cache@v3
+        with:
+          path: "tools/protobuf-compile/.workdir"
+          key: protobuf-tools-${{ hashFiles('tools/protobuf-compile/protobuf-compile.go') }}
+          restore-keys: |
+            protobuf-tools-
+
+      - name: "Code consistency checks"
+        run: |
+          make fmtcheck generate staticcheck exhaustive protobuf
+          if [[ -n "$(git status --porcelain)" ]]; then
+            echo >&2 "ERROR: Generated files are inconsistent. Run 'make generate' and 'make protobuf' locally and then commit the updated files."
+            git >&2 status --porcelain
+            exit 1
+          fi