add a github actions workflow

.github/workflows/ci.yml

@@ -0,0 +1,115 @@
+name: CI/CD Pipeline
+on:
+  push:
+  workflow_dispatch:
+
+jobs:
+  versions:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Determine versions
+        id: versions
+        run: |
+          echo "erlang=$(grep 'erlang_version' elixir_buildpack.config | cut -d'=' -f2)" >> "$GITHUB_OUTPUT"
+          echo "elixir=$(grep 'elixir_version' elixir_buildpack.config | cut -d'=' -f2)" >> "$GITHUB_OUTPUT"
+          echo "alpine=$(grep 'alpine_version' elixir_buildpack.config | cut -d'=' -f2)" >> "$GITHUB_OUTPUT"
+          echo "postgres=$(yq '.docker_services.postgres.version' < dev.yml)" >> "$GITHUB_OUTPUT"
+    outputs:
+      elixir: ${{ steps.versions.outputs.elixir }}
+      erlang: ${{ steps.versions.outputs.erlang }}
+      alpine: ${{ steps.versions.outputs.alpine }}
+      postgres: ${{ steps.versions.outputs.postgres }}
+
+  test:
+    runs-on: hexpm/elixir:${{ needs.versions.outputs.elixir }}-erlang-${{ needs.versions.outputs.erlang }}-alpine-${{ needs.versions.outputs.alpine }}
+    needs: versions
+    services:
+      postgres:
+        image: postgres:${{ needs.versions.outputs.postgres }}-alpine
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_HOST_AUTH_METHOD: trust
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    env:
+      MIX_ENV: test
+      DB_USER: postgres
+      DATABASE_URL: postgres://postgres@localhost/ex_gridhook_test
+    steps:
+      - uses: actions/checkout@v4
+      - run: mix local.hex --force && mix local.rebar --force && mix deps.get && mix compile
+      - run: mix format --check-formatted && mix credo
+      - run: mix do ecto.create, ecto.migrate && mix test
+
+  prepare-app-image:
+    runs-on: ubuntu-latest
+    needs: versions
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-region: ${{ secrets.AWS_REGION }}
+          role-to-assume: ${{ secrets.AWS_ECR_ACCESS_ROLE_ARN }}
+      - name: Log into AWS ECR
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ secrets.AWS_REGION }}.amazonaws.com
+      - uses: docker/build-push-action@v5
+        with:
+          build-args: |
+            ERLANG_VERSION=${{ needs.versions.outputs.erlang }}
+            ELIXIR_VERSION=${{ needs.versions.outputs.elixir }}
+            ALPINE_VERSION=${{ needs.versions.outputs.alpine }}
+            AWS_ACCESS_KEY_ID=${{ secrets.DOCKER_BUILDER_AWS_ACCESS_KEY_ID }}
+            AWS_SECRET_ACCESS_KEY=${{ secrets.DOCKER_BUILDER_AWS_SECRET_ACCESS_KEY }}
+            REVISION=${{ github.sha }}
+          context: .
+          push: ${{ github.ref_name == github.event.repository.default_branch }}
+          tags: |
+            ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ secrets.AWS_REGION }}.amazonaws.com/ex_gridhook:sha-${{ github.sha }}
+
+  deploy:
+    runs-on: ubuntu-latest
+    if: github.ref_name == github.event.repository.default_branch
+    needs:
+      - test
+      - prepare-app-image
+    concurrency:
+      group: deploy-to-production
+      cancel-in-progress: false
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          fetch-depth: 0
+      - name: Checkout stack repository
+        uses: actions/checkout@v4
+        with:
+          repository: barsoom/stack
+          path: stack
+          token: ${{ secrets.STACK_TOKEN }}
+          sparse-checkout: |
+            applications/gridhook/values.yaml
+            script/ci/deploy.sh
+            script/ci/ensure_revision_is_newer_than_deployed_revision.sh
+
+      - name: Ensure revision is newer than deployed revision
+        run: stack/script/ci/ensure_revision_is_newer_than_deployed_revision.sh
+
+      - name: Update values.yaml with new image tag
+        run: |
+          NEW_TAG="${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ secrets.AWS_REGION }}.amazonaws.com/ex_gridhook:sha-${{ github.sha }}"
+          sed -i "s|image:.*|image: $NEW_TAG|g" stack/applications/gridhook/values.yaml
+
+      - name: Deploy
+        run: stack/script/ci/deploy.sh