Migrate from GitHub Actions to Google Cloud Build

[NimJay]

Background

• Today, all of our CI (automated tests triggered by pull-requests and pushes to main) use GitHub Actions.
• See /.github/workflows.

Feature Request

• We should migrate all existing GitHub Action workflows to Google Cloud Build.

Why migrate to Google Cloud Build?

• We can dog-food yet another Google Cloud product and provide feedback to improve Google Cloud Build.
• We can support more Google Cloud users with an open source demonstration of Google Cloud Build.
• We can be consistent with the Point of Sale app which uses Google Cloud Build.

Work to be done:

• Discuss feasibility with a Google Cloud Build expert.
• Discuss folder structure, naming conventions, and scope with team.
• Migrate existing GitHub Action workflows to Cloud Build:
  • ci-main.yaml
  • ci-pr.yaml
  • cleanup.yaml
  • helm-chart-ci.yaml
  • kustomize-build-ci.yaml
  • push-deploy.yaml
  • terraform-validate-ci.yaml
• Delete unused resources.
  • install-dependencies.sh
  • GitHub Action Runners (Google Compute Engine virtual machines)
• Document new Google Cloud Build-based CI.
  • Add README.md next to new Cloud Build YAML configurations.
  • Update go/sample-app-ci.

[bourgeoisor]

It's also worth considering (to reduce scope) only porting some of the Actions over to Cloud Build (for example, the ci-main and ci-pr Actions), and having the other ones run in GitHub instead of self-hosted (that's already the case for helm-chart-ci and terraform-validate-ci!)

[minherz]

It is nice to add few "cons" to this list of "pros".

• Security risk to allow a custom code (anyone can submit a code change) to be run by Cloud Build in the CI project on GCP
• Security risk to expose extensive output that Cloud Build prints out to logs

These both bullets can be addressed by constraining who can run builds and/or who can see the logs. However, these solutions seriously slow development efforts on Open Source projects and contradict the first bullet in the "why" list.

There is a question regarding the last bullet in the "why" list. Can you please provide arguments that support a need to be consistent with PoC? Otherwise, that bullet does not qualify to be included.