Moving CI to GitHub actions

[kwigley]

Description

resolves #3688

This PR moves our CI to GitHub actions. I created the following 2 workflows.

main.yml

This workflow is the "main" CI workflow. This will run on all PRs, pushes to mainline branches ('develop', '*.latest`, etc.), and when manually dispatched in the GitHub UI. Today this workflow run static code checks (mypy, flake8) and unit tests. This could also include other lint checks, formatting checks, etc. This also builds, tests, and stores python distributions (wheel and source) as well, this can be used in other workflows (build docker image, publishing, etc.). This workflow runs for PRs from forked repositories and GitHub Actions does not pass secrets to forks, so this workflow would fail if it tried to access them.

integration.yml

This workflow can be triggers by untrusted actors.

Be default, only integration test affected by the code changes in the PRs will be run. The mapping of file changes and tests run can be found here: https://github.com/dbt-labs/dbt/blob/0d556de6994891561b408fe53ba8c521bc165730/.github/workflows/integration-pr.yml#L43-L55
If someone would like to run all tests or tests for a specific adapter, you can add a label to the pr to do so.
test all -> run all integration tests
test ${adapter} -> run tests for that specific ${adapter}

It also requires an additional check when the PR is from a forked repository. Right now, that additional check is a PR label ok to test. This extra check is needed to ensure that outside contributors do not exploit any secrets or compute. Since this action runs on the pull_request_target event, it is important to note that the action runs in the context of the "target" of a PR. So, for a PR pointing at the develop branch, the action will run on the develop branch, but also include all secrets and even a github token with write permissions. We explicitly checkout the head of the branch that the PR is coming from in order to run checks against the code to be merged. Since only folks with write access to the repo can add labels to PRs, we can ensure that the PR is coming from a trusted actor. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for more info why we should do this.

Additional notes

While testing these new workflows, I discovered an issue with python3.9 unit tests. I have turned them off for the time being and created #3689 to follow up with a fix. https://github.com/dbt-labs/dbt/blob/0d556de6994891561b408fe53ba8c521bc165730/.github/workflows/main.yml#L34

I think there is still work to be done to increase the reliability and trust in our test suite, but I believe that this PR will contribute towards that.

Checklist

• I have signed the CLA
• I have run this code in development and it appears to resolve the stated issue
• This PR includes tests, or tests are not required/relevant for this PR
• I have updated the CHANGELOG.md and added information about my change to the "dbt next" section.

addressed feedback