[bpapaspyros]

What and why

A release merge now builds its packages, but the .debs stop at the run's artifacts. Publishing needs a runner that can reach the publish host, and self-hosted runners never take jobs from public repositories. So the public repository hands the build over to a private publisher repository, which publishes from a self-hosted runner.

• reusable_release_tag.yml gets a publish job after build:
  • it lists the run's artifacts and keeps those of the released packages that built, per distro and architecture. A leg that failed uploaded nothing and is left out;
  • it sends them in one repository_dispatch to the private repository named by the RELEASE_PUBLISHER organization variable, or the publisher input;
  • the dispatch token is minted from the release GitHub App and limited to that one repository, with Contents write.
• Without a publisher named, or without the App secrets (the caller's tag job needs secrets: inherit), the run warns that nothing was published and stays green.
• reusable_release_publish.yml installs an SSH client where a runner image lacks one.

Testing

• Ran the dispatch step against a mock of the GitHub API, with three of four legs built:
  • it handed over exactly the three built artifacts;
  • each carried the package, version, tag, root, distro and architecture;
  • the dispatch carried the App token, and listing the artifacts used the run's own token.
• This has not run on GitHub yet.
• Tests updated, or not applicable
• Docs updated, or not applicable
• This changes or removes something existing (if so, title needs ! and means the next release is a major version bump)

Notes

• A releasing repository adds secrets: inherit to its tag job to publish.
• The publisher repository checks each artifact against its release tag before publishing, so a dispatch can only publish a real tagged release.

[mbloechli]

looks good to me otherwise