[bpapaspyros]

What and why

The apt archive gets channels: stable for releases, edge for builds of main, and nightly, which the publisher switches to what edge publishes once a day. Releases already reach the publisher. Builds of main need a workflow of their own, a version that sorts between releases, and a channel in the hand-over.

• reusable_edge_build.yml (new), called on a push to the default branch:
  • builds every package that declares <duatic_archive_root>, for each distro in ros_distros on amd64 and arm64;
  • versions them <version>+git<commit time>.<commit>, the committer time in UTC, which sorts after the release a build follows and before the next one;
  • hands what built to the publisher for edge, the same way the tag workflow does, and refuses to run for anything but a push to the default branch.
• reusable_release_tag.yml hands releases over for stable. The dispatch moves to release/hand_to_publisher.py, which both workflows run, and the payload now carries the channel.
• reusable_release_build.yml takes version_suffix, passed to the builder as DEB_VERSION_SUFFIX. The build fails when the .deb does not carry it.
• reusable_release_publish.yml:
  • takes channel, stable by default, checked like the other fields and sent with the request;
  • delivers each file under a hidden name and renames it into place, so a publish already running on the host never takes a half-written file;
  • drops its concurrency group. The publish host now takes one publish at a time itself, and a concurrency group keeps only one run waiting, so it would cancel queued publishes once builds of main arrive from several repositories.
• README: the edge workflow with a caller example, and the new inputs.

Testing

• New release/test_edge_packages.sh, added to self-check: 2 passed. Ran edge_packages.py on soem_vendor's main, which gives 0.4.1+git20261022072933.ef147ee.
• Ran hand_to_publisher.py against a mock of the GitHub API, with two of four legs built. It handed over exactly those two, with the channel and the suffixed version.
• Ran the sftp batch against a local sftp-server. The rename replaces a file already at that name.
• actionlint is clean apart from job.workflow_ref, which it does not know and the existing workflows already use.
• This has not run on GitHub yet.
• Tests updated, or not applicable
• Docs updated, or not applicable
• This changes or removes something existing (if so, title needs ! and means the next release is a major version bump)

Notes

• Based on feat(release): hand what the release built to a publisher repository #34.
• Needs duatic_devtools with DEB_VERSION_SUFFIX at the v1 the build checks out, and the channel support on the publish host, before an edge build can publish.
• A repository opts in with the caller in the README, which cancels the edge run of a commit superseded before it finished.
• Every routed package is rebuilt on each push, so a repository with many of them meets GitHub's 256-job matrix limit at 32 packages.

[mbloechli]

this PR looks good to me