pkg-build-reusable-workflow.yml

name: Build Reusable Workflow
description: |
  This reusable workflow is called by debian-packaging repos to offer a consistent
  build-and-test process.
  Debian suites use the Debusine build service, while Ubuntu codenames and Debian
  suites without a token use the local pkg-builder Docker container flow.

on:
  workflow_call:
    inputs:
      qcom-build-utils-ref:
        description: The ref name that was used to invoke this reusable workflow
        type: string
        required: true

      debian-ref:
        description: The debian ref to build. For example branch "qcom/debian/latest" or tag "debian/1.0.0-1"
        type: string
        required: true

      run-lintian:
        description: Run lintian or not during the Docker pkg-builder build path
        type: boolean
        default: true

      run-abi-checker:
        description: Run the ABI checker or not during the Docker pkg-builder build path
        type: boolean
        default: false

      is-prebuilt:
        description: |
          Controls the build mode passed to the Docker build_package action:
            "true"  — Force prebuilt binary mode.
            "false" — Force source build mode.
            ""      — Auto-detect (default): prebuilt if upstream.conf exists in the repo, else source.
        type: string
        default: ""

      release:
        description: Prepare a release bundle (finalizes changelog, creates git bundle for push-release) for the Debian Debusine path
        type: boolean
        default: false

      debusine-parent-workspace:
        description: Parent Debusine workspace used to create per-run child CI workspaces for Debian builds
        type: string

      force-docker-build:
        description: |
          When the resolved family is Debian, force the local sbuild pkg-builder path instead of Debusine.
          Automatically set to true when DEBUSINE_TOKEN is absent.
        type: boolean
        default: false

      assemble-orig:
        description: |
          When true, generate-source-package creates the .orig.tar.gz directly
          from the source tree and invokes dpkg-buildpackage -S, bypassing gbp.
          Use for packages whose source tree is assembled at CI time with no
          upstream tarball available via gbp or pristine-tar.
        type: boolean
        default: false

    secrets:
      DEBUSINE_USER:
        required: false
      DEBUSINE_TOKEN:
        required: false

    outputs:
      family:
        description: The resolved distro family (`debian` or `ubuntu`)
        value: ${{ jobs.resolve.outputs.family }}
      suite:
        description: The resolved suite/codename actually used by the workflow
        value: ${{ jobs.resolve.outputs.suite }}
      workspace:
        description: Debusine workspace ID for Debusine builds; empty for Docker builds
        value: ${{ jobs.test.outputs.workspace }}
      workspace_url:
        description: Debusine workspace URL for Debusine builds; empty for Docker builds
        value: ${{ jobs.test.outputs.workspace_url }}
      srcpkg_name:
        description: Source package name
        value: ${{ jobs.test.outputs.srcpkg_name }}
      srcpkg_version:
        description: Source package version
        value: ${{ jobs.test.outputs.srcpkg_version }}

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ inputs.release && 'release' || github.run_id }}

permissions:
  contents: read
  packages: read

env:
  DEBUSINE_ACTION_REF: main

jobs:
  resolve:
    name: Resolve branch target
    runs-on: ubuntu-latest
    outputs:
      family: ${{ steps.resolve.outputs.family }}
      force_docker_build: ${{ steps.resolve.outputs.force_docker_build }}
      suite: ${{ steps.resolve.outputs.suite }}
    steps:
      - name: Checkout qcom-build-utils scripts
        uses: actions/checkout@v5
        with:
          repository: qualcomm-linux/qcom-build-utils
          ref: ${{ inputs.qcom-build-utils-ref }}
          path: qcom-build-utils

      - name: Resolve family and suite from branch
        id: resolve
        shell: bash
        env:
          DEBIAN_REF_INPUT: ${{ inputs.debian-ref }}
          BASE_REF_INPUT: ${{ github.base_ref }}
          DEBUSINE_TOKEN: ${{ secrets.DEBUSINE_TOKEN }}
          FORCE_DOCKER_BUILD: ${{ inputs.force-docker-build }}
        run: |
          set -euo pipefail

          RESOLVER_SCRIPT="${GITHUB_WORKSPACE}/qcom-build-utils/scripts/resolve_branch_family_suite.sh"

          parse_resolved_values() {
            local resolved_kv="$1"
            local key value

            normalized_ref=""
            family=""
            suite=""
            while IFS='=' read -r key value; do
              case "$key" in
                normalized_ref) normalized_ref="$value" ;;
                family) family="$value" ;;
                suite) suite="$value" ;;
              esac
            done <<< "$resolved_kv"
          }

          source_ref=""
          if resolved_kv="$("$RESOLVER_SCRIPT" "$DEBIAN_REF_INPUT")"; then
            parse_resolved_values "$resolved_kv"
            source_ref="$normalized_ref"
          else
            if [[ -n "$BASE_REF_INPUT" ]]; then
              if resolved_kv="$("$RESOLVER_SCRIPT" "$BASE_REF_INPUT")"; then
                parse_resolved_values "$resolved_kv"
                source_ref="$normalized_ref"
                echo "::warning::debian-ref '$DEBIAN_REF_INPUT' does not end with '/<family>/<suite>'; falling back to base-ref '$BASE_REF_INPUT' for suite routing."
              else
                echo "::error::Unable to resolve build target from debian-ref '$DEBIAN_REF_INPUT' or base-ref '$BASE_REF_INPUT'. Expected a branch ending in '/<family>/<suite>' (for example 'ubuntu/resolute' or 'qcom/ubuntu/resolute')."
                exit 1
              fi
            else
              echo "::error::Unable to resolve build target from debian-ref '$DEBIAN_REF_INPUT'. Expected a branch ending in '/<family>/<suite>' (for example 'ubuntu/resolute' or 'qcom/ubuntu/resolute')."
              exit 1
            fi
          fi

          # Preserve Debian aliases used in branch names.
          if [[ "$family" == "debian" ]] && [[ "$suite" == "latest" || "$suite" == "unstable" ]]; then
            suite=sid
          fi

          force_docker_build=false
          if [[ "$family" == "debian" ]] && [[ -z "$DEBUSINE_TOKEN" || "$FORCE_DOCKER_BUILD" == "true" ]]; then
            force_docker_build=true
            if [[ -z "$DEBUSINE_TOKEN" ]]; then
              echo "::warning::DEBUSINE_TOKEN is not set or not accessible (fork PR secrets are unavailable to workflows triggered by external contributors) — falling back to local pkg-builder for suite '$suite'"
            else
              echo "::notice::force-docker-build is set — using local pkg-builder for suite '$suite'"
            fi
          fi

          echo "::notice title=Resolved build target::debian-ref='${DEBIAN_REF_INPUT}', source-ref='${source_ref}', family='${family}', suite='${suite}', force-docker-build='${force_docker_build}'"

          echo "family=$family" >> "$GITHUB_OUTPUT"
          echo "force_docker_build=$force_docker_build" >> "$GITHUB_OUTPUT"
          echo "suite=$suite" >> "$GITHUB_OUTPUT"

  docker-build:
    name: Build (Docker)
    if: ${{ needs.resolve.outputs.family == 'ubuntu' || needs.resolve.outputs.force_docker_build == 'true' }}
    needs: resolve
    runs-on: ubuntu-24.04-arm
    outputs:
      srcpkg_name: ${{ steps.metadata.outputs.srcpkg_name }}
      srcpkg_version: ${{ steps.metadata.outputs.srcpkg_version }}
    defaults:
      run:
        shell: bash
    container:
      image: ghcr.io/qualcomm-linux/pkg-builder:${{ needs.resolve.outputs.suite }}
      options: --privileged
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - name: Checkout qcom-build-utils
        uses: actions/checkout@v5
        with:
          repository: qualcomm-linux/qcom-build-utils
          ref: ${{ inputs.qcom-build-utils-ref }}
          path: qcom-build-utils
          fetch-depth: 1
          sparse-checkout: |
            .github
            scripts

      - name: Checkout Repository
        uses: actions/checkout@v5
        with:
          ref: ${{ inputs.debian-ref }}
          path: package-repo
          fetch-depth: 0
          fetch-tags: true

      - name: Collect source package metadata
        id: metadata
        run: |
          cd package-repo
          echo "srcpkg_name=$(dpkg-parsechangelog --show-field Source)" >> "$GITHUB_OUTPUT"
          echo "srcpkg_version=$(dpkg-parsechangelog --show-field Version)" >> "$GITHUB_OUTPUT"

      - name: Build Debian Packages
        uses: ./qcom-build-utils/.github/actions/build_package
        with:
          suite: ${{ needs.resolve.outputs.suite }}
          pkg-dir: package-repo
          build-dir: build-area
          run-lintian: ${{ inputs.run-lintian }}
          prebuilt: ${{ inputs.is-prebuilt }}

      - name: Run ABI (Application Binary Interface) Check
        if: ${{ inputs.run-abi-checker }}
        uses: ./qcom-build-utils/.github/actions/abi_checker
        with:
          apt-repository: "deb [arch=arm64 trusted=yes] https://qartifactory-edge.qualcomm.com/artifactory/qsc-deb-releases ${{ needs.resolve.outputs.suite }} main"

      - name: Upload Docker build artifacts
        run: |
          set -euxo pipefail
          tar -C build-area -czf docker-build-area.tgz .

      - name: Upload Docker build archive
        uses: actions/upload-artifact@v6
        with:
          name: docker-build-area
          path: docker-build-area.tgz
          if-no-files-found: error
          retention-days: 1

  debian-build:
    name: Build (Debusine)
    if: ${{ needs.resolve.outputs.family == 'debian' && needs.resolve.outputs.force_docker_build != 'true' }}
    needs: resolve
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/qualcomm-linux/debusine-pkg-builder:${{ needs.resolve.outputs.suite }}
      options: --user 0:0
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    outputs:
      workspace: ${{ steps.prepare-debusine.outputs.workspace }}
      workspace_url: ${{ steps.prepare-debusine.outputs.workspace_url }}
      srcpkg_name: ${{ steps.generate-source-package.outputs.srcpkg_name }}
      srcpkg_version: ${{ steps.generate-source-package.outputs.srcpkg_version }}
    defaults:
      run:
        shell: bash
    steps:
      - name: Checkout debusine-action helpers
        uses: actions/checkout@v5
        with:
          repository: qualcomm-linux/debusine-action
          ref: ${{ env.DEBUSINE_ACTION_REF }}
          path: debusine-action
          fetch-depth: 1
          sparse-checkout: |
            lib

      - name: Checkout Repository
        uses: actions/checkout@v5
        with:
          ref: ${{ inputs.debian-ref }}
          path: srcpkg
          fetch-depth: 0
          fetch-tags: true

      - name: Prepare release
        if: ${{ inputs.release }}
        env:
          SUITE_INPUT: ${{ needs.resolve.outputs.suite }}
        run: |
          set -ex
          echo "::group::Prepare release"
          SUITE="$SUITE_INPUT" debusine-action/lib/prepare-release
          echo "::endgroup::"

      - name: Generate source package
        id: generate-source-package
        env:
          SUITE_INPUT: ${{ needs.resolve.outputs.suite }}
          DEBUSINE_ASSEMBLE_ORIG: ${{ inputs.assemble-orig }}
        run: |
          set -ex
          SUITE="$SUITE_INPUT" debusine-action/lib/generate-source-package

      - name: Build in Debusine
        id: prepare-debusine
        env:
          GITHUB_REPOSITORY_ID: ${{ github.repository_id }}
          GITHUB_RUN_ID: ${{ github.run_id }}
          GITHUB_RUN_ATTEMPT: ${{ github.run_attempt }}
          DEBUSINE_HOST: ${{ vars.DEBUSINE_HOST }}
          DEBUSINE_SCOPE: ${{ vars.DEBUSINE_SCOPE }}
          DEBUSINE_TOKEN: ${{ secrets.DEBUSINE_TOKEN }}
          DEBUSINE_PARENT_WORKSPACE: ${{ inputs.debusine-parent-workspace }}
          SUITE: ${{ needs.resolve.outputs.suite }}
        run: |
          set -euxo pipefail
          debusine-action/lib/build
          cat output >> "$GITHUB_OUTPUT"
          workspace=$(sed -n 's/^workspace=//p' output)
          echo "workspace_url=https://${DEBUSINE_HOST}/${DEBUSINE_SCOPE}/${workspace}/" >> "$GITHUB_OUTPUT"

      - name: Note Debusine workspace URL
        run: |
          echo "Debusine Workspace URL: ${{ steps.prepare-debusine.outputs.workspace_url }}" >> "$GITHUB_STEP_SUMMARY"

      - name: Upload release bundle
        if: ${{ inputs.release }}
        uses: actions/upload-artifact@v6
        with:
          name: release-bundle
          path: release.bundle
          if-no-files-found: error
          retention-days: 1

  test:
    name: Test
    if: >-
      ${{
        always() && (
          (
            needs.resolve.outputs.family == 'debian' &&
            needs.resolve.outputs.force_docker_build != 'true' &&
            needs.debian-build.result == 'success'
          ) || (
            (
              needs.resolve.outputs.family == 'ubuntu' ||
              needs.resolve.outputs.force_docker_build == 'true'
            ) &&
            needs.docker-build.result == 'success'
          )
        )
      }}
    needs:
      - resolve
      - debian-build
      - docker-build
    outputs:
      workspace: ${{ steps.select.outputs.workspace }}
      workspace_url: ${{ steps.select.outputs.workspace_url }}
      srcpkg_name: ${{ steps.select.outputs.srcpkg_name }}
      srcpkg_version: ${{ steps.select.outputs.srcpkg_version }}
    runs-on: ubuntu-24.04-arm
    container:
      image: ${{ format('ghcr.io/qualcomm-linux/pkg-builder:{0}', needs.resolve.outputs.suite) }}
      options: --user 0:0
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    defaults:
      run:
        shell: bash
    steps:
      - name: Require Debusine credentials
        if: ${{ needs.resolve.outputs.family == 'debian' && needs.resolve.outputs.force_docker_build != 'true' }}
        env:
          DEBUSINE_USER: ${{ secrets.DEBUSINE_USER }}
          DEBUSINE_TOKEN: ${{ secrets.DEBUSINE_TOKEN }}
        run: |
          if [ -z "$DEBUSINE_USER" ] || [ -z "$DEBUSINE_TOKEN" ]; then
            echo "DEBUSINE_USER and DEBUSINE_TOKEN are required for Debian/Debusine tests" >&2
            exit 1
          fi

      - name: Checkout debusine-action helpers
        if: ${{ needs.resolve.outputs.family == 'debian' && needs.resolve.outputs.force_docker_build != 'true' }}
        uses: actions/checkout@v5
        with:
          repository: qualcomm-linux/debusine-action
          ref: ${{ env.DEBUSINE_ACTION_REF }}
          path: debusine-action
          fetch-depth: 1
          sparse-checkout: |
            lib

      - name: Checkout Repository
        if: ${{ needs.resolve.outputs.family == 'debian' && needs.resolve.outputs.force_docker_build != 'true' }}
        uses: actions/checkout@v5
        with:
          ref: ${{ inputs.debian-ref }}
          path: srcpkg
          fetch-depth: 1

      - name: Validate installability from Debusine CI workspace
        # Temporarily disabled while dependency repository injection is unresolved.
        if: ${{ false }}
        env:
          DEBUSINE_HOST: ${{ vars.DEBUSINE_HOST }}
          DEBUSINE_SCOPE: ${{ vars.DEBUSINE_SCOPE }}
          DEBUSINE_USER: ${{ secrets.DEBUSINE_USER }}
          DEBUSINE_TOKEN: ${{ secrets.DEBUSINE_TOKEN }}
          DEBUSINE_WORKSPACE: ${{ needs.debian-build.outputs.workspace }}
          SUITE: ${{ needs.resolve.outputs.suite }}
        run: |
          set -euxo pipefail

          debusine-action/lib/generate-apt-config
          install -d /etc/apt/keyrings /etc/apt/sources.list.d /etc/apt/auth.conf.d
          install -m 0644 debusine-ci.sources /etc/apt/sources.list.d/debusine-ci.sources
          install -m 0600 debusine-ci-auth.conf /etc/apt/auth.conf.d/debusine-ci-auth.conf

          qartifactory_suite="$SUITE"
          if [ "$qartifactory_suite" = "unstable" ]; then
            qartifactory_suite=sid
          fi

          case "$qartifactory_suite" in
            noble|questing|resolute|trixie|sid)
              cat > /etc/apt/keyrings/qsc-deb-releases.asc <<'EOF'
          -----BEGIN PGP PUBLIC KEY BLOCK-----

          mDMEaGwEMxYJKwYBBAHaRw8BAQdAg8Nfdby/c9Y6bctGLnGJrhMhedCGfYzrp9Sa
          RWtQgDe0NXFzY19hcHRfcmVwby0wNzA3MjAyNSA8YXJ0aWZhY3RvcnkuY29yZUBx
          dWFsY29tbS5jb20+iJkEExYKAEEWIQRyQhNJGZOZvf1sqY3IwASzX5SqWwUCaGwE
          MwIbAwUJBaOagAULCQgHAgIiAgYVCgkICwIEFgIDAQIeBwIXgAAKCRDIwASzX5Sq
          W0k4AQCzVUgf+ydkoHdxKiHzwZjDowL38lAp92zlvQqK2r+9kQEAxZYBhPQ4ZVo9
          RL2bOrJexNAJyYqRamtrU+jkBn1wjQq4OARobAQzEgorBgEEAZdVAQUBAQdASOGZ
          gHVoc7BboK7yCC3bSib9NLBlrsA47RRvT7fPHhoDAQgHiH4EGBYKACYWIQRyQhNJ
          GZOZvf1sqY3IwASzX5SqWwUCaGwEMwIbDAUJBaOagAAKCRDIwASzX5SqWzH3AP94
          HDue14QrgcEsyXCElAAZxYqiDMFu663G3ki0lGB1vAEAz0tqLiapgthdSt/c/2YQ
          tej7g/77RkEpjjhnWiLMiAM=
          =7H+M
          -----END PGP PUBLIC KEY BLOCK-----
          EOF
              cat > /etc/apt/sources.list.d/qsc-deb-releases.sources <<EOF
          Types: deb
          URIs: https://qartifactory-edge.qualcomm.com/artifactory/qsc-deb-releases
          Suites: $qartifactory_suite
          Components: main
          Signed-By: /etc/apt/keyrings/qsc-deb-releases.asc
          Enabled: yes
          EOF
              ;;
          esac

          apt-get update

          packages=$(grep-dctrl -n -s Package -r '' srcpkg/debian/control | sort -u | paste -sd ' ' -)
          if [ -z "$packages" ]; then
            echo "No binary packages found in srcpkg/debian/control" >&2
            exit 1
          fi

          env DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y $packages

      - name: Download Docker build artifacts
        if: ${{ needs.resolve.outputs.family == 'ubuntu' || needs.resolve.outputs.force_docker_build == 'true' }}
        uses: actions/download-artifact@v8
        with:
          name: docker-build-area
          path: .

      - name: Extract Docker build artifacts
        if: ${{ needs.resolve.outputs.family == 'ubuntu' || needs.resolve.outputs.force_docker_build == 'true' }}
        run: |
          set -euxo pipefail
          mkdir -p build-area
          tar -C build-area -xzf docker-build-area.tgz

      - name: Validate installability from Docker build artifacts
        # Temporarily disabled while dependency repository injection is unresolved.
        if: ${{ false }}
        run: |
          set -euxo pipefail

          # Add qsc-deb-releases so Qualcomm package dependencies are resolvable
          suite="${{ needs.resolve.outputs.suite }}"
          install -d /etc/apt/keyrings /etc/apt/sources.list.d
          cat > /etc/apt/keyrings/qsc-deb-releases.asc <<'KEYEOF'
          -----BEGIN PGP PUBLIC KEY BLOCK-----

          mDMEaGwEMxYJKwYBBAHaRw8BAQdAg8Nfdby/c9Y6bctGLnGJrhMhedCGfYzrp9Sa
          RWtQgDe0NXFzY19hcHRfcmVwby0wNzA3MjAyNSA8YXJ0aWZhY3RvcnkuY29yZUBx
          dWFsY29tbS5jb20+iJkEExYKAEEWIQRyQhNJGZOZvf1sqY3IwASzX5SqWwUCaGwE
          MwIbAwUJBaOagAULCQgHAgIiAgYVCgkICwIEFgIDAQIeBwIXgAAKCRDIwASzX5Sq
          W0k4AQCzVUgf+ydkoHdxKiHzwZjDowL38lAp92zlvQqK2r+9kQEAxZYBhPQ4ZVo9
          RL2bOrJexNAJyYqRamtrU+jkBn1wjQq4OARobAQzEgorBgEEAZdVAQUBAQdASOGZ
          gHVoc7BboK7yCC3bSib9NLBlrsA47RRvT7fPHhoDAQgHiH4EGBYKACYWIQRyQhNJ
          GZOZvf1sqY3IwASzX5SqWwUCaGwEMwIbDAUJBaOagAAKCRDIwASzX5SqWzH3AP94
          HDue14QrgcEsyXCElAAZxYqiDMFu663G3ki0lGB1vAEAz0tqLiapgthdSt/c/2YQ
          tej7g/77RkEpjjhnWiLMiAM=
          =7H+M
          -----END PGP PUBLIC KEY BLOCK-----
          KEYEOF
          cat > /etc/apt/sources.list.d/qsc-deb-releases.sources <<EOF
          Types: deb
          URIs: https://qartifactory-edge.qualcomm.com/artifactory/qsc-deb-releases
          Suites: $suite
          Components: main
          Signed-By: /etc/apt/keyrings/qsc-deb-releases.asc
          Enabled: yes
          EOF

          apt-get update

          debs=$(find "$PWD/build-area" -type f -name '*.deb' | sort)
          if [ -z "$debs" ]; then
            echo "No binary packages found in build-area" >&2
            exit 1
          fi

          env DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y $debs

      - name: Select test outputs
        id: select
        run: |
          if [[ "${{ needs.resolve.outputs.family }}" == "debian" && "${{ needs.resolve.outputs.force_docker_build }}" != "true" ]]; then
            echo "workspace=${{ needs.debian-build.outputs.workspace }}" >> "$GITHUB_OUTPUT"
            echo "workspace_url=${{ needs.debian-build.outputs.workspace_url }}" >> "$GITHUB_OUTPUT"
            echo "srcpkg_name=${{ needs.debian-build.outputs.srcpkg_name }}" >> "$GITHUB_OUTPUT"
            echo "srcpkg_version=${{ needs.debian-build.outputs.srcpkg_version }}" >> "$GITHUB_OUTPUT"
          else
            echo "workspace=" >> "$GITHUB_OUTPUT"
            echo "workspace_url=" >> "$GITHUB_OUTPUT"
            echo "srcpkg_name=${{ needs.docker-build.outputs.srcpkg_name }}" >> "$GITHUB_OUTPUT"
            echo "srcpkg_version=${{ needs.docker-build.outputs.srcpkg_version }}" >> "$GITHUB_OUTPUT"
          fi

      - name: Note temporary installability policy
        run: |
          {
            echo "## Temporary Test Policy"
            echo
            echo ":warning: Installability validation is temporarily disabled."
            echo
            echo "- Skipped: Validate installability from Debusine CI workspace"
            echo "- Skipped: Validate installability from Docker build artifacts"
          } >> "$GITHUB_STEP_SUMMARY"