ci: add release workflows publishing linux packages

.github/workflows/ci.yml

@@ -2,45 +2,37 @@
 name: CI
 
 on:
+  workflow_call: ~
   pull_request:
+    branches:
+      - main
   push:
     branches:
       - main
-    tags:
-      - "v*"
 
-# contents: read covers all jobs.  A future release-publishing job will need
-# contents: write — set it at the job level there rather than widening here.
 permissions:
   contents: read
 
 env:
-  # Derived from the tag (v1.2.3 → 1.2.3) on tag pushes; falls back to
-  # 0.0.0-dev for branch builds so nfpm always has a valid version string.
-  VERSION: ${{ startsWith(github.ref, 'refs/tags/v') && github.ref_name || '0.0.0-dev' }}
   # Bump this when a new nfpm release is available.
   NFPM_VERSION: "2.46.3"
 
+## Concurrency only allowed in the main branch.
+## So old builds running for old commits within the same Pull Request are cancelled
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
 jobs:
   test:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
 
-      - name: Install Rust stable
-        uses: dtolnay/rust-toolchain@stable
-
-      - name: Cache cargo registry
-        uses: actions/cache@v6
+      - name: Install environment
+        uses: ./.github/workflows/env-install
         with:
-          path: |
-            ~/.cargo/registry/index/
-            ~/.cargo/registry/cache/
-            ~/.cargo/git/db/
-            target/
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.toml', '**/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-
+          components: rustfmt, clippy
 
       - name: Check formatting
         run: cargo fmt --all -- --check
@@ -52,73 +44,127 @@ jobs:
         run: cargo test --all
 
   build:
-    runs-on: ubuntu-latest
-    needs: test
-    if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
+    needs:
+      - test
+    strategy:
+      matrix:
+        os:
+          - runner: ubuntu-24.04
+            target: x86_64-unknown-linux-musl
+            arch: amd64
+          - runner: ubuntu-24.04-arm
+            target: aarch64-unknown-linux-musl
+            arch: arm64
+    runs-on: ${{ matrix.os.runner }}
     steps:
       - uses: actions/checkout@v7
 
-      - name: Install Rust stable + musl target
-        uses: dtolnay/rust-toolchain@stable
+      - name: Install environment
+        uses: ./.github/workflows/env-install
         with:
-          targets: x86_64-unknown-linux-musl
+          targets: ${{ matrix.os.target }}
 
       - name: Install musl tools
         run: sudo apt-get install -y musl-tools
 
       - name: Build static release binary
-        run: cargo build --release --target x86_64-unknown-linux-musl
+        run: cargo build --release --target ${{ matrix.os.target }}
 
-      - name: Upload binary artifact
-        uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@v7
         with:
-          name: fix-perms-x86_64-musl
-          path: target/x86_64-unknown-linux-musl/release/fix-perms
+          name: fix-perms-${{ matrix.os.arch }}
+          path: target/${{ matrix.os.target }}/release/fix-perms
           if-no-files-found: error
 
   package:
-    runs-on: ubuntu-latest
-    needs: build
-    if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+      artifact-metadata: write
+    needs:
+      - build
+    strategy:
+      matrix:
+        os:
+          - runner: ubuntu-24.04
+            target: x86_64-unknown-linux-musl
+            arch: amd64
+          - runner: ubuntu-24.04-arm
+            target: aarch64-unknown-linux-musl
+            arch: arm64
+    runs-on: ${{ matrix.os.runner }}
     steps:
       - uses: actions/checkout@v7
 
-      - name: Install Rust stable
-        run: rustup toolchain install stable
+      - name: Install environment
+        uses: ./.github/workflows/env-install
 
-      - name: Download binary artifact
-        uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@v8
         with:
-          name: fix-perms-x86_64-musl
-          path: target/x86_64-unknown-linux-musl/release/
+          name: fix-perms-${{ matrix.os.arch }}
+          path: target/${{ matrix.os.target }}/release/
 
       - name: Restore binary permissions
-        run: chmod +x target/x86_64-unknown-linux-musl/release/fix-perms
-
-      - name: Derive package version
-        id: version
-        run: |
-          # Strip the leading 'v' from tag names (v1.2.3 → 1.2.3).
-          # Both dpkg and rpm reject version strings that start with 'v'.
-          ref="${GITHUB_REF_NAME}"
-          echo "value=${ref#v}" >> "$GITHUB_OUTPUT"
+        run: chmod +x target/${{ matrix.os.target }}/release/fix-perms
 
       - name: Install nfpm
         run: |
           curl -fsSL \
-            "https://github.com/goreleaser/nfpm/releases/download/v${NFPM_VERSION}/nfpm_${NFPM_VERSION}_amd64.deb" \
+            "https://github.com/goreleaser/nfpm/releases/download/v${NFPM_VERSION}/nfpm_${NFPM_VERSION}_$(dpkg --print-architecture).deb" \
             -o /tmp/nfpm.deb
           sudo dpkg -i /tmp/nfpm.deb
           rm /tmp/nfpm.deb
 
       - name: Build packages
-        run: cargo xtask build
-        env:
-          VERSION: ${{ steps.version.outputs.value }}
+        run: cargo xtask build --target ${{ matrix.os.target }}
+
+      - uses: actions/attest@v4
+        with:
+          subject-path: "dist/*"
 
-      - name: Upload packages
-        uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@v7
         with:
-          name: ignity-extensions-packages
-          path: dist/
+          name: ignity-extensions-packages-${{ matrix.os.arch }}
+          path: "dist/*"
           if-no-files-found: error
+
+  sanitize:
+    needs:
+      - package
+    strategy:
+      matrix:
+        os:
+          - runner: ubuntu-24.04
+            arch: amd64
+          - runner: ubuntu-24.04-arm
+            arch: arm64
+    runs-on: ${{ matrix.os.runner }}
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: ignity-extensions-packages-${{ matrix.os.arch }}
+          path: dist
+
+      - name: Prepare smoke test
+        run: |
+          mkdir -p /tmp/smoke/dir
+          touch /tmp/smoke/dir/file
+          echo "/tmp/smoke $(id -u):$(id -g) 0600 0700" > /tmp/smoke.spec
+
+      - name: Verify deb install
+        run: |
+          sudo dpkg -i dist/ignity-extensions_*.deb
+          fix-perms < /tmp/smoke.spec
+          test "$(stat -c %a /tmp/smoke/dir)" = "700"
+          test "$(stat -c %a /tmp/smoke/dir/file)" = "600"
+          sudo dpkg -r ignity-extensions
+
+      - name: Verify rpm install
+        run: |
+          sudo apt-get install -qy rpm
+          sudo rpm -i --nodeps dist/ignity-extensions-*.rpm
+          chmod -R 0777 /tmp/smoke
+          fix-perms < /tmp/smoke.spec
+          test "$(stat -c %a /tmp/smoke/dir)" = "700"
+          test "$(stat -c %a /tmp/smoke/dir/file)" = "600"

.github/workflows/env-install/action.yml

@@ -0,0 +1,32 @@
+---
+name: Environment installation
+description: Install the Rust toolchain and restore the cargo cache
+inputs:
+  targets:
+    description: "Comma-separated list of additional Rust targets to install"
+    required: false
+    default: ""
+  components:
+    description: "Comma-separated list of additional Rust components to install"
+    required: false
+    default: ""
+runs:
+  using: "composite"
+  steps:
+    - name: Install Rust stable
+      uses: dtolnay/rust-toolchain@stable
+      with:
+        targets: ${{ inputs.targets }}
+        components: ${{ inputs.components }}
+
+    - name: Cache cargo registry
+      uses: actions/cache@v6
+      with:
+        path: |
+          ~/.cargo/registry/index/
+          ~/.cargo/registry/cache/
+          ~/.cargo/git/db/
+          target/
+        key: ${{ runner.os }}-${{ runner.arch }}-cargo-${{ inputs.targets }}-${{ hashFiles('**/Cargo.toml', '**/Cargo.lock') }}
+        restore-keys: |
+          ${{ runner.os }}-${{ runner.arch }}-cargo-${{ inputs.targets }}-

.github/workflows/pre-release.yml

@@ -0,0 +1,38 @@
+---
+name: Pre release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "The version to release (e.g. 1.2.3). This workflow will automatically perform the required version bumps"
+        required: true
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}
+
+jobs:
+  pre-release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Setup github actions bot
+        uses: ./.github/workflows/setup-github-bot
+
+      - name: Install environment
+        uses: ./.github/workflows/env-install
+
+      - name: Run pre-release step
+        run: cargo xtask release:pre
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_VERSION: ${{ inputs.version }}

.github/workflows/release.yml

@@ -0,0 +1,72 @@
+---
+name: Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "The next iteration version (e.g. 1.2.4-dev). This workflow will automatically perform the required version bumps"
+        required: true
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}
+
+jobs:
+  ci:
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+      artifact-metadata: write
+    uses: ./.github/workflows/ci.yml
+    secrets: inherit
+
+  release:
+    runs-on: ubuntu-latest
+    needs:
+      - ci
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/download-artifact@v8
+        with:
+          pattern: ignity-extensions-packages-*
+          merge-multiple: true
+          path: dist
+
+      - name: Install environment
+        uses: ./.github/workflows/env-install
+
+      - name: Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: cargo xtask release
+
+  post-release:
+    needs:
+      - release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Setup github actions bot
+        uses: ./.github/workflows/setup-github-bot
+
+      - name: Install environment
+        uses: ./.github/workflows/env-install
+
+      - name: Run post-release step
+        run: cargo xtask release:post
+        env:
+          GH_TOKEN: ${{ github.token }}
+          NEXT_VERSION: ${{ inputs.version }}

.github/workflows/setup-github-bot/action.yml

@@ -0,0 +1,12 @@
+---
+name: Setup github actions bot
+description: Setup github actions bot to commit and create PRs
+
+runs:
+  using: "composite"
+  steps:
+    - name: Setup git
+      run: |
+        git config --global user.name "github-actions[bot]"
+        git config --global user.email "github-actions[bot]@users.noreply.github.com"
+      shell: bash