ci(ace): add native RPM/DEB release pipeline alongside goreleaser

[maqeel75]

• Updates release workflow to build native packages
• Makes sure that pre-release tags must not generate latest tag for docker images. latest tag will be generated only for final release tag

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 5e8e9857-cc35-4112-a5c3-a67c1aad9fb9

📥 Commits

Reviewing files that changed from the base of the PR and between 7592cb8 and 25f0d12.

📒 Files selected for processing (1)

• .github/workflows/release.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/release.yaml

---

📝 Walkthrough

Walkthrough

Changes

Release and Packaging

Layer / File(s)	Summary
Release control and artifact production .github/workflows/release.yaml	Release dispatch inputs, permissions, tag parsing, build matrices, snapshot GoReleaser runs, artifact uploads, and GA Docker tagging are added.
Shared packaging runtime and build helpers common/*, packaging/common.sh, packaging/common/*	Shared build orchestration, OS setup, repository configuration, syft installation, GPG signing, signature validation, and service runtime files are added.
RPM package build and specification packaging/build-rpm.sh, packaging/rpm/ace.spec	RPM and SRPM builds stage release inputs, generate SBOMs, sign outputs, and install ACE runtime files with lifecycle scripts.
DEB package build and specification packaging/build-deb.sh, packaging/deb/debian/*	Debian builds create changelogs and packages with metadata, maintainer scripts, SBOMs, service configuration, and documentation.
Matrix package orchestration .github/workflows/release.yaml	RPM and DEB matrix jobs normalize GoReleaser archives, invoke the builder action, and upload per-target artifacts.
Repository publishing and release manifest .github/workflows/release.yaml	Package artifacts are published to DNF and APT repositories, backed up, aggregated into a manifest, and passed to candidate publication and Slack notification steps.

Poem

I’m a rabbit with packages tucked tight,
Building RPMs and DEBs through the night.
Tarballs hop, signatures gleam,
Manifests float downstream in a dream.
“Squeak!” goes the pipeline, bright and grand—
ACE now blooms across the land.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: adding native RPM/DEB release packaging alongside GoReleaser.
Description check	✅ Passed	The description matches the changeset by mentioning native package builds and the Docker latest-tag behavior.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/native-packages-release-workflow

---

_{Comment @coderabbitai help to get the list of available commands.}

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[coderabbitai]

Actionable comments posted: 5

🧹 Nitpick comments (1)

packaging/build-deb.sh (1)

56-56: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Quote variable expansions (shellcheck SC2086).

Unquoted ${COMPONENT_NAME} (line 56) and ${ACE_BRANCH} (line 64) are subject to word-splitting/globbing.

🔧 Proposed fix

-  cp ${COMPONENT_NAME}/common/pgedge-ace.* $BUILD_DIR/debian/
+  cp "${COMPONENT_NAME}"/common/pgedge-ace.* "$BUILD_DIR"/debian/

     curl -fsSL -o "$BUILD_DIR/NOTICE.txt" \
-      https://raw.githubusercontent.com/pgEdge/ace/${ACE_BRANCH}/NOTICE.txt
+      "https://raw.githubusercontent.com/pgEdge/ace/${ACE_BRANCH}/NOTICE.txt"

Also applies to: 64-64

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packaging/build-deb.sh` at line 56, Quote the variable expansions in the
build commands using COMPONENT_NAME and ACE_BRANCH, including the cp command and
the command at the later ACE_BRANCH reference, while preserving their existing
path and argument behavior.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/release.yaml:
- Around line 386-390: Update the release manifest workflow to build cells[]
from a persisted inventory of successfully downloaded package artifacts rather
than the complete matrix. Use this artifact inventory consistently for publisher
push targets, backups, and manifest generation, including force_push runs with
failed matrix cells, so missing architectures are not reported as shipped.
- Around line 246-264: Update the “Build and push image” workflow step to expose
github.ref_name through an environment variable, then use that variable for all
shell references instead of interpolating the GitHub expression inside the
script. Quote the variable in the tag construction, case condition, log message,
and --build-arg value while preserving the existing GA versus pre-release
tagging behavior.

In `@common/common-functions.sh`:
- Around line 85-93: Update configure_pgedge_apt_repo to fail immediately when
downloading or installing the release package fails: remove the trailing `||
true`, use a unique temporary file for the downloaded package, clean it up after
installation, and run the source-file update and apt-get update with consistent
privilege escalation.

In `@packaging/build-deb.sh`:
- Around line 90-96: Update post_build so cp failures are not swallowed by the
blanket || echo handler. Distinguish an unmatched .deb glob from genuine copy
errors, reporting “No .deb packages found” only when no packages exist and
propagating failures such as permission or disk errors with a nonzero status.

In `@packaging/rpm/ace.spec`:
- Around line 35-36: Use the extracted KEY_ID when invoking gpg for SBOM
detached signing: update the signing command in packaging/rpm/ace.spec at lines
35-36 and the corresponding command in packaging/deb/debian/rules at lines 18-21
to pass --local-user "$KEY_ID", ensuring both packages sign with the intended
key.

---

Nitpick comments:
In `@packaging/build-deb.sh`:
- Line 56: Quote the variable expansions in the build commands using
COMPONENT_NAME and ACE_BRANCH, including the cp command and the command at the
later ACE_BRANCH reference, while preserving their existing path and argument
behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 4ae613b5-cdb2-4eb9-bf07-3ec773624183

📥 Commits

Reviewing files that changed from the base of the PR and between a82e4ff and 7592cb8.

📒 Files selected for processing (16)

• .github/workflows/release.yaml
• common/build.sh
• common/common-functions.sh
• packaging/build-deb.sh
• packaging/build-rpm.sh
• packaging/common.sh
• packaging/common/pgedge-ace.logrotate
• packaging/common/pgedge-ace.service
• packaging/common/pgedge-ace.tmpfiles.conf
• packaging/deb/debian/control
• packaging/deb/debian/docs
• packaging/deb/debian/format
• packaging/deb/debian/postinst
• packaging/deb/debian/preinst
• packaging/deb/debian/rules
• packaging/rpm/ace.spec