build: Publish Clio to packages.xrplf.org (#3192)

Co-authored-by: Bart <bthomee@users.noreply.github.com>

.github/workflows/release.yml

@@ -14,6 +14,18 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  release-info:
+    name: Determine release info
+    runs-on: ubuntu-latest
+    outputs:
+      channel: ${{ steps.release_info.outputs.channel }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - id: release_info
+        uses: XRPLF/actions/release-info@7cc0e4a8d9d0b838f92c48d312856b190341bbba
+
   build-and-test:
     name: Build and Test
 
@@ -60,6 +72,16 @@ jobs:
       targets: package
       analyze_build_time: false
 
+  publish_package:
+    name: Publish debian package
+    needs: [release-info, package]
+    uses: ./.github/workflows/reusable-publish-package.yml
+    with:
+      channel: ${{ needs.release-info.outputs.channel }}
+    secrets:
+      nexus_username: ${{ secrets.NEXUS_REMOTE_USERNAME }}
+      nexus_password: ${{ secrets.NEXUS_REMOTE_PASSWORD }}
+
   release:
     needs: [build-and-test, package]
     uses: ./.github/workflows/reusable-release.yml

.github/workflows/reusable-publish-package.yml

@@ -0,0 +1,61 @@
+# See docs/install-clio.md, "Publishing".
+name: Reusable publish package
+
+on:
+  workflow_call:
+    inputs:
+      channel:
+        description: "Release channel to publish to, selecting the deb-<channel> repository"
+        required: true
+        type: string
+
+    secrets:
+      nexus_username:
+        description: Username of a Nexus account with write access to the repositories
+        required: false
+      nexus_password:
+        description: Password or token for that Nexus account
+        required: false
+
+defaults:
+  run:
+    shell: bash
+
+env:
+  PACKAGE_DIR: packages
+
+jobs:
+  publish:
+    name: Publish debian package
+    runs-on: heavy
+    container:
+      image: ghcr.io/xrplf/xrpld/packaging-debian:sha-b6a8995
+
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          path: ${{ env.PACKAGE_DIR }}
+          pattern: clio_deb_package_*
+
+      # dpkg-deb refuses to read a version CPack should not have produced.
+      - name: Verify packages
+        run: |
+          shopt -s globstar nullglob
+          for package in "${PACKAGE_DIR}"/**/*.deb; do
+              dpkg-deb --field "${package}" Package Version Architecture
+          done
+
+      - name: Publish packages
+        env:
+          CHANNEL: ${{ inputs.channel }}
+          NEXUS_USERNAME: ${{ secrets.nexus_username }}
+          NEXUS_PASSWORD: ${{ secrets.nexus_password }}
+          DRY_RUN_OPTION: ${{ (github.repository == 'XRPLF/clio' && github.event_name != 'pull_request') && '' || '--dry-run' }}
+        run: |
+          publish_pkg.py \
+              --channel "${CHANNEL}" \
+              --package-dir "${PACKAGE_DIR}" \
+              ${DRY_RUN_OPTION}