GH-47582: [CI][Packaging] Move linux-packaging tasks to apache/arrow repository (#47600)

### Rationale for this change

There are several things that make this change wanted. We want to move some CI jobs from `ursacomputing/crossbow` to `apache/arrow`. Moving the Linux Packaging jobs will allow us to automate some release tasks and potentially (if we are able to make reproducible builds for linux packaging work) add automated signing to them avoiding having to require a PMC signature for the Linux packaging artifacts.

### What changes are included in this PR?

- Move `check_labels` and `report_ci` jobs to independent reusable workflows.
- Update `cpp_extra` to use those.
- Create new `linux_packaging.yml` workflow replicating work that was done on crossbow. Integrate that workflow with `check_labels` and `report_ci`
- Update release binary submit and binary download to run workflow when tag is pushed and download the artifacts from the release instead of from the crossbow repository.

### Are these changes tested?

Some via CI on fork and some manual testing.

### Are there any user-facing changes?

No

* GitHub Issue: #47582

Lead-authored-by: Raúl Cumplido <[email protected]>
Co-authored-by: Sutou Kouhei <[email protected]>
Co-authored-by: Sutou Kouhei <[email protected]>
Signed-off-by: Sutou Kouhei <[email protected]>

Author: raulcd

.github/workflows/check_labels.yml

@@ -0,0 +1,75 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: Check Labels Reusable
+
+on:
+  workflow_call:
+    inputs:
+      parent-workflow:
+        description: "The parent workflow filename (without .yml)"
+        required: true
+        type: string
+    outputs:
+      ci-extra-labels:
+        description: "The extra CI labels"
+        value: ${{ jobs.check-labels.outputs.ci-extra-labels }}
+      force:
+        description: "Whether to force running the jobs"
+        value: ${{ jobs.check-labels.outputs.force }}
+
+jobs:
+  check-labels:
+    name: Check labels
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      ci-extra-labels: ${{ steps.check.outputs.ci-extra-labels }}
+      force: ${{ steps.check.outputs.force }}
+    steps:
+      - name: Checkout Arrow
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - name: Check
+        id: check
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -ex
+          case "${GITHUB_EVENT_NAME}" in
+            push|schedule|workflow_dispatch)
+              echo "force=true" >> "${GITHUB_OUTPUT}"
+              ;;
+            pull_request)
+              {
+                echo "ci-extra-labels<<LABELS"
+                gh pr view ${{ github.event.number }} \
+                  --jq '[.labels[].name | select(startswith("CI: Extra"))]' \
+                  --json labels \
+                  --repo ${GITHUB_REPOSITORY}
+                echo "LABELS"
+              } >> "${GITHUB_OUTPUT}"
+              git fetch origin ${GITHUB_BASE_REF}
+              git diff --stat origin/${GITHUB_BASE_REF}..
+              if git diff --stat origin/${GITHUB_BASE_REF}.. | \
+                   grep \
+                     --fixed-strings ".github/workflows/${{ inputs.parent-workflow }}.yml" \
+                     --quiet; then
+                echo "force=true" >> "${GITHUB_OUTPUT}"
+              fi
+              ;;
+          esac

.github/workflows/cpp_extra.yml

@@ -24,7 +24,9 @@ on:
       - '!dependabot/**'
     paths:
       - '.dockerignore'
+      - '.github/workflows/check_labels.yml'
       - '.github/workflows/cpp_extra.yml'
+      - '.github/workflows/report_ci.yml'
       - 'ci/conda_env_*'
       - 'ci/docker/**'
       - 'ci/scripts/ccache_setup.sh'
@@ -43,7 +45,9 @@ on:
   pull_request:
     paths:
       - '.dockerignore'
+      - '.github/workflows/check_labels.yml'
       - '.github/workflows/cpp_extra.yml'
+      - '.github/workflows/report_ci.yml'
       - 'ci/conda_env_*'
       - 'ci/docker/**'
       - 'ci/scripts/ccache_setup.sh'
@@ -75,53 +79,19 @@ permissions:
 
 jobs:
   check-labels:
-    name: Check labels
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    outputs:
-      ci-extra: ${{ steps.check.outputs.ci-extra }}
-    steps:
-      - name: Checkout Arrow
-        if: github.event_name == 'pull_request'
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - name: Check
-        id: check
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          case "${GITHUB_EVENT_NAME}" in
-            push|schedule)
-              ci_extra=true
-              ;;
-            pull_request)
-              n_ci_extra_labels=$(
-                gh pr view ${{ github.event.number }} \
-                  --jq '.labels[].name | select(. == "CI: Extra")' \
-                  --json labels \
-                  --repo ${GITHUB_REPOSITORY} | wc -l)
-              if [ "${n_ci_extra_labels}" -eq 1 ]; then
-                ci_extra=true
-              else
-                git fetch origin ${GITHUB_BASE_REF}
-                if git diff --stat origin/${GITHUB_BASE_REF}.. | \
-                     grep \
-                       --fixed-strings ".github/workflows/cpp_extra.yml" \
-                       --quiet; then
-                  ci_extra=true
-                else
-                  ci_extra=false
-                fi
-              fi
-              ;;
-          esac
-
-          echo "ci-extra=${ci_extra}" >> "${GITHUB_OUTPUT}"
+    uses: ./.github/workflows/check_labels.yml
+    secrets: inherit
+    with:
+      parent-workflow: cpp_extra
 
   docker:
     needs: check-labels
     name: ${{ matrix.title }}
     runs-on: ${{ matrix.runs-on }}
-    if: needs.check-labels.outputs.ci-extra == 'true'
+    if: >-
+      needs.check-labels.outputs.force == 'true' ||
+      contains(fromJSON(needs.check-labels.outputs.ci-extra-labels || '[]'), 'CI: Extra') ||
+      contains(fromJSON(needs.check-labels.outputs.ci-extra-labels || '[]'), 'CI: Extra: C++')
     timeout-minutes: 75
     strategy:
       fail-fast: false
@@ -198,7 +168,10 @@ jobs:
     needs: check-labels
     name: JNI macOS
     runs-on: macos-14
-    if: needs.check-labels.outputs.ci-extra == 'true'
+    if: >-
+      needs.check-labels.outputs.force == 'true' ||
+      contains(fromJSON(needs.check-labels.outputs.ci-extra-labels || '[]'), 'CI: Extra') ||
+      contains(fromJSON(needs.check-labels.outputs.ci-extra-labels || '[]'), 'CI: Extra: C++')
     timeout-minutes: 45
     env:
       MACOSX_DEPLOYMENT_TARGET: "14.0"
@@ -280,58 +253,8 @@ jobs:
           ../minimal_build.build/arrow-example
 
   report-extra-cpp:
-    runs-on: ubuntu-latest
     needs:
       - docker
       - jni-macos
-    # We don't have the job id as part of the context neither the job name.
-    # The GitHub API exposes numeric id or job name but not the github.job (report-extra-cpp).
-    # We match github.job to the name so we can pass it via context in order to be ignored on the report.
-    # The job is still running.
-    name: ${{ github.job }}
-    if: github.event_name == 'schedule' && always()
-    steps:
-      - name: Checkout Arrow
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          fetch-depth: 0
-      - name: Setup Python
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
-        with:
-          python-version: 3
-      - name: Setup Archery
-        run: python3 -m pip install -e dev/archery[crossbow]
-      - name: Prepare common options
-        run: |
-          if [ "${GITHUB_REPOSITORY}" = "apache/arrow" ]; then
-            echo "COMMON_OPTIONS=--send" >> "${GITHUB_ENV}"
-          else
-            echo "COMMON_OPTIONS=--dry-run" >> "${GITHUB_ENV}"
-          fi
-      - name: Send email
-        env:
-          GH_TOKEN: ${{ github.token }}
-          SMTP_PASSWORD: ${{ secrets.ARROW_SMTP_PASSWORD }}
-        run: |
-          archery ci report-email \
-            --ignore ${{ github.job }} \
-            --recipient-email '[email protected]' \
-            --repository ${{ github.repository }} \
-            --sender-email '[email protected]' \
-            --sender-name Arrow \
-            --smtp-port 587 \
-            --smtp-server 'commit-email.info' \
-            --smtp-user arrow \
-            ${COMMON_OPTIONS} \
-            ${{ github.run_id }}
-      - name: Send chat message
-        if: always()
-        env:
-          GH_TOKEN: ${{ github.token }}
-          CHAT_WEBHOOK: ${{ secrets.ARROW_ZULIP_WEBHOOK }}
-        run: |
-          archery ci report-chat \
-            --ignore ${{ github.job }} \
-            --repository ${{ github.repository }} \
-            ${COMMON_OPTIONS} \
-            ${{ github.run_id }}
+    uses: ./.github/workflows/report_ci.yml
+    secrets: inherit