Update workflows

Signed-off-by: Simon Beaudoin <sbeaudoi@qti.qualcomm.com>

Author: simonbeaudoin0935

.github/workflows/build-debian-package.yml

@@ -38,8 +38,7 @@ on:
           - lecore-prd-u2404-arm64-xlrg-od-ephem
 
 permissions:
- contents: read
- security-events: write
+  contents: read
 
 jobs:
   build:
@@ -49,7 +48,7 @@ jobs:
       debian-ref: ${{ inputs.debian-ref }}
       distro-codename: ${{ inputs.distro-codename }}
       run-abi-checker: ${{ inputs.abi-checker }}
-      push-to-repo: ${{ inputs.push-to-repo }}
+      is-post-merge: ${{ inputs.push-to-repo }}
       runner: ${{inputs.builder_runner}}
     secrets:
       TOKEN: ${{ secrets.DEB_PKG_BOT_CI_TOKEN }}

.github/workflows/pr-pre-post-merge.yml

@@ -0,0 +1,37 @@
+name: PR Pre and Post Merge Build
+description: |
+  Test a package build pre and post merge.
+  When a PR is opened, synchronized or reopened against debian/latest, this workflow will test that the package builds successfully inside the PR.
+  The user will want to mark this check as required in branch protection rules to ensure that PRs cannot be merged unless the package builds successfully.
+  When a PR is closed AND merged, this workflow will test that debian/latest builds successfully and push the new package to the staging repo.
+  This is controled by the is-post-merge input to the reusable workflow, which is set based on the PR action and merged status.
+  This workflow will explicitely NOT run on closed but unmerged PRs to avoid unnecessary builds (say in the case of a declined PR)
+
+on:
+  pull_request_target:
+    branches: [ debian/latest ]
+    types: [ opened, synchronize, reopened, closed ]
+
+permissions:
+  contents: read
+
+jobs:
+
+  build:
+
+    # This condition ensures that the job runs for all PR actions except closed unmerged,
+    # i.e., it runs for opened, synchronize, reopened (pre-merge) and closed merged (post-merge).
+    if: ${{ github.event.action != 'closed' || github.event.pull_request.merged == true }}
+    uses: qualcomm-linux/qcom-build-utils/.github/workflows/qcom-build-pkg-reusable-workflow.yml@main
+    with:
+      qcom-build-utils-ref: main  
+      
+      # PRE-MERGE: use the PR head branch (github.head_ref)
+      # POST-MERGE: use the base branch name from the PR (e.g. "debian/latest")
+      debian-ref: ${{ (github.event.action == 'closed' && github.event.pull_request.merged) && github.event.pull_request.base.ref || github.head_ref }}
+      run-abi-checker: true
+       # True if the PR was merged (i.e. post-merge): closed & merged
+      is-post-merge: ${{ github.event.action == 'closed' && github.event.pull_request.merged == true }}
+
+    secrets:
+      TOKEN: ${{secrets.DEB_PKG_BOT_CI_TOKEN}}

.github/workflows/release.yml

@@ -0,0 +1,46 @@
+name: Release Version
+description: |
+  Release a new package version.
+  This workflow is manually triggered via workflow_dispatch.
+
+on:
+  workflow_dispatch:
+    inputs:
+
+      distro-codename:
+        description: The distribution codename to build for. Ex noble, questing, etc
+        type: choice
+        default: noble
+        options:
+          - noble
+          - questing
+
+      runner:
+        type: choice
+        default: ubuntu-latest
+        options:
+          - ubuntu-latest
+          - lecore-prd-u2404-arm64-xlrg-od-ephem
+
+      test-run:
+        description: |
+          If true, the built packages will be uploaded to the 'test' folder in S3.
+          If false, the built packages will be uploaded to the 'proposed' folder in S3
+        type: boolean
+        default: true
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+
+    uses: qualcomm-linux/qcom-build-utils/.github/workflows/qcom-release-reusable-workflow.yml@main
+    with:
+      qcom-build-utils-ref: main
+      distro-codename: ${{ github.event.inputs.distro-codename }}
+      test-run: ${{ github.event.inputs.test-run == 'true' && true || false }}
+      runner: ${{ github.event.inputs.runner }}
+
+    secrets:
+      TOKEN: ${{secrets.DEB_PKG_BOT_CI_TOKEN}}