ci: add Debian 13 package build workflow

[rgerhards]

This PR adds a GitHub Actions workflow that validates Debian 13 (trixie) package builds on every pull request.

Summary

The workflow ensures that PRs do not break Debian package builds by using official Debian packaging sources and dependencies.

Key Features

• Uses debian:trixie container (Debian 13)
• Fetches official Debian packaging from salsa.debian.org or apt-get source
• Installs build dependencies from debian/control using mk-build-deps
• Builds packages with dpkg-buildpackage (Debian's standard build tool)
• Validates package installation
• Verifies documentation packages are built
• Uploads .deb artifacts for inspection

Testing

The workflow provides 100% fidelity with Debian's actual build process, ensuring distribution readiness.

Impact

PRs now automatically verify Debian 13 compatibility, preventing packaging regressions from reaching production.

see also rsyslog#6586

[gemini-code-assist]

Note

Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported.

[cubic-dev-ai]

3 issues found across 1 file

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/debian_package_build.yml">

<violation number="1" location=".github/workflows/debian_package_build.yml:66">
P2: `apt-get source rsyslog` will always fail because the default `debian:trixie` container only has binary package repositories enabled (`Types: deb`). Source repositories (`deb-src`) are not configured, and the workflow never enables them. The primary fetch path is dead code — the workflow always falls through to the `git clone` from salsa.debian.org.

Enable source repos before `apt-get source`, e.g. by adding:
```bash
sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/debian.sources
apt-get update
```</violation>

<violation number="2" location=".github/workflows/debian_package_build.yml:144">
P1: Custom agent: **Code Quality Guard**

**Toothless CI step**: The 'Install and test packages' step catches all errors and downgrades them to WARNINGs. Package installation failure is silently ignored, and missing `rsyslogd` binary after install only prints a WARNING. This step can **never fail**, which defeats the stated purpose of preventing packaging regressions.

At minimum, the `rsyslogd -v` check after installation should be a hard failure — if the main binary isn't installed, the packages are broken.

| Metric | Score |
|---|---|
| AI_PROBABILITY | 85% |
| POLICY_COMPLIANCE | 50% |
| SLOP_SCORE | 80% |</violation>

<violation number="3" location=".github/workflows/debian_package_build.yml:192">
P1: Custom agent: **Code Quality Guard**

**Shell bug**: `[ -f ../*.deb ]` does not work correctly with glob patterns. When multiple `.deb` files exist (expected for rsyslog), the glob expands to multiple arguments causing `[: too many arguments` error. The Summary step will always falsely report build failure and `exit 1`.

Use `ls ../*.deb >/dev/null 2>&1` or `compgen -G '../*.deb' >/dev/null 2>&1` instead.

This is a strong indicator of AI-generated code (SLOP_SCORE: high) — the pattern looks plausible but is functionally broken.

| Metric | Score |
|---|---|
| AI_PROBABILITY | 85% |
| POLICY_COMPLIANCE | 60% |
| SLOP_SCORE | 75% |</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

2 issues found across 1 file (changes from recent commits).

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/debian_package_build.yml">

<violation number="1" location=".github/workflows/debian_package_build.yml:114">
P1: Custom agent: **Code Quality Guard**

**SLOP_SCORE: High** — The fallback logic silently disables *all* Debian patches (`debian/patches/series`) when the build fails, then retries. This is a dangerous "make CI green at any cost" anti-pattern that:

1. **Contradicts the PR's stated goal** of "100% fidelity with Debian's actual build process."
2. **May skip security/compatibility patches** that Debian maintainers applied intentionally.
3. **Masks real build failures** — the failure may not be patch-related at all, yet the retry will still proceed without patches.
4. **Comment is misleading** — says "Disable patches that fail to apply" but disables ALL patches indiscriminately.

If a build fails, the workflow should fail clearly so the issue can be investigated. If patches need selective handling, use `quilt push -a --fuzz=0` to identify and report the specific failing patch rather than blanket-disabling everything.</violation>

<violation number="2" location=".github/workflows/debian_package_build.yml:121">
P1: The retry build uses `--no-pre-clean`, so stale artifacts from the failed first build attempt persist into the second attempt. This can produce corrupted or inconsistent packages. Either remove `--no-pre-clean` from the retry call (so `debian/rules clean` runs), or explicitly clean the build tree before retrying.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}