Factor out apt .sources generation and consolidate metadata artifact

Address review feedback on the sources/metadata generation:

- Extract the deb822 .sources stanza generation into lib/sources-common.sh
  and source it from both generate-sources-tar and generate-step-summary, so
  the machine-readable artifacts and the human-facing summary can no longer
  drift apart. The stanza now lists all components (main contrib non-free
  non-free-firmware), tracking e68a692.
- generate-sources-tar now emits the baseline .sources for the resolved target
  workspace (qli or qli-staging) via DEBUSINE_TARGET_WORKSPACE, incorporating
  the qli-staging support from 7d6fd1b, instead of a hardcoded qli.sources.
- Rename the metadata.json "package" key to "source-package" to disambiguate
  from binary packages.
- Consolidate the two upload steps into a single artifact named "metadata"
  containing the .sources files and metadata.json.

Signed-off-by: Vedant Rokad <vrokad@qti.qualcomm.com>

Author: vrokad

.github/workflows/debusine.yml

@@ -267,26 +267,20 @@ jobs:
           DEBUSINE_USER: ${{ secrets.DEBUSINE_USER }}
           DEBUSINE_TOKEN: ${{ secrets.DEBUSINE_TOKEN }}
           DEBUSINE_WORKSPACE: ${{ steps.build.outputs.workspace }}
+          DEBUSINE_TARGET_WORKSPACE: ${{ needs.resolve.outputs.debusine_target_workspace }}
           SUITE: ${{ needs.resolve.outputs.suite }}
           SRCPKG_NAME: ${{ needs.source-package.outputs.srcpkg_name }}
           SRCPKG_VERSION: ${{ needs.source-package.outputs.srcpkg_version }}
         run: |
           debusine-action/lib/generate-sources-tar
 
-      - name: Upload sources files
+      - name: Upload metadata
         uses: actions/upload-artifact@v7
         with:
-          name: qli-apt-sources
+          name: metadata
           path: |
-            qli.sources
-            qli-ci.sources
-          if-no-files-found: error
-
-      - name: Upload sources metadata
-        uses: actions/upload-artifact@v7
-        with:
-          name: sources-metadata
-          path: metadata.json
+            *.sources
+            metadata.json
           if-no-files-found: error
 
   release:

lib/generate-sources-tar

@@ -6,11 +6,15 @@ set -ex
 
 # Run on the host
 
-# Emits the real qli and qli-ci apt .sources files plus a separate structured
-# metadata.json, so that a downstream consumer (e.g. a Coral workflow) can
-# download them and copy the .sources files straight onto the target system
-# (into /etc/apt/sources.list.d/) without parsing JSON or scraping the
-# human-facing step summary.
+# Emits the real baseline (qli/qli-staging) and qli-ci apt .sources files plus a
+# separate structured metadata.json, so that a downstream consumer (e.g. a Coral
+# workflow) can download them and copy the .sources files straight onto the
+# target system (into /etc/apt/sources.list.d/) without parsing JSON or scraping
+# the human-facing step summary.
+
+# The .sources stanzas are generated by lib/sources-common.sh, which is also
+# used by generate-step-summary so the artifacts and the human-facing
+# instructions stay in sync.
 
 # Dependencies:
 #   ca-certificates and curl packages: when you run this script
@@ -23,37 +27,19 @@ set -ex
 #   DEBUSINE_USER
 #   DEBUSINE_TOKEN
 #   DEBUSINE_WORKSPACE
+#   DEBUSINE_TARGET_WORKSPACE
 #   SUITE
 #   SRCPKG_NAME
 #   SRCPKG_VERSION
 
 # Outputs:
-#   qli.sources, qli-ci.sources: apt .sources files
-#   metadata.json: standalone JSON describing the package/version/suite
-
-qli_uri="https://deb.${DEBUSINE_HOST}/${DEBUSINE_SCOPE}/qli/"
-ci_uri="https://deb.${DEBUSINE_HOST}/${DEBUSINE_SCOPE}/${DEBUSINE_WORKSPACE}/"
+#   ${DEBUSINE_TARGET_WORKSPACE}.sources, qli-ci.sources: apt .sources files
+#   metadata.json: standalone JSON describing the source package/version/suite
 
-qli_public_key=$(curl -fsSu "${DEBUSINE_USER}:${DEBUSINE_TOKEN}" "${qli_uri}signing-keys.asc"|sed -e 's/^$/./;s/^/ /')
-ci_public_key=$(curl -fsSu "${DEBUSINE_USER}:${DEBUSINE_TOKEN}" "${ci_uri}signing-keys.asc"|sed -e 's/^$/./;s/^/ /')
+. "$(dirname "$0")/sources-common.sh"
 
-cat > qli.sources <<END
-Types: deb deb-src
-URIs: ${qli_uri}
-Suites: ${SUITE}
-Components: main
-Signed-By:
-${qli_public_key}
-END
-
-cat > qli-ci.sources <<END
-Types: deb deb-src
-URIs: ${ci_uri}
-Suites: ${SUITE}
-Components: main
-Signed-By:
-${ci_public_key}
-END
+emit_sources "${DEBUSINE_TARGET_WORKSPACE}" > "${DEBUSINE_TARGET_WORKSPACE}.sources"
+emit_sources "${DEBUSINE_WORKSPACE}" > qli-ci.sources
 
 SRCPKG_NAME="$SRCPKG_NAME" SRCPKG_VERSION="$SRCPKG_VERSION" SUITE="$SUITE" \
 python3 - metadata.json <<'PY'
@@ -62,7 +48,7 @@ import os
 import sys
 
 data = {
-    "package": os.environ["SRCPKG_NAME"],
+    "source-package": os.environ["SRCPKG_NAME"],
     "version": os.environ["SRCPKG_VERSION"],
     "suite": os.environ["SUITE"],
 }
@@ -71,4 +57,3 @@ with open(sys.argv[1], "w") as f:
     json.dump(data, f, indent=2)
     f.write("\n")
 PY
-

lib/generate-step-summary

@@ -28,15 +28,17 @@ set -ex
 
 : ${GITHUB_STEP_SUMMARY:=/dev/null}
 
+. "$(dirname "$0")/sources-common.sh"
+
 if [ "${BUILD_RESULT}" = "success" ]; then
     build_status="successful"
 else
     build_status="failed"
 fi
 
 if [ "${BUILD_RESULT}" = "success" ]; then
-    target_public_key=$(curl -fsSu "${DEBUSINE_USER}:${DEBUSINE_TOKEN}" "https://deb.${DEBUSINE_HOST}/${DEBUSINE_SCOPE}/${DEBUSINE_TARGET_WORKSPACE}/signing-keys.asc"|sed -e 's/^$/./;s/^/ /')
-    ci_public_key=$(curl -fsSu "${DEBUSINE_USER}:${DEBUSINE_TOKEN}" "https://deb.${DEBUSINE_HOST}/${DEBUSINE_SCOPE}/${DEBUSINE_WORKSPACE}/signing-keys.asc"|sed -e 's/^$/./;s/^/ /')
+    target_sources=$(emit_sources "${DEBUSINE_TARGET_WORKSPACE}")
+    ci_sources=$(emit_sources "${DEBUSINE_WORKSPACE}")
 fi
 
 cat > "$GITHUB_STEP_SUMMARY" <<END2
@@ -66,24 +68,14 @@ END
 ## Create \`${DEBUSINE_TARGET_WORKSPACE}.sources\` for baseline apt repository access
 \`\`\`
 sudo sh -c 'cat > /etc/apt/sources.list.d/${DEBUSINE_TARGET_WORKSPACE}.sources' <<END
-Types: deb deb-src
-URIs: https://deb.${DEBUSINE_HOST}/${DEBUSINE_SCOPE}/${DEBUSINE_TARGET_WORKSPACE}/
-Suites: ${SUITE}
-Components: main contrib non-free non-free-firmware
-Signed-By:
-${target_public_key}
+${target_sources}
 END
 \`\`\`
 
 ## Create \`qli-ci.sources\` for build-specific apt repository access
 \`\`\`
 sudo sh -c 'cat > /etc/apt/sources.list.d/qli-ci.sources' <<END
-Types: deb deb-src
-URIs: https://deb.${DEBUSINE_HOST}/${DEBUSINE_SCOPE}/${DEBUSINE_WORKSPACE}/
-Suites: ${SUITE}
-Components: main contrib non-free non-free-firmware
-Signed-By:
-${ci_public_key}
+${ci_sources}
 END
 \`\`\`
 END2

lib/sources-common.sh

@@ -0,0 +1,33 @@
+# Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+# SPDX-License-Identifier: BSD-3-Clause-Clear
+# shellcheck shell=sh
+
+# Shared helper for generating apt .sources stanzas, sourced by
+# generate-sources-tar (which writes them to files for artifact upload) and
+# generate-step-summary (which embeds them in the human-facing summary). Keeping
+# a single implementation ensures the machine-readable artifacts and the
+# instructions shown to users never drift apart.
+
+# Inputs (from the environment):
+#   DEBUSINE_HOST
+#   DEBUSINE_SCOPE
+#   DEBUSINE_USER
+#   DEBUSINE_TOKEN
+#   SUITE
+
+# emit_sources WORKSPACE
+# Prints an apt deb822 .sources stanza for the given Debusine workspace to
+# stdout, embedding that workspace's signing key.
+emit_sources() {
+	_workspace="$1"
+	_uri="https://deb.${DEBUSINE_HOST}/${DEBUSINE_SCOPE}/${_workspace}/"
+	_public_key=$(curl -fsSu "${DEBUSINE_USER}:${DEBUSINE_TOKEN}" "${_uri}signing-keys.asc"|sed -e 's/^$/./;s/^/ /')
+	cat <<END
+Types: deb deb-src
+URIs: ${_uri}
+Suites: ${SUITE}
+Components: main contrib non-free non-free-firmware
+Signed-By:
+${_public_key}
+END
+}