[WIP] Fix release pipeline to trigger Build and Release job reliably (#276)

* Initial plan

* fix: convert release.yml to reusable workflow, call it directly from create-release-tag.yml

Co-authored-by: Meliox <5264368+Meliox@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Meliox <5264368+Meliox@users.noreply.github.com>

.github/workflows/create-release-tag.yml

@@ -1,8 +1,9 @@
 name: Tag Release
 
 # Triggered when the chore/version-bump PR is merged to main.
-# debian/changelog is already on main from the merged PR — just create the tag.
+# debian/changelog is already on main from the merged PR — just create the tag,
-# release.yml triggers on the tag push and builds the release.
+# then directly invoke the Build and Release reusable workflow.
+# Using workflow_call avoids relying on GitHub tag-push event delivery.
 
 on:
   pull_request:
@@ -20,6 +21,8 @@ jobs:
     if: |
       github.event.pull_request.merged == true &&
       github.event.pull_request.head.ref == 'chore/version-bump'
+    outputs:
+      tag: ${{ steps.create_tag.outputs.tag }}
 
     steps:
       - uses: actions/checkout@v7
@@ -28,9 +31,18 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Create and push tag
+        id: create_tag
         run: |
           VERSION=$(grep -m1 '(' debian/changelog | sed 's/.*(\(.*\)).*/\1/')
           git config user.name  "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git tag "v${VERSION}"
           git push origin "v${VERSION}"
+          echo "tag=v${VERSION}" >> "$GITHUB_OUTPUT"
+
+  build-and-release:
+    needs: tag
+    uses: ./.github/workflows/release.yml
+    with:
+      tag: ${{ needs.tag.outputs.tag }}
+    secrets: inherit

.github/workflows/release.yml

@@ -1,12 +1,22 @@
 name: Build and Release
 
-# Triggered when version-bump.yml pushes a vX.Y.Z tag.
+# Reusable workflow called by create-release-tag.yml after the tag is pushed.
 # Builds the .deb, signs it, and publishes a GitHub Release.
+# Can also be triggered manually via workflow_dispatch for re-runs.
 
 on:
-  push:
+  workflow_call:
-    tags:
+    inputs:
-      - 'v*'
+      tag:
+        description: "The vX.Y.Z tag that was just pushed"
+        required: true
+        type: string
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "The vX.Y.Z tag to release (e.g. v1.0.2)"
+        required: true
+        type: string
 
 permissions:
   contents: write
@@ -14,12 +24,11 @@ permissions:
 jobs:
   release:
     runs-on: ubuntu-latest
-    if: github.actor == 'github-actions[bot]'
 
     steps:
       - uses: actions/checkout@v7
         with:
-          ref: ${{ github.ref }}
+          ref: ${{ inputs.tag }}
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
 
@@ -28,7 +37,7 @@ jobs:
         run: |
           VERSION=$(grep -m1 '(' debian/changelog | sed 's/.*(\(.*\)).*/\1/')
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-          echo "tag=v$VERSION"    >> "$GITHUB_OUTPUT"
+          echo "tag=${{ inputs.tag }}" >> "$GITHUB_OUTPUT"
 
       - name: Install build dependencies
         run: |
@@ -85,15 +94,6 @@ jobs:
           ' debian/changelog | grep '^\s*\*' | sed 's/^\s*\* /- /' > /tmp/notes.md
           [[ -s /tmp/notes.md ]] || echo "- Automated release." > /tmp/notes.md
 
-      - name: Create Git tag
-        env:
-          TAG: ${{ steps.version.outputs.tag }}
-        run: |
-          git config user.name  "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git tag "$TAG"
-          git push origin "$TAG"
-
       - name: Collect release assets
         id: assets
         run: |