Build and push nightly packages

[legoktm]

Status

Ready for review

Description

As part of our monorepo consolidation, we're moving the nightly package building from the securedrop-builder repository to here. The overall process is the same, we build the packages for bullseye and bookworm, then push buildinfo files and then push debs.

Some changes:

• nightlies will not be pushed if the bookworm job fails. This is largely to simplify the configuration and also because we're going to move to bookworm pretty soon.
• Authentication will be done via a GitHub token, which will be configured by infra.
• Running clean-old-packages will happen via the securedrop-apt-test repository itself instead of during nightly builds.

Fixes #1776.

Test Plan

• Visual review
• See successful test run at https://github.com/freedomofpress/securedrop-client/actions/runs/7800588879/job/21273810560 -> freedomofpress/securedrop-apt-test@3b5de76 + freedomofpress/build-logs@6520c9b

[rocodes]

Thanks so much @legoktm this is great. Just documenting for our future selves: the desired behaviour is to hold back all the day's packages if there's one that fails to build, yes? Is that true on bookworm and bullseye? Seems sensible in terms of keeping machines in sync, but definitely means we have to be proactive about flaky CI and failures in component repos (also desirable)

I was mildly confused about the usage of the builder repo, per my inline comment, but it makes sense (and not to be a monster but it makes me want to rename it to securedrop-localwheels or something)

[rocodes]

LGTM, based on visual review and reviewing github workflow output. Left a couple of clarifying comments/questions just for future searchability.

[legoktm]

the desired behaviour is to hold back all the day's packages if there's one that fails to build, yes? Is that true on bookworm and bullseye

Yes. Previously the behavior was if any bullseye build failed, all nightlies would be held up. But if any bookworm build failed, the bullseye nightlies would still be pushed. This made sense when we first implemented it because bookworm hadn't been released yet so build failures weren't unexpected and also we were pretty far away.

Now if any build, across either bullseye or bookworm fails, none of the nightlies will fail. I think this is reasonable since bullseye is stable and we're pretty close, relatively, to moving to it. I think if we added trixie CI post-bookworm, we'd want to have it be non-blocking as well.

but definitely means we have to be proactive about flaky CI and failures in component repos (also desirable)

Yep, there's also an icinga check for new nightlies as well.