Adding publish-rpm-repository action/workflow

[alexlovelltroy]

Description

This pull request introduces a new reusable GitHub Action and workflow for securely publishing RPM repositories to S3, including robust documentation and CI enhancements. The main focus is on enabling safe, verifiable, and automated publication of signed RPM packages, with strong key management and metadata integrity guarantees. The changes add both the action implementation and comprehensive usage documentation, as well as integration into the CI pipeline for testing.

New RPM Repository Publication Action and Workflow

Major new features and documentation:

1. New reusable workflow and action for RPM repository publication

• Adds .github/workflows/publish-rpm-repository.yml and actions/publish-rpm-repository/action.yml to aggregate signed RPMs, generate and sign repository metadata, and publish to S3 with optional CloudFront invalidation. This includes concurrency controls, robust key handling, and a safe publication order to ensure metadata integrity. [1] [2]

2. Comprehensive documentation for the new publication process

• Documents the action and workflow in README.md and a dedicated actions/publish-rpm-repository/README.md, covering publication model, security, inputs/outputs, and client trust configuration. Usage examples and security best practices are included. [1] [2] [3] [4]

3. CI/CD and linting enhancements

• Updates .github/workflows/ci.yml to add a test-rpm-repository-publisher job that exercises the new publisher inside a container, and adds a new .github/actionlint.yaml to suppress false positives for workflow-specific properties. [1] [2]

4. Security and compliance

• All new files include SPDX copyright and license headers, ensuring compliance and traceability. [1] [2] [3] [4]

5. README enhancements and cross-linking

• Updates action and workflow listings in README.md for discoverability, and adds cross-references between documentation files for easier navigation. [1] [2] [3]

These changes collectively provide a robust, auditable, and easy-to-use solution for publishing signed RPM repositories in a secure and automated fashion, with clear guidance for both direct and workflow-based usage.

Checklist

• My code follows the style guidelines of this project
• I have added/updated comments where needed
• I have added tests that prove my fix is effective or my feature works
• I have run make test (or equivalent) locally and all tests pass
• I have updated the relevant documentation (CLI examples, man pages, README, other docs, etc.)
• DCO Sign-off: All commits are signed off (git commit -s) with my real name and email
• REUSE Compliance:
  • Each new/modified source file has SPDX copyright and license headers
  • Any non-commentable files include a <filename>.license sidecar
  • All referenced licenses are present in the LICENSES/ directory

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Dependency update

---

For more info, see Contributing Guidelines.