ci: publish secure multiarch releases

.github/workflows/ci.yml

@@ -1,31 +1,59 @@
-name: CI Pipeline for ghostcript-printer-app
+name: CI
 
 on:
   push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - main
+    branches: [main]
+  pull_request: {}
   workflow_dispatch:
+concurrency:
+  group: "${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}"
+  cancel-in-progress: true
+
+
+permissions: {}
 
 jobs:
-  build-rock:
-    runs-on: ubuntu-22.04
+  build-fsdk:
+    name: FSDK (${{ matrix.arch }})
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: x86_64
+            runner: ubuntu-24.04
+          - arch: aarch64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 360
+    permissions:
+      contents: read
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Pack with Rockcraft
-        uses: canonical/craft-actions/rockcraft-pack@main
-        id: rockcraft
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: taiki-e/install-action@d438492cf8a250514fa2d34b30bc3c0dc37c65ff # v2
+        with:
+          tool: just
+      - name: Install host dependencies
+        run: sudo apt-get update && sudo apt-get install --yes fuse3 podman
+      - name: Fetch sources with retries
+        run: just fetch
+      - name: Build and verify FSDK appliance
+        run: just verify
 
   build-snap:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Build Snap Package
-        uses: snapcore/action-build@v1
-        id: snapcraft
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Build Snap package
+        id: snapcraft
+        continue-on-error: true
+        uses: snapcore/action-build@3bdaa03e1ba6bf59a65f84a751d943d549a54e79 # v1
+      - name: Retry Snap build after transient failure
+        if: steps.snapcraft.outcome == 'failure'
+        uses: snapcore/action-build@3bdaa03e1ba6bf59a65f84a751d943d549a54e79 # v1