Add a new job running lintian on binary packages

Signed-off-by: Dylan Aïssi <dylan.aissi@collabora.com>

README.md

@@ -297,3 +297,15 @@ instead of Buster
       $ git push origin ${PROPOSED_BRANCH}:${PROPOSED_BRANCH}
 
   Follow the instructions provided by the above command to create a merge request
+
+# Enable lintian job for a specific package
+
+To enable the lintian job for a specific package, you just need
+to create a `debian/apertis/lintian` file in your package repository.
+
+      $ touch debian/apertis/lintian
+      $ git add debian/apertis/lintian
+      $ git commmit -m "Add debian/apertis/lintian to enable lintian for my package"
+
+The `ci-package-builder` will check the presence of this file and will enable
+the lintian job if this file is present.

ci-package-builder.yml

@@ -159,6 +159,7 @@ stages:
   - upload
   - OBS
   - abi-checker
+  - lintian
   - cleanup
 
 prepare-build-env:
@@ -943,6 +944,56 @@ abi-checker:
         - debian/apertis/abi-compare
       when: on_success
 
+lintian:
+  stage: lintian
+  dependencies:
+    - prepare-build-env
+  script:
+    # Retrieve again new binary packages from OBS.
+    # They are already captured as artifacts but in a child pipeline that prevents
+    # us to directly use them. See https://gitlab.com/gitlab-org/gitlab/-/issues/285100
+    # So, we need to download them from OBS or use the GitLab API to retrieve them
+    # from the child pipeline. Using the GitLab API requires to use project tokens which
+    # is not a problem for Apertis, but would require adjustments for Apertis derivatives.
+    - LIST_ARCH_PKGS=arch_built.txt
+    - |
+      osc repositories "$PROJECT" "$PACKAGE" |
+        grep "^$OBS_REPOSITORIES" |
+        awk '{print $2}' > "$LIST_ARCH_PKGS"
+    - |
+      if [ -s "$LIST_ARCH_PKGS" ]
+      then
+        echo "🌟 OBS produced binary packages!"
+        echo "🔍 Lintian will check them!"
+      else
+        echo "🛑 OBS did not produce any binary packages!"
+        exit 1
+      fi
+    - |
+      while read -r ARCH
+      do
+        echo "🔍 Retrieving ${ARCH} binary packages from OBS:"
+        osc getbinaries -d "$ARCH" "$PROJECT" "$PACKAGE" "$OBS_REPOSITORIES" "$ARCH"
+      done < "$LIST_ARCH_PKGS"
+    - |
+      while read -r ARCH
+      do
+        echo "🔍 Running lintian on ${ARCH} packages:"
+        lintian --verbose --info --color always --show-overrides --fail-on error,warning ${ARCH}/*changes | tee lintian_results_${ARCH}.txt
+        echo -e "\n"
+      done < "$LIST_ARCH_PKGS"
+  artifacts:
+    paths:
+      - 'lintian_results_*.txt'
+    when: always
+    expire_in: 1 week
+  rules:
+    - *upload_rules
+    - if: $CI_COMMIT_BRANCH || $CI_MERGE_REQUEST_TARGET_BRANCH_NAME
+      exists:
+        - debian/apertis/lintian
+      when: on_success
+
 cleanup:
   stage: cleanup
   tags: