feat(build): trigger COPR RPM builds on release

Add a least-privilege reusable workflow that validates release versions and assets before requesting a COPR build. Keep dry runs side-effect free, send the exact release metadata as JSON, wait for application publishing when selected, and include RPM status in the release result.

.github/workflows/build-rpm.yml

@@ -0,0 +1,72 @@
+name: Trigger RPM Build
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        required: true
+        type: string
+      dry_run:
+        required: true
+        type: boolean
+    secrets:
+      COPR_BUILD_WEBHOOK_URL:
+        required: false
+
+permissions: {}
+
+jobs:
+  trigger_copr:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Validate release version
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          if [[ ! "$VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Invalid release version: $VERSION"
+            exit 1
+          fi
+
+      - name: Print dry-run request
+        if: ${{ inputs.dry_run }}
+        env:
+          VERSION: ${{ inputs.version }}
+        run: echo "Would request the COPR build for $VERSION."
+
+      - name: Verify release assets
+        if: ${{ !inputs.dry_run }}
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          curl --fail --silent --show-error --location --head \
+            --proto '=https' --proto-redir '=https' \
+            --connect-timeout 15 --max-time 60 \
+            "https://github.com/$GITHUB_REPOSITORY/releases/download/$VERSION/artalk_ui.tar.gz"
+
+      - name: Trigger Copr Build Webhook
+        if: ${{ !inputs.dry_run }}
+        env:
+          COPR_BUILD_WEBHOOK_URL: ${{ secrets.COPR_BUILD_WEBHOOK_URL }}
+          VERSION: ${{ inputs.version }}
+        run: |
+          if [[ -z "$COPR_BUILD_WEBHOOK_URL" ]]; then
+            echo "COPR_BUILD_WEBHOOK_URL is not configured."
+            exit 1
+          fi
+
+          payload="$(
+            jq -cn \
+              --arg repository "$GITHUB_REPOSITORY" \
+              --arg ref "refs/tags/$VERSION" \
+              --arg version "$VERSION" \
+              '{repository: $repository, ref: $ref, version: $version}'
+          )"
+          curl --fail-with-body --silent --show-error \
+            --proto '=https' \
+            --connect-timeout 15 --max-time 60 \
+            --header 'Content-Type: application/json' \
+            --request POST \
+            --data "$payload" \
+            "${COPR_BUILD_WEBHOOK_URL%/}/artalk/"

.github/workflows/build.yml

@@ -20,13 +20,16 @@ on:
         description: "Build items"
         type: choice
         options:
+          - "ui,app,docker,rpm"
           - "ui,app,docker"
           - "ui,app"
           - "ui,docker"
           - "app,docker"
+          - "app,rpm"
           - ui
           - app
           - docker
+          - rpm
         default: "ui,app,docker"
 
 permissions:
@@ -100,9 +103,25 @@ jobs:
     permissions:
       contents: write
 
+  # Build RPM
+  rpm:
+    if: |
+      always() &&
+      needs.tagging.result == 'success' &&
+      !contains(fromJSON('["failure", "cancelled"]'), needs.app.result) &&
+      (inputs.build_items == '' || contains(format(',{0},', inputs.build_items), ',rpm,'))
+    needs: [tagging, app]
+    uses: ./.github/workflows/build-rpm.yml
+    permissions: {}
+    with:
+      version: ${{ needs.tagging.outputs.version }}
+      dry_run: ${{ inputs.dry_run || false }}
+    secrets:
+      COPR_BUILD_WEBHOOK_URL: ${{ secrets.COPR_BUILD_WEBHOOK_URL }}
+
   # All builds are complete
   done:
-    needs: [tagging, ui, docker, app]
+    needs: [tagging, ui, docker, app, rpm]
     if: |
       always() &&
       needs.tagging.result == 'success' &&