ci: trigger rpm/deb deployment via trivy-repo workflow (aquasecurity#10476)

Author: DmitriyLewen

.github/workflows/release.yaml

@@ -21,56 +21,22 @@ jobs:
       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
 
   deploy-packages:
-    name: Deploy rpm/dep packages
+    name: Deploy rpm/deb packages
     needs: release # run this job after 'release' job completes
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-2404-2core
     steps:
-      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      # Cache is keyed by github.sha and scoped to tag-push events triggered by maintainers only.
-      # Cache is written exclusively by the release job (reusable-release.yaml) on the same
-      # tag-push event. Only maintainers can push tags, so external contributors cannot influence
-      # the cache contents. The key includes github.sha to prevent collisions across runs.
-      - name: Restore Trivy binaries from cache
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 # zizmor: ignore[cache-poisoning]
-        with:
-          path: dist/
-          key: ${{ runner.os }}-bins-${{github.workflow}}-${{github.sha}}
-
-      - name: Install dependencies
-        run: |
-          sudo apt-get -y update
-          sudo apt-get -y install rpm reprepro createrepo-c distro-info
-
-      - name: Checkout trivy-repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          repository: ${{ github.repository_owner }}/trivy-repo
-          path: trivy-repo
-          token: ${{ secrets.ORG_REPO_TOKEN }}
-          persist-credentials: true # deploy-rpm.sh and deploy-deb.sh run git push
-
-      - name: Setup git settings
+      - name: Trigger deploy-packages workflow in trivy-repo
+        env:
+          GH_TOKEN: ${{ secrets.TRIVY_WORKFLOW_TRIGGER_TOKEN }}
         run: |
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git config --global user.name "github-actions[bot]"
-
-      - name: Create rpm repository
-        run: ci/deploy-rpm.sh
-
-      - name: Import GPG key
-        run: echo -e "${{ secrets.GPG_KEY }}" | gpg --import
-
-      - name: Create deb repository
-        run: ci/deploy-deb.sh
+          gh workflow run deploy-packages.yml \
+            --repo "$GITHUB_REPOSITORY_OWNER/trivy-repo" \
+            --ref main \
+            --field "version=$GITHUB_REF_NAME"
 
   # `update-chart-version` creates a new PR for updating the helm chart
   update-chart-version:
-    needs: deploy-packages
+    needs: release
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
@@ -99,7 +65,7 @@ jobs:
 
   # `trigger-version-update` triggers workflows in the `aqua` repositories to update the Trivy version.
   trigger-version-update:
-    needs: deploy-packages
+    needs: release
     runs-on: ubuntu-22.04
     steps:
       - name: Trigger update_version workflow in trivy-telemetry