fix(ci): Add workflow_call trigger to enable reusable workflows

- build-packages.yml: Add workflow_call with secrets
- build-image.yml: Add workflow_call with inputs, fix matrix for all event types
- publish-packages.yml: Add workflow_call with inputs and secrets

This fixes the release.yml workflow which was failing because it tried
to call these workflows as reusable workflows without the workflow_call
trigger defined.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.github/workflows/build-image.yml

@@ -1,6 +1,21 @@
 name: Build SecuBox System Images
 
 on:
+  workflow_call:
+    inputs:
+      board:
+        description: 'Target board'
+        required: false
+        type: string
+        default: 'all'
+      size:
+        description: 'Image size'
+        required: false
+        type: string
+        default: '8G'
+    secrets:
+      GPG_PRIVATE_KEY:
+        required: false
   workflow_dispatch:
     inputs:
       board:
@@ -33,7 +48,8 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        board: ${{ github.event_name == 'push' && fromJson('["mochabin","espressobin-v7","espressobin-ultra","vm-x64"]') || (github.event.inputs.board == 'all' && fromJson('["mochabin","espressobin-v7","espressobin-ultra","vm-x64"]') || fromJson(format('["{0}"]', github.event.inputs.board))) }}
+        # Handle all event types: push (tags), workflow_call, workflow_dispatch
+        board: ${{ (github.event_name == 'push' || (inputs.board == 'all' || inputs.board == '')) && fromJson('["mochabin","espressobin-v7","espressobin-ultra","vm-x64"]') || (github.event.inputs.board == 'all' && fromJson('["mochabin","espressobin-v7","espressobin-ultra","vm-x64"]') || fromJson(format('["{0}"]', inputs.board || github.event.inputs.board || 'vm-x64'))) }}
 
     steps:
       - name: Checkout
@@ -80,7 +96,7 @@ jobs:
             --board ${{ matrix.board }} \
             --suite ${{ env.DEBIAN_SUITE }} \
             --out output/ \
-            --size ${{ github.event.inputs.size || '8G' }}
+            --size ${{ inputs.size || github.event.inputs.size || '8G' }}
           sudo chown -R $(id -u):$(id -g) output/
         timeout-minutes: 90
 

.github/workflows/build-packages.yml

@@ -6,6 +6,14 @@ on:
     tags: ['v*']
   pull_request:
     branches: [main, master]
+  workflow_call:
+    secrets:
+      GPG_PRIVATE_KEY:
+        required: false
+      DEPLOY_SSH_KEY:
+        required: false
+      DEPLOY_KNOWN_HOSTS:
+        required: false
   workflow_dispatch:
     inputs:
       package:

.github/workflows/publish-packages.yml

@@ -3,6 +3,20 @@
 name: Publish Packages
 
 on:
+  workflow_call:
+    inputs:
+      distribution:
+        description: 'Target distribution'
+        required: false
+        type: string
+        default: 'bookworm'
+    secrets:
+      GPG_PRIVATE_KEY:
+        required: true
+      DEPLOY_SSH_KEY:
+        required: true
+      DEPLOY_KNOWN_HOSTS:
+        required: true
   workflow_run:
     workflows: ["Build SecuBox .deb packages"]
     types: [completed]