ci: add gated arm64 (.deb) release leg to debian-hll (hll -> citusdata/community)

.github/workflows/build-package.yml

@@ -16,7 +16,8 @@ on:
 jobs:
   build_package:
     name: Build package
-    runs-on: ubuntu-latest
+    # arm64 legs run on native ARM64 runners; amd64 stays on ubuntu-latest.
+    runs-on: ${{ matrix.arch == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
     strategy:
       fail-fast: false
       matrix:
@@ -26,6 +27,9 @@ jobs:
           - debian/trixie
           - ubuntu/jammy
           - ubuntu/noble
+        # arm64 debs are gated behind the DEB_BUILD_MULTI_ARCH repo variable
+        # (default OFF -> amd64 only, so the existing release pipeline is unchanged).
+        arch: ${{ fromJSON(vars.DEB_BUILD_MULTI_ARCH == 'true' && '["amd64", "arm64"]' || '["amd64"]') }}
 
     steps:
       - name: Checkout repository
@@ -51,6 +55,32 @@ jobs:
       - name: Install python requirements
         run: python -m pip install -r tools/packaging_automation/requirements.txt
 
+      # The arm64 builder/signer images are not published to Docker Hub yet, so
+      # build them natively in-job by cloning develop's tooling (this branch has
+      # none). "docker run" prefers a local image, so citus_package picks these up
+      # automatically; amd64 keeps pulling the published images from Docker Hub.
+      - name: Login to Docker Hub
+        if: matrix.arch == 'arm64'
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USER_NAME }}
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
+      - name: Build arm64 builder image
+        if: matrix.arch == 'arm64'
+        run: |
+          git clone -b develop --depth=1 https://github.com/citusdata/packaging.git tooling
+          cd tooling
+          export TEST=false
+          export TARGET_PLATFORM="${PLATFORM/\//,}"
+          ./update_image
+        env:
+          PLATFORM: ${{ matrix.platform }}
+
+      - name: Build arm64 debsigner image
+        if: matrix.arch == 'arm64'
+        run: docker build -t citusdata/packaging:debsigner -f tooling/dockerfiles/debsigner/Dockerfile tooling
+
       - name: Build packages
         run: |
           python -m  tools.packaging_automation.citus_package \