ci: reproducible builds/refactor (#5808)

* ci: reproducible builds/refactor

* ci: fix mac desktop upload

* ci: docker shell abort on error

* scripts: add reproduce script

* ci: add new reproduce workflow

* scripts/reproduce-builds: change repo back to official

.github/actions/prepare-build/action.yml

@@ -0,0 +1,52 @@
+name: "Prebuilt steps for build"
+description: "Reusable steps for multiple jobs"
+inputs:
+   java_ver:
+     required: true
+     description: "Java version to install"
+   ghc_ver:
+     required: true
+     description: "GHC version to install"
+   github_ref:
+     required: true
+     description: "Git reference"
+   os:
+     required: true
+     description: "Target OS"
+   cache_path:
+     required: false
+     default: "~/.cabal/store"
+     description: "Cache path"
+   cabal_ver:
+     required: false
+     default: 3.10.1.0
+     description: "GHC version to install"
+runs:
+  using: "composite"
+  steps:
+    - name: Skip unreliable ghc 8.10.7 build on stable branch
+      shell: bash
+      if: inputs.ghc_ver == '8.10.7' && inputs.github_ref == 'refs/heads/stable'
+      run: exit 0
+
+    - name: Setup Haskell
+      uses: simplex-chat/setup-haskell-action@v2
+      with:
+        ghc-version: ${{ inputs.ghc_ver }}
+        cabal-version: ${{ inputs.cabal_ver }}
+
+    - name: Setup Java
+      if: startsWith(inputs.github_ref, 'refs/tags/v')
+      uses: actions/setup-java@v3
+      with:
+        distribution: 'corretto'
+        java-version: ${{ inputs.java_ver }}
+        cache: 'gradle'
+
+    - name: Restore cached build
+      uses: actions/cache@v4
+      with:
+        path: |
+          ${{ inputs.cache_path }}
+          dist-newstyle
+        key: ${{ inputs.os }}-ghc${{ inputs.ghc_ver }}-${{ hashFiles('cabal.project', 'simplex-chat.cabal') }}

.github/actions/prepare-release/action.yml

@@ -0,0 +1,39 @@
+name: "Upload binary and update hash"
+description: "Reusable steps for multiple jobs"
+inputs:
+   bin_path:
+     required: true
+     description: "Path to binary to upload"
+   bin_name:
+     required: true
+     description: "Name of uploaded binary"
+   bin_hash:
+     required: true
+     description: "Message with SHA to include in release"
+   github_ref:
+     required: true
+     description: "Github reference"
+   github_token:
+     required: true
+     description: "Github token"
+runs:
+  using: "composite"
+  steps:
+    - name: Linux upload AppImage to release
+      if: startsWith(inputs.github_ref, 'refs/tags/v')
+      uses: simplex-chat/upload-release-action@v2
+      with:
+        repo_token: ${{ inputs.github_token }}
+        file: ${{ inputs.bin_path }}
+        asset_name: ${{ inputs.bin_name }}
+        tag: ${{ inputs.github_ref }}
+
+    - name: Linux update AppImage hash
+      if: startsWith(inputs.github_ref, 'refs/tags/v')
+      uses: simplex-chat/action-gh-release@v2
+      env:
+        GITHUB_TOKEN: ${{ inputs.github_token }}
+      with:
+        append_body: true
+        body: |
+          ${{ inputs.bin_hash }}