release_draft.yaml

name: Release Draft
run-name: aws-advanced-odbc-wrapper Draft Release - ${{ github.ref_name }}

on:
  push:
    tags:
      - '[0-9]+.[0-9]+.[0-9]+'

permissions:
  id-token: write
  actions: write
  contents: write
  deployments: write
  packages: write
  pull-requests: write
  repository-projects: write

env:
  WIX_VERSION: 5.0.2
  BUILD_CONFIG: Release

jobs:
  build-windows:
    runs-on: windows-latest
    steps:
      - name: Checkout aws-advanced-odbc-wrapper
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - name: Resolve AWS SDK version
        id: aws-sdk-version
        shell: bash
        run: echo "tag=$(grep AWS_SDK_CPP_TAG scripts/compile_aws_sdk_win.ps1 | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)" >> "$GITHUB_OUTPUT"
      - name: Retrieve AWS SDK for C++ Cache
        id: cache-aws-sdk
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: aws_sdk/install
          key: ${{ runner.os }}-aws-sdk-cpp-${{env.BUILD_CONFIG}}-shared-${{ steps.aws-sdk-version.outputs.tag }}
      - name: Build AWS SDK for C++
        if: ${{steps.cache-aws-sdk.outputs.cache-hit != 'true'}}
        run: |
          ./scripts/compile_aws_sdk_win.ps1 ${{env.BUILD_CONFIG}}
      - name: Setup Dotnet for WiX
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
      - name: Install WiX
        shell: cmd
        run: |
          dotnet tool install --global wix --version ${{env.WIX_VERSION}}
          wix extension add --global WixToolset.UI.wixext/${{env.WIX_VERSION}}
      - name: Run build installer script
        shell: pwsh
        run: |
          ./installer/build_installer.ps1 ${{env.BUILD_CONFIG}}
      - name: Configure AWS credentials OIDC
        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6
        with:
          role-skip-session-tagging: true
          aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_DEPLOY_ROLE }}
          role-session-name: aws-odbc-win-signer
      - name: Configure AWS credentials Signer
        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6
        with:
          role-skip-session-tagging: true
          role-chaining: true
          aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
          role-to-assume: ${{ secrets.AWS_SIGNER_ROLE }}
          role-external-id: ${{ secrets.AWS_SIGNER_ROLE_ID }}
      - name: Run signer script
        shell: pwsh
        working-directory: ./scripts
        run: |
          choco upgrade jq -y
          . ".\sign_artifacts_win.ps1"
          Invoke-SignInstaller ../installer winx64a ${{ github.ref_name }} ${{ secrets.AWS_UNSIGNED_BUCKET }} ${{ secrets.AWS_SIGNED_BUCKET }} ${{ secrets.AWS_S3_KEY }}aws-advanced-odbc-wrapper-${{ github.ref_name }}-winx64a.msi
      - name: Upload installer
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: installers-windows
          path: ./installer/*winx64a.msi
          retention-days: 5
          if-no-files-found: error

  build-macos:
    runs-on: macos-15
    outputs:
      macos_arm64_ansi: ${{ steps.macos-arm64-ansi.outputs.hash }}
      macos_arm64_unicode: ${{ steps.macos-arm64-unicode.outputs.hash }}
    steps:
      - name: Checkout aws-advanced-odbc-wrapper
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - name: Install Build Dependencies
        run: |
          brew update && brew upgrade && brew cleanup
          brew install cmake unixodbc curl openssl@3 zlib icu4c
      - name: Resolve AWS SDK version
        id: aws-sdk-version
        shell: bash
        run: echo "tag=$(grep AWS_SDK_CPP_TAG scripts/compile_aws_sdk_unix.sh | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)" >> "$GITHUB_OUTPUT"
      - name: Retrieve AWS SDK for C++ Cache
        id: cache-aws-sdk
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: aws_sdk/install
          key: ${{ runner.os }}-aws-sdk-cpp-${{env.BUILD_CONFIG}}-shared-${{ steps.aws-sdk-version.outputs.tag }}
      - name: Build AWS SDK for C++
        if: ${{steps.cache-aws-sdk.outputs.cache-hit != 'true'}}
        run: |
          export SDKROOT="$(xcrun --sdk macosx --show-sdk-path)"
          ./scripts/compile_aws_sdk_unix.sh ${{env.BUILD_CONFIG}}
      - name: Build aws-advanced-odbc-wrapper
        run: |
          cmake -S . -B build -DCMAKE_BUILD_TYPE=${{env.BUILD_CONFIG}} -DBUILD_UNIT_TEST=OFF
          cmake --build build
          ls ./build/driver/
      - name: Check Artifacts
        shell: bash
        run:
          ls -l ${{ github.workspace }}/build/driver/
      - name: Install gnu-tar
        run: brew install gnu-tar
      - name: Configure AWS credentials OIDC
        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6
        with:
          role-skip-session-tagging: true
          aws-region: us-west-1
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_DEPLOY_ROLE }}
          role-session-name: aws-odbc-mac-signer
      - name: Configure AWS credentials Signer
        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6
        with:
          role-skip-session-tagging: true
          role-chaining: true
          aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
          role-to-assume: ${{ secrets.AWS_SIGNER_ROLE }}
          role-external-id: ${{ secrets.AWS_SIGNER_ROLE_ID }}
      - name: Sign macOS artifacts
        env:
          MAC_SIGNER_S3_BUCKET: ${{ secrets.AWS_MAC_SIGNER_S3_BUCKET }}
          MAC_SIGNER_PRESIGNED_PREFIX: ${{ secrets.AWS_MAC_SIGNER_PRESIGNED_PREFIX }}
          MAC_SIGNER_SIGNED_PREFIX: ${{ secrets.AWS_MAC_SIGNER_SIGNED_PREFIX }}
          MAC_SIGNER_DYLIBS_DIR: ${{ secrets.AWS_MAC_SIGNER_DYLIBS_DIR }}
          MAC_SIGNER_PKG_DIR: ${{ secrets.AWS_MAC_SIGNER_PKG_DIR }}
        run: |
          ./scripts/macOS/sign_artifacts_mac.sh ${{ github.ref_name }}
      - name: Upload the ANSI & Unicode driver
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: installers-macos
          path: |
            ${{ github.workspace }}/build/aws-advanced-odbc-wrapper-${{ github.ref_name }}-macos-arm64.pkg
          retention-days: 5
          if-no-files-found: error

  build-linux:
    runs-on: ubuntu-latest
    outputs:
      linux_x64_ansi: ${{ steps.linux-x64-ansi.outputs.hash }}
      linux_x64_unicode: ${{ steps.linux-x64-unicode.outputs.hash }}
    steps:
      - name: Checkout aws-advanced-odbc-wrapper
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - name: Install Build Dependencies
        run: |
          sudo apt-get update
          sudo apt-get install cmake libcurl4-openssl-dev libssl-dev odbcinst unixodbc-dev uuid-dev zlib1g-dev
      - name: Resolve AWS SDK version
        id: aws-sdk-version
        shell: bash
        run: echo "tag=$(grep AWS_SDK_CPP_TAG scripts/compile_aws_sdk_unix.sh | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)" >> "$GITHUB_OUTPUT"
      - name: Retrieve AWS SDK for C++ Cache
        id: cache-aws-sdk
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: aws_sdk/install
          key: ${{ runner.os }}-aws-sdk-cpp-${{env.BUILD_CONFIG}}-shared-${{ steps.aws-sdk-version.outputs.tag }}
      - name: Build AWS SDK for C++
        if: ${{steps.cache-aws-sdk.outputs.cache-hit != 'true'}}
        run: |
          ./scripts/compile_aws_sdk_unix.sh ${{env.BUILD_CONFIG}}
      - name: Build aws-advanced-odbc-wrapper
        run: |
          cmake -S . -B build -DCMAKE_BUILD_TYPE=${{env.BUILD_CONFIG}} -DBUILD_UNIT_TEST=OFF
          cmake --build build
          ls ./build/driver/
      - name: Get Ansi Driver Hash
        id: linux-x64-ansi
        run: |
          hash=$(sha256sum ${{ github.workspace }}/build/driver/aws-advanced-odbc-wrapper-a.so | cut -d' ' -f1)
          echo "hash=${hash}" >> "$GITHUB_OUTPUT"
          echo ${HASH}
      - name: Get Unicode Driver Hash
        id: linux-x64-unicode
        run: |
          hash=$(sha256sum ${{ github.workspace }}/build/driver/aws-advanced-odbc-wrapper-w.so | cut -d' ' -f1)
          echo "hash=${hash}" >> "$GITHUB_OUTPUT"
          echo ${HASH}
      - name: Move Artifacts
        shell: bash
        run: |
          mkdir stage
          find ${{ github.workspace }}/build/driver/ -name "*.so*" -exec cp {} ${{ github.workspace }}/stage \;
      - name: Package Drivers as Tar
        shell: bash
        run: |
          ls stage
          cd stage
          tar -chf "aws-advanced-odbc-wrapper-${{ github.ref_name }}-linux-x64.tar.gz" --gzip *
      - name: Upload the ANSI & Unicode driver
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: installers-linux
          path: |
            ./stage/aws-advanced-odbc-wrapper-${{ github.ref_name }}-linux-x64.tar.gz
          retention-days: 5
          if-no-files-found: error

  draft-release:
    name: Create Draft Release
    runs-on: ubuntu-latest
    needs: [
      build-linux,
      build-macos,
      build-windows
    ]
    env:
      linux_x64_ansi_hash: ${{needs.build-linux.outputs.linux_x64_ansi}}
      linux_x64_unicode_hash: ${{needs.build-linux.outputs.linux_x64_unicode}}
    steps:
      - name: Checkout aws-advanced-odbc-wrapper
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 1
      - name: Download all installers
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          path: installers
          pattern: installers-*
          merge-multiple: true
      - name: Extract release notes
        uses: ffurrer2/extract-release-notes@273da39a24fb7db106a35526c8162815faffd31d # v3
        with:
          release_notes_file: RELEASE_DETAILS.md
      - name: Append Checksums
        run: |
          cat << EOF >> RELEASE_DETAILS.md

          ### SHA256 Checksums

          - linux_x64_ansi: \`$linux_x64_ansi_hash\`
          - linux_x64_unicode: \`$linux_x64_unicode_hash\`

          EOF
      - name: Upload to Draft Release
        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1
        with:
          draft: true
          name: "AWS Advanced ODBC Wrapper - v${{ github.ref_name }}"
          bodyFile: RELEASE_DETAILS.md
          artifacts: "*/*.msi, */*.tar.gz, */*.pkg"