create-release.yml

name: Attach Artifacts To Draft Release

permissions:
  contents: write
  actions: write
  packages: write
  id-token: write

on:
  workflow_dispatch:
    inputs:
      version:
        description: "Version (example: 4.8.2)"
        required: true
      branch:
        description: "Branch to release (Defaults to master)"
        required: false
        default: "master"
      runId:
        description: "RunId of liquibase/liquibase artifacts to attach"
        required: true
      standalone_zip:
        description: "Flag to indicate if the workflow is triggered to create a standalone zip"
        required: false
        type: boolean
        default: false
      dry_run:
        description: "Flag to indicate if the workflow is triggered to create a dry-run release"
        required: false
        type: boolean
        default: false
  workflow_call:
    inputs:
      version:
        description: "Version (example: 4.8.2)"
        required: true
        type: string
      branch:
        description: "Branch to release (Defaults to master)"
        required: false
        default: "master"
        type: string
      runId:
        description: "RunId of liquibase/liquibase artifacts to attach"
        required: true
        type: string
      standalone_zip:
        description: "Flag to indicate if the workflow is triggered to create a standalone zip"
        required: true
        type: boolean
        default: false
      dry_run:
        description: "Flag to indicate if the workflow is triggered to create a dry-run release"
        required: true
        type: boolean
        default: false
    outputs:
      dry_run_zip_url:
        description: "The URL of the created zip file"
        value: ${{ jobs.build-installers.outputs.dry_run_zip_url }}
      dry_run_tar_gz_url:
        description: "The URL of the created tar.gz file"
        value: ${{ jobs.build-installers.outputs.dry_run_tar_gz_url }}

jobs:
  setup:
    name: Setup
    runs-on: ubuntu-22.04
    outputs:
      version: ${{ inputs.version }}
      branch: ${{ inputs.branch }}
      runId: ${{ inputs.runId }}
      uber_jar_runId: ${{ steps.get_run_id.outputs.run_id }}
    steps:
      - run: |
          echo "Creating version ${{ inputs.version }} from ${{ inputs.branch }} with artifacts from build ${{ inputs.runId }} "

  # owasp-scanner:
  #   needs: [setup]
  #   uses: liquibase/build-logic/.github/workflows/owasp-scanner.yml@main
  #   with:
  #     branch: ${{ needs.setup.outputs.branch }}
  #   secrets: inherit

  reversion:
    needs: [setup]
    name: Re-version artifacts ${{ needs.setup.outputs.version }}
    runs-on: ubuntu-22.04
    steps:

      - uses: actions/checkout@v5

      - name: Configure AWS credentials for vault access
        uses: aws-actions/configure-aws-credentials@v5
        with:
          role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }}
          aws-region: us-east-1

      - name: Get secrets from vault
        id: vault-secrets
        uses: aws-actions/aws-secretsmanager-get-secrets@v2
        with:
          secret-ids: |
            ,/vault/liquibase
          parse-json-secrets: true

      - name: Download liquibase-artifacts
        uses: dawidd6/action-download-artifact@v11
        with:
          workflow: run-tests.yml
          run_id: ${{ needs.setup.outputs.runId }}
          name: liquibase-artifacts
          path: download/liquibase-artifacts

      - name: Get Current Run ID
        id: get_run_id
        run: |
          run_id=${{ github.run_id }}
          echo "uber_jar_runId=${run_id}" >> $GITHUB_OUTPUT

      - name: Convert escaped newlines and set GPG key
        run: |
          {
            echo "GPG_KEY_CONTENT<<GPG_EOF"
            printf '%b' "${{ env.GPG_SECRET }}"
            echo
            echo "GPG_EOF"
          } >> $GITHUB_ENV

      - name: Set up JDK
        uses: actions/setup-java@v5
        with:
          java-version: "8"
          distribution: "temurin"
          gpg-private-key: ${{ env.GPG_KEY_CONTENT }}
          gpg-passphrase: GPG_PASSPHRASE
        env:
          GPG_PASSWORD: ${{ env.GPG_PASSPHRASE }}


      - name: maven-settings-xml-action
        uses: whelk-io/maven-settings-xml-action@v22
        with:
          repositories: |
            [
              {
                "id": "liquibase",
                "url": "https://maven.pkg.github.com/liquibase/liquibase",
                "releases": {
                  "enabled": "true"
                },
                "snapshots": {
                  "enabled": "true",
                  "updatePolicy": "always"
                }
              }
            ]
          servers: |
            [
              {
                "id": "liquibase",
                "username": "liquibot",
                "password": "${{ env.LIQUIBOT_PAT_GPM_ACCESS }}"
              }
            ]

      - name: Re-version Artifacts
        env:
          GPG_PASSWORD: ${{ env.GPG_PASSPHRASE }}
        run: |
          scripts_branch=${{ github.ref }}
          mkdir -p $PWD/.github/util/
          # Download a script (re-version.sh) from a URL and save it to the specified directory
          curl -o $PWD/.github/util/re-version.sh https://raw.githubusercontent.com/liquibase/liquibase/$scripts_branch/.github/util/re-version.sh

          # Download another script (sign-artifacts.sh) from a URL and save it to the specified directory
          curl -o $PWD/.github/util/sign-artifacts.sh https://raw.githubusercontent.com/liquibase/liquibase/$scripts_branch/.github/util/sign-artifacts.sh
          curl -o $PWD/.github/util/ManifestReversion.java https://raw.githubusercontent.com/liquibase/liquibase/$scripts_branch/.github/util/ManifestReversion.java
          chmod +x $PWD/.github/util/re-version.sh
          chmod +x $PWD/.github/util/ManifestReversion.java
          chmod +x $PWD/.github/util/sign-artifacts.sh
          $PWD/.github/util/re-version.sh download/liquibase-artifacts "${{ needs.setup.outputs.version }}" "${{ needs.setup.outputs.branch }}"

          # Execute the sign-artifacts.sh script with specific arguments
          $PWD/.github/util/sign-artifacts.sh download/liquibase-artifacts "${{ needs.setup.outputs.version }}" "${{ needs.setup.outputs.branch }}"

          $PWD/.github/util/sign-artifacts.sh re-version/out

          # Move files to a specific directory
          mkdir re-version/final
          mv re-version/out/liquibase-core-${{ needs.setup.outputs.version }}.jar re-version/final
          mv re-version/out/liquibase-${{ needs.setup.outputs.version }}.tar.gz re-version/final
          mv re-version/out/liquibase-${{ needs.setup.outputs.version }}.zip re-version/final
          (cd re-version/out/ && zip liquibase-additional-${{ needs.setup.outputs.version }}.zip *)
          mv re-version/out/liquibase-additional-${{ needs.setup.outputs.version }}.zip re-version/final

      - name: Cache Completed Artifacts
        uses: actions/cache@v4.3.0
        with:
          key: completed-artifacts-${{ github.run_number }}-${{ github.run_attempt }}
          path: re-version/final

      - name: Set repository tags
        if: ${{ inputs.standalone_zip == false && inputs.dry_run == false }}
        run: |
          git tag -f v${{ needs.setup.outputs.version }}
          git push -f origin v${{ needs.setup.outputs.version }}

  build-installers:
    needs: [setup, reversion]
    name: Build Installers
    runs-on: ubuntu-22.04
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v5

      - name: Configure AWS credentials for vault access
        uses: aws-actions/configure-aws-credentials@v5
        with:
          role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }}
          aws-region: us-east-1

      - name: Get secrets from vault
        id: vault-secrets
        uses: aws-actions/aws-secretsmanager-get-secrets@v2
        with:
          secret-ids: |
            ,/vault/liquibase
          parse-json-secrets: true

      - name: Convert escaped newlines and set GPG key
        run: |
          {
            echo "GPG_KEY_CONTENT<<GPG_EOF"
            printf '%b' "${{ env.GPG_SECRET }}"
            echo
            echo "GPG_EOF"
          } >> $GITHUB_ENV

      - name: Restore Completed Artifacts
        uses: actions/cache@v4.3.0
        with:
          key: completed-artifacts-${{ github.run_number }}-${{ github.run_attempt }}
          path: re-version/final

       # https://github.com/actions/setup-java/tree/v4/?tab=readme-ov-file#install-multiple-jdks   
      - name: Set up JDK for GPG
        uses: actions/setup-java@v5
        with:
          java-version: |
            17
            8
          distribution: "temurin"
          gpg-private-key: ${{ env.GPG_KEY_CONTENT }}
          gpg-passphrase: GPG_PASSPHRASE
        env:
          GPG_PASSWORD: ${{ env.GPG_PASSPHRASE }}

      - name: Decode Client Authentication Certificate
        run: |
          echo "${{ env.SM_CLIENT_CERT_FILE_B64 }}" | base64 --decode > /tmp/client-auth.p12

      - name: Set Environment Variables for Signing
        run: |
          echo "SM_HOST=${{ env.SM_HOST }}" >> "$GITHUB_ENV"
          echo "SM_API_KEY=${{ env.SM_API_KEY }}" >> "$GITHUB_ENV"
          echo "SM_CLIENT_CERT_FILE=/tmp/client-auth.p12" >> "$GITHUB_ENV"
          echo "SM_CLIENT_CERT_PASSWORD=${{ env.SM_CLIENT_CERT_PASSWORD }}" >> "$GITHUB_ENV"
          echo "SM_CODE_SIGNING_CERT_SHA1_HASH=${{ env.SM_CODE_SIGNING_CERT_SHA1_HASH }}" >> "$GITHUB_ENV"
          echo "SM_KEY_PAIR_ALIAS=${{ env.SM_KEY_PAIR_ALIAS }}" >> "$GITHUB_ENV"

      - name: Install jsign and osslsigncode
        run: |
          curl -fSslL https://github.com/ebourg/jsign/releases/download/3.1/jsign_3.1_all.deb -o jsign_3.1_all.deb
          sudo dpkg --install jsign_3.1_all.deb
          sudo apt-get install osslsigncode
          
      - name: Create pkcs11properties.cfg
        run: |
          cat << EOF > pkcs11properties.cfg
          name=signingmanager
          library="$(pwd)/.github/util/smpkcs11.so"
          slotListIndex=0
          EOF
          mv pkcs11properties.cfg $(pwd)/.github/util/

      - name: Install Android SDK & Build Tools
        run: |
          export JAVA_HOME=${JAVA_HOME_17_x64}
          export PATH="$JAVA_HOME/bin:$PATH"
          java -version
          ANDROID_SDK_ROOT=$HOME/android-sdk
          mkdir -p "$ANDROID_SDK_ROOT/cmdline-tools"
          cd "$ANDROID_SDK_ROOT/cmdline-tools"
          
          wget https://dl.google.com/android/repository/commandlinetools-linux-9477386_latest.zip -O tools.zip
          unzip tools.zip -d temp
          rm tools.zip
          mv temp/cmdline-tools "$ANDROID_SDK_ROOT/cmdline-tools/latest"
      
          echo "y" | $ANDROID_SDK_ROOT/cmdline-tools/latest/bin/sdkmanager \
            --sdk_root="$ANDROID_SDK_ROOT" \
            "platform-tools" "build-tools;30.0.2"
      
          echo "ANDROID_HOME=$ANDROID_SDK_ROOT" >> $GITHUB_ENV
          echo "$ANDROID_SDK_ROOT/platform-tools" >> $GITHUB_PATH
          echo "$ANDROID_SDK_ROOT/build-tools/30.0.2" >> $GITHUB_PATH
          
      - name: Install DigiCert KeyLocker Client Tools
        uses: digicert/ssm-code-signing@v1.1.1

      - name: Build Unsigned Windows Installer
        env:
          INSTALL4J_LICENSE_KEY: ${{ env.INSTALL4J_LICENSE_KEY }}
        run: |
          version="${{ needs.setup.outputs.version }}"
          tarFile=$(pwd)/re-version/final/liquibase-$version.tar.gz
          scriptDir=$(pwd)/.github/util/

          mkdir -p liquibase-dist/target/liquibase-$version
          (cd liquibase-dist/target/liquibase-$version && tar xfz $tarFile)
          (cd liquibase-dist && $scriptDir/package-install4j.sh $version)
          mv liquibase-dist/target/liquibase-*-installer-* re-version/final

      - name: Find Unsigned Windows Installer
        id: find-installer
        run: |
          INSTALLER_PATH=$(find re-version/final -name "liquibase-*-installer-*" | head -n 1)
          if [ -z "$INSTALLER_PATH" ]; then
            echo "Error: No installer file found!"
            exit 1
          fi
          echo "Found installer: $INSTALLER_PATH"
          echo "INSTALLER_PATH=$INSTALLER_PATH" >> $GITHUB_ENV

      - name: Sign Windows Installer using KeyLocker
        run: |
          smctl sign -v --fingerprint "$SM_CODE_SIGNING_CERT_SHA1_HASH" \
          --keypair-alias $SM_KEY_PAIR_ALIAS \
          --certificate "$SM_CLIENT_CERT_FILE" \
          --config-file "$(pwd)/.github/util/pkcs11properties.cfg" \
          --input "$INSTALLER_PATH" --tool jsign

      - name: Verify Windows Installer Signature
        run: osslsigncode verify -CAfile /etc/ssl/certs/ca-certificates.crt -in "$INSTALLER_PATH"
        
      - name: Re-version Installers
        env:
          GPG_PASSWORD: ${{ env.GPG_PASSPHRASE }}
        run: |
          version="${{ needs.setup.outputs.version }}"

          ##Sign Files
          $PWD/.github/util/sign-artifacts.sh re-version/final

          (cd re-version/final && zip liquibase-additional-$version.zip *.asc *.md5 *.sha1)
          rm re-version/final/*.asc
          rm re-version/final/*.md5
          rm re-version/final/*.sha1

        # Check if the tag already exists in OSS repository, if it does, exit with error. This is to prevent the artifacts from being attached to the already released tag.
      - name: Check OSS release tag existence, if tag exists, exit with error
        run: |
          tag="v${{ needs.setup.outputs.version }}"
          if git show-ref --tags --quiet --verify -- "refs/tags/$tag"
          then
              echo "Tag $tag already exists"
              exit 1
          fi

      - name: Attach Files to Draft Release
        if: ${{ inputs.standalone_zip == false && inputs.dry_run == false }}
        uses: softprops/action-gh-release@v2
        with:
          tag_name: v${{ needs.setup.outputs.version }}
          fail_on_unmatched_files: true
          body: Liquibase ${{ needs.setup.outputs.version }}
          generate_release_notes: true
          draft: true
          files: re-version/final/*
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Attach Files to Dry-Run Draft Release
        id: attach-files-dry-run
        if: ${{ inputs.standalone_zip == false && inputs.dry_run == true }}
        uses: softprops/action-gh-release@v2
        with:
          tag_name: v${{ needs.setup.outputs.version }}
          fail_on_unmatched_files: true
          body: Liquibase ${{ needs.setup.outputs.version }} (Dry-Run)
          generate_release_notes: true
          draft: true
          files: re-version/final/*
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Attach standalone zip to Build
        if: ${{ inputs.standalone_zip == true && inputs.dry_run == false }}
        uses: actions/upload-artifact@v5
        with:
          name: liquibase-installers-${{ needs.setup.outputs.version }}
          path: re-version/final/*