create-release.yml

name: Attach Artifacts To Draft Release

permissions:
  contents: write
  actions: write
  packages: write
  id-token: write

on:
  workflow_dispatch:
    inputs:
      version:
        description: "Version (example: 4.8.2)"
        required: true
      branch:
        description: "Branch to release (Defaults to master)"
        required: false
        default: "master"
      runId:
        description: "RunId of liquibase/liquibase artifacts to attach"
        required: true
      standalone_zip:
        description: "Flag to indicate if the workflow is triggered to create a standalone zip"
        required: false
        type: boolean
        default: false
      dry_run:
        description: "Flag to indicate if the workflow is triggered to create a dry-run release"
        required: false
        type: boolean
        default: false
  workflow_call:
    inputs:
      version:
        description: "Version (example: 4.8.2)"
        required: true
        type: string
      branch:
        description: "Branch to release (Defaults to master)"
        required: false
        default: "master"
        type: string
      runId:
        description: "RunId of liquibase/liquibase artifacts to attach"
        required: true
        type: string
      standalone_zip:
        description: "Flag to indicate if the workflow is triggered to create a standalone zip"
        required: true
        type: boolean
        default: false
      dry_run:
        description: "Flag to indicate if the workflow is triggered to create a dry-run release"
        required: true
        type: boolean
        default: false
    outputs:
      dry_run_zip_url:
        description: "The URL of the created zip file"
        value: ${{ jobs.build-installers.outputs.dry_run_zip_url }}
      dry_run_tar_gz_url:
        description: "The URL of the created tar.gz file"
        value: ${{ jobs.build-installers.outputs.dry_run_tar_gz_url }}

env:
  DEPENDENCIES: "liquibase-bigquery" # Comma separated list of dependencies to release the extensions list
  EXTENSIONS: "liquibase-commercial-bigquery,liquibase-checks" # Comma separated list of extensions to release to GPM

jobs:
  setup:
    name: Setup
    runs-on: ubuntu-22.04
    outputs:
      version: ${{ inputs.version }}
      branch: ${{ inputs.branch }}
      runId: ${{ inputs.runId }}
      uber_jar_runId: ${{ steps.get_run_id.outputs.run_id }}
      dependencies: ${{ env.DEPENDENCIES }}
      extensions: ${{ env.EXTENSIONS }}
    steps:
      - run: |
          echo "Creating version ${{ inputs.version }} from ${{ inputs.branch }} with artifacts from build ${{ inputs.runId }} "

  # owasp-scanner:
  #   needs: [setup]
  #   uses: liquibase/build-logic/.github/workflows/owasp-scanner.yml@main
  #   with:
  #     branch: ${{ needs.setup.outputs.branch }}
  #   secrets: inherit

  build-azure-uber-jar:
    needs: [setup]
    # needs: [setup, owasp-scanner]
    uses: ./.github/workflows/build-azure-uber-jar.yml
    with:
      branch: ${{ needs.setup.outputs.branch }}
      liquibase-version: ${{ needs.setup.outputs.version }}
    secrets: inherit

  build-extension-jars:
    needs: [setup]
    # needs: [setup, owasp-scanner]
    uses: ./.github/workflows/build-extension-jars.yml
    with:
      liquibase-version: ${{ needs.setup.outputs.version }}
      dependencies: ${{ needs.setup.outputs.dependencies }}
      extensions: ${{ needs.setup.outputs.extensions }}
      branch: ${{ needs.setup.outputs.branch }}
    secrets: inherit

  get-liquibase-checks-version:
    needs: [setup]
    if: ${{ contains(needs.setup.outputs.extensions, 'liquibase-checks') }}
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.extract-version.outputs.version }}
    steps:

      - name: Configure AWS credentials for vault access
        uses: aws-actions/configure-aws-credentials@v5
        with:
          role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }}
          aws-region: us-east-1

      - name: Get secrets from vault
        id: vault-secrets
        uses: aws-actions/aws-secretsmanager-get-secrets@v2
        with:
          secret-ids: |
            ,/vault/liquibase
          parse-json-secrets: true
      
      - name: Get GitHub App token
        id: get-token
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ env.LIQUIBASE_GITHUB_APP_ID }}
          private-key: ${{ env.LIQUIBASE_GITHUB_APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          repositories: liquibase-checks
          permission-contents: write
          
      - uses: actions/checkout@v5
        with:
          repository: liquibase/liquibase-checks
          token: ${{ steps.get-token.outputs.token }}

      - id: extract-version
        name: Extract version from pom.xml
        shell: bash
        run: |
          VERSION=$(grep '<version>' pom.xml | head -n 1 | sed 's/.*<version>\(.*\)-SNAPSHOT<\/version>.*/\1/')
          echo "version=$VERSION" >> $GITHUB_OUTPUT

  reversion:
    needs: [setup,build-azure-uber-jar,build-extension-jars,get-liquibase-checks-version]
    name: Re-version artifacts ${{ needs.setup.outputs.version }}
    runs-on: ubuntu-22.04
    steps:

      - name: Configure AWS credentials for vault access
        uses: aws-actions/configure-aws-credentials@v5
        with:
          role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }}
          aws-region: us-east-1

      - name: Get secrets from vault
        id: vault-secrets
        uses: aws-actions/aws-secretsmanager-get-secrets@v2
        with:
          secret-ids: |
            ,/vault/liquibase
          parse-json-secrets: true

      - name: Get GitHub App token
        id: get-token
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ env.LIQUIBASE_GITHUB_APP_ID }}
          private-key: ${{ env.LIQUIBASE_GITHUB_APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          repositories: liquibase-pro
          permission-contents: write

      - uses: actions/checkout@v5

      - uses: actions/checkout@v5
        name: Checkout liquibase-pro
        with:
          repository: liquibase/liquibase-pro
          ref: "${{ needs.setup.outputs.branch }}"
          path: download/repo/liquibase-pro
          token: ${{ steps.get-token.outputs.token }}

      - name: Download liquibase-artifacts
        uses: dawidd6/action-download-artifact@v11
        with:
          workflow: run-tests.yml
          run_id: ${{ needs.setup.outputs.runId }}
          name: liquibase-artifacts
          path: download/liquibase-artifacts

      - name: Get Current Run ID
        id: get_run_id
        run: |
          run_id=${{ github.run_id }}
          echo "uber_jar_runId=${run_id}" >> $GITHUB_OUTPUT

      - name: Download liquibase-pro-azure-artifacts
        uses: actions/download-artifact@v5
        with:
          name: liquibase-pro-azure-artifacts
          path: liquibase-pro/liquibase-azure-deps

      - name: maven-settings-xml-action
        uses: whelk-io/maven-settings-xml-action@v22
        with:
          repositories: |
            [
              {
                "id": "liquibase",
                "url": "https://maven.pkg.github.com/liquibase/liquibase",
                "releases": {
                  "enabled": "true"
                },
                "snapshots": {
                  "enabled": "true",
                  "updatePolicy": "always"
                }
              },
              {
                "id": "liquibase-pro",
                "url": "https://maven.pkg.github.com/liquibase/liquibase-pro",
                "releases": {
                  "enabled": "true"
                },
                "snapshots": {
                  "enabled": "true",
                  "updatePolicy": "always"
                }
              }
            ]
          servers: |
            [
              {
                "id": "liquibase",
                "username": "liquibot",
                "password": "${{ env.LIQUIBOT_PAT_GPM_ACCESS }}"
              },
              {
                "id": "liquibase-pro",
                "username": "liquibot",
                "password": "${{ env.LIQUIBOT_PAT_GPM_ACCESS }}"
              }
            ]

      - name: Get extensions artifacts
        run: |
          IFS=',' read -ra ADDR <<< "${{ needs.setup.outputs.extensions }}"
          for extension in "${ADDR[@]}"; do
            if [ "$extension" != "liquibase-checks" ]; then
              mvn dependency:get -DgroupId=org.liquibase.ext -DartifactId=$extension -Dversion=${{ needs.setup.outputs.version }} -Dtransitive=false || echo "Failed to download $extension artifact"
            else
              mvn dependency:get -DgroupId=org.liquibase.ext -DartifactId=$extension -Dversion=${{ needs.get-liquibase-checks-version.outputs.version }} -Dtransitive=false || echo "Failed to download $extension artifact"
            fi
          done

      - name: Convert escaped newlines and set GPG key
        run: |
          {
            echo "GPG_KEY_CONTENT<<GPG_EOF"
            printf '%b' "${{ env.GPG_SECRET }}"
            echo
            echo "GPG_EOF"
          } >> $GITHUB_ENV

      - name: Set up JDK 17
        uses: actions/setup-java@v5
        with:
          java-version: "17"
          distribution: "temurin"
          gpg-private-key: ${{ env.GPG_KEY_CONTENT }}
          gpg-passphrase: GPG_PASSPHRASE
        env:
          GPG_PASSWORD: ${{ env.GPG_PASSPHRASE }}

      - name: Re-version Artifacts
        env:
          GPG_PASSWORD: ${{ env.GPG_PASSPHRASE }}
        run: |
          scripts_branch=${{ github.ref }}
          mkdir -p $PWD/.github/util/
          # Download a script (re-version.sh) from a URL and save it to the specified directory
          curl -o $PWD/.github/util/re-version.sh https://raw.githubusercontent.com/liquibase/liquibase/$scripts_branch/.github/util/re-version.sh

          # Download another script (sign-artifacts.sh) from a URL and save it to the specified directory
          curl -o $PWD/.github/util/sign-artifacts.sh https://raw.githubusercontent.com/liquibase/liquibase/$scripts_branch/.github/util/sign-artifacts.sh
          curl -o $PWD/.github/util/ManifestReversion.java https://raw.githubusercontent.com/liquibase/liquibase/$scripts_branch/.github/util/ManifestReversion.java
          chmod +x $PWD/.github/util/re-version.sh
          chmod +x $PWD/.github/util/ManifestReversion.java
          chmod +x $PWD/.github/util/sign-artifacts.sh
          $PWD/.github/util/re-version.sh download/liquibase-artifacts "${{ needs.setup.outputs.version }}" "${{ needs.setup.outputs.branch }}"

          # Execute the sign-artifacts.sh script with specific arguments
          $PWD/.github/util/sign-artifacts.sh download/liquibase-artifacts "${{ needs.setup.outputs.version }}" "${{ needs.setup.outputs.branch }}"

          ## Sign Files
          ## liquibase-azure-deps and liquibase extensions are already on its correct version. Check reusable workflow: build-azure-uber-jar.yml and build-extension-jars.yml
          mv liquibase-pro/liquibase-azure-deps/* re-version/out

          # Modify the zip file
          unzip re-version/out/liquibase-${{ needs.setup.outputs.version }}.zip -d re-version/out/liquibase-${{ needs.setup.outputs.version }}
          mkdir -p re-version/out/liquibase-${{ needs.setup.outputs.version }}/internal/extensions
          rm -rf re-version/out/liquibase-${{ needs.setup.outputs.version }}.zip
          IFS=',' read -ra EXT <<< "${{ needs.setup.outputs.extensions }}"
          for i in "${EXT[@]}"; do
            if [ "$i" != "liquibase-checks" ]; then
              cp ~/.m2/repository/org/liquibase/ext/$i/${{ needs.setup.outputs.version }}/$i-${{ needs.setup.outputs.version }}.jar re-version/out/liquibase-${{ needs.setup.outputs.version }}/internal/extensions/$i.jar || echo "Failed to move $i artifact"
            else
              cp ~/.m2/repository/org/liquibase/ext/$i/${{ needs.get-liquibase-checks-version.outputs.version }}/$i-${{ needs.get-liquibase-checks-version.outputs.version }}.jar re-version/out/liquibase-${{ needs.setup.outputs.version }}/internal/extensions/$i.jar || echo "Failed to move $i artifact"
            fi
          done
          (cd re-version/out/liquibase-${{ needs.setup.outputs.version }} && zip -r ../liquibase-${{ needs.setup.outputs.version }}.zip . && cd .. && rm -rf liquibase-${{ needs.setup.outputs.version }})

          # Modify the tar.gz file
          mkdir -p re-version/out/liquibase-${{ needs.setup.outputs.version }}
          tar -xzvf re-version/out/liquibase-${{ needs.setup.outputs.version }}.tar.gz -C re-version/out/liquibase-${{ needs.setup.outputs.version }}
          rm -rf re-version/out/liquibase-${{ needs.setup.outputs.version }}.tar.gz
          mkdir -p re-version/out/liquibase-${{ needs.setup.outputs.version }}/internal/extensions
          for I in "${EXT[@]}"; do
            if [ "$I" != "liquibase-checks" ]; then
              cp ~/.m2/repository/org/liquibase/ext/$I/${{ needs.setup.outputs.version }}/$I-${{ needs.setup.outputs.version }}.jar re-version/out/liquibase-${{ needs.setup.outputs.version }}/internal/extensions/$I.jar || echo "Failed to move $I artifact"
            else
              cp ~/.m2/repository/org/liquibase/ext/$I/${{ needs.get-liquibase-checks-version.outputs.version }}/$I-${{ needs.get-liquibase-checks-version.outputs.version }}.jar re-version/out/liquibase-${{ needs.setup.outputs.version }}/internal/extensions/$I.jar || echo "Failed to move $I artifact"
            fi
          done
          (cd re-version/out/liquibase-${{ needs.setup.outputs.version }} && tar -czvf ../liquibase-${{ needs.setup.outputs.version }}.tar.gz * && cd .. && rm -rf liquibase-${{ needs.setup.outputs.version }})

          $PWD/.github/util/sign-artifacts.sh re-version/out

          # Move files to a specific directory
          mkdir re-version/final re-version/s3-minimal
          mv re-version/out/liquibase-core-${{ needs.setup.outputs.version }}.jar re-version/final
          mv re-version/out/liquibase-commercial-${{ needs.setup.outputs.version }}.jar re-version/final
          mv re-version/out/liquibase-${{ needs.setup.outputs.version }}.tar.gz re-version/final
          mv re-version/out/liquibase-${{ needs.setup.outputs.version }}.zip re-version/final
          mv re-version/out/liquibase-minimal-${{ needs.setup.outputs.version }}* re-version/s3-minimal
          mv re-version/out/liquibase-azure-deps-${{ needs.setup.outputs.version }}.jar re-version/final/liquibase-azure-deps-${{ needs.setup.outputs.version }}.jar
          (cd re-version/out/ && zip liquibase-additional-${{ needs.setup.outputs.version }}.zip *)
          mv re-version/out/liquibase-additional-${{ needs.setup.outputs.version }}.zip re-version/final

      - name: Cache Completed Artifacts
        uses: actions/cache@v4.2.4
        with:
          key: completed-artifacts-${{ github.run_number }}-${{ github.run_attempt }}
          path: re-version/final

      - name: Cache Minimal Completed Artifacts
        uses: actions/cache@v4.2.4
        with:
          key: minimal-artifacts-${{ github.run_number }}-${{ github.run_attempt }}
          path: re-version/s3-minimal

      - name: Set repository tags
        if: ${{ inputs.standalone_zip == false && inputs.dry_run == false }}
        run: |
          git tag -f v${{ needs.setup.outputs.version }}
          git push -f origin v${{ needs.setup.outputs.version }}
          (cd download/repo/liquibase-pro && git tag -f v${{ needs.setup.outputs.version }})
          (cd download/repo/liquibase-pro && git push -f origin v${{ needs.setup.outputs.version }})

  build-installers:
    needs: [setup, reversion]
    name: Build Installers
    runs-on: ubuntu-22.04
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v5

      - name: Configure AWS credentials for vault access
        uses: aws-actions/configure-aws-credentials@v5
        with:
          role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }}
          aws-region: us-east-1

      - name: Get secrets from vault
        id: vault-secrets
        uses: aws-actions/aws-secretsmanager-get-secrets@v2
        with:
          secret-ids: |
            ,/vault/liquibase
          parse-json-secrets: true

      - name: Convert escaped newlines and set GPG key
        run: |
          {
            echo "GPG_KEY_CONTENT<<GPG_EOF"
            printf '%b' "${{ env.GPG_SECRET }}"
            echo
            echo "GPG_EOF"
          } >> $GITHUB_ENV

      - name: Restore Completed Artifacts
        uses: actions/cache@v4.2.4
        with:
          key: completed-artifacts-${{ github.run_number }}-${{ github.run_attempt }}
          path: re-version/final

       # https://github.com/actions/setup-java/tree/v4/?tab=readme-ov-file#install-multiple-jdks   
      - name: Set up JDK for GPG
        uses: actions/setup-java@v5
        with:
          java-version: |
            17
          distribution: "adopt"
          gpg-private-key: ${{ env.GPG_KEY_CONTENT }}
          gpg-passphrase: GPG_PASSPHRASE
        env:
          GPG_PASSWORD: ${{ env.GPG_PASSPHRASE }}

      - name: Decode Client Authentication Certificate
        run: |
          echo "${{ env.SM_CLIENT_CERT_FILE_B64 }}" | base64 --decode > /tmp/client-auth.p12

      - name: Set Environment Variables for Signing
        run: |
          echo "SM_HOST=${{ env.SM_HOST }}" >> "$GITHUB_ENV"
          echo "SM_API_KEY=${{ env.SM_API_KEY }}" >> "$GITHUB_ENV"
          echo "SM_CLIENT_CERT_FILE=/tmp/client-auth.p12" >> "$GITHUB_ENV"
          echo "SM_CLIENT_CERT_PASSWORD=${{ env.SM_CLIENT_CERT_PASSWORD }}" >> "$GITHUB_ENV"
          echo "SM_CODE_SIGNING_CERT_SHA1_HASH=${{ env.SM_CODE_SIGNING_CERT_SHA1_HASH }}" >> "$GITHUB_ENV"
          echo "SM_KEY_PAIR_ALIAS=${{ env.SM_KEY_PAIR_ALIAS }}" >> "$GITHUB_ENV"

      - name: Install jsign and osslsigncode
        run: |
          curl -fSslL https://github.com/ebourg/jsign/releases/download/3.1/jsign_3.1_all.deb -o jsign_3.1_all.deb
          sudo dpkg --install jsign_3.1_all.deb
          sudo apt-get install osslsigncode
          
      - name: Create pkcs11properties.cfg
        run: |
          cat << EOF > pkcs11properties.cfg
          name=signingmanager
          library="$(pwd)/.github/util/smpkcs11.so"
          slotListIndex=0
          EOF
          mv pkcs11properties.cfg $(pwd)/.github/util/

      - name: Install Android SDK & Build Tools
        run: |
          export JAVA_HOME=${JAVA_HOME_17_x64}
          export PATH="$JAVA_HOME/bin:$PATH"
          java -version
          ANDROID_SDK_ROOT=$HOME/android-sdk
          mkdir -p "$ANDROID_SDK_ROOT/cmdline-tools"
          cd "$ANDROID_SDK_ROOT/cmdline-tools"
          
          wget https://dl.google.com/android/repository/commandlinetools-linux-9477386_latest.zip -O tools.zip
          unzip tools.zip -d temp
          rm tools.zip
          mv temp/cmdline-tools "$ANDROID_SDK_ROOT/cmdline-tools/latest"
      
          echo "y" | $ANDROID_SDK_ROOT/cmdline-tools/latest/bin/sdkmanager \
            --sdk_root="$ANDROID_SDK_ROOT" \
            "platform-tools" "build-tools;30.0.2"
      
          echo "ANDROID_HOME=$ANDROID_SDK_ROOT" >> $GITHUB_ENV
          echo "$ANDROID_SDK_ROOT/platform-tools" >> $GITHUB_PATH
          echo "$ANDROID_SDK_ROOT/build-tools/30.0.2" >> $GITHUB_PATH
          
      - name: Install DigiCert KeyLocker Client Tools
        uses: digicert/ssm-code-signing@v1.1.1

      - name: Build Unsigned Windows Installer
        env:
          INSTALL4J_LICENSE_KEY: ${{ env.INSTALL4J_LICENSE_KEY }}
        run: |
          version="${{ needs.setup.outputs.version }}"
          tarFile=$(pwd)/re-version/final/liquibase-$version.tar.gz
          scriptDir=$(pwd)/.github/util/

          mkdir -p liquibase-dist/target/liquibase-$version
          (cd liquibase-dist/target/liquibase-$version && tar xfz $tarFile)
          (cd liquibase-dist && $scriptDir/package-install4j.sh $version)
          mv liquibase-dist/target/liquibase-*-installer-* re-version/final

      - name: Find Unsigned Windows Installer
        id: find-installer
        run: |
          INSTALLER_PATH=$(find re-version/final -name "liquibase-*-installer-*" | head -n 1)
          if [ -z "$INSTALLER_PATH" ]; then
            echo "Error: No installer file found!"
            exit 1
          fi
          echo "Found installer: $INSTALLER_PATH"
          echo "INSTALLER_PATH=$INSTALLER_PATH" >> $GITHUB_ENV

      - name: Sign Windows Installer using KeyLocker
        run: |
          smctl sign -v --fingerprint "$SM_CODE_SIGNING_CERT_SHA1_HASH" \
          --keypair-alias $SM_KEY_PAIR_ALIAS \
          --certificate "$SM_CLIENT_CERT_FILE" \
          --config-file "$(pwd)/.github/util/pkcs11properties.cfg" \
          --input "$INSTALLER_PATH" --tool jsign

      - name: Verify Windows Installer Signature
        run: osslsigncode verify -CAfile /etc/ssl/certs/ca-certificates.crt -in "$INSTALLER_PATH"
        
      - name: Re-version Installers
        env:
          GPG_PASSWORD: ${{ env.GPG_PASSPHRASE }}
        run: |
          version="${{ needs.setup.outputs.version }}"

          ##Sign Files
          $PWD/.github/util/sign-artifacts.sh re-version/final

          (cd re-version/final && zip liquibase-additional-$version.zip *.asc *.md5 *.sha1)
          rm re-version/final/*.asc
          rm re-version/final/*.md5
          rm re-version/final/*.sha1

        # Check if the tag already exists in OSS repository, if it does, exit with error. This is to prevent the artifacts from being attached to the already released tag.
      - name: Check OSS release tag existence, if tag exists, exit with error
        run: |
          tag="v${{ needs.setup.outputs.version }}"
          if git show-ref --tags --quiet --verify -- "refs/tags/$tag"
          then
              echo "Tag $tag already exists"
              exit 1
          fi

      - name: Attach Files to Draft Release
        if: ${{ inputs.standalone_zip == false && inputs.dry_run == false }}
        uses: softprops/action-gh-release@v2
        with:
          tag_name: v${{ needs.setup.outputs.version }}
          fail_on_unmatched_files: true
          body: Liquibase ${{ needs.setup.outputs.version }}
          generate_release_notes: true
          draft: true
          files: re-version/final/*
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Attach Files to Dry-Run Draft Release
        id: attach-files-dry-run
        if: ${{ inputs.standalone_zip == false && inputs.dry_run == true }}
        uses: softprops/action-gh-release@v2
        with:
          tag_name: v${{ needs.setup.outputs.version }}
          fail_on_unmatched_files: true
          body: Liquibase ${{ needs.setup.outputs.version }} (Dry-Run)
          generate_release_notes: true
          draft: true
          files: re-version/final/*
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Attach standalone zip to Build
        if: ${{ inputs.standalone_zip == true && inputs.dry_run == false }}
        uses: actions/upload-artifact@v4
        with:
          name: liquibase-installers-${{ needs.setup.outputs.version }}
          path: re-version/final/*

  deploy_minimal_artifact_s3:
    if: ${{ inputs.dry_run == false }}
    name: Deploy minimal artifacts to lbio s3 bucket
    needs: [setup, reversion]
    runs-on: ubuntu-latest
    steps:

      - name: Configure AWS credentials for vault access
        uses: aws-actions/configure-aws-credentials@v5
        with:
          role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }}
          aws-region: us-east-1

      - name: Get secrets from vault
        id: vault-secrets
        uses: aws-actions/aws-secretsmanager-get-secrets@v2
        with:
          secret-ids: |
            ,/vault/liquibase
          parse-json-secrets: true
          
      - name: Restore Minimal Completed Artifacts
        uses: actions/cache@v4.2.4
        with:
          key: minimal-artifacts-${{ github.run_number }}-${{ github.run_attempt }}
          path: re-version/s3-minimal

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v5
        with:
          role-to-assume: ${{ env.AWS_IO_DEV_GITHUB_OIDC_ROLE_ARN_LIQUIBASE }}
          aws-region: us-east-2

      - name: Publish minimal assets to s3 bucket
        run: |
          aws s3 sync "re-version/s3-minimal" s3://${{ env.LBIO_DOWNLOADS_S3_BUCKET }}/downloads/liquibase-minimal/v${{ needs.setup.outputs.version }}/ --only-show-errors