spark-connect 0.2.2

name: Build, Test, and Draft Release

on:
  pull_request:
    branches:
      - release
    paths-ignore:
      - 'docs/**'
      - '.github/workflows/release.yaml'

env:
  PROJECT_NAME: spark-connect

jobs:
  tag-version:
    name: Tag Version
    runs-on: ubuntu-latest
    permissions:
      contents: write
    outputs:
      version: ${{ steps.get_version.outputs.version }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Extract version from Cargo.toml
        id: get_version
        run: |
          VERSION=$(grep -Po '(?<=^version = ")[^"]*' Cargo.toml)
          echo "version=$VERSION" >> $GITHUB_OUTPUT

      - name: Create and push tag
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git tag -f v${{ steps.get_version.outputs.version }}
          git push -f origin v${{ steps.get_version.outputs.version }}

  test-and-package:
    needs: [tag-version]
    runs-on: ubuntu-latest
    services:
      docker:
        image: docker:20.10.24-dind
        options: --privileged
    permissions:
      actions: read
      id-token: write
      contents: write
    outputs:
      hash_b64: ${{ steps.hash.outputs.hash_b64 }}
    steps:
      - uses: actions/checkout@v4

      - name: Run Spark Connect Server container instance
        run: docker run -d -p 15002:15002 ${{ github.repository_owner }}/spark-connect-server:delta
      - name: Set up Rust
        uses: dtolnay/rust-toolchain@stable
      - name: Test crate
        run: |
          cargo test --locked spark-connect
      
      # Package crate (creates target/package/*.crate)
      - name: Package crate
        run: cargo package
        
      # 🔑 Compute SHA256 hashes and encode in base64 for SLSA workflow
      - name: Compute hashes
        id: hash
        run: |
          set -euo pipefail
          for f in target/package/*.crate; do
            sha=$(sha256sum "$f" | cut -d ' ' -f1)
            echo "${sha}  $f" >> hashes.txt
          done
          b64=$(base64 -w0 hashes.txt)
          echo "hash_b64=$b64" >> $GITHUB_OUTPUT

      # Create draft release with crate
      - name: Create draft release
        uses: softprops/action-gh-release@v2
        with:
          name: "${{ env.PROJECT_NAME }} v${{ needs.tag-version.outputs.version }}"
          tag_name: v${{ needs.tag-version.outputs.version }}
          body: |
            Included in this release:
            
            - Crate tarball for crates.io (`*.crate`).
            - Provenance.
          draft: true
          files: target/package/*.crate
          overwrite_files: true

  # Creates provenance and adds it to the release
  # TODO: replace slsa with native GitHub assert
  provenance:
    needs: [tag-version, test-and-package]
    permissions:
      actions: read
      id-token: write
      contents: write
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
    with:
      base64-subjects: ${{ needs.test-and-package.outputs.hash_b64 }}
      upload-assets: true
      upload-tag-name: v${{ needs.tag-version.outputs.version }}
      draft-release: true