Windows.yml

name: Windows
on:
  workflow_call:
    inputs:
      duckdb_version:
        type: string
      duckdb_commit:
        type: string
      skip_tests:
        type: boolean
      run_all:
        type: boolean
      runners:
        type: string
      runner_provider:
        type: string
        required: true
concurrency:
  group: windows-${{ github.workflow }}-${{ github.ref }}-${{ github.head_ref || '' }}-${{ github.base_ref || '' }}-${{ github.ref != 'refs/heads/main' || github.sha }}-${{ inputs.duckdb_version }}
  cancel-in-progress: true

env:
  GH_TOKEN: ${{ secrets.GH_TOKEN }}
  DUCKDB_VERSION: ${{ inputs.duckdb_version }}
  DUCKDB_COMMIT: ${{ inputs.duckdb_commit }}
  AZURE_CODESIGN_ENDPOINT: https://eus.codesigning.azure.net/
  AZURE_CODESIGN_ACCOUNT: duckdb-signing-2
  AZURE_CODESIGN_PROFILE: duckdb-certificate-profile

jobs:
 win-release-64:
    # Builds binaries for windows_amd64
    name: Windows (64 Bit)
    runs-on: ${{ fromJSON(inputs.runners).windows_2022_x64 || 'windows-2022' }}
    env:
      GEN: ninja
      CC: clang-cl
      CXX: clang-cl
    steps:
    - name: "Checkout"
      uses: duckdb/duckdb-ci/.github/actions/checkout@main
      with:
        runner_provider: ${{ inputs.runner_provider }}
        fetch_depth: 0
        ref: ${{ inputs.duckdb_commit }}

    - uses: actions/setup-python@v6
      with:
        python-version: '3.12'

    - uses: ./.github/actions/ccache-action
    - name: Set up MSVC environment (x64)
      uses: ./.github/actions/setup-msvc-env

    - name: Build
      shell: bash
      run: |
        clang-cl --version
        python scripts/ci/retry.py -- python scripts/windows_ci.py
        python scripts/ci/retry.py -- make windows_release

    - name: Verify architecture flags
      shell: pwsh
      run: |
        $commands = Get-Content compile_commands.json -Raw
        if (!$commands.Contains('clang-cl')) {
          throw 'Windows amd64 Release compile commands are not using clang-cl'
        }
        if (!$commands.Contains('-march=haswell') -or !$commands.Contains('-mtune=generic')) {
          throw 'Windows amd64 Release compile commands are missing the CLI architecture flags'
        }

    - name: Set DUCKDB_INSTALL_LIB for ADBC tests
      shell: pwsh
      run: echo "DUCKDB_INSTALL_LIB=$((Get-ChildItem -Recurse -Filter "duckdb.dll" | Select-Object -First 1).FullName)" >> $env:GITHUB_ENV

    - name: Test DUCKDB_INSTALL_LIB variable
      shell: bash
      run: echo "$DUCKDB_INSTALL_LIB"

    - name: Test
      shell: bash
      if: ${{ !inputs.skip_tests }}
      run: |
        python test/run.py

    - name: Test with VS2019 C++ stdlib
      shell: bash
      if: ${{ !inputs.skip_tests }}
      run: |
        python scripts/ci/retry.py -- curl -L --output ./test/msvcp140.dll https://blobs.duckdb.org/ci/msvcp140.dll
        ls ./test
        python test/run.py
        rm ./test/msvcp140.dll

    - name: Tools Test
      shell: bash
      if: ${{ !inputs.skip_tests }}
      run: |
        python scripts/ci/retry.py -- python -m pip install pytest
        python -m pytest tools/shell/tests --shell-binary duckdb.exe

    - name: Sign files with Azure Trusted Signing (TM)
      if: github.repository == 'duckdb/duckdb' && github.event_name != 'pull_request'
      uses: azure/trusted-signing-action@v0
      with:
        azure-tenant-id:              ${{ secrets.AZURE_CODESIGN_TENANT_ID }}
        azure-client-id:              ${{ secrets.AZURE_CODESIGN_CLIENT_ID }}
        azure-client-secret:          ${{ secrets.AZURE_CODESIGN_CLIENT_SECRET }}
        endpoint:                     ${{ env.AZURE_CODESIGN_ENDPOINT }}
        trusted-signing-account-name: ${{ env.AZURE_CODESIGN_ACCOUNT }}
        certificate-profile-name:     ${{ env.AZURE_CODESIGN_PROFILE }}
        files-folder:                 ${{ github.workspace }}
        files-folder-filter:          exe,dll
        files-folder-recurse:         true
        file-digest:                  SHA256
        timestamp-rfc3161:            http://timestamp.acs.microsoft.com
        timestamp-digest:             SHA256

    - name: CLI check
      shell: bash
      run: |
        ./duckdb.exe -c "PRAGMA platform; PRAGMA version;"
        if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
          # Fail on a zero major version.
          ./duckdb.exe -ascii -noheader -c "SELECT library_version FROM pragma_version() WHERE library_version NOT LIKE 'v0%'" | grep '^v';
        fi


    - name: Deploy
      shell: bash
      env:
        AWS_ENDPOINT_URL: ${{ secrets.S3_DUCKDB_STAGING_ENDPOINT }}
        AWS_ACCESS_KEY_ID: ${{ secrets.S3_DUCKDB_STAGING_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.S3_DUCKDB_STAGING_KEY }}
      run: |
        make cli-release-artifact ARTIFACT_SUFFIX=windows-amd64 CLI_BINARY=duckdb.exe
        make shared-libs-release-artifact ARTIFACT_SUFFIX=windows-amd64 SHARED_LIBRARIES="src/duckdb.dll src/duckdb.lib"
        make static-libs-release-artifact ARTIFACT_SUFFIX=windows-amd64 STATIC_LIBRARIES="src/duckdb_static.lib src/duckdb_shell.lib src/main/http/duckdb_httplib.lib src/main/extension/duckdb_loadable_extensions.lib extension/*/*_extension.lib"
        ./scripts/upload-assets-to-staging.sh github_release duckdb-cli-windows-amd64.tar.gz duckdb-shared-libs-windows-amd64.tar.gz duckdb-static-libs-windows-amd64.tar.gz

    - uses: actions/upload-artifact@v7
      with:
        path: duckdb-cli-windows-amd64.tar.gz
        archive: false

    - uses: actions/upload-artifact@v7
      with:
        path: duckdb-shared-libs-windows-amd64.tar.gz
        archive: false

    - uses: actions/upload-artifact@v7
      with:
        path: duckdb-static-libs-windows-amd64.tar.gz
        archive: false

    - uses: actions/upload-artifact@v7
      with:
        name: release-core-extensions-windows-amd64
        path: repository
        if-no-files-found: error

    - name: Package release artifact
      shell: bash
      run: make release-artifact RELEASE_ARTIFACT_SOURCE_DIR=. RELEASE_ARTIFACT_TARBALL=build/windows-release-amd64-build.tar.gz

    - uses: actions/upload-artifact@v7
      with:
        path: build/windows-release-amd64-build.tar.gz
        if-no-files-found: error
        archive: false

 win-release-32:
    name: Windows (32 Bit)
    needs:
      - win-release-64
    if: ${{ github.ref_name == 'main' || github.repository != 'duckdb/duckdb' || inputs.run_all }}
    runs-on: ${{ fromJSON(inputs.runners).windows_2022_x64 || 'windows-2022' }}
    env:
      GEN: ninja
      CC: clang-cl
      CXX: clang-cl
      EXTRA_CMAKE_VARIABLES: -DCMAKE_C_COMPILER_TARGET=i686-pc-windows-msvc -DCMAKE_CXX_COMPILER_TARGET=i686-pc-windows-msvc

    steps:
    - name: "Checkout"
      uses: duckdb/duckdb-ci/.github/actions/checkout@main
      with:
        runner_provider: ${{ inputs.runner_provider }}
        fetch_depth: 0
        ref: ${{ inputs.duckdb_commit }}

    - uses: actions/setup-python@v6
      with:
        python-version: '3.12'

    - uses: ./.github/actions/ccache-action
    - name: Set up MSVC environment (x86 target)
      uses: ./.github/actions/setup-msvc-env
      with:
        arch: x86
        host_arch: x64

    - name: Build
      shell: bash
      run: |
        clang-cl --version
        python scripts/ci/retry.py -- make windows_release_32

    - name: Verify compiler
      shell: pwsh
      run: |
        $commands = Get-Content compile_commands.json -Raw
        if (!$commands.Contains('clang-cl')) {
          throw 'Windows 32-bit compile commands are not using clang-cl'
        }

    - name: Test
      shell: bash
      if: ${{ !inputs.skip_tests }}
      run: python test/run.py

    - name: Tools Test
      shell: bash
      if: ${{ !inputs.skip_tests }}
      run: |
        python scripts/ci/retry.py -- python -m pip install pytest
        python -m pytest tools/shell/tests --shell-binary duckdb.exe

 win-release-arm64:
   name: Windows (ARM64)
   needs:
    - win-release-64
   if: ${{ github.ref_name == 'main' || github.repository != 'duckdb/duckdb' || inputs.run_all }}
   runs-on: windows-2025-vs2026
   env:
     GEN: ninja
     CC: clang-cl
     CXX: clang-cl
     EXTRA_CMAKE_VARIABLES: -DCMAKE_C_COMPILER_TARGET=arm64-pc-windows-msvc -DCMAKE_CXX_COMPILER_TARGET=arm64-pc-windows-msvc

   steps:
     - uses: actions/checkout@v6
       with:
         fetch-depth: 0
         ref: ${{ inputs.duckdb_commit }}

     - uses: actions/setup-python@v6
       with:
         python-version: '3.12'

     - uses: ./.github/actions/ccache-action
     - name: Set up MSVC environment (arm64 target)
       uses: ./.github/actions/setup-msvc-env
       with:
         arch: arm64
         host_arch: x64

     - name: Build
       shell: bash
       run: |
         clang-cl --version
         python scripts/ci/retry.py -- make DUCKDB_PLATFORM=windows_arm64 windows_release

     - name: Verify architecture flags
       shell: pwsh
       run: |
         $commands = Get-Content compile_commands.json -Raw
         if (!$commands.Contains('clang-cl')) {
           throw 'Windows ARM64 Release compile commands are not using clang-cl'
         }
         if (!$commands.Contains('-march=armv8-a') -or !$commands.Contains('-mtune=generic')) {
           throw 'Windows ARM64 Release compile commands are missing the architecture flags'
         }

     - name: Sign files with Azure Trusted Signing (TM)
       if: github.repository == 'duckdb/duckdb' && github.event_name != 'pull_request'
       uses: azure/trusted-signing-action@v0
       with:
         azure-tenant-id:              ${{ secrets.AZURE_CODESIGN_TENANT_ID }}
         azure-client-id:              ${{ secrets.AZURE_CODESIGN_CLIENT_ID }}
         azure-client-secret:          ${{ secrets.AZURE_CODESIGN_CLIENT_SECRET }}
         endpoint:                     ${{ env.AZURE_CODESIGN_ENDPOINT }}
         trusted-signing-account-name: ${{ env.AZURE_CODESIGN_ACCOUNT }}
         certificate-profile-name:     ${{ env.AZURE_CODESIGN_PROFILE }}
         files-folder:                 ${{ github.workspace }}
         files-folder-filter:          exe,dll
         files-folder-recurse:         true
         file-digest:                  SHA256
         timestamp-rfc3161:            http://timestamp.acs.microsoft.com
         timestamp-digest:             SHA256


     - name: Deploy
       shell: bash
       env:
         AWS_ENDPOINT_URL: ${{ secrets.S3_DUCKDB_STAGING_ENDPOINT }}
         AWS_ACCESS_KEY_ID: ${{ secrets.S3_DUCKDB_STAGING_ID }}
         AWS_SECRET_ACCESS_KEY: ${{ secrets.S3_DUCKDB_STAGING_KEY }}
       run: |
         make cli-release-artifact ARTIFACT_SUFFIX=windows-arm64 CLI_BINARY=duckdb.exe
         make shared-libs-release-artifact ARTIFACT_SUFFIX=windows-arm64 SHARED_LIBRARIES="src/duckdb.dll src/duckdb.lib"
         make static-libs-release-artifact ARTIFACT_SUFFIX=windows-arm64 STATIC_LIBRARIES="src/duckdb_static.lib src/duckdb_shell.lib src/main/http/duckdb_httplib.lib src/main/extension/duckdb_loadable_extensions.lib extension/*/*_extension.lib"
         ./scripts/upload-assets-to-staging.sh github_release duckdb-cli-windows-arm64.tar.gz duckdb-shared-libs-windows-arm64.tar.gz duckdb-static-libs-windows-arm64.tar.gz

     - uses: actions/upload-artifact@v7
       with:
         path: duckdb-cli-windows-arm64.tar.gz
         archive: false

     - uses: actions/upload-artifact@v7
       with:
         path: duckdb-shared-libs-windows-arm64.tar.gz
         archive: false

     - uses: actions/upload-artifact@v7
       with:
         path: duckdb-static-libs-windows-arm64.tar.gz
         archive: false

     - uses: actions/upload-artifact@v7
       with:
         name: release-core-extensions-windows-arm64
         path: repository
         if-no-files-found: error

     - name: Package release artifact
       shell: bash
       run: make release-artifact RELEASE_ARTIFACT_SOURCE_DIR=. RELEASE_ARTIFACT_TARBALL=build/windows-release-arm64-build.tar.gz

     - uses: actions/upload-artifact@v7
       with:
         path: build/windows-release-arm64-build.tar.gz
         if-no-files-found: error
         archive: false

 mingw:
     name: MinGW (64 Bit)
     needs:
      - win-release-64
     runs-on: ${{ fromJSON(inputs.runners).windows_2022_x64 || 'windows-2022' }}
     env:
       GEN: ninja
       CC: C:/rtools42/x86_64-w64-mingw32.static.posix/bin/gcc.exe
       CXX: C:/rtools42/x86_64-w64-mingw32.static.posix/bin/g++.exe
       EXTENSION_CONFIGS: '${GITHUB_WORKSPACE}/.github/config/bundled_extensions.cmake'
       DUCKDB_CAPABILITIES: 'httplib loadable_extensions'
     steps:
       - name: "Checkout"
         uses: duckdb/duckdb-ci/.github/actions/checkout@main
         with:
           runner_provider: ${{ inputs.runner_provider }}
           ref: ${{ inputs.duckdb_commit }}

       - uses: actions/setup-python@v6
         with:
           python-version: '3.12'

       - name: Setup Rtools
         uses: r-lib/actions/setup-r@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2.12.1
         with:
           r-version: devel
           update-rtools: true
           rtools-version: '42'

       - name: Dependencies
         shell: bash
         run: |
           python scripts/ci/retry.py -- choco install \
             ccache \
             make \
             --no-progress

       - uses: ./.github/actions/ccache-action

       - name: Build Environment
         shell: bash
         run: |
           {
             # bash from Git
             echo 'C:/Program Files/Git/bin'
             # make, ninja and ccache from Chocolatey
             echo 'C:/ProgramData/Chocolatey/bin'
             # gcc and g++ from Rtools42
             echo 'C:/rtools42/x86_64-w64-mingw32.static.posix/bin'
           } >> "${GITHUB_PATH}"

       - name: Build Environment Check
         shell: bash
         run: |
           where bash
           bash --version
           where make
           make --version
           where ninja
           ninja --version
           where ccache
           ccache --version
           where g++
           g++ --version
           echo %PATH%

       - name: MinGW Runtime Diagnostics
         shell: bash
         run: |
           set -x
           echo "PWD=$PWD"
           echo "PATH=$PATH"
           where python
           python --version
           echo "Nearby DLLs and EXEs:"
           find build/release -maxdepth 3 \( -name '*.dll' -o -name '*.exe' \) | sort || true
           /c/Windows/System32/cmd.exe /c "where libstdc++-6.dll" || true
           /c/Windows/System32/cmd.exe /c "where libgcc_s_seh-1.dll" || true
           /c/Windows/System32/cmd.exe /c "where libwinpthread-1.dll" || true

       - name: Build
         run: python scripts/ci/retry.py -- make release

       - name: Test
         if: ${{ !inputs.skip_tests }}
         run: python build/release/test/run.py


       - name: Deploy static libraries
         shell: bash
         env:
           AWS_ENDPOINT_URL: ${{ secrets.S3_DUCKDB_STAGING_ENDPOINT }}
           AWS_ACCESS_KEY_ID: ${{ secrets.S3_DUCKDB_STAGING_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.S3_DUCKDB_STAGING_KEY }}
         run: |
           make static-libs-release-artifact ARTIFACT_SUFFIX=windows-mingw STATIC_LIBRARIES="build/release/src/libduckdb_static.a build/release/src/libduckdb_shell.a build/release/src/main/http/libduckdb_httplib.a build/release/src/main/extension/libduckdb_loadable_extensions.a build/release/extension/*/lib*_extension.a"
           ./scripts/upload-assets-to-staging.sh github_release duckdb-static-libs-windows-mingw.tar.gz

       - uses: actions/upload-artifact@v7
         with:
           path: duckdb-static-libs-windows-mingw.tar.gz
           archive: false

       - uses: actions/upload-artifact@v7
         with:
           name: release-core-extensions-windows-mingw
           path: build/release/repository
           if-no-files-found: error

       - name: Package release artifact
         shell: bash
         run: make release-artifact RELEASE_ARTIFACT_TARBALL=build/windows-release-mingw-build.tar.gz

       - uses: actions/upload-artifact@v7
         with:
           path: build/windows-release-mingw-build.tar.gz
           if-no-files-found: error
           archive: false