Skip to content

Commit 36b0da7

Browse files
baileympearsonbaileympearson
authored
chore: full SSDLC compliance workflow (#179)
1 parent 2e71058 commit 36b0da7

File tree

10 files changed

+710
-899
lines changed

10 files changed

+710
-899
lines changed

‎.evergreen/config.yml

Lines changed: 0 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -96,14 +96,6 @@ functions:
9696
env:
9797
PROJECT_DIRECTORY: ${PROJECT_DIRECTORY}
9898
NODE_GITHUB_TOKEN: ${github_token}
99-
run prebuild and force publish:
100-
- command: shell.exec
101-
type: test
102-
params:
103-
working_dir: src
104-
script: >
105-
${PREPARE_SHELL}
106-
NODE_FORCE_PUBLISH=1 NODE_GITHUB_TOKEN=${github_token} ${PROJECT_DIRECTORY}/.evergreen/run-prebuild.sh
10799
install dependencies:
108100
- command: subprocess.exec
109101
type: setup
@@ -138,65 +130,8 @@ tasks:
138130
commands:
139131
- func: install dependencies
140132
- func: run prebuild
141-
- name: run-prebuild-force-publish
142-
commands:
143-
- func: install dependencies
144-
- func: run prebuild and force publish
145133

146134
buildvariants:
147-
- name: macos
148-
display_name: 'macOS 10.14'
149-
run_on: macos-1014
150-
tasks:
151-
- run-prebuild
152-
- run-prebuild-force-publish
153-
expansions:
154-
NODE_LTS_VERSION: 14
155-
NPM_VERSION: 9
156-
- name: macos-m1
157-
display_name: MacOS M1
158-
run_on: macos-1100-arm64
159-
tasks:
160-
- run-prebuild
161-
- run-prebuild-force-publish
162-
expansions:
163-
NODE_LTS_VERSION: 18
164-
- name: windows-x64
165-
display_name: 'Windows 2016'
166-
run_on: windows-64-vs2017-test
167-
tasks:
168-
- run-prebuild
169-
- run-prebuild-force-publish
170-
- name: rhel8-s390x
171-
display_name: 'RHEL 8 s390x'
172-
run_on: rhel83-zseries-small
173-
expansions:
174-
has_packages: true
175-
packager_distro: rhel8
176-
packager_arch: s390x
177-
tasks:
178-
- run-prebuild
179-
- run-prebuild-force-publish
180-
- name: ubuntu1804-64
181-
display_name: 'Ubuntu 18.04 64-bit'
182-
run_on: ubuntu1804-test
183-
expansions:
184-
has_packages: true
185-
packager_distro: ubuntu1804
186-
packager_arch: x86_64
187-
tasks:
188-
- run-prebuild
189-
- run-prebuild-force-publish
190-
- name: ubuntu1804-arm64
191-
display_name: 'Ubuntu 18.04 arm64'
192-
run_on: ubuntu1804-arm64-build
193-
expansions:
194-
has_packages: true
195-
packager_distro: ubuntu1804
196-
packager_arch: arm64
197-
tasks:
198-
- run-prebuild
199-
- run-prebuild-force-publish
200135
- name: ubuntu2204-64
201136
display_name: 'Ubuntu 22.04 64-bit'
202137
run_on: ubuntu2204-small

‎.evergreen/run-prebuild.sh

Lines changed: 3 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -10,42 +10,6 @@ export PATH="/opt/mongodbtoolchain/v2/bin:$PATH"
1010

1111
echo "Node Version $(node -v)"
1212

13-
get_version_at_git_rev () {
14-
local REV=$1
15-
local VERSION
16-
VERSION=$(node -r child_process -e "console.log(JSON.parse(child_process.execSync('git show $REV:./package.json', { encoding: 'utf8' })).version);")
17-
echo "$VERSION"
18-
}
19-
20-
run_prebuild() {
21-
set +o xtrace # Don't log the token
22-
if [[ -z $NODE_GITHUB_TOKEN ]];then
23-
echo "No github token set. Cannot run prebuild."
24-
exit 1
25-
else
26-
echo "Github token detected. Running prebuild."
27-
npm run prebuild -- -u "${NODE_GITHUB_TOKEN}"
28-
echo "Prebuild's successfully submitted"
29-
fi
30-
set -o xtrace
31-
}
32-
33-
34-
VERSION_AT_HEAD=$(get_version_at_git_rev "HEAD")
35-
VERSION_AT_HEAD_1=$(get_version_at_git_rev "HEAD~1")
36-
37-
if [[ -n $NODE_FORCE_PUBLISH ]]; then
38-
echo 'NODE_FORCE_PUBLISH detected'
39-
echo "Beginning prebuild"
40-
run_prebuild
41-
elif [[ $VERSION_AT_HEAD != "$VERSION_AT_HEAD_1" ]]; then
42-
echo "Difference is package version ($VERSION_AT_HEAD_1 -> $VERSION_AT_HEAD)"
43-
echo "Beginning prebuild"
44-
run_prebuild
45-
else
46-
echo "No difference is package version ($VERSION_AT_HEAD_1 -> $VERSION_AT_HEAD)"
47-
echo "Will prebuild without submit"
48-
npm run prebuild
49-
echo "Local prebuild successful."
50-
ls prebuilds
51-
fi
13+
npm run prebuild
14+
echo "Local prebuild successful."
15+
ls prebuilds

‎.github/actions/setup/action.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,5 +11,5 @@ runs:
1111
registry-url: 'https://registry.npmjs.org'
1212
- run: npm install -g npm@latest
1313
shell: bash
14-
- run: npm clean-install
14+
- run: npm clean-install --ignore-scripts
1515
shell: bash

‎.github/docker/Dockerfile.glibc

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
FROM ubuntu:bionic AS build
2+
3+
# Possible values: s390x, arm64, x64
4+
ARG NODE_ARCH
5+
ADD https://nodejs.org/dist/v16.20.1/node-v16.20.1-linux-${NODE_ARCH}.tar.gz /
6+
RUN mkdir -p /nodejs && tar -xzf /node-v16.20.1-linux-${NODE_ARCH}.tar.gz --strip-components=1 -C /nodejs
7+
ENV PATH=$PATH:/nodejs/bin
8+
9+
WORKDIR /kerberos
10+
COPY . .
11+
12+
RUN apt-get -qq update && apt-get -qq install -y python3 build-essential libkrb5-dev && ldd --version
13+
14+
RUN npm clean-install --ignore-scripts
15+
RUN npm run prebuild
16+
17+
FROM scratch
18+
19+
COPY --from=build /kerberos/prebuilds/ /

‎.github/workflows/build.yml

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
on:
2+
pull_request:
3+
branches: [main]
4+
workflow_dispatch: {}
5+
workflow_call: {}
6+
7+
name: Build and Test
8+
9+
permissions:
10+
contents: write
11+
pull-requests: write
12+
id-token: write
13+
14+
jobs:
15+
host_builds:
16+
strategy:
17+
matrix:
18+
os: [macos-latest, windows-2019]
19+
runs-on: ${{ matrix.os }}
20+
steps:
21+
- uses: actions/checkout@v4
22+
23+
- name: Build ${{ matrix.os }} Prebuild
24+
run: |
25+
npm clean-install --ignore-scripts
26+
npm run prebuild
27+
28+
- id: upload
29+
name: Upload prebuild
30+
uses: actions/upload-artifact@v4
31+
with:
32+
name: build-${{ matrix.os }}
33+
path: prebuilds/
34+
if-no-files-found: 'error'
35+
retention-days: 1
36+
compression-level: 0
37+
38+
container_builds:
39+
outputs:
40+
artifact_id: ${{ steps.upload.outputs.artifact-id }}
41+
runs-on: ubuntu-latest
42+
strategy:
43+
matrix:
44+
linux_arch: [s390x, arm64, amd64]
45+
steps:
46+
- uses: actions/checkout@v4
47+
48+
- name: Set up QEMU
49+
uses: docker/setup-qemu-action@v3
50+
51+
- name: Set up Docker Buildx
52+
uses: docker/setup-buildx-action@v3
53+
54+
- name: Run Buildx
55+
run: |
56+
docker buildx create --name builder --bootstrap --use
57+
docker buildx build --platform linux/${{ matrix.linux_arch }} --build-arg NODE_ARCH=${{ matrix.linux_arch == 'amd64' && 'x64' || matrix.linux_arch }} --output type=local,dest=./prebuilds,platform-split=false -f ./.github/docker/Dockerfile.glibc .
58+
59+
- id: upload
60+
name: Upload prebuild
61+
uses: actions/upload-artifact@v4
62+
with:
63+
name: build-linux-${{ matrix.linux_arch }}
64+
path: prebuilds/
65+
if-no-files-found: 'error'
66+
retention-days: 1
67+
compression-level: 0

‎.github/workflows/release.yml

Lines changed: 85 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -8,23 +8,98 @@ permissions:
88
pull-requests: write
99
id-token: write
1010

11-
name: release
11+
name: release-latest
1212

1313
jobs:
14-
release-please:
14+
release_please:
1515
runs-on: ubuntu-latest
16+
outputs:
17+
release_created: ${{ steps.release.outputs.release_created }}
1618
steps:
1719
- id: release
1820
uses: googleapis/release-please-action@v4
21+
with:
22+
target-branch: main
23+
24+
build:
25+
needs: [release_please]
26+
name: "Perform any build or bundling steps, as necessary."
27+
uses: ./.github/workflows/build.yml
28+
29+
ssdlc:
30+
needs: [release_please, build]
31+
permissions:
32+
# required for all workflows
33+
security-events: write
34+
id-token: write
35+
contents: write
36+
environment: release
37+
runs-on: ubuntu-latest
38+
steps:
39+
- uses: actions/checkout@v4
40+
41+
- name: Install Node and dependencies
42+
uses: mongodb-labs/drivers-github-tools/node/setup@v2
43+
with:
44+
ignore_install_scripts: true
45+
46+
- name: Load version and package info
47+
uses: mongodb-labs/drivers-github-tools/node/get_version_info@v2
48+
with:
49+
npm_package_name: kerberos
50+
51+
- name: actions/compress_sign_and_upload
52+
uses: mongodb-labs/drivers-github-tools/node/sign_node_package@v2
53+
with:
54+
aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
55+
aws_region_name: us-east-1
56+
aws_secret_id: ${{ secrets.AWS_SECRET_ID }}
57+
npm_package_name: kerberos
58+
dry_run: ${{ needs.release_please.outputs.release_created == '' }}
59+
sign_native: true
60+
61+
- name: Copy sbom file to release assets
62+
shell: bash
63+
if: ${{ '' == '' }}
64+
run: cp sbom.json ${{ env.S3_ASSETS }}/sbom.json
65+
66+
# only used for mongodb-client-encryption
67+
- name: Augment SBOM and copy to release assets
68+
if: ${{ '' != '' }}
69+
uses: mongodb-labs/drivers-github-tools/sbom@v2
70+
with:
71+
silk_asset_group: ''
72+
sbom_file_name: sbom.json
73+
74+
- name: Generate authorized pub report
75+
uses: mongodb-labs/drivers-github-tools/full-report@v2
76+
with:
77+
release_version: ${{ env.package_version }}
78+
product_name: kerberos
79+
sarif_report_target_ref: main
80+
third_party_dependency_tool: n/a
81+
dist_filenames: artifacts/*
82+
token: ${{ github.token }}
83+
sbom_file_name: sbom.json
84+
85+
- uses: mongodb-labs/drivers-github-tools/upload-s3-assets@v2
86+
with:
87+
version: ${{ env.package_version }}
88+
product_name: kerberos
89+
dry_run: ${{ needs.release_please.outputs.release_created == '' }}
90+
91+
publish:
92+
needs: [release_please, ssdlc, build]
93+
environment: release
94+
runs-on: ubuntu-latest
95+
steps:
96+
- uses: actions/checkout@v4
97+
98+
- name: Install Node and dependencies
99+
uses: mongodb-labs/drivers-github-tools/node/setup@v2
19100

20-
# If release-please created a release, publish to npm
21-
- if: ${{ steps.release.outputs.release_created }}
22-
uses: actions/checkout@v4
23-
- if: ${{ steps.release.outputs.release_created }}
24-
name: actions/setup
25-
uses: ./.github/actions/setup
26-
- if: ${{ steps.release.outputs.release_created }}
27-
run: npm publish --provenance
101+
- run: npm publish --provenance --tag=latest
102+
if: ${{ needs.release_please.outputs.release_created }}
28103
env:
29104
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
30105

‎README.md

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,49 @@ Now you can install `kerberos` with the following:
4545
npm install kerberos
4646
```
4747

48+
#### Prebuild Platforms
49+
50+
Below are the platforms that are available as prebuilds on each github release.
51+
`prebuild-install` downloads these automatically depending on the platform you are running npm install on.
52+
53+
- Linux GLIBC 2.23 or later
54+
- s390x
55+
- arm64
56+
- x64
57+
- MacOS universal binary
58+
- x64
59+
- arm64
60+
- Windows
61+
- x64
62+
63+
### Release Integrity
64+
65+
Releases are created automatically and signed using the [Node team's GPG key](https://pgp.mongodb.com/node-driver.asc). This applies to the git tag as well as all release packages provided as part of a GitHub release. To verify the provided packages, download the key and import it using gpg:
66+
67+
```
68+
gpg --import node-driver.asc
69+
```
70+
71+
The GitHub release contains a detached signature file for the NPM package (named
72+
`kerberos-X.Y.Z.tgz.sig`).
73+
74+
The following command returns the link npm package.
75+
```shell
76+
npm view [email protected] dist.tarball
77+
```
78+
79+
Using the result of the above command, a `curl` command can return the official npm package for the release.
80+
81+
To verify the integrity of the downloaded package, run the following command:
82+
```shell
83+
gpg --verify kerberos-X.Y.Z.tgz.sig kerberos-X.Y.Z.tgz
84+
```
85+
86+
>[!Note]
87+
No verification is done when using npm to install the package. To ensure release integrity when using npm, download the tarball manually from the GitHub release, verify the signature, then install the package from the downloaded tarball using npm install mongodb-X.Y.Z.tgz.
88+
89+
To verify the native `.node` packages, follow the same steps as above.
90+
4891
### Testing
4992

5093
Run the test suite using:

‎binding.gyp

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,15 @@
1313
'xcode_settings': {
1414
'GCC_ENABLE_CPP_EXCEPTIONS': 'YES',
1515
'CLANG_CXX_LIBRARY': 'libc++',
16-
'MACOSX_DEPLOYMENT_TARGET': '10.12'
16+
'MACOSX_DEPLOYMENT_TARGET': '10.12',
17+
"OTHER_CFLAGS": [
18+
"-arch x86_64",
19+
"-arch arm64"
20+
],
21+
"OTHER_LDFLAGS": [
22+
"-arch x86_64",
23+
"-arch arm64"
24+
]
1725
},
1826
'cflags!': [ '-fno-exceptions' ],
1927
'cflags_cc!': [ '-fno-exceptions' ],

0 commit comments

Comments
 (0)