Skip to content

Commit b172c2b

Browse files
baileympearsonbaileympearson
committed
test
1 parent c149e16 commit b172c2b

File tree

2 files changed

+117
-4
lines changed

2 files changed

+117
-4
lines changed

‎.github/actions/sign_and_upload_package/action.yml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,10 @@ inputs:
1414
npm_package_name:
1515
description: 'The name for the npm package this repository represents'
1616
required: true
17+
dry_run:
18+
description: 'Should we upload files to the release?'
19+
required: false
20+
default: 'true'
1721

1822
runs:
1923
using: composite
@@ -65,6 +69,7 @@ runs:
6569
run: ls -la artifacts/
6670

6771
- name: "Upload release artifacts"
72+
if: ${{ inputs.dry_run == false }}
6873
run: gh release upload v${{ steps.get_vars.outputs.package_version }} artifacts/*.*
6974
shell: bash
7075
env:

‎.github/workflows/build.yml

Lines changed: 112 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -79,22 +79,130 @@ jobs:
7979
- id: release
8080
uses: googleapis/release-please-action@v4
8181

82+
generate_sarif_report:
83+
environment: release
84+
runs-on: ubuntu-latest
85+
needs: [release_please]
86+
permissions:
87+
# required for all workflows
88+
security-events: write
89+
id-token: write
90+
contents: write
91+
92+
steps:
93+
- uses: actions/checkout@v4
94+
- name: Set up drivers-github-tools
95+
uses: mongodb-labs/drivers-github-tools/setup@v2
96+
with:
97+
aws_region_name: us-east-1
98+
aws_role_arn: ${{ secrets.aws_role_arn }}
99+
aws_secret_id: ${{ secrets.aws_secret_id }}
100+
101+
- name: "Generate Sarif Report"
102+
uses: mongodb-labs/drivers-github-tools/code-scanning-export@v2
103+
with:
104+
ref: main
105+
output-file: sarif-report.json
106+
107+
- name: Get release version and release package file name
108+
id: get_version
109+
shell: bash
110+
run: |
111+
package_version=$(jq --raw-output '.version' package.json)
112+
echo "package_version=${package_version}" >> "$GITHUB_OUTPUT"
113+
- name: actions/publish_asset_to_s3
114+
uses: mongodb-labs/drivers-github-tools/node/publish_asset_to_s3@v2
115+
with:
116+
version: ${{ steps.get_version.outputs.package_version }}
117+
product_name: mongodb-client-encryption
118+
file: sarif-report.json
119+
dry_run: ${{ needs.release_please.outputs.release_created == '' }}
120+
121+
generate_compliance_report:
122+
environment: release
123+
runs-on: ubuntu-latest
124+
needs: [release_please]
125+
permissions:
126+
# required for all workflows
127+
security-events: write
128+
id-token: write
129+
contents: write
130+
131+
steps:
132+
- uses: actions/checkout@v4
133+
- name: Set up drivers-github-tools
134+
uses: mongodb-labs/drivers-github-tools/setup@v2
135+
with:
136+
aws_region_name: us-east-1
137+
aws_role_arn: ${{ secrets.aws_role_arn }}
138+
aws_secret_id: ${{ secrets.aws_secret_id }}
139+
140+
- name: Get release version and release package file name
141+
id: get_version
142+
shell: bash
143+
run: |
144+
package_version=$(jq --raw-output '.version' package.json)
145+
echo "package_version=${package_version}" >> "$GITHUB_OUTPUT"
146+
147+
- name: Generate compliance report
148+
uses: mongodb-labs/drivers-github-tools/compliance-report@v2
149+
with:
150+
sbom_name: sbom.json # TODO - confirm sbom file name
151+
sarif_name: sarif-report.json
152+
security_report_location: tbd
153+
release_version: ${{ steps.get_version.outputs.package_version }}
154+
token: ${{ github.token }}
155+
156+
- name: actions/publish_asset_to_s3
157+
uses: mongodb-labs/drivers-github-tools/node/publish_asset_to_s3@v2
158+
with:
159+
version: ${{ steps.get_version.outputs.package_version }}
160+
product_name: mongodb-client-encryption
161+
file: ${{env.S3_ASSETS}}/ssdlc_compliance_report.txt
162+
dry_run: ${{ needs.release_please.outputs.release_created == '' }}
163+
82164
sign_and_upload:
83165
needs: [release_please]
84-
if: ${{ needs.release_please.outputs.release_created }}
85166
runs-on: ubuntu-latest
86167
environment: release
87168
steps:
88169
- uses: actions/checkout@v4
89170
- name: actions/setup
90171
uses: ./.github/actions/setup
172+
- name: Get release version and release package file name
173+
id: get_vars
174+
shell: bash
175+
run: |
176+
package_version=$(jq --raw-output '.version' package.json)
177+
echo "package_version=${package_version}" >> "$GITHUB_OUTPUT"
178+
echo "package_file=mongodb-${package_version}.tgz" >> "$GITHUB_OUTPUT"
91179
- name: actions/sign_and_upload_package
92180
uses: ./.github/actions/sign_and_upload_package
93181
with:
94182
aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
95183
aws_region_name: 'us-east-1'
96184
aws_secret_id: ${{ secrets.AWS_SECRET_ID }}
97185
npm_package_name: 'mongodb-client-encryption'
98-
- run: npm publish --provenance --tag=alpha
99-
env:
100-
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
186+
dry_run: ${{ needs.release_please.outputs.release_created == '' }}
187+
188+
- name: Generate authorized pub report
189+
uses: mongodb-labs/drivers-github-tools/authorized-pub@v2
190+
with:
191+
release_version: ${{ steps.get_version.outputs.package_version }}
192+
product_name: mongodb-client-encryption
193+
# <package> and <package>.sig
194+
filenames: artifacts/*
195+
token: ${{ github.token }}
196+
197+
- name: actions/publish_asset_to_s3
198+
uses: mongodb-labs/drivers-github-tools/node/publish_asset_to_s3@v2
199+
with:
200+
version: ${{ steps.get_version.outputs.package_version }}
201+
product_name: mongodb-client-encryption
202+
file: ${{env.S3_ASSETS}}/authorized-publication.txt
203+
dry_run: ${{ needs.release_please.outputs.release_created == '' }}
204+
205+
# - run: npm publish --provenance --tag=alpha
206+
# if: ${{ needs.release_please.outputs.release_created }}
207+
# env:
208+
# NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

0 commit comments

Comments
 (0)