Skip to content

Commit af77c3b

Browse files
baileympearsonbaileympearson
authored
chore(NODE-6243): move Node release tooling to drivers-github-tools (#45)
1 parent b92ef30 commit af77c3b

File tree

7 files changed

+284
-40
lines changed

7 files changed

+284
-40
lines changed

‎gpg-sign/action.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ runs:
1616
id: filenames
1717
run: |
1818
set -eux
19-
export FILENAMES=${{inputs.filenames}}
19+
FILENAMES="${{inputs.filenames}}"
2020
if [[ $FILENAMES =~ '*' ]]; then
2121
FILENAMES=$(ls $FILENAMES | sed -e ':a' -e 'N' -e '$!ba' -e 's/\n/ /g')
2222
fi

‎node/generate_release.mjs

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
import { readFileSync } from "node:fs";
2+
import { join, dirname } from "node:path";
3+
import { fileURLToPath } from "node:url";
4+
5+
const __dirname = dirname(fileURLToPath(import.meta.url));
6+
7+
const args = process.argv.slice(2);
8+
if (!(args.length === 3 || args.length === 4)) {
9+
console.error(
10+
`usage: generate_release.js <package> <branch> <npm tag> <optional silk asset group>`,
11+
);
12+
process.exit(1);
13+
}
14+
15+
const [npmPackage, branch, tag, assetGroup] = args;
16+
17+
const isNative =
18+
npmPackage === "kerberos" || npmPackage === "mongodb-client-encryption";
19+
const template = readFileSync(
20+
join(__dirname, "./release_template.yml"),
21+
"utf-8",
22+
);
23+
24+
const EVERGREEN_PROJECTS = {
25+
mongodb: "mongo-node-driver-next",
26+
bson: "js-bson",
27+
};
28+
29+
const generated = template
30+
.replaceAll("RELEASE_BRANCH", branch)
31+
.replaceAll("RELEASE_PACKAGE", npmPackage)
32+
.replaceAll("RELEASE_TAG", tag)
33+
.replaceAll("EVERGREEN_PROJECT", EVERGREEN_PROJECTS[npmPackage] ?? "")
34+
.replaceAll("IGNORE_INSTALL_SCRIPTS", isNative)
35+
.replaceAll("SILK_ASSET_GROUP", assetGroup ? `'${assetGroup}'` : "''");
36+
37+
const project = EVERGREEN_PROJECTS[npmPackage];
38+
if (!project) {
39+
const final = generated
40+
.split("\n")
41+
.filter((line) => !line.includes("evergreen"))
42+
.join("\n");
43+
process.stdout.write(final);
44+
process.exit();
45+
}
46+
47+
process.stdout.write(generated);

‎node/get_version_info/action.yml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
name: Publish Release Asset to S3
2+
description: "Publish Asset to S3"
3+
inputs:
4+
npm_package_name:
5+
description: the npm package name
6+
required: true
7+
8+
runs:
9+
using: composite
10+
steps:
11+
- name: Get release version and release package file name
12+
id: get_version
13+
shell: bash
14+
run: |
15+
package_version=$(jq --raw-output '.version' package.json)
16+
echo "package_version=${package_version}" >> "$GITHUB_ENV"
17+
echo "package_file=${{ inputs.npm_package_name }}-${package_version}.tgz" >> "$GITHUB_ENV"
18+
echo "commit=$(git rev-parse HEAD)" >> $GITHUB_ENV

‎node/publish_asset_to_s3/action.yml

Lines changed: 0 additions & 39 deletions
This file was deleted.

‎node/release_template.yml

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
on:
2+
push:
3+
branches: [RELEASE_BRANCH]
4+
workflow_dispatch: {}
5+
6+
permissions:
7+
contents: write
8+
pull-requests: write
9+
id-token: write
10+
11+
name: release-RELEASE_TAG
12+
13+
jobs:
14+
release_please:
15+
runs-on: ubuntu-latest
16+
outputs:
17+
release_created: ${{ steps.release.outputs.release_created }}
18+
steps:
19+
- id: release
20+
uses: googleapis/release-please-action@v4
21+
with:
22+
target-branch: RELEASE_BRANCH
23+
24+
build:
25+
needs: [release_please]
26+
name: "Perform any build or bundling steps, as necessary."
27+
uses: ./.github/workflows/build.yml
28+
29+
ssdlc:
30+
needs: [release_please, build]
31+
permissions:
32+
# required for all workflows
33+
security-events: write
34+
id-token: write
35+
contents: write
36+
environment: release
37+
runs-on: ubuntu-latest
38+
steps:
39+
- uses: actions/checkout@v4
40+
41+
- name: Install Node and dependencies
42+
uses: mongodb-labs/drivers-github-tools/node/setup@v2
43+
with:
44+
ignore_install_scripts: IGNORE_INSTALL_SCRIPTS
45+
46+
- name: Load version and package info
47+
uses: mongodb-labs/drivers-github-tools/node/get_version_info@v2
48+
with:
49+
npm_package_name: RELEASE_PACKAGE
50+
51+
- name: actions/compress_sign_and_upload
52+
uses: mongodb-labs/drivers-github-tools/node/sign_node_package@v2
53+
with:
54+
aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
55+
aws_region_name: us-east-1
56+
aws_secret_id: ${{ secrets.AWS_SECRET_ID }}
57+
npm_package_name: RELEASE_PACKAGE
58+
dry_run: ${{ needs.release_please.outputs.release_created == '' }}
59+
60+
- name: Copy sbom file to release assets
61+
shell: bash
62+
if: ${{ SILK_ASSET_GROUP == '' }}
63+
run: cp sbom.json ${{ env.S3_ASSETS }}/sbom.json
64+
65+
# only used for mongodb-client-encryption
66+
- name: Augment SBOM and copy to release assets
67+
if: ${{ SILK_ASSET_GROUP != '' }}
68+
uses: mongodb-labs/drivers-github-tools/sbom@v2
69+
with:
70+
silk_asset_group: SILK_ASSET_GROUP
71+
sbom_file_name: sbom.json
72+
73+
- name: Generate authorized pub report
74+
uses: mongodb-labs/drivers-github-tools/full-report@v2
75+
with:
76+
release_version: ${{ env.package_version }}
77+
product_name: RELEASE_PACKAGE
78+
sarif_report_target_ref: RELEASE_BRANCH
79+
third_party_dependency_tool: n/a
80+
dist_filenames: artifacts/*
81+
token: ${{ github.token }}
82+
sbom_file_name: sbom.json
83+
evergreen_project: EVERGREEN_PROJECT
84+
evergreen_commit: ${{ env.commit }}
85+
86+
- uses: mongodb-labs/drivers-github-tools/upload-s3-assets@v2
87+
with:
88+
version: ${{ env.package_version }}
89+
product_name: RELEASE_PACKAGE
90+
dry_run: ${{ needs.release_please.outputs.release_created == '' }}
91+
92+
publish:
93+
needs: [release_please, ssdlc, build]
94+
environment: release
95+
runs-on: ubuntu-latest
96+
steps:
97+
- uses: actions/checkout@v4
98+
99+
- name: Install Node and dependencies
100+
uses: mongodb-labs/drivers-github-tools/node/setup@v2
101+
102+
- run: npm publish --provenance --tag=RELEASE_TAG
103+
if: ${{ needs.release_please.outputs.release_created }}
104+
env:
105+
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

‎node/setup/action.yml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: Setup
2+
description: "Installs node, driver dependencies, and builds source"
3+
inputs:
4+
ignore_install_scripts:
5+
description: Should we ignore postinstall scripts?
6+
default: "false"
7+
8+
runs:
9+
using: composite
10+
steps:
11+
- uses: actions/setup-node@v4
12+
with:
13+
node-version: "lts/*"
14+
cache: "npm"
15+
registry-url: "https://registry.npmjs.org"
16+
- run: npm install -g npm@latest
17+
shell: bash
18+
- run: npm clean-install
19+
if: ${{ inputs.ignore_install_scripts == 'false' }}
20+
shell: bash
21+
- run: npm clean-install --ignore-scripts
22+
if: ${{ inputs.ignore_install_scripts == 'true' }}
23+
shell: bash

‎node/sign_node_package/action.yml

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
name: Compress, Sign and Upload to GH Release
2+
description: "Compresses package and signs with garasign and uploads to GH release"
3+
4+
inputs:
5+
aws_role_arn:
6+
description: "AWS role input for drivers-github-tools/gpg-sign@v2"
7+
required: true
8+
aws_region_name:
9+
description: "AWS region name input for drivers-github-tools/gpg-sign@v2"
10+
required: true
11+
aws_secret_id:
12+
description: "AWS secret id input for drivers-github-tools/gpg-sign@v2"
13+
required: true
14+
npm_package_name:
15+
description: "The name for the npm package this repository represents"
16+
required: true
17+
dry_run:
18+
description: "Should we upload files to the release?"
19+
required: false
20+
default: "false"
21+
artifact_directory:
22+
description: The directory in which to output signatures.
23+
default: artifacts
24+
sign_native:
25+
description: Download and sign native packages
26+
default: "false"
27+
28+
runs:
29+
using: composite
30+
steps:
31+
- uses: actions/download-artifact@v4
32+
if: ${{ inputs.sign_native == 'true' }}
33+
34+
- run: npm pack
35+
shell: bash
36+
37+
- name: Make signatures directory
38+
shell: bash
39+
run: |
40+
mkdir ${{ inputs.artifact_directory }}
41+
42+
- name: Load version and package info
43+
uses: mongodb-labs/drivers-github-tools/node/get_version_info@v2
44+
with:
45+
npm_package_name: ${{ inputs.npm_package_name }}
46+
47+
- name: Set up drivers-github-tools
48+
uses: mongodb-labs/drivers-github-tools/setup@v2
49+
with:
50+
aws_region_name: ${{ inputs.aws_region_name }}
51+
aws_role_arn: ${{ inputs.aws_role_arn }}
52+
aws_secret_id: ${{ inputs.aws_secret_id }}
53+
54+
- name: Determine what files to sign (native packages, works with glob patterns of build artifacts)
55+
if: ${{ inputs.sign_native == 'true' }}
56+
shell: bash
57+
run: |
58+
FILENAMES="build-*/*.tar.gz"
59+
if [[ $FILENAMES =~ '*' ]]; then
60+
FILENAMES=$(ls $FILENAMES | sed -e ':a' -e 'N' -e '$!ba' -e 's/\n/ /g')
61+
fi
62+
FILENAMES="$FILENAMES ${{ env.package_file }}"
63+
echo "FILES_TO_SIGN=${FILENAMES}" >> "$GITHUB_ENV"
64+
65+
- name: Determine what files to sign (non-native packages, with only the release tarball)
66+
if: ${{ inputs.sign_native != 'true' }}
67+
shell: bash
68+
run: |
69+
FILENAMES="${{ env.package_file }}"
70+
echo "FILES_TO_SIGN=${FILENAMES}" >> "$GITHUB_ENV"
71+
72+
- name: Create detached signature
73+
uses: mongodb-labs/drivers-github-tools/gpg-sign@v2
74+
with:
75+
filenames: ${{ env.FILES_TO_SIGN }}
76+
env:
77+
RELEASE_ASSETS: ${{ inputs.artifact_directory }}
78+
79+
- name: Copy the tarballs to the artifacts directory
80+
shell: bash
81+
run: |
82+
for filename in ${{ env.FILES_TO_SIGN }}; do cp ${filename} artifacts/; done
83+
ls -la artifacts/
84+
85+
- name: "Upload release artifacts"
86+
if: ${{ inputs.dry_run == false }}
87+
run: gh release upload v${{ env.package_version }} artifacts/*.*
88+
shell: bash
89+
env:
90+
GH_TOKEN: ${{ github.token }}

0 commit comments

Comments
 (0)