PHPC-2384, PHPC-2399, PHPC-2400: Publish SSDLC assets on release #1584

alcaeus · 2024-06-13T10:48:30Z

This PR fixes the following issues:

In order to have all resources available when we publish SSDLC assets, it is necessary to run the static analysis and release packaging workflows as part of the release workflow. Through this we can ensure that up-to-date code scanning results are available for export, and that we can fetch all generated files to add them to the authorised publication document.

Along with the necessary changes to publish all assets, I've also made a couple of improvements related to the release process:

The token generation and checkout now uses the secure-checkout action from drivers-github-tools
Creating version bump commits and the release tag are also handled through actions from drivers-github-tools
The changelog added to package.xml is no longer read from the tag, but rather generated using the GitHub API from the existing tag. This cleans up the tag message in the process
Windows packages are now built in a reusable workflow that is called as part of a matrix. The advantage is that signing and attaching a Windows build will now no longer wait until all builds have completed, but only until that particular build is done. This should make better use of available action runners
Build artifacts are no longer uploaded to save on space

For a sample workflow run, see this example in my fork. Note that I've only built Windows packages for a single version to reduce resource usage.

alcaeus · 2024-06-13T10:49:03Z

.github/actions/windows/prepare-build/action.yml

@@ -41,7 +41,7 @@ runs:
    - name: Enable Developer Command Prompt
      uses: ilammy/msvc-dev-cmd@v1
      with:
-        arch: ${{ matrix.arch }}
+        arch: ${{ inputs.arch }}


This happened to "just work" before, but broke down once the action was used in a job that didn't use the matrix strategy. Took me longer to figure out than I care to admit...

alcaeus · 2024-06-13T10:52:21Z

bin/update-release-version.php

@@ -140,7 +140,8 @@ function get_next_minor_version(array $versions): array
    ];
 }

-if ($argc !== 2) {
+// Allow 2 arguments as the bump-version action always passes a version number, even when not needed
+if (! in_array($argc, [2, 3])) {


The version bump script always passes the version number as an argument, so I decided to allow an additional argument without using it.

jmikola

Some questions and one optional suggestion.

jmikola · 2024-06-13T14:37:02Z

.github/workflows/package-release.yml

+      arch: ${{ matrix.arch }}
+      ts: ${{ matrix.ts }}
+      upload_release_asset: true
+    secrets: inherit


Noted: https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idsecretsinherit

jmikola · 2024-06-13T14:37:36Z

.github/workflows/package-release.yml

      - name: "Upload release artifacts"
-        run: gh release upload ${{ github.ref_name }} ${{ env.PACKAGE_FILE }} ${{ env.PACKAGE_FILE }}.sig
-        continue-on-error: true


Was the removal of continue-on-error: true intentional?

It was. I put it there initially because any tag build would trigger the package workflow, regardless of whether there was a GitHub release to go with it. With the change, the package workflow is only triggered from the release workflow, so if the upload fails we want to be alerted instead of the workflow run passing as if nothing went wrong.

jmikola · 2024-06-13T14:53:28Z

.github/workflows/release.yml

+          # Use get-version as a dummy as a version_bump_script is required
+          # We run the bump script manually earlier so we can sanity-check the version number and print nice output
+          version_bump_script: "./bin/update-release-version.php get-version"
+          commit_template: 'Package ${VERSION}'


I noted that bump-version/action.yml uses envsubst. Does that guarantee that we won't get any unexpected substitutions on the following line when COMMIT_MESSAGE=$COMMIT_MESSAGE is run?

I realize this is unlikely given the values we'd use for commit_template.

I'll bring this up with @blink1073, but I don't think so.

As I understand it, it is only substituting what you have in the commit template, so VERSION in this case.

Ah, I was misunderstanding and thought that the COMMIT_MESSAGE= line might inadvertently perform another substitution if a $VAR string remained after envsubst (e.g. malformed $VERSION value).

But it's clear that $COMMIT_MESSAGE is the only substitution happening there. And that line is the standard snippet to append to the GitHub environment. Sorry for the noise.

.github/workflows/build-windows-package.yml

jmikola · 2024-06-13T14:59:32Z

.github/workflows/release.yml


      - name: "Set summary"
        run: |
          echo '🚀 Created tag and drafted release for version [${{ inputs.version }}](${{ env.RELEASE_URL }})' >> $GITHUB_STEP_SUMMARY
          echo '✍️ You may now update the release notes and publish the release when ready' >> $GITHUB_STEP_SUMMARY
+
+  static-analysis:
+    needs: prepare-release


Noted that jobs.<job_id>.needs accepts either a string or array. I was confused at first because you used an array for a single value in build-windows-package.yml.

jmikola · 2024-06-13T15:11:05Z

.github/workflows/release.yml

+      - name: "Upload SBOM as release artifact"
+        run: gh release upload ${{ inputs.version }} ${{ env.S3_ASSETS }}/cyclonedx.sbom.json
+        # Silk currently errors out when downloading the SBOM. Don't let this fail the entire build
+        continue-on-error: true


Noted this is also in place for "Download SBOM file from Silk".

Is this expected to be permanent to make the release process resilient to Silk outages?

Yes, although I've only added it here since the inventory asset group for PHPC didn't have an SBOM Lite file associated with it. It works now but forgot to remove this.
Edit: this is removed now.

alcaeus added 6 commits June 12, 2024 10:23

Run packaging manually from release workflow

f7a7f46

Run static analysis for tag manually from release workflow

d5021c1

Publish SSDLC assets after release

af09ea9

Use secure-checkout action to generate token and run checkout

d804694

Use API to generate changelog for PECL package

cf85c7c

Use inputs.version to pass version

c53c215

alcaeus requested a review from jmikola June 13, 2024 10:48

alcaeus added 5 commits June 13, 2024 12:49

Use bump and tag actions from drivers-github-tools

de9a496

Remove build artifacts and require release asset upload to succeed

235978e

Continue publishing SSDLC assets if SBOM download fails

a38f678

Extract building Windows Package to reusable workflow

0b11963

Remove unnecessary release files

03dbe44

alcaeus force-pushed the publish-ssdlc-assets-on-release branch from d36da66 to 03dbe44 Compare June 13, 2024 10:49

alcaeus commented Jun 13, 2024

View reviewed changes

alcaeus changed the base branch from master to v1.19 June 13, 2024 11:13

alcaeus changed the title ~~PHPC-2384, PHPC-2399, PHPC-2340: Publish SSDLC assets on publish~~ PHPC-2384, PHPC-2399, PHPC-2340: Publish SSDLC assets on release Jun 13, 2024

alcaeus changed the title ~~PHPC-2384, PHPC-2399, PHPC-2340: Publish SSDLC assets on release~~ PHPC-2384, PHPC-2399, PHPC-2400: Publish SSDLC assets on release Jun 13, 2024

jmikola approved these changes Jun 13, 2024

View reviewed changes

alcaeus added 2 commits June 13, 2024 17:17

Apply suggestion from code review

5441f3b

Let publish job error out when SBOM download fails

d05c633

alcaeus enabled auto-merge (squash) June 13, 2024 15:18

alcaeus merged commit 9f0789f into mongodb:v1.19 Jun 13, 2024
53 checks passed

mongodb-php-bot mentioned this pull request Jun 13, 2024

Merge v1.19 into master #1585

Merged

alcaeus deleted the publish-ssdlc-assets-on-release branch June 13, 2024 15:32

jmikola mentioned this pull request Jun 13, 2024

PHPORM-185, PHPORM-191, PHPORM-192: Publish SSDLC assets on release mongodb/laravel-mongodb#3004

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

PHPC-2384, PHPC-2399, PHPC-2400: Publish SSDLC assets on release #1584

PHPC-2384, PHPC-2399, PHPC-2400: Publish SSDLC assets on release #1584

Uh oh!

alcaeus commented Jun 13, 2024 •

edited

Loading

Uh oh!

alcaeus Jun 13, 2024

Uh oh!

alcaeus Jun 13, 2024

Uh oh!

jmikola left a comment

Uh oh!

jmikola Jun 13, 2024

Uh oh!

jmikola Jun 13, 2024

Uh oh!

alcaeus Jun 13, 2024

Uh oh!

jmikola Jun 13, 2024

Uh oh!

alcaeus Jun 13, 2024

Uh oh!

blink1073 Jun 13, 2024

Uh oh!

jmikola Jun 13, 2024

Uh oh!

Uh oh!

jmikola Jun 13, 2024

Uh oh!

jmikola Jun 13, 2024

Uh oh!

alcaeus Jun 13, 2024 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

PHPC-2384, PHPC-2399, PHPC-2400: Publish SSDLC assets on release #1584

PHPC-2384, PHPC-2399, PHPC-2400: Publish SSDLC assets on release #1584

Uh oh!

Conversation

alcaeus commented Jun 13, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jmikola left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

alcaeus Jun 13, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

alcaeus commented Jun 13, 2024 •

edited

Loading

alcaeus Jun 13, 2024 •

edited

Loading