Skip to content

Commit 35fd6b0

Browse files
baileympearsonbaileympearson
authored
chore(NODE-6212): generate sarif reports in releases and upload sbom lite to s3 [skip-ci] (#4143)
1 parent c1af6ad commit 35fd6b0

File tree

3 files changed

+151
-4
lines changed

3 files changed

+151
-4
lines changed

‎.github/workflows/codeql.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@ name: "CodeQL"
22

33
on:
44
push:
5-
branches: [ "main" ]
5+
branches: [ "main", "5.x" ]
66
pull_request:
7-
branches: [ "main" ]
7+
branches: [ "main", "5.x" ]
88

99
jobs:
1010
analyze:

‎.github/workflows/release-5.x.yml

Lines changed: 74 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ jobs:
2020
uses: googleapis/release-please-action@v4
2121
with:
2222
target-branch: 5.x
23-
23+
2424
compress_sign_and_upload:
2525
needs: [release_please]
2626
if: ${{ needs.release_please.outputs.release_created }}
@@ -40,3 +40,76 @@ jobs:
4040
- run: npm publish --provenance --tag=5x
4141
env:
4242
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
43+
44+
generate_sarif_report:
45+
environment: release
46+
runs-on: ubuntu-latest
47+
needs: [release_please]
48+
permissions:
49+
# required for all workflows
50+
security-events: write
51+
id-token: write
52+
contents: write
53+
54+
steps:
55+
- uses: actions/checkout@v4
56+
- name: Set up drivers-github-tools
57+
uses: mongodb-labs/drivers-github-tools/setup@v2
58+
with:
59+
aws_region_name: us-east-1
60+
aws_role_arn: ${{ secrets.aws_role_arn }}
61+
aws_secret_id: ${{ secrets.aws_secret_id }}
62+
63+
- name: "Generate Sarif Report"
64+
uses: mongodb-labs/drivers-github-tools/code-scanning-export@v2
65+
with:
66+
ref: 5.x
67+
output-file: sarif-report.json
68+
69+
- name: Get release version and release package file name
70+
id: get_version
71+
shell: bash
72+
run: |
73+
package_version=$(jq --raw-output '.version' package.json)
74+
echo "package_version=${package_version}" >> "$GITHUB_OUTPUT"
75+
- name: actions/publish_asset_to_s3
76+
uses: mongodb-labs/drivers-github-tools/node/publish_asset_to_s3@main
77+
with:
78+
version: ${{ steps.get_version.outputs.package_version }}
79+
product_name: node-mongodb-native
80+
file: sarif-report.json
81+
dry_run: ${{ needs.release_please.outputs.release_created == '' }}
82+
83+
upload_sbom_lite:
84+
environment: release
85+
runs-on: ubuntu-latest
86+
needs: [release_please]
87+
permissions:
88+
# required for all workflows
89+
security-events: write
90+
id-token: write
91+
contents: write
92+
93+
steps:
94+
- uses: actions/checkout@v4
95+
- name: Set up drivers-github-tools
96+
uses: mongodb-labs/drivers-github-tools/setup@v2
97+
with:
98+
aws_region_name: us-east-1
99+
aws_role_arn: ${{ secrets.aws_role_arn }}
100+
aws_secret_id: ${{ secrets.aws_secret_id }}
101+
102+
- name: Get release version and release package file name
103+
id: get_version
104+
shell: bash
105+
run: |
106+
package_version=$(jq --raw-output '.version' package.json)
107+
echo "package_version=${package_version}" >> "$GITHUB_OUTPUT"
108+
109+
- name: actions/publish_asset_to_s3
110+
uses: mongodb-labs/drivers-github-tools/node/publish_asset_to_s3@v2
111+
with:
112+
version: ${{ steps.get_version.outputs.package_version }}
113+
product_name: node-mongodb-native
114+
file: sbom.json
115+
dry_run: ${{ needs.release_please.outputs.release_created == '' }}

‎.github/workflows/release.yml

Lines changed: 75 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,11 +30,85 @@ jobs:
3030
uses: ./.github/actions/setup
3131
- name: actions/compress_sign_and_upload
3232
uses: ./.github/actions/compress_sign_and_upload
33-
with:
33+
with:
3434
aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
3535
aws_region_name: 'us-east-1'
3636
aws_secret_id: ${{ secrets.AWS_SECRET_ID }}
3737
npm_package_name: 'mongodb'
3838
- run: npm publish --provenance
3939
env:
4040
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
41+
42+
generate_sarif_report:
43+
environment: release
44+
runs-on: ubuntu-latest
45+
needs: [release_please]
46+
permissions:
47+
# required for all workflows
48+
security-events: write
49+
id-token: write
50+
contents: write
51+
52+
steps:
53+
- uses: actions/checkout@v4
54+
- name: Set up drivers-github-tools
55+
uses: mongodb-labs/drivers-github-tools/setup@v2
56+
with:
57+
aws_region_name: us-east-1
58+
aws_role_arn: ${{ secrets.aws_role_arn }}
59+
aws_secret_id: ${{ secrets.aws_secret_id }}
60+
61+
- name: "Generate Sarif Report"
62+
uses: mongodb-labs/drivers-github-tools/code-scanning-export@v2
63+
with:
64+
ref: main
65+
output-file: sarif-report.json
66+
67+
- name: Get release version and release package file name
68+
id: get_version
69+
shell: bash
70+
run: |
71+
package_version=$(jq --raw-output '.version' package.json)
72+
echo "package_version=${package_version}" >> "$GITHUB_OUTPUT"
73+
- name: actions/publish_asset_to_s3
74+
uses: mongodb-labs/drivers-github-tools/node/publish_asset_to_s3@v2
75+
with:
76+
version: ${{ steps.get_version.outputs.package_version }}
77+
product_name: node-mongodb-native
78+
file: sarif-report.json
79+
dry_run: ${{ needs.release_please.outputs.release_created == '' }}
80+
81+
82+
upload_sbom_lite:
83+
environment: release
84+
runs-on: ubuntu-latest
85+
needs: [release_please]
86+
permissions:
87+
# required for all workflows
88+
security-events: write
89+
id-token: write
90+
contents: write
91+
92+
steps:
93+
- uses: actions/checkout@v4
94+
- name: Set up drivers-github-tools
95+
uses: mongodb-labs/drivers-github-tools/setup@v2
96+
with:
97+
aws_region_name: us-east-1
98+
aws_role_arn: ${{ secrets.aws_role_arn }}
99+
aws_secret_id: ${{ secrets.aws_secret_id }}
100+
101+
- name: Get release version and release package file name
102+
id: get_version
103+
shell: bash
104+
run: |
105+
package_version=$(jq --raw-output '.version' package.json)
106+
echo "package_version=${package_version}" >> "$GITHUB_OUTPUT"
107+
108+
- name: actions/publish_asset_to_s3
109+
uses: mongodb-labs/drivers-github-tools/node/publish_asset_to_s3@v2
110+
with:
111+
version: ${{ steps.get_version.outputs.package_version }}
112+
product_name: node-mongodb-native
113+
file: sbom.json
114+
dry_run: ${{ needs.release_please.outputs.release_created == '' }}

0 commit comments

Comments
 (0)