Skip to content

chore: ssdlc compliance flow #25

chore: ssdlc compliance flow

chore: ssdlc compliance flow #25

Workflow file for this run

on:
push:
branches: ["6.1"]
pull_request:
branches: ["main"]
workflow_dispatch: {}
permissions:
contents: write
pull-requests: write
id-token: write
name: release-6.1
jobs:
release_please:
runs-on: ubuntu-latest
outputs:
release_created: ${{ steps.release.outputs.release_created }}
steps:
- id: release
uses: googleapis/release-please-action@v4
with:
target-branch: 6.1
build:
needs: [release_please]
name: "Perform any build or bundling steps, as necessary."
uses: ./.github/workflows/build.yml
ssdlc:
needs: [release_please, build]
permissions:
# required for all workflows
security-events: write
id-token: write
contents: write
environment: release
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Install Node and dependencies
uses: mongodb-labs/drivers-github-tools/node/setup@v2
with:
ignore_install_scripts: true
- name: Load version and package info
uses: mongodb-labs/drivers-github-tools/node/get_version_info@v2
with:
npm_package_name: mongodb-client-encryption
- name: actions/compress_sign_and_upload
uses: mongodb-labs/drivers-github-tools/node/sign_node_package@v2
with:
aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
aws_region_name: us-east-1
aws_secret_id: ${{ secrets.AWS_SECRET_ID }}
npm_package_name: mongodb-client-encryption
dry_run: ${{ needs.release_please.outputs.release_created == '' }}
- name: Set up silk environment
shell: bash
run: |
set -eu
SILKBOMB_ENVFILE=/tmp/silkbomb-envfile
cat << EOF > $SILKBOMB_ENVFILE
SILK_CLIENT_ID=${SILKBOMB_USER}
SILK_CLIENT_SECRET=${SILKBOMB_KEY}
EOF
echo 'SILKBOMB_ENVFILE=$SILKBOMB_ENVFILE' >> $GITHUB_ENV
- name: Copy sbom file to release assets
shell: bash
if: ${{ 'mongodb-client-encryption-6.1' == '' }}
run: cp sbom.json ${{ env.S3_ASSETS }}/sbom.json
# only used for mongodb-client-encryption
- name: Augment SBOM and copy to release assets
if: ${{ 'mongodb-client-encryption-6.1' != '' }}
uses: mongodb-labs/drivers-github-tools/sbom@v2
with:
silk_asset_group: 'mongodb-client-encryption-6.1'
sbom_file_name: sbom.json
- name: Generate authorized pub report
uses: mongodb-labs/drivers-github-tools/full-report@v2
with:
release_version: ${{ env.package_version }}
product_name: mongodb-client-encryption
sarif_report_target_ref: 6.1
third_party_dependency_tool: n/a
dist_filenames: artifacts/*
token: ${{ github.token }}
sbom_file_name: sbom.json
- uses: mongodb-labs/drivers-github-tools/upload-s3-assets@v2
with:
version: ${{ env.package_version }}
product_name: mongodb-client-encryption
dry_run: ${{ needs.release_please.outputs.release_created == '' }}
publish:
needs: [release_please, ssdlc, build]
environment: release
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Install Node and dependencies
uses: mongodb-labs/drivers-github-tools/node/setup@v2
- run: npm publish --provenance --tag=6.1
if: ${{ needs.release_please.outputs.release_created }}
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}