Skip to content

Commit 80be3c0

Browse files
jamisjamis
authored
RUBY-3501 SSDLC for bson-ruby (#330)
* SSDLC shenanigans... * publish job depends on the build job * need Ruby configured to build the native code * fix regex anchoring (alerted via codeql) * ignore vendor folder * apparently we have to specify environment for each job * see if it picks up jruby this way? * download all artifacts to the current directory don't create separate directories for each downloaded artifact. * authorized-pub task doesn't like globs with spaces in them * use boolean type for dry-run flag * don't need to specify "false" explicitly anymore * simplify the build phase (don't need secure checkout)
1 parent 9af9f98 commit 80be3c0

File tree

15 files changed

+350
-247
lines changed

15 files changed

+350
-247
lines changed

‎.github/workflows/cleanup.yml

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
name: "Dry-Run Cleanup"
2+
run-name: "Dry Run Cleanup for ${{ github.ref }}"
3+
4+
on:
5+
workflow_dispatch:
6+
inputs:
7+
confirm:
8+
description: Indicate whether you want this workflow to run (must be "true")
9+
required: true
10+
type: string
11+
tag:
12+
description: The name of the tag (and release) to clean up
13+
required: true
14+
type: string
15+
16+
jobs:
17+
release:
18+
name: "Dry-Run Cleanup"
19+
environment: release
20+
runs-on: 'ubuntu-latest'
21+
if: ${{ inputs.confirm == 'true' }}
22+
23+
permissions:
24+
# required for all workflows
25+
security-events: write
26+
27+
# required to fetch internal or private CodeQL packs
28+
packages: read
29+
30+
# only required for workflows in private repositories
31+
actions: read
32+
contents: write
33+
34+
# required by the mongodb-labs/drivers-github-tools/setup@v2 step
35+
# also required by `rubygems/release-gem`
36+
id-token: write
37+
38+
steps:
39+
- name: "Run the cleanup action"
40+
uses: mongodb-labs/drivers-github-tools/ruby/cleanup@v2
41+
with:
42+
app_id: ${{ vars.APP_ID }}
43+
app_private_key: ${{ secrets.APP_PRIVATE_KEY }}
44+
tag: ${{ inputs.tag }}

‎.github/workflows/codeql.yml

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
name: "CodeQL"
2+
3+
on: [ push, pull_request ]
4+
5+
jobs:
6+
analyze:
7+
name: Analyze (${{ matrix.language }})
8+
# Runner size impacts CodeQL analysis time. To learn more, please see:
9+
# - https://gh.io/recommended-hardware-resources-for-running-codeql
10+
# - https://gh.io/supported-runners-and-hardware-resources
11+
# - https://gh.io/using-larger-runners (GitHub.com only)
12+
# Consider using larger runners or machines with greater resources for possible analysis time improvements.
13+
runs-on: 'ubuntu-latest'
14+
timeout-minutes: 360
15+
permissions:
16+
# required for all workflows
17+
security-events: write
18+
19+
# required to fetch internal or private CodeQL packs
20+
packages: read
21+
22+
# only required for workflows in private repositories
23+
actions: read
24+
contents: read
25+
26+
strategy:
27+
fail-fast: false
28+
matrix:
29+
include:
30+
- language: ruby
31+
build-mode: none
32+
- language: c
33+
build-mode: manual
34+
- language: java
35+
build-mode: none
36+
steps:
37+
- name: Checkout repository
38+
uses: actions/checkout@v4
39+
40+
# Initializes the CodeQL tools for scanning.
41+
- name: Initialize CodeQL
42+
uses: github/codeql-action/init@v3
43+
with:
44+
languages: ${{ matrix.language }}
45+
build-mode: ${{ matrix.build-mode }}
46+
config: |
47+
paths-ignore:
48+
- .evergreen
49+
- spec
50+
- perf
51+
- vendor
52+
53+
- name: Setup Ruby
54+
if: matrix.build-mode == 'manual'
55+
uses: ruby/setup-ruby@v1
56+
with:
57+
ruby-version: '3.2'
58+
bundler-cache: true
59+
60+
- name: Manually build the native code
61+
if: matrix.build-mode == 'manual'
62+
run: |
63+
bundle exec rake compile
64+
65+
- name: Perform CodeQL Analysis
66+
uses: github/codeql-action/analyze@v3
67+
with:
68+
category: "/language:${{matrix.language}}"
69+

‎.github/workflows/release.yml

Lines changed: 170 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,170 @@
1+
name: "BSON Release"
2+
run-name: "BSON Release for ${{ github.ref }}"
3+
4+
on:
5+
workflow_dispatch:
6+
inputs:
7+
dry_run:
8+
description: Whether this is a dry run or not
9+
required: true
10+
default: true
11+
type: boolean
12+
13+
env:
14+
SILK_ASSET_GROUP: bson-ruby
15+
RELEASE_MESSAGE_TEMPLATE: |
16+
Version {0} of [BSON for Ruby](https://rubygems.org/gems/bson) is now available.
17+
18+
**Release Highlights**
19+
20+
TODO: one or more paragraphs describing important changes in this release
21+
22+
**Documentation**
23+
24+
Documentation is available at [MongoDB.com](https://www.mongodb.com/docs/ruby-driver/current/tutorials/bson/).
25+
26+
**Installation**
27+
28+
You may install this version via RubyGems, with:
29+
30+
gem install --version {0} bson
31+
32+
permissions:
33+
# required for all workflows
34+
security-events: write
35+
36+
# required to fetch internal or private CodeQL packs
37+
packages: read
38+
39+
# only required for workflows in private repositories
40+
actions: read
41+
contents: write
42+
43+
# required by the mongodb-labs/drivers-github-tools/setup@v2 step
44+
# also required by `rubygems/release-gem`
45+
id-token: write
46+
47+
jobs:
48+
build:
49+
name: "Build Gems"
50+
runs-on: ubuntu-latest
51+
strategy:
52+
fail-fast: false
53+
matrix:
54+
ruby: [ '3.2', jruby ]
55+
steps:
56+
- name: Check out the repository
57+
uses: actions/checkout@v4
58+
59+
- name: Setup Ruby
60+
uses: ruby/setup-ruby@v1
61+
with:
62+
ruby-version: ${{ matrix.ruby }}
63+
bundler-cache: true
64+
65+
- name: Set output gem file name
66+
shell: bash
67+
run: |
68+
echo "GEM_FILE_NAME=$(bundle exec rake gem_file_name)" >> "$GITHUB_ENV"
69+
70+
- name: Build the gem
71+
shell: bash
72+
run: bundle exec rake build
73+
74+
- name: Save the generated gem file for later
75+
uses: actions/upload-artifact@v4
76+
with:
77+
name: ${{ env.GEM_FILE_NAME }}
78+
path: ${{ env.GEM_FILE_NAME }}
79+
retention-days: 1
80+
overwrite: true
81+
82+
publish:
83+
name: Publish Gems
84+
needs: build
85+
environment: release
86+
runs-on: ubuntu-latest
87+
steps:
88+
- name: Check out the repository
89+
uses: mongodb-labs/drivers-github-tools/secure-checkout@v2
90+
with:
91+
app_id: ${{ vars.APP_ID }}
92+
private_key: ${{ secrets.APP_PRIVATE_KEY }}
93+
94+
- name: Setup Ruby
95+
uses: ruby/setup-ruby@v1
96+
with:
97+
ruby-version: '3.2'
98+
bundler-cache: true
99+
100+
- name: Get the release version
101+
shell: bash
102+
run: echo "RELEASE_VERSION=$(bundle exec rake version)" >> "$GITHUB_ENV"
103+
104+
- name: Setup GitHub tooling for DBX Drivers
105+
uses: mongodb-labs/drivers-github-tools/setup@v2
106+
with:
107+
aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
108+
aws_region_name: ${{ vars.AWS_REGION_NAME }}
109+
aws_secret_id: ${{ secrets.AWS_SECRET_ID }}
110+
111+
- name: Fetch the gem artifacts
112+
uses: actions/download-artifact@v4
113+
with:
114+
merge-multiple: true
115+
116+
- name: Sign the gems
117+
uses: mongodb-labs/drivers-github-tools/gpg-sign@v2
118+
with:
119+
filenames: '*.gem'
120+
121+
- name: Generate SSDLC Reports
122+
uses: mongodb-labs/drivers-github-tools/full-report@v2
123+
with:
124+
product_name: BSON for Ruby
125+
release_version: ${{ env.RELEASE_VERSION }}
126+
dist_filenames: '*.gem'
127+
silk_asset_group: bson-ruby
128+
129+
- name: Create the tag
130+
uses: mongodb-labs/drivers-github-tools/tag-version@v2
131+
with:
132+
version: ${{ env.RELEASE_VERSION }}
133+
tag_template: "v${VERSION}"
134+
tag_message_template: "Release tag for v${VERSION}"
135+
136+
- name: Create a new release
137+
shell: bash
138+
run: gh release create v${{ env.RELEASE_VERSION }} --title ${{ env.RELEASE_VERSION }} --generate-notes --draft
139+
140+
- name: Capture the changelog
141+
shell: bash
142+
run: gh release view v${{ env.RELEASE_VERSION }} --json body --template '{{ .body }}' >> changelog
143+
144+
- name: Prepare release message
145+
shell: bash
146+
run: |
147+
echo "${{ format(env.RELEASE_MESSAGE_TEMPLATE, env.RELEASE_VERSION) }}" > release-message
148+
cat changelog >> release-message
149+
150+
- name: Update release information
151+
shell: bash
152+
run: |
153+
echo "RELEASE_URL=$(gh release edit v${{ env.RELEASE_VERSION }} --notes-file release-message)" >> "$GITHUB_ENV"
154+
155+
- name: Upload release artifacts
156+
shell: bash
157+
run: gh release upload v${{ env.RELEASE_VERSION }} *.gem ${{ env.RELEASE_ASSETS }}/*.sig
158+
159+
- name: Upload S3 assets
160+
uses: mongodb-labs/drivers-github-tools/upload-s3-assets@v2
161+
with:
162+
version: ${{ env.RELEASE_VERSION }}
163+
product_name: 'bson-ruby'
164+
dry_run: ${{ inputs.dry_run }}
165+
166+
- name: Publish the gems
167+
uses: rubygems/release-gem@v1
168+
if: inputs.dry_run == 'false'
169+
with:
170+
await-release: false

0 commit comments

Comments
 (0)