Skip to content

Commit 1c66bad

Browse files
oarbusioarbusi
authored
chore: Onboard to Silkbomb to generate SSDLC reports, SBOM and generate augmented SBOM on demand (#463)
1 parent 35a1ba2 commit 1c66bad

File tree

9 files changed

+240
-5
lines changed

9 files changed

+240
-5
lines changed

‎.github/workflows/generate-augmented-sbom.yml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
name: Augment SBOM
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
release_version:
7+
description: "Release version (e.g. 3.12.1)"
8+
required: true
9+
type: string
10+
11+
permissions:
12+
id-token: write
13+
contents: read
14+
15+
jobs:
16+
augment-sbom:
17+
runs-on: ubuntu-latest
18+
env:
19+
KONDUKTO_TOKEN: ${{ secrets.KONDUKTO_TOKEN }}
20+
KONDUKTO_REPO: ${{ vars.KONDUKTO_REPO }}
21+
KONDUKTO_BRANCH_PREFIX: ${{ vars.KONDUKTO_BRANCH_PREFIX }}
22+
SILKBOMB_IMG: ${{ vars.SILKBOMB_IMG }}
23+
steps:
24+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
25+
26+
- name: Get current date
27+
id: date
28+
run: echo "date=$(date +'%Y-%m-%d')" >> "$GITHUB_OUTPUT"
29+
30+
- name: Augment SBOM with Kondukto
31+
env:
32+
RELEASE_VERSION: ${{ inputs.release_version }}
33+
run: ./scripts/compliance/augment-sbom.sh
34+
35+
- name: Generate SSDLC report
36+
env:
37+
AUTHOR: ${{ github.actor }}
38+
VERSION: ${{ inputs.release_version }}
39+
AUGMENTED_REPORT: "true"
40+
run: ./scripts/compliance/gen-ssdlc-report.sh
41+
42+
- name: Upload augmented SBOM as artifact
43+
uses: actions/upload-artifact@v4
44+
with:
45+
name: augmented_sbom_and_ssdlc_report
46+
path: |
47+
compliance/v${{ inputs.release_version }}/augmented-sbom-v${{ inputs.release_version }}-${{ steps.date.outputs.date }}.json
48+
compliance/v${{ inputs.release_version }}/ssdlc-compliance-${{ inputs.release_version }}-${{ steps.date.outputs.date }}.md
49+
if-no-files-found: error

‎.github/workflows/package.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ jobs:
2929
with:
3030
node-version: 18.x
3131
- name: Checkout
32-
uses: actions/checkout@v4
32+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
3333
with:
3434
ref: ${{ github.event.pull_request.head.ref }}
3535
repository: ${{ github.event.pull_request.head.repo.full_name }}
@@ -50,7 +50,7 @@ jobs:
5050
with:
5151
node-version: 18.x
5252
- name: Checkout
53-
uses: actions/checkout@v4
53+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
5454
with:
5555
ref: ${{ github.event.pull_request.head.ref }}
5656
repository: ${{ github.event.pull_request.head.repo.full_name }}
@@ -70,7 +70,7 @@ jobs:
7070
with:
7171
node-version: 18.x
7272
- name: Checkout
73-
uses: actions/checkout@v4
73+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
7474
with:
7575
ref: ${{ github.event.pull_request.head.ref }}
7676
repository: ${{ github.event.pull_request.head.repo.full_name }}
@@ -90,7 +90,7 @@ jobs:
9090
with:
9191
node-version: 18.x
9292
- name: Checkout
93-
uses: actions/checkout@v4
93+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
9494
with:
9595
ref: ${{ github.event.pull_request.head.ref }}
9696
repository: ${{ github.event.pull_request.head.repo.full_name }}
@@ -111,7 +111,7 @@ jobs:
111111
with:
112112
node-version: 18.x
113113
- name: Checkout
114-
uses: actions/checkout@v4
114+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
115115
with:
116116
ref: ${{ github.event.pull_request.head.ref }}
117117
repository: ${{ github.event.pull_request.head.repo.full_name }}

‎.github/workflows/release.yml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -314,3 +314,57 @@ jobs:
314314
labels: failed-release
315315
title: Publishing v${{ steps.extract-version.outputs.VERSION }} to GitHub Releases failed
316316
body: See https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
317+
- name: Generate PURL and SBOM
318+
run: |
319+
./scripts/compliance/gen-purls.sh
320+
./scripts/compliance/gen-sbom.sh
321+
env:
322+
SILKBOMB_IMG: ${{ vars.SILKBOMB_IMG }}
323+
- name: Upload SBOM to Kondukto
324+
run: ./scripts/compliance/upload-sbom.sh
325+
env:
326+
KONDUKTO_TOKEN: ${{ secrets.KONDUKTO_TOKEN }}
327+
SILKBOMB_IMG: ${{ vars.SILKBOMB_IMG }}
328+
KONDUKTO_REPO: ${{ vars.KONDUKTO_REPO }}
329+
KONDUKTO_BRANCH_PREFIX: ${{ vars.KONDUKTO_BRANCH_PREFIX }}
330+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
331+
- name: Generate SSDLC report
332+
run: |
333+
AUTHOR="${{ github.actor }}"
334+
export AUTHOR
335+
VERSION="${{ steps.extract-version.outputs.VERSION }}"
336+
export VERSION
337+
./scripts/compliance/gen-ssdlc-report.sh
338+
env:
339+
KONDUKTO_TOKEN: ${{ secrets.KONDUKTO_TOKEN }}
340+
SILKBOMB_IMG: ${{ vars.SILKBOMB_IMG }}
341+
KONDUKTO_REPO: ${{ vars.KONDUKTO_REPO }}
342+
KONDUKTO_BRANCH_PREFIX: ${{ vars.KONDUKTO_BRANCH_PREFIX }}
343+
- name: Import GPG key
344+
uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec
345+
with:
346+
gpg_private_key: ${{ secrets.APIX_BOT_GPG_PRIVATE_KEY }}
347+
passphrase: ${{ secrets.APIX_BOT_PASSPHRASE }}
348+
git_user_signingkey: true
349+
git_commit_gpgsign: true
350+
- name: Commit changes
351+
shell: bash
352+
run: |
353+
if [[ $(git status --porcelain) ]]; then
354+
git pull
355+
git config --local user.email [email protected]
356+
git config --local user.name svc-apix-bot
357+
git remote set-url origin https://svc-apix-bot:${{ secrets.APIX_BOT_PAT }}@github.com/${{ github.repository }}
358+
git add compliance/v*/*
359+
git commit -m "chore: Update SSDLC report for ${{ steps.extract-version.outputs.VERSION }}"
360+
git push origin
361+
else
362+
echo "No changes to commit."
363+
fi
364+
- name: Upload SBOM as release artifact
365+
uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631
366+
with:
367+
files: compliance/sbom.json
368+
tag_name: ${{ steps.extract-version.outputs.VERSION }}
369+
env:
370+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎scripts/compliance/augment-sbom.sh‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
: "${RELEASE_VERSION:?RELEASE_VERSION environment variable not set}"
5+
DATE=$(date +'%Y-%m-%d')
6+
7+
echo "Augmenting SBOM..."
8+
docker run \
9+
--pull=always \
10+
--platform="linux/amd64" \
11+
--rm \
12+
-v "${PWD}:/pwd" \
13+
-e KONDUKTO_TOKEN \
14+
"$SILKBOMB_IMG" \
15+
augment \
16+
--sbom-in "/pwd/compliance/sbom.json" \
17+
--repo "$KONDUKTO_REPO" \
18+
--branch "$KONDUKTO_BRANCH_PREFIX" \
19+
--sbom-out "/pwd/compliance/augmented-sbom-v${RELEASE_VERSION}-${DATE}.json"

‎scripts/compliance/gen-purls.sh‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#!/bin/bash
2+
3+
# Reference: .cursor/rules - be surgical, only output PURLs, use jq for JSON parsing
4+
5+
if ! command -v jq &> /dev/null; then
6+
echo "jq is required but not installed. Please install jq to use this script."
7+
exit 1
8+
fi
9+
10+
mkdir -p compliance
11+
12+
PKG_JSON=package.json
13+
14+
# Output all npm dependencies, devDependencies, and peerDependencies as PURLs to compliance/purls.txt
15+
yq -r --output-format json '.dependencies | to_entries | .[] | "pkg:npm/" + .key + "@" + .value' $PKG_JSON > compliance/purls.txt
16+
yq -r --output-format json '.devDependencies | to_entries | .[] | "pkg:npm/" + .key + "@" + .value' $PKG_JSON >> compliance/purls.txt
17+
yq -r --output-format json '.peerDependencies | to_entries | .[] | "pkg:npm/" + .key + "@" + .value' $PKG_JSON >> compliance/purls.txt

‎scripts/compliance/gen-sbom.sh‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
echo "Generating SBOM..."
5+
docker run --rm \
6+
-v "$PWD:/pwd" \
7+
"$SILKBOMB_IMG" \
8+
update \
9+
--purls /pwd/compliance/purls.txt \
10+
--sbom-out /pwd/compliance/sbom.json

‎scripts/compliance/gen-ssdlc-report.sh‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
release_date=${DATE:-$(date -u '+%Y-%m-%d')}
5+
6+
export DATE="${release_date}"
7+
8+
if [ -z "${AUTHOR:-}" ]; then
9+
AUTHOR=$(git config user.name)
10+
fi
11+
12+
if [ -z "${VERSION:-}" ]; then
13+
VERSION=$(git tag --list 'v*' --sort=-v:refname | head -1 | cut -d 'v' -f 2)
14+
fi
15+
16+
if [ "${AUGMENTED_REPORT:-false}" = "true" ]; then
17+
target_dir="."
18+
file_name="ssdlc-compliance-${VERSION}-${DATE}.md"
19+
SBOM_TEXT=" - See Augmented SBOM manifests (CycloneDX in JSON format):
20+
- This file has been provided along with this report under the name 'linux_amd64_augmented_sbom_v${VERSION}.json'
21+
- Please note that this file was generated on ${DATE} and may not reflect the latest security information of all third party dependencies."
22+
23+
else # If not augmented, generate the standard report
24+
target_dir="compliance/v${VERSION}"
25+
file_name="ssdlc-compliance-${VERSION}.md"
26+
SBOM_TEXT=" - See SBOM Lite manifests (CycloneDX in JSON format):
27+
- https://github.com/mongodb/awscdk-resources-mongodbatlas/releases/download/v${VERSION}/sbom.json"
28+
# Ensure awscdk-resources-mongodbatlas version directory exists
29+
mkdir -p "${target_dir}"
30+
fi
31+
32+
export AUTHOR
33+
export VERSION
34+
export SBOM_TEXT
35+
36+
echo "Generating SSDLC report for MongoDB Atlas AWS CDK Resources version ${VERSION}, author ${AUTHOR} and release date ${DATE}..."
37+
38+
envsubst < templates/ssdlc-compliance.template.md \
39+
> "${target_dir}/${file_name}"
40+
41+
echo "SSDLC compliance report ready. Files in ${target_dir}/:"
42+
ls -l "${target_dir}/"
43+
44+
echo "Printing the generated report:"
45+
cat "${target_dir}/${file_name}"

‎scripts/compliance/upload-sbom.sh‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
echo "Uploading SBOMs..."
5+
docker run --rm \
6+
-v "$PWD:/pwd" \
7+
-e KONDUKTO_TOKEN \
8+
"$SILKBOMB_IMG" \
9+
upload \
10+
--sbom-in /pwd/compliance/sbom.json \
11+
--repo "$KONDUKTO_REPO" \
12+
--branch "$KONDUKTO_BRANCH_PREFIX"

‎templates/ssdlc-compliance.template.md‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
SSDLC Compliance Report: MongoDB Atlas AWS CDK Resources ${VERSION}
2+
=================================================================
3+
4+
- Release Creator: ${AUTHOR}
5+
- Created On: ${DATE}
6+
7+
Overview:
8+
9+
- **Product and Release Name**
10+
- MongoDB Atlas AWS CDK Resources ${VERSION}, ${DATE}.
11+
12+
- **Process Document**
13+
- https://www.mongodb.com/blog/post/how-mongodb-protects-against-supply-chain-vulnerabilities
14+
15+
- **Tool used to track third party vulnerabilities**
16+
- [Kondukto](https://arcticglow.kondukto.io/)
17+
18+
- **Dependency Information**
19+
${SBOM_TEXT}
20+
21+
- **Security Testing Report**
22+
- Available as needed from Cloud Security.
23+
24+
- **Security Assessment Report**
25+
- Available as needed from Cloud Security.
26+
27+
Assumptions and attestations:
28+
29+
- Internal processes are used to ensure CVEs are identified and mitigated within SLAs.

0 commit comments

Comments
 (0)