Skip to content

Commit 335bbad

Browse files
jamisjamis
authored
RUBY-3504 SSDLC processes for libmongocrypt-helper (#10)
1 parent 51f9f20 commit 335bbad

File tree

9 files changed

+205
-98
lines changed

9 files changed

+205
-98
lines changed

‎.github/workflows/cleanup.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
name: "Dry-Run Cleanup"
2+
run-name: "Dry Run Cleanup for ${{ github.ref }}"
3+
4+
on:
5+
workflow_dispatch:
6+
inputs:
7+
confirm:
8+
description: Indicate whether you want this workflow to run (must be "true")
9+
required: true
10+
type: string
11+
tag:
12+
description: The name of the tag (and release) to clean up
13+
required: true
14+
type: string
15+
16+
jobs:
17+
release:
18+
name: "Dry-Run Cleanup"
19+
environment: release
20+
runs-on: 'ubuntu-latest'
21+
if: ${{ inputs.confirm == 'true' }}
22+
23+
permissions:
24+
# required for all workflows
25+
security-events: write
26+
27+
# required to fetch internal or private CodeQL packs
28+
packages: read
29+
30+
# only required for workflows in private repositories
31+
actions: read
32+
contents: write
33+
34+
# required by the mongodb-labs/drivers-github-tools/setup@v2 step
35+
# also required by `rubygems/release-gem`
36+
id-token: write
37+
38+
steps:
39+
- name: "Run the cleanup action"
40+
uses: mongodb-labs/drivers-github-tools/ruby/cleanup@v2
41+
with:
42+
app_id: ${{ vars.APP_ID }}
43+
app_private_key: ${{ secrets.APP_PRIVATE_KEY }}
44+
tag: ${{ inputs.tag }}

‎.github/workflows/codeql.yml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
name: "CodeQL"
2+
3+
on: [ push, pull_request ]
4+
5+
jobs:
6+
analyze:
7+
name: Analyze (${{ matrix.language }})
8+
# Runner size impacts CodeQL analysis time. To learn more, please see:
9+
# - https://gh.io/recommended-hardware-resources-for-running-codeql
10+
# - https://gh.io/supported-runners-and-hardware-resources
11+
# - https://gh.io/using-larger-runners (GitHub.com only)
12+
# Consider using larger runners or machines with greater resources for possible analysis time improvements.
13+
runs-on: 'ubuntu-latest'
14+
timeout-minutes: 360
15+
permissions:
16+
# required for all workflows
17+
security-events: write
18+
19+
# required to fetch internal or private CodeQL packs
20+
packages: read
21+
22+
# only required for workflows in private repositories
23+
actions: read
24+
contents: read
25+
26+
strategy:
27+
fail-fast: false
28+
matrix:
29+
include:
30+
- language: ruby
31+
build-mode: none
32+
steps:
33+
- name: Checkout repository
34+
uses: actions/checkout@v4
35+
36+
# Initializes the CodeQL tools for scanning.
37+
- name: Initialize CodeQL
38+
uses: github/codeql-action/init@v3
39+
with:
40+
languages: ${{ matrix.language }}
41+
build-mode: ${{ matrix.build-mode }}
42+
config: |
43+
paths-ignore:
44+
- etc
45+
- ext/libmongocrypt/libmongocrypt
46+
47+
- name: Perform CodeQL Analysis
48+
uses: github/codeql-action/analyze@v3
49+
with:
50+
category: "/language:${{matrix.language}}"

‎.github/workflows/release.yml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
name: "Release"
2+
run-name: "Release for ${{ github.ref }}"
3+
4+
on:
5+
workflow_dispatch:
6+
inputs:
7+
dry_run:
8+
description: Is this a dry run?
9+
required: true
10+
default: true
11+
type: boolean
12+
13+
env:
14+
RELEASE_MESSAGE_TEMPLATE: |
15+
Version {0} of the [libmongocrypt helper for Ruby](https://rubygems.org/gems/libmongocrypt-helper) is now available.
16+
17+
**Release Highlights**
18+
19+
TODO: one or more paragraphs describing important changes in this release
20+
21+
**Documentation**
22+
23+
Documentation is available at [MongoDB.com](https://www.mongodb.com/docs/ruby-driver/current/).
24+
25+
**Installation**
26+
27+
You may install this version via RubyGems, with:
28+
29+
gem install --version {0} libmongocrypt-helper
30+
31+
jobs:
32+
release:
33+
name: "Release"
34+
environment: release
35+
runs-on: 'ubuntu-latest'
36+
37+
permissions:
38+
# required for all workflows
39+
security-events: write
40+
41+
# required to fetch internal or private CodeQL packs
42+
packages: read
43+
44+
# only required for workflows in private repositories
45+
actions: read
46+
contents: write
47+
48+
# required by the mongodb-labs/drivers-github-tools/setup@v2 step
49+
# also required by `rubygems/release-gem`
50+
id-token: write
51+
52+
steps:
53+
- name: "Run the publish action"
54+
uses: mongodb-labs/drivers-github-tools/ruby/publish@v2
55+
with:
56+
app_id: ${{ vars.APP_ID }}
57+
app_private_key: ${{ secrets.APP_PRIVATE_KEY }}
58+
aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
59+
aws_region_name: ${{ vars.AWS_REGION_NAME }}
60+
aws_secret_id: ${{ secrets.AWS_SECRET_ID }}
61+
dry_run: ${{ inputs.dry_run }}
62+
gem_name: libmongocrypt-helper
63+
product_name: Libmongocrypt Helper for Ruby
64+
product_id: libmongocrypt-helper-ruby
65+
release_message_template: ${{ env.RELEASE_MESSAGE_TEMPLATE }}
66+
silk_asset_group: libmongocrypt-helper-ruby

‎README.maint.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,11 @@ Edit `lib/libmongocrypt_helper/version.rb` and:
1010
2. Update the `VERSION` constant to the version of the helper, which is
1111
derived from `libmongocrypt` version as described below.
1212
3. Download the source code of the corresponding version of `libmongocrypt` from
13-
https://github.com/mongodb/libmongocrypt/releases/, and unpack it to
13+
<https://github.com/mongodb/libmongocrypt/releases/>, and unpack it to
1414
`ext/libmongocrypt/libmongocrypt`.
1515
4. Update the SBOM lite file by running `etc/update-sbom.sh`
1616
5. Commit the changes including the new shared library.
17-
6Run `./release.sh` to create a gem and push it to RubyGems.
17+
6. Create a PR for the changes. Once approved and merged, run the "Release" action on GitHub to create and publish the new gem.
1818

1919
## Helper Version Scheme
2020

‎Rakefile‎

Lines changed: 41 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,5 @@
11
require 'bundler'
2-
require 'bundler/gem_tasks'
32
require 'rubygems/package'
4-
require 'rubygems/security/policies'
5-
6-
def signed_gem?(path_to_gem)
7-
Gem::Package.new(path_to_gem, Gem::Security::HighSecurity).verify
8-
true
9-
rescue Gem::Security::Exception => e
10-
false
11-
end
123

134
desc 'Compiles the libmongocrypt library'
145
task :compile do
@@ -17,18 +8,46 @@ task :compile do
178
end
189
end
1910

20-
desc 'Verifies that all built gems in pkg/ are valid'
21-
task :verify do
22-
gems = Dir['pkg/*.gem']
23-
if gems.empty?
24-
puts 'There are no gems in pkg/ to verify'
25-
else
26-
gems.each do |gem|
27-
if signed_gem?(gem)
28-
puts "#{gem} is signed"
29-
else
30-
abort "#{gem} is not signed"
31-
end
32-
end
11+
desc 'NOT USED'
12+
task :build do
13+
abort <<~WARNING
14+
`rake build` does nothing in this project. The gem must be built via
15+
the `Release` action on GitHub, which is triggered manually when
16+
a new release is ready.
17+
WARNING
18+
end
19+
20+
# `rake version` is used by the deployment system so get the release version
21+
# of the product beng deployed. It must do nothing more than just print the
22+
# product version number.
23+
#
24+
# See the mongodb-labs/driver-github-tools/ruby/publish Github action.
25+
desc 'Print the current value of Mongo::VERSION'
26+
task :version do
27+
require_relative 'lib/libmongocrypt_helper/version'
28+
29+
puts LibmongocryptHelper::VERSION
30+
end
31+
32+
# overrides the default Bundler-provided `release` task, which also
33+
# builds the gem. Our release process assumes the gem has already
34+
# been built (and signed via GPG), so we just need `rake release` to
35+
# push the gem to rubygems.
36+
desc 'USED BY GITHUB ACTIONS'
37+
task :release do
38+
require_relative 'lib/libmongocrypt_helper/version'
39+
40+
if ENV['GITHUB_ACTION'].nil?
41+
abort <<~WARNING
42+
`rake release` must be invoked from the `Release` GitHub action,
43+
and must not be invoked locally. This ensures the gem is properly signed
44+
and distributed by the appropriate user.
45+
46+
Note that it is the `rubygems/release-gem@v1` step in the `Release`
47+
action that invokes this task. Do not rename or remove this task, or the
48+
release-gem step will fail. Reimplement this task with caution.
49+
WARNING
3350
end
51+
52+
system 'gem', 'push', "libmongocrypt-helper-#{LibmongocryptHelper::VERSION}.gem"
3453
end

‎gem-public_cert.pem‎

Lines changed: 0 additions & 26 deletions
This file was deleted.

‎libmongocrypt-helper.gemspec‎

Lines changed: 2 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
lib = File.expand_path('../lib', __FILE__)
1+
lib = File.expand_path('lib', __dir__)
22
$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
33
require 'libmongocrypt_helper/version'
44

@@ -21,14 +21,7 @@ Gem::Specification.new do |s|
2121
'source_code_uri' => 'https://github.com/mongodb/libmongocrypt-helper-ruby'
2222
}
2323

24-
if File.exist?('gem-private_key.pem')
25-
s.signing_key = 'gem-private_key.pem'
26-
s.cert_chain = ['gem-public_cert.pem']
27-
else
28-
warn "[#{s.name}] Warning: No private key present, creating unsigned gem."
29-
end
30-
31-
#s.files = %w(CONTRIBUTING.md CHANGELOG.md LICENSE NOTICE README.md Rakefile)
24+
# s.files = %w(CONTRIBUTING.md CHANGELOG.md LICENSE NOTICE README.md Rakefile)
3225
s.extensions = ['ext/libmongocrypt/extconf.rb']
3326
s.files = Dir.glob('lib/**/*') + Dir.glob('ext/**/*') - [File.join('ext/libmongocrypt/libmongocrypt/build')]
3427

‎release.sh‎

Lines changed: 0 additions & 30 deletions
This file was deleted.

‎release/mri/build.sh‎

Lines changed: 0 additions & 9 deletions
This file was deleted.

0 commit comments

Comments
 (0)