Skip to content

Commit 24a0796

Browse files
oarbusioarbusi
authored
chore: Generate SSDLC report and SBOM on release (#1365)
1 parent 49e4559 commit 24a0796

File tree

9 files changed

+221
-4
lines changed

9 files changed

+221
-4
lines changed

‎.github/workflows/publish.yaml‎

Lines changed: 38 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ on:
1818
maxParallelRegions:
1919
description: "Maximum number of regions to be updated concurrently"
2020
type: number
21-
default: "15"
21+
default: 15
2222
required: true
2323

2424
jobs:
@@ -63,7 +63,11 @@ jobs:
6363
sudo apt-get install -y python3-pip
6464
pip install awscli cloudformation-cli cloudformation-cli-go-plugin
6565
- name: Run publishing script
66-
run: 'cd cfn-resources && ./cfn-publish.sh "${{ github.event.inputs.resourceName }}"'
66+
id: publish
67+
run: |
68+
cd cfn-resources
69+
./cfn-publish.sh "${{ github.event.inputs.resourceName }}"
70+
echo "published_version=$(cat published_version.txt)" >> "$GITHUB_OUTPUT"
6771
env:
6872
RESOURCE_VERSION_PUBLISHING: ${{ github.event.inputs.resourceVersionPublishing }}
6973
MCLI_OPS_MANAGER_URL: ${{ env.MONGODB_ATLAS_BASE_URL }}
@@ -95,4 +99,35 @@ jobs:
9599
OPS_GENIE_API_KEY: ${{ secrets.OPS_GENIE_API_KEY_PUBLISHING }}
96100
MICROSOFT_TEAMS_WEBHOOK_CREATE_URL: ${{ secrets.MICROSOFT_TEAMS_WEBHOOK_CREATE_URL_PUBLISHING }}
97101
MICROSOFT_TEAMS_WEBHOOK_UPDATE_URL: ${{ secrets.MICROSOFT_TEAMS_WEBHOOK_UPDATE_URL_PUBLISHING }}
98-
102+
outputs:
103+
published_version: ${{ steps.publish.outputs.published_version }}
104+
105+
compliance:
106+
needs: publish
107+
runs-on: ubuntu-latest
108+
steps:
109+
- name: terraform-provider-mongodbatlas-checkout
110+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
111+
with:
112+
repository: mongodb/terraform-provider-mongodbatlas
113+
ref: master
114+
- name: Generate SSDLC report
115+
uses: mongodb/terraform-provider-mongodbatlas/.github/templates/run-script-and-commit@master
116+
with:
117+
script_call: |
118+
AUTHOR="${{ github.actor }}"
119+
export AUTHOR
120+
make gen-sbom-and-ssdlc-report RESOURCE=${{ github.event.inputs.resourceName }} VERSION=${{ needs.publish.outputs.published_version }}
121+
apix_bot_pat: ${{ secrets.APIX_BOT_PAT }}
122+
remote: https://svc-apix-bot:${{ secrets.APIX_BOT_PAT }}@github.com/${{ github.repository }}
123+
gpg_private_key: ${{ secrets.APIX_BOT_GPG_PRIVATE_KEY }}
124+
passphrase: ${{ secrets.APIX_BOT_PASSPHRASE }}
125+
file_to_commit: 'cfn-resources/${{ github.event.inputs.resourceName }}/compliance/v*/*'
126+
commit_message:
127+
"chore: Update SSDLC report for ${{ needs.publish.outputs.published_version }}"
128+
repo-path: "cfn-resources/"
129+
env:
130+
KONDUKTO_TOKEN: ${{ secrets.KONDUKTO_TOKEN }}
131+
SILKBOMB_IMG: ${{ vars.SILKBOMB_IMG }}
132+
KONDUKTO_REPO: ${{ vars.KONDUKTO_REPO }}
133+
KONDUKTO_BRANCH_PREFIX: ${{ vars.KONDUKTO_BRANCH_PREFIX }}

‎Makefile‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,3 +63,9 @@ generate-mocks: # uses mockery to generate mocks in folder `cfn-resources/testut
6363
generate-resource-versions-markdown:
6464
(cd cfn-resources && go run tool/markdown-generator/*.go)
6565

66+
.PHONY: gen-sbom-and-ssdlc-report
67+
gen-sbom-and-ssdlc-report:
68+
./scripts/gen-purl.sh $(RESOURCE)
69+
./scripts/generate-sbom.sh $(RESOURCE) $(VERSION)
70+
./scripts/gen-ssdlc-report.sh $(RESOURCE) $(VERSION)
71+
./scripts/upload-sbom.sh $(RESOURCE) $(VERSION)

‎cfn-resources/cfn-publishing-helper.sh‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,12 @@ for resource in ${resources}; do
113113
fi
114114
command="aws cloudformation publish-type --type RESOURCE --arn ${type_arn} ${version_param}"
115115
echo "${command}"
116-
${command}
116+
publish_output=$(${command})
117+
echo "${publish_output}"
118+
119+
# Extract and store the published version from PublicTypeArn
120+
published_version=$(echo "${publish_output}" | jq -r '.PublicTypeArn' | awk -F'/' '{print $NF}')
121+
echo "$published_version" >published_version.txt
117122

118123
echo "Deleting role stack as it is not needeed anymore"
119124
roleStack="mongodb-atlas-${resource//-/}-role-stack"

‎scripts/extract-purls.sh‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
if [ "$#" -ne 2 ]; then
5+
echo "Usage: $0 <binary_path> <output_file>"
6+
exit 1
7+
fi
8+
9+
BINARY_PATH="$1"
10+
OUTPUT_FILE="$2"
11+
12+
go version -m "$BINARY_PATH" |
13+
awk '$1 == "dep" || $1 == "=>" { print "pkg:golang/" $2 "@" $3 }' |
14+
LC_ALL=C sort >"$OUTPUT_FILE"

‎scripts/gen-purl.sh‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
#!/bin/bash
2+
3+
set -euo pipefail
4+
: "${LINKER_FLAGS:=}"
5+
6+
if [ $# -ne 1 ]; then
7+
echo "Usage: $0 <resource-name>"
8+
exit 1
9+
fi
10+
11+
RESOURCE="$1"
12+
13+
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
14+
EXTRACT_PURL_SCRIPT="${SCRIPT_DIR}/extract-purls.sh"
15+
16+
if [ ! -x "$EXTRACT_PURL_SCRIPT" ]; then
17+
echo "extract-purls.sh not found or not executable"
18+
exit 1
19+
fi
20+
21+
echo "==> Generating purls"
22+
23+
# Define output and temp files
24+
OUT_DIR="cfn-resources/${RESOURCE}/compliance"
25+
BIN_DIR="${OUT_DIR}/bin"
26+
PURL_ALL="${OUT_DIR}/purls.txt"
27+
28+
# Build and extract for Linux
29+
pushd "cfn-resources/${RESOURCE}/cmd" >/dev/null
30+
GOOS=linux GOARCH=amd64 go build -ldflags "${LINKER_FLAGS}" -o "../compliance/bin"
31+
popd >/dev/null
32+
"$EXTRACT_PURL_SCRIPT" "${BIN_DIR}" "${PURL_ALL}"
33+
34+
# Clean up temp files
35+
rm -f "${BIN_DIR}"

‎scripts/gen-ssdlc-report.sh‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
release_date=${DATE:-$(date -u '+%Y-%m-%d')}
5+
6+
if [ $# -ne 2 ]; then
7+
echo "Usage: $0 <resource-name> <version>"
8+
exit 1
9+
fi
10+
11+
RESOURCE="$1"
12+
VERSION="$2"
13+
14+
export DATE="${release_date}"
15+
16+
if [ "${AUGMENTED_REPORT:-false}" = "true" ]; then
17+
target_dir="."
18+
file_name="ssdlc-compliance-${RESOURCE}-${VERSION}-${DATE}.md"
19+
SBOM_TEXT=" - See Augmented SBOM manifests (CycloneDX in JSON format):
20+
- This file has been provided along with this report under the name 'linux_amd64_augmented_sbom_v${VERSION}.json'
21+
- Please note that this file was generated on ${DATE} and may not reflect the latest security information of all third party dependencies."
22+
23+
else # If not augmented, generate the standard report
24+
target_dir="cfn-resources/${RESOURCE}/compliance/v${VERSION}"
25+
file_name="ssdlc-compliance-${RESOURCE}-${VERSION}.md"
26+
SBOM_TEXT=" - See SBOM Lite manifests (CycloneDX in JSON format):
27+
- https://github.com/mongodb/mongodbatlas-cloudformation-resources/cfn-resources/${RESOURCE}/compliance/v${VERSION}/sbom.json"
28+
# Ensure terraform-provider-mongodbatlas version directory exists
29+
mkdir -p "${target_dir}"
30+
fi
31+
32+
export AUTHOR
33+
export VERSION
34+
export SBOM_TEXT
35+
36+
echo "Generating SSDLC report for CloudFormation MongoDB::Atlas::${RESOURCE} version ${VERSION}, author ${AUTHOR} and release date ${DATE}..."
37+
38+
envsubst <templates/ssdlc-compliance.template.md \
39+
>"${target_dir}/${file_name}"
40+
41+
echo "SSDLC compliance report ready. Files in ${target_dir}/:"
42+
ls -l "${target_dir}/"
43+
44+
echo "Printing the generated report:"
45+
cat "${target_dir}/${file_name}"

‎scripts/generate-sbom.sh‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
if [ $# -ne 2 ]; then
5+
echo "Usage: $0 <resource-name> <version>"
6+
exit 1
7+
fi
8+
9+
RESOURCE="$1"
10+
VERSION="$2"
11+
COMPLIANCE_DIR="cfn-resources/${RESOURCE}/compliance"
12+
13+
if [ ! -d "$COMPLIANCE_DIR" ]; then
14+
echo "Compliance directory not found: $COMPLIANCE_DIR"
15+
exit 1
16+
fi
17+
18+
PURL_FILE="${COMPLIANCE_DIR}/purls.txt"
19+
SBOM_FILE="${COMPLIANCE_DIR}/v${VERSION}/sbom.json"
20+
21+
# Ensure the output directory exists
22+
mkdir -p "$(dirname "$SBOM_FILE")"
23+
24+
echo "Generating SBOM for resource: $RESOURCE..."
25+
docker run --rm \
26+
-v "$PWD:/pwd" \
27+
"$SILKBOMB_IMG" \
28+
update \
29+
--purls "/pwd/${PURL_FILE}" \
30+
--sbom-out "/pwd/${SBOM_FILE}"

‎scripts/upload-sbom.sh‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
if [ $# -ne 2 ]; then
5+
echo "Usage: $0 <resource-name> <version>"
6+
exit 1
7+
fi
8+
9+
RESOURCE="$1"
10+
echo "Uploading SBOMs for resource: $RESOURCE..."
11+
docker run --rm \
12+
-v "$PWD:/pwd" \
13+
-e KONDUKTO_TOKEN \
14+
"$SILKBOMB_IMG" \
15+
upload \
16+
--sbom-in "/pwd/cfn-resources/${RESOURCE}/compliance/v${VERSION}/sbom.json" \
17+
--repo "$KONDUKTO_REPO" \
18+
--branch "$KONDUKTO_BRANCH_PREFIX-${RESOURCE}-linux-arm64"

‎templates/ssdlc-compliance.template.md‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
SSDLC Compliance Report: CloudFormation MongoDB::Atlas::${RESOURCE} ${VERSION}
2+
=================================================================
3+
4+
- Release Creator: ${AUTHOR}
5+
- Created On: ${DATE}
6+
7+
Overview:
8+
9+
- **Product and Release Name**
10+
- CloudFormation MongoDB::Atlas::${RESOURCE} ${VERSION}, ${DATE}.
11+
12+
- **Process Document**
13+
- https://www.mongodb.com/blog/post/how-mongodb-protects-against-supply-chain-vulnerabilities
14+
15+
- **Tool used to track third party vulnerabilities**
16+
- [Kondukto](https://arcticglow.kondukto.io/)
17+
18+
- **Dependency Information**
19+
${SBOM_TEXT}
20+
21+
- **Security Testing Report**
22+
- Available as needed from Cloud Security.
23+
24+
- **Security Assessment Report**
25+
- Available as needed from Cloud Security.
26+
27+
Assumptions and attestations:
28+
29+
- Internal processes are used to ensure CVEs are identified and mitigated within SLAs.

0 commit comments

Comments
 (0)