Skip to content

Commit a9b2083

Browse files
baileympearsonbaileympearson
committed
add all ssdlc tooling
1 parent 513c519 commit a9b2083

File tree

2 files changed

+177
-0
lines changed

2 files changed

+177
-0
lines changed

‎.github/workflows/build.yml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
on:
2+
pull_request:
3+
branches: [main]
4+
workflow_dispatch: {}
5+
workflow_call: {}
6+
7+
name: Build
8+
9+
permissions:
10+
contents: write
11+
pull-requests: write
12+
id-token: write
13+
14+
jobs:
15+
host_builds:
16+
strategy:
17+
matrix:
18+
os: [macos-latest, windows-2019]
19+
runs-on: ${{ matrix.os }}
20+
steps:
21+
- uses: actions/checkout@v4
22+
23+
- name: Build ${{ matrix.os }} Prebuild
24+
run: npm i --ignore-scripts && npm run install-zstd && npm run compile
25+
shell: bash
26+
27+
- id: upload
28+
name: Upload prebuild
29+
uses: actions/upload-artifact@v4
30+
with:
31+
name: build-${{ matrix.os }}
32+
path: prebuilds/
33+
if-no-files-found: "error"
34+
retention-days: 1
35+
compression-level: 0
36+
37+
container_builds:
38+
outputs:
39+
artifact_id: ${{ steps.upload.outputs.artifact-id }}
40+
runs-on: ubuntu-latest
41+
strategy:
42+
matrix:
43+
linux_arch: [s390x, arm64, amd64]
44+
steps:
45+
- uses: actions/checkout@v4
46+
47+
- name: Set up QEMU
48+
uses: docker/setup-qemu-action@v3
49+
50+
- name: Set up Docker Buildx
51+
uses: docker/setup-buildx-action@v3
52+
53+
- name: Run Buildx
54+
run: |
55+
docker buildx create --name builder --bootstrap --use
56+
docker buildx build \
57+
--platform linux/${{ matrix.linux_arch }} \
58+
--build-arg="NODE_ARCH=${{ matrix.linux_arch == 'amd64' && 'x64' || matrix.linux_arch }}" \
59+
--output type=local,dest=./prebuilds,platform-split=false \
60+
-f ./.github/docker/Dockerfile.glibc \
61+
.
62+
63+
- id: upload
64+
name: Upload prebuild
65+
uses: actions/upload-artifact@v4
66+
with:
67+
name: build-linux-${{ matrix.linux_arch }}
68+
path: prebuilds/
69+
if-no-files-found: "error"
70+
retention-days: 1
71+
compression-level: 0

‎.github/workflows/release.yml‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
on:
2+
push:
3+
branches: ["main"]
4+
workflow_dispatch: {}
5+
6+
permissions:
7+
contents: write
8+
pull-requests: write
9+
id-token: write
10+
11+
name: release
12+
13+
jobs:
14+
release_please:
15+
runs-on: ubuntu-latest
16+
outputs:
17+
release_created: ${{ steps.release.outputs.release_created }}
18+
steps:
19+
- id: release
20+
uses: googleapis/release-please-action@v4
21+
with:
22+
target-branch: main
23+
24+
build:
25+
needs: [release_please]
26+
name: "Perform any build or bundling steps, as necessary."
27+
uses: ./.github/workflows/build.yml
28+
29+
ssdlc:
30+
needs: [release_please, build]
31+
permissions:
32+
# required for all workflows
33+
security-events: write
34+
id-token: write
35+
contents: write
36+
environment: release
37+
runs-on: ubuntu-latest
38+
steps:
39+
- uses: actions/checkout@v4
40+
41+
- name: Install Node and dependencies
42+
uses: mongodb-labs/drivers-github-tools/node/setup@v2
43+
with:
44+
ignore_install_scripts: true
45+
46+
- name: Load version and package info
47+
uses: mongodb-labs/drivers-github-tools/node/get_version_info@v2
48+
with:
49+
npm_package_name: "@mongodb-js/zstd"
50+
51+
- name: actions/compress_sign_and_upload
52+
uses: mongodb-labs/drivers-github-tools/node/sign_node_package@v2
53+
with:
54+
aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
55+
aws_region_name: us-east-1
56+
aws_secret_id: ${{ secrets.AWS_SECRET_ID }}
57+
npm_package_name: "@mongodb-js/zstd"
58+
dry_run: ${{ needs.release_please.outputs.release_created == '' }}
59+
sign_native: true
60+
61+
- name: Copy sbom file to release assets
62+
shell: bash
63+
if: ${{ '@mongodb-js/zstd' == '' }}
64+
run: cp sbom.json ${{ env.S3_ASSETS }}/sbom.json
65+
66+
# only used for mongodb-client-encryption
67+
- name: Augment SBOM and copy to release assets
68+
if: ${{ '@mongodb-js/zstd' != '' }}
69+
uses: mongodb-labs/drivers-github-tools/sbom@v2
70+
with:
71+
silk_asset_group: "@mongodb-js/zstd"
72+
sbom_file_name: sbom.json
73+
74+
- name: Generate authorized pub report
75+
uses: mongodb-labs/drivers-github-tools/full-report@v2
76+
with:
77+
release_version: ${{ env.package_version }}
78+
product_name: "@mongodb-js/zstd"
79+
sarif_report_target_ref: main
80+
third_party_dependency_tool: n/a
81+
dist_filenames: artifacts/*
82+
token: ${{ github.token }}
83+
sbom_file_name: sbom.json
84+
85+
- uses: mongodb-labs/drivers-github-tools/upload-s3-assets@v2
86+
with:
87+
version: ${{ env.package_version }}
88+
product_name: "@mongodb-js/zstd"
89+
dry_run: ${{ needs.release_please.outputs.release_created == '' }}
90+
91+
publish:
92+
needs: [release_please, ssdlc, build]
93+
environment: release
94+
runs-on: ubuntu-latest
95+
steps:
96+
- uses: actions/checkout@v4
97+
98+
- name: Install Node and dependencies
99+
uses: mongodb-labs/drivers-github-tools/node/setup@v2
100+
with:
101+
ignore_install_scripts: true
102+
103+
- run: npm publish --provenance
104+
if: ${{ needs.release_please.outputs.release_created }}
105+
env:
106+
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

0 commit comments

Comments
 (0)