Skip to content

Commit de60b9e

Browse files
jamisjamis
authored
RUBY-3357 SSDLC Requirements (#2880)
* add more tasks to the release workflow also, add a cleanup workflow for use while testing * workflows don't have descriptions * inputs are specified on the trigger, not the workflow * skip the SBOM generation until we can figure it out * use bson-ruby asset group, for testing this is temporary until silk is able to grab the correct sbom lite from the mongo-ruby-driver repo * put code scan results in S3_ASSETS and for testing, remove dry-run from s3 upload, to make sure it works * restore the correct silk asset group * refactor to try the new ruby actions in drivers-github-tools * remove stray quotation mark * use the canonical version of the ruby actions * Indicate `dry_run` to be of type boolean This is so it gets rendered as a checkbox. We'll default it to `true` to avoid accidental releases.
1 parent 30afb45 commit de60b9e

File tree

3 files changed

+76
-83
lines changed

3 files changed

+76
-83
lines changed

‎.github/workflows/cleanup.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
name: "Dry-Run Cleanup"
2+
run-name: "Dry Run Cleanup for ${{ github.ref }}"
3+
4+
on:
5+
workflow_dispatch:
6+
inputs:
7+
confirm:
8+
description: Indicate whether you want this workflow to run (must be "true")
9+
required: true
10+
type: string
11+
tag:
12+
description: The name of the tag (and release) to clean up
13+
required: true
14+
type: string
15+
16+
jobs:
17+
release:
18+
name: "Dry-Run Cleanup"
19+
environment: release
20+
runs-on: 'ubuntu-latest'
21+
if: ${{ inputs.confirm == 'true' }}
22+
23+
permissions:
24+
# required for all workflows
25+
security-events: write
26+
27+
# required to fetch internal or private CodeQL packs
28+
packages: read
29+
30+
# only required for workflows in private repositories
31+
actions: read
32+
contents: write
33+
34+
# required by the mongodb-labs/drivers-github-tools/setup@v2 step
35+
# also required by `rubygems/release-gem`
36+
id-token: write
37+
38+
steps:
39+
- name: "Run the cleanup action"
40+
uses: mongodb-labs/drivers-github-tools/ruby/cleanup@v2
41+
with:
42+
app_id: ${{ vars.APP_ID }}
43+
app_private_key: ${{ secrets.APP_PRIVATE_KEY }}
44+
tag: ${{ inputs.tag }}

‎.github/workflows/release.yml‎

Lines changed: 20 additions & 83 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,17 @@
11
name: "Driver Release"
2-
run-name: "Ruby Driver Release ${{ github.ref_name }}"
2+
run-name: "Driver Release for ${{ github.ref }}"
33

4-
on: workflow_dispatch
4+
on:
5+
workflow_dispatch:
6+
inputs:
7+
dry_run:
8+
description: Whether this is a dry run or not
9+
required: true
10+
default: true
11+
type: boolean
512

613
env:
14+
SILK_ASSET_GROUP: mongodb-ruby-driver
715
RELEASE_MESSAGE_TEMPLATE: |
816
Version {0} of the [MongoDB Ruby Driver](https://rubygems.org/gems/mongo) is now available.
917
@@ -43,88 +51,17 @@ jobs:
4351
id-token: write
4452

4553
steps:
46-
- name: "Create temporary app token"
47-
uses: actions/create-github-app-token@v1
48-
id: app-token
49-
with:
50-
app-id: ${{ vars.APP_ID }}
51-
private-key: ${{ secrets.APP_PRIVATE_KEY }}
52-
53-
- name: "Store GitHub token in environment"
54-
run: echo "GH_TOKEN=${{ steps.app-token.outputs.token }}" >> "$GITHUB_ENV"
55-
shell: bash
56-
57-
- name: Checkout repository
58-
uses: actions/checkout@v4
59-
with:
60-
token: ${{ env.GH_TOKEN }}
61-
62-
- name: Setup Ruby
63-
uses: ruby/setup-ruby@v1
64-
with:
65-
ruby-version: '3.2'
66-
bundler-cache: true
67-
68-
- name: Setup GitHub tooling for DBX Drivers
69-
uses: mongodb-labs/drivers-github-tools/setup@v2
54+
- name: "Run the publish action"
55+
uses: mongodb-labs/drivers-github-tools/ruby/publish@v2
7056
with:
57+
app_id: ${{ vars.APP_ID }}
58+
app_private_key: ${{ secrets.APP_PRIVATE_KEY }}
7159
aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
7260
aws_region_name: ${{ vars.AWS_REGION_NAME }}
7361
aws_secret_id: ${{ secrets.AWS_SECRET_ID }}
74-
75-
- name: Get the driver version
76-
shell: bash
77-
run: |
78-
echo "DRIVER_VERSION=$(ruby -Ilib -rmongo/version -e 'puts Mongo::VERSION')" >> "$GITHUB_ENV"
79-
80-
- name: Set output gem file name
81-
shell: bash
82-
run: |
83-
echo "GEM_FILE_NAME=mongo-${{ env.DRIVER_VERSION }}.gem" >> "$GITHUB_ENV"
84-
85-
- name: Build the gem
86-
shell: bash
87-
run: |
88-
gem build --output=${{ env.GEM_FILE_NAME }} mongo.gemspec
89-
90-
- name: Sign the gem
91-
uses: mongodb-labs/drivers-github-tools/gpg-sign@v2
92-
with:
93-
filenames: '${{ env.GEM_FILE_NAME }}'
94-
95-
- name: Create and sign the tag
96-
uses: mongodb-labs/drivers-github-tools/git-sign@v2
97-
with:
98-
command: "git tag -u ${{ env.GPG_KEY_ID }} -m 'Release tag for v${{ env.DRIVER_VERSION }}' v${{ env.DRIVER_VERSION }}"
99-
100-
- name: Push the tag to the repository
101-
shell: bash
102-
run: |
103-
git push origin v${{ env.DRIVER_VERSION }}
104-
105-
- name: Create a new release
106-
shell: bash
107-
run: gh release create v${{ env.DRIVER_VERSION }} --title ${{ env.DRIVER_VERSION }} --generate-notes --draft
108-
109-
- name: Capture the changelog
110-
shell: bash
111-
run: gh release view v${{ env.DRIVER_VERSION }} --json body --template '{{ .body }}' >> changelog
112-
113-
- name: Prepare release message
114-
shell: bash
115-
run: |
116-
echo "${{ format(env.RELEASE_MESSAGE_TEMPLATE, env.DRIVER_VERSION) }}" > release-message
117-
cat changelog >> release-message
118-
119-
- name: Update release information
120-
shell: bash
121-
run: |
122-
echo "RELEASE_URL=$(gh release edit v${{ env.DRIVER_VERSION }} --notes-file release-message)" >> "$GITHUB_ENV"
123-
124-
- name: Upload release artifacts
125-
run: gh release upload v${{ env.DRIVER_VERSION }} ${{ env.GEM_FILE_NAME }} ${{ env.RELEASE_ASSETS }}/${{ env.GEM_FILE_NAME }}.sig
126-
127-
- name: Publish the gem
128-
uses: rubygems/release-gem@v1
129-
with:
130-
await-release: false
62+
dry_run: ${{ inputs.dry_run }}
63+
gem_name: mongo
64+
product_name: Ruby Driver
65+
product_id: mongodb-ruby-driver
66+
release_message_template: ${{ env.RELEASE_MESSAGE_TEMPLATE }}
67+
silk_asset_group: ${{ env.SILK_ASSET_GROUP }}

‎Rakefile‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,18 @@ task :build do
4646
WARNING
4747
end
4848

49+
# `rake version` is used by the deployment system so get the release version
50+
# of the product beng deployed. It must do nothing more than just print the
51+
# product version number.
52+
#
53+
# See the mongodb-labs/driver-github-tools/ruby/publish Github action.
54+
desc "Print the current value of Mongo::VERSION"
55+
task :version do
56+
require 'mongo/version'
57+
58+
puts Mongo::VERSION
59+
end
60+
4961
# overrides the default Bundler-provided `release` task, which also
5062
# builds the gem. Our release process assumes the gem has already
5163
# been built (and signed via GPG), so we just need `rake release` to

0 commit comments

Comments
 (0)