Skip to content

Commit 2d3629e

Browse files
andrpacandrpac
authored
CLOUDP-327368/ssdlc-reports (#105)
* feat: generate ssdlc reports as part of release * feat: manual workflow for SBOMs and SSDLC report * chore: remove redundant code
1 parent f90bb46 commit 2d3629e

File tree

6 files changed

+190
-1
lines changed

6 files changed

+190
-1
lines changed

‎.github/workflows/generate-ssdlc-report.yml

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
name: Create SBOMs and SSDLC report PR
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
version:
7+
type: string
8+
description: "Version of the release to extract the SBOM and obtain SSDLC report"
9+
required: true
10+
11+
permissions:
12+
contents: read
13+
14+
jobs:
15+
sboms:
16+
name: Create SBOMs and SSDLC compliance reports as workflow artifacts
17+
runs-on: ubuntu-latest
18+
env:
19+
VERSION: ${{ github.event.inputs.version }}
20+
21+
steps:
22+
- name: Install tools (podman)
23+
run: |
24+
sudo apt update
25+
sudo apt install -y podman unzip
26+
27+
- name: Checkout code
28+
uses: actions/checkout@v4.1.1
29+
30+
- name: Set up Go
31+
uses: actions/setup-go@v5
32+
with:
33+
go-version-file: 'go.mod'
34+
35+
- name: Download all plugin binaries
36+
run: |
37+
BASE_URL="https://github.com/mongodb/atlas-cli-plugin-kubernetes/releases/download/v${VERSION}"
38+
curl -L "${BASE_URL}/atlas-cli-plugin-kubernetes_${VERSION}_linux_arm64.tar.gz" -o "linux_arm64.tar.gz"
39+
curl -L "${BASE_URL}/atlas-cli-plugin-kubernetes_${VERSION}_darwin_arm64.zip" -o "darwin_arm64.zip"
40+
curl -L "${BASE_URL}/atlas-cli-plugin-kubernetes_${VERSION}_windows_x86_64.zip" -o "windows_x86_64.zip"
41+
42+
- name: Extract all binaries
43+
run: |
44+
mkdir -p extracted/linux_arm64
45+
mkdir -p extracted/darwin_arm64
46+
mkdir -p extracted/windows_x86_64
47+
48+
# Extract and move Linux ARM64 binary
49+
tar -xzf linux_arm64.tar.gz
50+
mv atlas-cli-plugin-kubernetes_*_linux_arm64/atlas-cli-plugin-kubernetes extracted/linux_arm64/
51+
52+
# Extract macOS and Windows into their dirs
53+
unzip -o darwin_arm64.zip -d extracted/darwin_arm64
54+
unzip -o windows_x86_64.zip -d extracted/windows_x86_64
55+
56+
- name: Generate PURLs from all binaries
57+
run: |
58+
mkdir -p build/package
59+
60+
binaries=(
61+
"extracted/linux_arm64/atlas-cli-plugin-kubernetes"
62+
"extracted/darwin_arm64/atlas-cli-plugin-kubernetes"
63+
"extracted/windows_x86_64/atlas-cli-plugin-kubernetes.exe"
64+
)
65+
66+
tmp_files=()
67+
68+
for bin in "${binaries[@]}"; do
69+
if [[ -f "$bin" ]]; then
70+
echo "==> Extracting from $bin"
71+
tmp_file=$(mktemp)
72+
go version -m "$bin" | \
73+
awk '$1 == "dep" || $1 == "=>" { print "pkg:golang/" $2 "@" $3 }' | \
74+
LC_ALL=C sort > "$tmp_file"
75+
tmp_files+=("$tmp_file")
76+
else
77+
echo "==> Skipping missing binary: $bin"
78+
fi
79+
done
80+
81+
cat "${tmp_files[@]}" | LC_ALL=C sort | uniq > build/package/purls.txt
82+
echo "==> Final purls.txt:"
83+
cat build/package/purls.txt
84+
85+
- name: Fetch Silkbomb image
86+
run: |
87+
set -e
88+
podman pull "${{ secrets.silkbomb_image }}"
89+
90+
- name: Generate SBOM
91+
env:
92+
SILKBOMB_PURLS_FILE: "./build/package/purls.txt"
93+
SILKBOMB_SBOM_FILE: "./build/package/sbom.json"
94+
SILKBOMB_IMAGE: ${{ secrets.silkbomb_image }}
95+
run: build/package/generate-sbom.sh
96+
97+
- name: Generate SSDLC report
98+
env:
99+
AUTHOR: ${{ github.actor }}
100+
VERSION: ${{ env.VERSION }}
101+
run: |
102+
build/package/generate-ssdlc-report.sh
103+
104+
- name: Upload SBOM as artifact
105+
uses: actions/upload-artifact@v4
106+
with:
107+
name: sbom
108+
path: build/package/sbom.json
109+
110+
- name: Upload SSDLC report as artifact
111+
uses: actions/upload-artifact@v4
112+
with:
113+
name: ssdlc-compliance-report.md
114+
path: ssdlc-compliance-report.md

‎.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ gon_arm64.json
3131
*.xml
3232
sbom.json
3333
augmented-sbom.json
34+
ssdlc-compliance-report.md
3435

3536
# We don't want to commit env variables
3637
*.env

‎build/ci/release.yml

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -143,6 +143,12 @@ functions:
143143
mv ./build/package/sbom.json sbom.json
144144
mv ./build/package/augmented-sbom.json augmented-sbom.json
145145
echo "Moved SBOMs to repository root."
146+
"generate ssdlc report":
147+
- command: subprocess.exec
148+
type: test
149+
params:
150+
working_dir: src/github.com/mongodb/atlas-cli-plugin-kubernetes
151+
binary: build/package/generate-ssdlc-report.sh
146152
"package":
147153
- command: github.generate_token
148154
params:
@@ -241,6 +247,14 @@ tasks:
241247
- func: "generate sbom"
242248
- func: "upload sbom"
243249
- func: "move sboms"
250+
- name: test-ssdlc-report
251+
tags: ["code_health"]
252+
allowed_requesters: ["patch"]
253+
depends_on:
254+
- name: test-sbom
255+
tags: "success"
256+
commands:
257+
- func: "generate ssdlc report"
244258
- name: test-trace
245259
tags: ["code_health"]
246260
allowed_requesters: ["patch"]
@@ -266,8 +280,9 @@ tasks:
266280
commands:
267281
- func: "generate sbom"
268282
- func: "upload sbom"
269-
- func: "generate notices"
270283
- func: "move sboms"
284+
- func: "generate ssdlc report"
285+
- func: "generate notices"
271286
- func: "install goreleaser"
272287
- func: "install macos notarization service"
273288
- func: "install gh-token"

‎build/package/.goreleaser.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,3 +93,4 @@ release:
9393
- glob: ./*.asc
9494
- glob: ./sbom.json
9595
- glob: ./augmented-sbom.json
96+
- glob: ./ssdlc-compliance-report.md

‎build/package/generate-ssdlc-report.sh

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
#!/usr/bin/env bash
2+
3+
# Copyright 2025 MongoDB Inc
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
set -Eeou pipefail
18+
19+
: "${AUTHOR:=$(git config user.name)}"
20+
: "${VERSION:=$(git tag --list 'atlas-cli-plugin-kubernetes/v*' --sort=-taggerdate | head -1 | cut -d 'v' -f 2)}"
21+
: "${DATE:=$(date -u '+%Y-%m-%d')}"
22+
23+
export AUTHOR VERSION DATE
24+
25+
REPORT_OUT="${REPORT_OUT:-ssdlc-compliance-report.md}"
26+
echo "Generating SSDLC checklist for atlas-cli-plugin version ${VERSION}, author ${AUTHOR}, release date ${DATE}..."
27+
echo "Report will be part of the release: ${REPORT_OUT}"
28+
29+
# Render the template with environment variable substitution
30+
envsubst < docs/releases/ssdlc-compliance.template.md > "${REPORT_OUT}"

‎docs/releases/ssdlc-compliance.template.md

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
SSDLC Compliance Report: Atlas CLI Plugin Kubernetes v${VERSION}
2+
=================================================================
3+
4+
- **Release Creator:** ${AUTHOR}
5+
- **Created On:** ${DATE}
6+
7+
## Overview
8+
9+
- **Product Name and Version**
10+
- Atlas CLI Plugin Kubernetes v${VERSION}, generated on ${DATE}.
11+
12+
- **Process Documentation**
13+
- [How MongoDB Protects Against Supply Chain Vulnerabilities](https://www.mongodb.com/blog/post/how-mongodb-protects-against-supply-chain-vulnerabilities)
14+
15+
- **Dependency Information**
16+
- The Software Bill of Materials (SBOM) is:
17+
- a) part of this release as `sbom.json` and `augmented-sbom.json` with vulnerabilities found from Kondukto
18+
- b) part of the released artifacts from the on-demand workflow as `sbom.json`
19+
20+
- **Security Testing Report**
21+
- Available on request from the Cloud Security team.
22+
23+
- **Security Assessment Report**
24+
- Available on request from the Cloud Security team.
25+
26+
## Assumptions and Attestations
27+
28+
- Internal processes are in place to ensure CVEs are identified and mitigated within established SLAs.

0 commit comments

Comments
 (0)