Skip to content

Commit 6bb5703

Browse files
jamisjamis
authored
Port the new release infrastructure to 7.5-stable (#6033)
* port the new release infrastructure to 7.5-stable * Add the sbom * typo in product description * remove rubocop and associated workflow
1 parent b603a2b commit 6bb5703

File tree

12 files changed

+317
-163
lines changed

12 files changed

+317
-163
lines changed

‎.github/workflows/codeql.yml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
name: "CodeQL"
2+
3+
on:
4+
push:
5+
pull_request:
6+
schedule:
7+
- cron: '20 0 * * 0'
8+
9+
jobs:
10+
analyze:
11+
name: Analyze (${{ matrix.language }})
12+
# Runner size impacts CodeQL analysis time. To learn more, please see:
13+
# - https://gh.io/recommended-hardware-resources-for-running-codeql
14+
# - https://gh.io/supported-runners-and-hardware-resources
15+
# - https://gh.io/using-larger-runners (GitHub.com only)
16+
# Consider using larger runners or machines with greater resources for possible analysis time improvements.
17+
runs-on: 'ubuntu-latest'
18+
timeout-minutes: 360
19+
permissions:
20+
# required for all workflows
21+
security-events: write
22+
23+
# required to fetch internal or private CodeQL packs
24+
packages: read
25+
26+
# only required for workflows in private repositories
27+
actions: read
28+
contents: read
29+
30+
strategy:
31+
fail-fast: false
32+
matrix:
33+
include:
34+
- language: ruby
35+
build-mode: none
36+
steps:
37+
- name: Checkout repository
38+
uses: actions/checkout@v4
39+
40+
# Initializes the CodeQL tools for scanning.
41+
- name: Initialize CodeQL
42+
uses: github/codeql-action/init@v3
43+
with:
44+
languages: ${{ matrix.language }}
45+
build-mode: ${{ matrix.build-mode }}
46+
config: |
47+
paths-ignore:
48+
- .evergreen
49+
- spec
50+
- perf
51+
- examples
52+
- test-apps
53+
# If you wish to specify custom queries, you can do so here or in a config file.
54+
# By default, queries listed here will override any specified in a config file.
55+
# Prefix the list here with "+" to use these queries and those in the config file.
56+
57+
# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
58+
# queries: security-extended,security-and-quality
59+
60+
# If the analyze step fails for one of the languages you are analyzing with
61+
# "We were unable to automatically build your code", modify the matrix above
62+
# to set the build mode to "manual" for that language. Then modify this step
63+
# to build your code.
64+
# ℹ️ Command-line programs to run using the OS shell.
65+
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
66+
- if: matrix.build-mode == 'manual'
67+
run: |
68+
echo 'If you are using a "manual" build mode for one or more of the' \
69+
'languages you are analyzing, replace this with the commands to build' \
70+
'your code, for example:'
71+
echo ' make bootstrap'
72+
echo ' make release'
73+
exit 1
74+
75+
- name: Perform CodeQL Analysis
76+
uses: github/codeql-action/analyze@v3
77+
with:
78+
category: "/language:${{matrix.language}}"
79+

‎.github/workflows/release.yml‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
name: "Gem Release"
2+
run-name: "Gem Release for ${{ github.ref }}"
3+
4+
on:
5+
# for auto-deploy when merging a release-candidate PR
6+
push:
7+
branches:
8+
- 'master'
9+
- '*-stable'
10+
11+
# for manual release
12+
workflow_dispatch:
13+
inputs:
14+
pr:
15+
description: "The number of the merged release candidate PR"
16+
required: true
17+
18+
env:
19+
SILK_ASSET_GROUP: mongoid
20+
GEM_NAME: mongoid
21+
PRODUCT_NAME: Mongoid
22+
PRODUCT_ID: mongoid
23+
24+
permissions:
25+
# required for all workflows
26+
security-events: write
27+
28+
# required to fetch internal or private CodeQL packs
29+
packages: read
30+
31+
# only required for workflows in private repositories
32+
actions: read
33+
pull-requests: read
34+
contents: write
35+
36+
# required by the mongodb-labs/drivers-github-tools/setup@v2 step
37+
# also required by `rubygems/release-gem`
38+
id-token: write
39+
40+
jobs:
41+
check:
42+
name: "Check Release"
43+
runs-on: ubuntu-latest
44+
outputs:
45+
message: ${{ steps.check.outputs.message }}
46+
ref: ${{ steps.check.outputs.ref }}
47+
steps:
48+
- name: "Run the check action"
49+
id: check
50+
uses: jamis/drivers-github-tools/ruby/pr-check@ruby-3643-update-release-process
51+
52+
build:
53+
name: "Build Gems"
54+
needs: check
55+
environment: release
56+
runs-on: ubuntu-latest
57+
steps:
58+
- name: "Run the build action"
59+
uses: jamis/drivers-github-tools/ruby/build@ruby-3643-update-release-process
60+
with:
61+
app_id: ${{ vars.APP_ID }}
62+
app_private_key: ${{ secrets.APP_PRIVATE_KEY }}
63+
artifact: 'ruby-3.2'
64+
gem_name: ${{ env.GEM_NAME }}
65+
ruby_version: 'ruby-3.2'
66+
ref: ${{ needs.check.outputs.ref }}
67+
68+
publish:
69+
name: "Publish Gems"
70+
needs: [ check, build ]
71+
environment: release
72+
runs-on: 'ubuntu-latest'
73+
steps:
74+
- name: "Run the publish action"
75+
uses: jamis/drivers-github-tools/ruby/publish@ruby-3643-update-release-process
76+
with:
77+
app_id: ${{ vars.APP_ID }}
78+
app_private_key: ${{ secrets.APP_PRIVATE_KEY }}
79+
aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
80+
aws_region_name: ${{ vars.AWS_REGION_NAME }}
81+
aws_secret_id: ${{ secrets.AWS_SECRET_ID }}
82+
dry_run: false
83+
gem_name: ${{ env.GEM_NAME }}
84+
product_name: ${{ env.PRODUCT_NAME }}
85+
product_id: ${{ env.PRODUCT_ID }}
86+
release_message: ${{ needs.check.outputs.message }}
87+
silk_asset_group: ${{ env.SILK_ASSET_GROUP }}
88+
ref: ${{ needs.check.outputs.ref }}

‎Rakefile‎

Lines changed: 85 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# frozen_string_literal: true
2+
# rubocop:todo all
23

34
require "bundler"
4-
require "bundler/gem_tasks"
55
Bundler.setup
66

77
ROOT = File.expand_path(File.join(File.dirname(__FILE__)))
@@ -10,34 +10,53 @@ $: << File.join(ROOT, 'spec/shared/lib')
1010

1111
require "rake"
1212
require "rspec/core/rake_task"
13-
require 'mrss/spec_organizer'
14-
require 'rubygems/package'
15-
require 'rubygems/security/policies'
16-
17-
def signed_gem?(path_to_gem)
18-
Gem::Package.new(path_to_gem, Gem::Security::HighSecurity).verify
19-
true
20-
rescue Gem::Security::Exception => e
21-
false
22-
end
23-
24-
$LOAD_PATH.unshift File.expand_path("../lib", __FILE__)
25-
require "mongoid/version"
2613

27-
tasks = Rake.application.instance_variable_get('@tasks')
28-
tasks['release:do'] = tasks.delete('release')
14+
if File.exist?('./spec/shared/lib/tasks/candidate.rake')
15+
load 'spec/shared/lib/tasks/candidate.rake'
16+
end
2917

30-
task :gem => :build
18+
desc 'Build the gem'
3119
task :build do
32-
system "gem build mongoid.gemspec"
20+
command = %w[ gem build ]
21+
command << "--output=#{ENV['GEM_FILE_NAME']}" if ENV['GEM_FILE_NAME']
22+
command << (ENV['GEMSPEC'] || 'mongoid.gemspec')
23+
system(*command)
3324
end
3425

35-
task :install => :build do
36-
system "sudo gem install mongoid-#{Mongoid::VERSION}.gem"
26+
# `rake version` is used by the deployment system so get the release version
27+
# of the product beng deployed. It must do nothing more than just print the
28+
# product version number.
29+
#
30+
# See the mongodb-labs/driver-github-tools/ruby/publish Github action.
31+
desc "Print the current value of Mongoid::VERSION"
32+
task :version do
33+
require 'mongoid/version'
34+
35+
puts Mongoid::VERSION
3736
end
3837

38+
# overrides the default Bundler-provided `release` task, which also
39+
# builds the gem. Our release process assumes the gem has already
40+
# been built (and signed via GPG), so we just need `rake release` to
41+
# push the gem to rubygems.
3942
task :release do
40-
raise "Please use ./release.sh to release"
43+
require 'mongoid/version'
44+
45+
if ENV['GITHUB_ACTION'].nil?
46+
abort <<~WARNING
47+
`rake release` must be invoked from the `Mongoid Release` GitHub action,
48+
and must not be invoked locally. This ensures the gem is properly signed
49+
and distributed by the appropriate user.
50+
51+
Note that it is the `rubygems/release-gem@v1` step in the `Mongoid Release`
52+
action that invokes this task. Do not rename or remove this task, or the
53+
release-gem step will fail. Reimplement this task with caution.
54+
55+
mongoid-#{Mongoid::VERSION}.gem was NOT pushed to RubyGems.
56+
WARNING
57+
end
58+
59+
system 'gem', 'push', "mongoid-#{Mongoid::VERSION}.gem"
4160
end
4261

4362
RSpec::Core::RakeTask.new("spec") do |spec|
@@ -49,6 +68,46 @@ RSpec::Core::RakeTask.new('spec:progress') do |spec|
4968
spec.pattern = "spec/**/*_spec.rb"
5069
end
5170

71+
desc 'Build and validate the evergreen config'
72+
task eg: %w[ eg:build eg:validate ]
73+
74+
# 'eg' == 'evergreen', but evergreen is too many letters for convenience
75+
namespace :eg do
76+
desc 'Builds the .evergreen/config.yml file from the templates'
77+
task :build do
78+
ruby '.evergreen/update-evergreen-configs'
79+
end
80+
81+
desc 'Validates the .evergreen/config.yml file'
82+
task :validate do
83+
system 'evergreen validate --project mongoid .evergreen/config.yml'
84+
end
85+
86+
desc 'Updates the evergreen executable to the latest available version'
87+
task :update do
88+
system 'evergreen get-update --install'
89+
end
90+
91+
desc 'Runs the current branch as an evergreen patch'
92+
task :patch do
93+
system 'evergreen patch --uncommitted --project mongoid --browse --auto-description --yes'
94+
end
95+
end
96+
97+
namespace :generate do
98+
desc 'Generates a mongoid.yml from the template'
99+
task :config do
100+
require 'mongoid'
101+
require 'erb'
102+
103+
template_path = 'lib/rails/generators/mongoid/config/templates/mongoid.yml'
104+
database_name = ENV['DATABASE_NAME'] || 'my_db'
105+
106+
config = ERB.new(File.read(template_path), trim_mode: '-').result(binding)
107+
File.write('mongoid.yml', config)
108+
end
109+
end
110+
52111
CLASSIFIERS = [
53112
[%r,^mongoid/attribute,, :attributes],
54113
[%r,^mongoid/association/[or],, :associations_referenced],
@@ -64,6 +123,8 @@ RUN_PRIORITY = %i(
64123
)
65124

66125
def spec_organizer
126+
require 'mrss/spec_organizer'
127+
67128
Mrss::SpecOrganizer.new(
68129
root: ROOT,
69130
classifiers: CLASSIFIERS,
@@ -97,34 +158,12 @@ desc "Generate all documentation"
97158
task :docs => 'docs:yard'
98159

99160
namespace :docs do
100-
desc "Generate yard documention"
161+
desc "Generate yard documentation"
101162
task :yard do
163+
require "mongoid/version"
164+
102165
out = File.join('yard-docs', Mongoid::VERSION)
103166
FileUtils.rm_rf(out)
104167
system "yardoc -o #{out} --title mongoid-#{Mongoid::VERSION}"
105168
end
106169
end
107-
108-
namespace :release do
109-
task :check_private_key do
110-
unless File.exist?('gem-private_key.pem')
111-
raise "No private key present, cannot release"
112-
end
113-
end
114-
end
115-
116-
desc 'Verifies that all built gems in pkg/ are valid'
117-
task :verify do
118-
gems = Dir['pkg/*.gem']
119-
if gems.empty?
120-
puts 'There are no gems in pkg/ to verify'
121-
else
122-
gems.each do |gem|
123-
if signed_gem?(gem)
124-
puts "#{gem} is signed"
125-
else
126-
abort "#{gem} is not signed"
127-
end
128-
end
129-
end
130-
end

‎gem-public_cert.pem‎

Lines changed: 0 additions & 26 deletions
This file was deleted.

‎lib/mongoid/version.rb‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
# frozen_string_literal: true
22

33
module Mongoid
4-
VERSION = "7.5.4"
4+
# The current version of Mongoid
5+
#
6+
# Note that this file is automatically updated via `rake candidate:create`.
7+
# Manual changes to this file will be overwritten by that rake task.
8+
VERSION = '7.5.4'
59
end

‎product.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
---
2+
name: Mongoid
3+
description: a Ruby ODM for MongoDB
4+
package: mongoid
5+
jira: https://jira.mongodb.org/projects/MONGOID
6+
version:
7+
number: 7.5.4
8+
file: lib/mongoid/version.rb

0 commit comments

Comments
 (0)