Dependency Health #22
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: Dependency Health | |
| on: | |
| schedule: | |
| # Weekly, similar to mongosh's cron-tasks.yml workflow. | |
| - cron: "0 3 * * 0" | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| id-token: write # required for aws-actions/configure-aws-credentials OIDC role assumption | |
| jobs: | |
| generate: | |
| name: Scan dependencies and update notices | |
| runs-on: ubuntu-latest | |
| # This workflow maintains THIRD_PARTY_NOTICES.md on main: never run it | |
| # against any other branch, even for manual workflow_dispatch runs. | |
| if: github.ref == 'refs/heads/main' | |
| steps: | |
| - uses: mongodb-js/devtools-shared/actions/setup-bot-token@4b1d47bae509ef8c45c809893fa8a53dfc943c32 # main | |
| id: app-token | |
| with: | |
| app-id: ${{ vars.DEVTOOLS_BOT_APP_ID }} | |
| private-key: ${{ secrets.DEVTOOLS_BOT_PRIVATE_KEY }} | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| token: ${{ steps.app-token.outputs.token }} | |
| persist-credentials: true | |
| ref: main | |
| - name: Set up Node.js and pnpm | |
| uses: ./.github/actions/setup-node-pnpm | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Generate dependency SBOM | |
| run: pnpm run create-dependency-sbom-lists | |
| - name: Update third-party notices | |
| if: always() | |
| run: pnpm run update-third-party-notices | |
| - name: Commit and push updated third-party notices | |
| if: always() | |
| env: | |
| # Skip pre-commit hooks, since this is a bot commit. | |
| HUSKY: "0" | |
| GIT_AUTHOR_NAME: "${{ steps.app-token.outputs.app-slug}}[bot]" | |
| GIT_AUTHOR_EMAIL: "${{ steps.app-token.outputs.app-email }}" | |
| GIT_COMMITTER_NAME: "${{ steps.app-token.outputs.app-slug}}[bot]" | |
| GIT_COMMITTER_EMAIL: "${{ steps.app-token.outputs.app-email }}" | |
| run: | | |
| git add THIRD_PARTY_NOTICES.md | |
| if git diff --cached --quiet; then | |
| echo "No THIRD_PARTY_NOTICES.md changes to commit" | |
| else | |
| git commit -m "docs: update third-party notices [skip actions]" | |
| git push origin main | |
| fi | |
| - name: Configure AWS credentials for DevProd Platforms ECR | |
| if: always() | |
| uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 | |
| with: | |
| role-to-assume: ${{ secrets.DEVPROD_PLATFORMS_ECR_ROLE_ARN }} | |
| aws-region: us-east-1 | |
| - name: Generate SBOM and upload to Kondukto via SilkBomb | |
| if: always() | |
| env: | |
| KONDUKTO_BRANCH: ${{ github.ref_name }} | |
| KONDUKTO_TOKEN: ${{ secrets.KONDUKTO_TOKEN }} | |
| run: | | |
| set -e | |
| ECR_HOST=901841024863.dkr.ecr.us-east-1.amazonaws.com | |
| SILKBOMB_IMAGE="${ECR_HOST}/release-infrastructure/silkbomb:2.0" | |
| aws ecr get-login-password --region us-east-1 \ | |
| | docker login --username AWS --password-stdin "${ECR_HOST}" | |
| docker pull "${SILKBOMB_IMAGE}" | |
| docker run --rm \ | |
| -e KONDUKTO_TOKEN \ | |
| -v "$PWD":/pwd \ | |
| "${SILKBOMB_IMAGE}" \ | |
| augment \ | |
| --repo ${{ github.repository }} \ | |
| --branch "$KONDUKTO_BRANCH" \ | |
| --sbom-in /pwd/.sbom/sbom-prod.cyclonedx.json \ | |
| --sbom-out /pwd/.sbom/sbom.json | |
| - name: Upload SBOM artifact | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: sbom | |
| path: .sbom/sbom.json | |
| if-no-files-found: ignore | |
| retention-days: 7 |