chore: add third party notice generation and kondukto integration MCP-598 #14
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: Dependency Health | |
| on: | |
| schedule: | |
| # Weekly, similar to mongosh's cron-tasks.yml workflow. | |
| - cron: "0 3 * * 0" | |
| workflow_dispatch: | |
| pull_request: | |
| branches: | |
| - main | |
| permissions: | |
| contents: write | |
| id-token: write # required for aws-actions/configure-aws-credentials OIDC role assumption | |
| jobs: | |
| generate: | |
| name: Scan dependencies and update notices | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: mongodb-js/devtools-shared/actions/setup-bot-token@04e390e1e6157b3edbc120f3d9359d3fb47ab839 # main | |
| id: app-token | |
| with: | |
| app-id: ${{ vars.DEVTOOLS_BOT_APP_ID }} | |
| private-key: ${{ secrets.DEVTOOLS_BOT_PRIVATE_KEY }} | |
| - name: Checkout repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| with: | |
| token: ${{ steps.app-token.outputs.token }} | |
| persist-credentials: true | |
| - name: Set up Node.js and pnpm | |
| uses: ./.github/actions/setup-node-pnpm | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Generate dependency SBOM | |
| run: pnpm run create-dependency-sbom-lists | |
| - name: Update third-party notices | |
| if: always() | |
| run: pnpm run update-third-party-notices | |
| - name: Commit and push updated third-party notices | |
| # Run even if earlier steps failed, so notices are still committed when | |
| # the regeneration step produced changes. The pull_request trigger is | |
| # removed, but this guard keeps the push blocked if it is ever re-added. | |
| if: always() && github.event_name != 'pull_request' | |
| env: | |
| # Skip pre-commit hooks, since this is a bot commit. | |
| HUSKY: "0" | |
| GIT_AUTHOR_NAME: "${{ steps.app-token.outputs.app-slug}}[bot]" | |
| GIT_AUTHOR_EMAIL: "${{ steps.app-token.outputs.app-email }}" | |
| GIT_COMMITTER_NAME: "${{ steps.app-token.outputs.app-slug}}[bot]" | |
| GIT_COMMITTER_EMAIL: "${{ steps.app-token.outputs.app-email }}" | |
| run: | | |
| git add THIRD_PARTY_NOTICES.md | |
| if git diff --cached --quiet; then | |
| echo "No THIRD_PARTY_NOTICES.md changes to commit" | |
| else | |
| git commit -m "chore: update third-party notices [skip actions]" | |
| git push | |
| fi | |
| - name: Configure AWS credentials for DevProd Platforms ECR | |
| if: always() | |
| uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 | |
| with: | |
| role-to-assume: ${{ secrets.DEVPROD_PLATFORMS_ECR_ROLE_ARN }} | |
| aws-region: us-east-1 | |
| - name: Generate SBOM and upload to Kondukto via SilkBomb | |
| if: always() | |
| env: | |
| KONDUKTO_BRANCH: ${{ github.ref_name }} | |
| KONDUKTO_TOKEN: ${{ secrets.KONDUKTO_TOKEN }} | |
| run: | | |
| set -e | |
| ECR_HOST=901841024863.dkr.ecr.us-east-1.amazonaws.com | |
| SILKBOMB_IMAGE="${ECR_HOST}/release-infrastructure/silkbomb:2.0" | |
| aws ecr get-login-password --region us-east-1 \ | |
| | docker login --username AWS --password-stdin "${ECR_HOST}" | |
| docker pull "${SILKBOMB_IMAGE}" | |
| docker run --rm \ | |
| -e KONDUKTO_TOKEN \ | |
| -v "$PWD":/pwd \ | |
| "${SILKBOMB_IMAGE}" \ | |
| augment \ | |
| --repo ${{ github.repository }} \ | |
| --branch "$KONDUKTO_BRANCH" \ | |
| --sbom-in /pwd/.sbom/sbom-prod.cyclonedx.json \ | |
| --sbom-out /pwd/.sbom/sbom.json | |
| - name: Upload SBOM artifact | |
| if: always() | |
| uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v7.0.1 | |
| with: | |
| name: sbom | |
| path: .sbom/sbom.json | |
| if-no-files-found: ignore | |
| retention-days: 7 |