-
Notifications
You must be signed in to change notification settings - Fork 68
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
chore: full SSDLC compliance workflow (#179)
- Loading branch information
1 parent
2e71058
commit 36b0da7
Showing
10 changed files
with
710 additions
and
899 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| FROM ubuntu:bionic AS build | ||
|
|
||
| # Possible values: s390x, arm64, x64 | ||
| ARG NODE_ARCH | ||
| ADD https://nodejs.org/dist/v16.20.1/node-v16.20.1-linux-${NODE_ARCH}.tar.gz / | ||
| RUN mkdir -p /nodejs && tar -xzf /node-v16.20.1-linux-${NODE_ARCH}.tar.gz --strip-components=1 -C /nodejs | ||
| ENV PATH=$PATH:/nodejs/bin | ||
|
|
||
| WORKDIR /kerberos | ||
| COPY . . | ||
|
|
||
| RUN apt-get -qq update && apt-get -qq install -y python3 build-essential libkrb5-dev && ldd --version | ||
|
|
||
| RUN npm clean-install --ignore-scripts | ||
| RUN npm run prebuild | ||
|
|
||
| FROM scratch | ||
|
|
||
| COPY --from=build /kerberos/prebuilds/ / |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,67 @@ | ||
| on: | ||
| pull_request: | ||
| branches: [main] | ||
| workflow_dispatch: {} | ||
| workflow_call: {} | ||
|
|
||
| name: Build and Test | ||
|
|
||
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
| id-token: write | ||
|
|
||
| jobs: | ||
| host_builds: | ||
| strategy: | ||
| matrix: | ||
| os: [macos-latest, windows-2019] | ||
| runs-on: ${{ matrix.os }} | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Build ${{ matrix.os }} Prebuild | ||
| run: | | ||
| npm clean-install --ignore-scripts | ||
| npm run prebuild | ||
| - id: upload | ||
| name: Upload prebuild | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: build-${{ matrix.os }} | ||
| path: prebuilds/ | ||
| if-no-files-found: 'error' | ||
| retention-days: 1 | ||
| compression-level: 0 | ||
|
|
||
| container_builds: | ||
| outputs: | ||
| artifact_id: ${{ steps.upload.outputs.artifact-id }} | ||
| runs-on: ubuntu-latest | ||
| strategy: | ||
| matrix: | ||
| linux_arch: [s390x, arm64, amd64] | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Set up QEMU | ||
| uses: docker/setup-qemu-action@v3 | ||
|
|
||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 | ||
|
|
||
| - name: Run Buildx | ||
| run: | | ||
| docker buildx create --name builder --bootstrap --use | ||
| docker buildx build --platform linux/${{ matrix.linux_arch }} --build-arg NODE_ARCH=${{ matrix.linux_arch == 'amd64' && 'x64' || matrix.linux_arch }} --output type=local,dest=./prebuilds,platform-split=false -f ./.github/docker/Dockerfile.glibc . | ||
| - id: upload | ||
| name: Upload prebuild | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: build-linux-${{ matrix.linux_arch }} | ||
| path: prebuilds/ | ||
| if-no-files-found: 'error' | ||
| retention-days: 1 | ||
| compression-level: 0 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -45,6 +45,49 @@ Now you can install `kerberos` with the following: | |
| npm install kerberos | ||
| ``` | ||
|
|
||
| #### Prebuild Platforms | ||
|
|
||
| Below are the platforms that are available as prebuilds on each github release. | ||
| `prebuild-install` downloads these automatically depending on the platform you are running npm install on. | ||
|
|
||
| - Linux GLIBC 2.23 or later | ||
| - s390x | ||
| - arm64 | ||
| - x64 | ||
| - MacOS universal binary | ||
| - x64 | ||
| - arm64 | ||
| - Windows | ||
| - x64 | ||
|
|
||
| ### Release Integrity | ||
|
|
||
| Releases are created automatically and signed using the [Node team's GPG key](https://pgp.mongodb.com/node-driver.asc). This applies to the git tag as well as all release packages provided as part of a GitHub release. To verify the provided packages, download the key and import it using gpg: | ||
|
|
||
| ``` | ||
| gpg --import node-driver.asc | ||
| ``` | ||
|
|
||
| The GitHub release contains a detached signature file for the NPM package (named | ||
| `kerberos-X.Y.Z.tgz.sig`). | ||
|
|
||
| The following command returns the link npm package. | ||
| ```shell | ||
| npm view [email protected] dist.tarball | ||
| ``` | ||
|
|
||
| Using the result of the above command, a `curl` command can return the official npm package for the release. | ||
|
|
||
| To verify the integrity of the downloaded package, run the following command: | ||
| ```shell | ||
| gpg --verify kerberos-X.Y.Z.tgz.sig kerberos-X.Y.Z.tgz | ||
| ``` | ||
|
|
||
| >[!Note] | ||
| No verification is done when using npm to install the package. To ensure release integrity when using npm, download the tarball manually from the GitHub release, verify the signature, then install the package from the downloaded tarball using npm install mongodb-X.Y.Z.tgz. | ||
|
|
||
| To verify the native `.node` packages, follow the same steps as above. | ||
|
|
||
| ### Testing | ||
|
|
||
| Run the test suite using: | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.