CLOUDP-315271: Onboard Kundukto to CI (#3862)

cveticm · cveticm · commit 78ad99d2346d · 2025-05-19T11:44:10.000+01:00
diff --git a/.gitignore b/.gitignore
@@ -5,6 +5,7 @@
 *.so
 *.dylib
 bin/**
+compliance/**
 dist/**
 # mac notarization service
 linux_amd64/**
diff --git a/Makefile b/Makefile
@@ -106,7 +106,7 @@ addcopy: ## Add missing license to files
 	@scripts/add-copy.sh
 
 .PHONY: generate
-generate: gen-docs gen-mocks gen-api-commands ## Generate docs, mocks, code, api commands, all auto generated assets
+generate: gen-docs gen-mocks gen-api-commands gen-purls ## Generate docs, mocks, code, api commands, all auto generated assets
 
 .PHONY: apply-overlay
 apply-overlay: ## Apply overlay on openapi spec
@@ -138,6 +138,14 @@ gen-docs: gen-docs-metadata ## Generate docs for atlascli commands
 	@echo "==> Generating docs"
 	go run -ldflags "$(LINKER_FLAGS)" ./tools/cmd/docs
 
+.PHONY: gen-purls
+gen-purls: # Generate purls on linux os
+	@echo "==> Generating purls"
+	GOOS=linux GOARCH=amd64 go build -trimpath -mod=readonly -o bin/atlas-linux ./cmd/atlas
+	go version -m ./bin/atlas-linux | \
+		awk '$$1 == "dep" || $$1 == "=>" { print "pkg:golang/" $$2 "@" $$3 }' | \
+		LC_ALL=C sort > build/package/purls.txt
+
 .PHONY: build
 build: ## Generate an atlas binary in ./bin
 	@echo "==> Building $(ATLAS_BINARY_NAME) binary"
diff --git a/build/ci/check-purls.sh b/build/ci/check-purls.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+
+# Copyright 2025 MongoDB Inc
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -Eeou pipefail
+
+if ! git diff --quiet --exit-code build/package/purls.txt; then
+    echo "build/package/purls.txt is out of date. Please run 'make gen-purls' and commit the result."
+    git --no-pager diff build/package/purls.txt
+    exit 1
+fi
diff --git a/build/ci/evergreen.yml b/build/ci/evergreen.yml
@@ -533,6 +533,21 @@ functions:
         binary: make
         args:
           - otel
+  "check purls":
+    - command: subprocess.exec
+      type: test
+      params:
+        <<: *go_options
+        binary: make
+        args: 
+        - gen-purls
+    - command: subprocess.exec
+      params:
+        <<: *go_options
+        include_expansions_in_env:
+          - workdir
+        binary: build/ci/check-purls.sh
+
 tasks:
   - name: compile
     tags: ["code_health"]
@@ -1726,6 +1741,10 @@ tasks:
         vars:
           span: "coverage"
           attr: "total=${percentage},count=${count}"
+  - name: check_purls
+    tags: ["code_health"]
+    commands:
+      - func: "check purls"
   - name: snyk_monitor
     tags:
     - snyk
diff --git a/build/ci/release.yml b/build/ci/release.yml
@@ -70,6 +70,48 @@ functions:
       params:
         <<: *go_options
         binary: build/package/generate-notices.sh
+  "generate sbom":  
+    - command: ec2.assume_role
+      params:
+        role_arn: ${ecr_role_arn}
+    - command: subprocess.exec
+      params:
+        <<: *go_options
+        include_expansions_in_env:
+          - AWS_ACCESS_KEY_ID
+          - AWS_SECRET_ACCESS_KEY
+          - AWS_SESSION_TOKEN
+          - workdir
+        binary: build/package/generate-sbom.sh 
+  "run silkbomb": 
+    - command: ec2.assume_role
+      params:
+        role_arn: ${kondukto_role_arn}
+    - command: shell.exec
+      params:
+        silent: true
+        shell: bash
+        include_expansions_in_env: [AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN]
+        script: |
+          set -e
+          kondukto_token=$(aws secretsmanager get-secret-value --secret-id "kondukto-token" --region "us-east-1" --query 'SecretString' --output text)
+          echo "KONDUKTO_TOKEN=$kondukto_token" > ${workdir}/kondukto_credentials.env
+    - command: shell.exec
+      params:
+        shell: bash
+        script: |
+          docker run \
+          --pull=always \
+          --platform="linux/amd64" \
+          --rm \
+          --env-file ${workdir}/kondukto_credentials.env \
+          -v ${workdir}:/workdir \
+          901841024863.dkr.ecr.us-east-1.amazonaws.com/release-infrastructure/silkbomb:2.0 \
+          upload \
+          --sbom-in /workdir/src/github.com/mongodb/mongodb-atlas-cli/compliance/sbom.json \
+          --repo mongodb_mongodb-atlas-cli  \
+          --branch ${branch_name}  
+          rm ${workdir}/kondukto_credentials.env
   "package":
     - command: github.generate_token
       params:
@@ -317,6 +359,10 @@ tasks:
           permissions: public-read
           content_type: ${content_type|application/octet-stream}
           display_name: unsigned
+  - name: generate_and_upload_sbom
+    commands:  
+      - func: "generate sbom"
+      - func: "run silkbomb"
   - name: package_goreleaser
     tags: ["packaging"]
     depends_on:
@@ -528,6 +574,8 @@ buildvariants:
         depends_on:
           - name: package_msi
             variant: "go_atlascli_msi_snapshot"
+          - name: generate_and_upload_sbom
+            variant: ssdlc
   - name: publish_atlascli_snapshot
     display_name: "Publish AtlasCLI Snapshot"
     run_on:
@@ -553,6 +601,8 @@ buildvariants:
         depends_on:
           - name: package_msi
             variant: release_atlascli_msi
+          - name: generate_and_upload_sbom
+            variant: ssdlc
   - name: copybara
     display_name: "Copybara"
     git_tag_only: true
@@ -605,3 +655,11 @@ buildvariants:
       - ubuntu2004-small
     tasks:
       - name: .smoke-test .generate .repo .atlascli
+  - name: ssdlc
+    display_name: Compliance [ssdlc]
+    run_on:
+      - ubuntu2204-small
+    expansions:
+      <<: *go_linux_version
+    tasks:
+      - name: generate_and_upload_sbom
diff --git a/build/package/.goreleaser.yml b/build/package/.goreleaser.yml
@@ -142,4 +142,5 @@ release:
   name_template: "MongoDB Atlas CLI {{.Version}}"
   extra_files:
     - glob: ./bin/*.msi
-version: 2
+    - glob: compliance/**/*
+version: 2
diff --git a/build/package/generate-sbom.sh b/build/package/generate-sbom.sh
@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+
+# Copyright 2025 MongoDB Inc
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -Eeou pipefail
+
+export WORKDIR=${workdir:?}
+
+# Authenticate Docker to AWS ECR
+aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin 901841024863.dkr.ecr.us-east-1.amazonaws.com
+
+echo "Generating SBOMs..."
+docker run --rm \
+  -v "$WORKDIR/src/github.com/mongodb/mongodb-atlas-cli:/pwd" \
+  901841024863.dkr.ecr.us-east-1.amazonaws.com/release-infrastructure/silkbomb:2.0 \
+  update \
+  --purls /pwd/build/package/purls.txt \
+  --sbom-out /pwd/sbom.json
+  
diff --git a/build/package/purls.txt b/build/package/purls.txt
@@ -0,0 +1,122 @@
+pkg:golang/cloud.google.com/go/auth/oauth2adapt@v0.2.8
+pkg:golang/cloud.google.com/go/auth@v0.16.0
+pkg:golang/cloud.google.com/go/compute/metadata@v0.6.0
+pkg:golang/cloud.google.com/go/iam@v1.5.0
+pkg:golang/cloud.google.com/go/kms@v1.21.2
+pkg:golang/cloud.google.com/go/longrunning@v0.6.6
+pkg:golang/github.com/AlecAivazis/survey/v2@v2.3.7
+pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/azcore@v1.18.0
+pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/azidentity@v1.9.0
+pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/internal@v1.11.1
+pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys@v1.3.1
+pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal@v1.1.1
+pkg:golang/github.com/AzureAD/microsoft-authentication-library-for-go@v1.4.2
+pkg:golang/github.com/Masterminds/semver/v3@v3.3.1
+pkg:golang/github.com/PaesslerAG/gval@v1.0.0
+pkg:golang/github.com/PaesslerAG/jsonpath@v0.1.1
+pkg:golang/github.com/ProtonMail/go-crypto@v1.2.0
+pkg:golang/github.com/STARRY-S/zip@v0.2.1
+pkg:golang/github.com/andybalholm/brotli@v1.1.1
+pkg:golang/github.com/aws/aws-sdk-go-v2/config@v1.29.14
+pkg:golang/github.com/aws/aws-sdk-go-v2/credentials@v1.17.67
+pkg:golang/github.com/aws/aws-sdk-go-v2/feature/ec2/imds@v1.16.30
+pkg:golang/github.com/aws/aws-sdk-go-v2/internal/configsources@v1.3.34
+pkg:golang/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.6.34
+pkg:golang/github.com/aws/aws-sdk-go-v2/internal/ini@v1.8.3
+pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding@v1.12.3
+pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url@v1.12.15
+pkg:golang/github.com/aws/aws-sdk-go-v2/service/kms@v1.38.3
+pkg:golang/github.com/aws/aws-sdk-go-v2/service/sso@v1.25.3
+pkg:golang/github.com/aws/aws-sdk-go-v2/service/ssooidc@v1.30.1
+pkg:golang/github.com/aws/aws-sdk-go-v2/service/sts@v1.33.19
+pkg:golang/github.com/aws/aws-sdk-go-v2@v1.36.3
+pkg:golang/github.com/aws/smithy-go@v1.22.2
+pkg:golang/github.com/bodgit/plumbing@v1.3.0
+pkg:golang/github.com/bodgit/sevenzip@v1.6.0
+pkg:golang/github.com/bodgit/windows@v1.0.1
+pkg:golang/github.com/briandowns/spinner@v1.23.2
+pkg:golang/github.com/cloudflare/circl@v1.6.0
+pkg:golang/github.com/denisbrodbeck/machineid@v1.0.1
+pkg:golang/github.com/dsnet/compress@v0.0.2-0.20230904184137-39efe44ab707
+pkg:golang/github.com/fatih/color@v1.14.1
+pkg:golang/github.com/felixge/httpsnoop@v1.0.4
+pkg:golang/github.com/fsnotify/fsnotify@v1.8.0
+pkg:golang/github.com/go-logr/logr@v1.4.2
+pkg:golang/github.com/go-logr/stdr@v1.2.2
+pkg:golang/github.com/go-viper/mapstructure/v2@v2.2.1
+pkg:golang/github.com/golang-jwt/jwt/v5@v5.2.2
+pkg:golang/github.com/golang/mock@v1.6.0
+pkg:golang/github.com/golang/snappy@v0.0.4
+pkg:golang/github.com/google/go-github/v61@v61.0.0
+pkg:golang/github.com/google/go-querystring@v1.1.0
+pkg:golang/github.com/google/s2a-go@v0.1.9
+pkg:golang/github.com/google/uuid@v1.6.0
+pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.6
+pkg:golang/github.com/googleapis/gax-go/v2@v2.14.1
+pkg:golang/github.com/hashicorp/errwrap@v1.1.0
+pkg:golang/github.com/hashicorp/go-multierror@v1.1.1
+pkg:golang/github.com/hashicorp/golang-lru/v2@v2.0.7
+pkg:golang/github.com/iancoleman/strcase@v0.3.0
+pkg:golang/github.com/kballard/go-shellquote@v0.0.0-20180428030007-95032a82bc51
+pkg:golang/github.com/klauspost/compress@v1.18.0
+pkg:golang/github.com/klauspost/pgzip@v1.2.6
+pkg:golang/github.com/kylelemons/godebug@v1.1.0
+pkg:golang/github.com/mattn/go-colorable@v0.1.13
+pkg:golang/github.com/mattn/go-isatty@v0.0.20
+pkg:golang/github.com/mgutz/ansi@v0.0.0-20170206155736-9520e82c474b
+pkg:golang/github.com/mholt/archives@v0.1.1
+pkg:golang/github.com/minio/minlz@v1.0.0
+pkg:golang/github.com/mongodb-forks/digest@v1.1.0
+pkg:golang/github.com/montanaflynn/stats@v0.7.1
+pkg:golang/github.com/nwaples/rardecode/v2@v2.1.0
+pkg:golang/github.com/pelletier/go-toml/v2@v2.2.3
+pkg:golang/github.com/pelletier/go-toml@v1.9.5
+pkg:golang/github.com/pierrec/lz4/v4@v4.1.21
+pkg:golang/github.com/pkg/browser@v0.0.0-20240102092130-5ac0b6a4141c
+pkg:golang/github.com/sagikazarmark/locafero@v0.7.0
+pkg:golang/github.com/shirou/gopsutil/v4@v4.25.3
+pkg:golang/github.com/sorairolake/lzip-go@v0.3.5
+pkg:golang/github.com/sourcegraph/conc@v0.3.0
+pkg:golang/github.com/spf13/afero@v1.14.0
+pkg:golang/github.com/spf13/cast@v1.7.1
+pkg:golang/github.com/spf13/cobra@v1.9.1
+pkg:golang/github.com/spf13/pflag@v1.0.6
+pkg:golang/github.com/spf13/viper@v1.20.1
+pkg:golang/github.com/subosito/gotenv@v1.6.0
+pkg:golang/github.com/tangzero/inflector@v1.0.0
+pkg:golang/github.com/therootcompany/xz@v1.0.1
+pkg:golang/github.com/tklauser/go-sysconf@v0.3.12
+pkg:golang/github.com/tklauser/numcpus@v0.6.1
+pkg:golang/github.com/ulikunitz/xz@v0.5.12
+pkg:golang/github.com/xdg-go/pbkdf2@v1.0.0
+pkg:golang/github.com/xdg-go/scram@v1.1.2
+pkg:golang/github.com/xdg-go/stringprep@v1.0.4
+pkg:golang/github.com/youmark/pkcs8@v0.0.0-20240726163527-a2c0da244d78
+pkg:golang/go.mongodb.org/atlas-sdk/v20240530005@v20240530005.0.0
+pkg:golang/go.mongodb.org/atlas-sdk/v20250312002@v20250312002.0.0
+pkg:golang/go.mongodb.org/atlas@v0.38.0
+pkg:golang/go.mongodb.org/mongo-driver@v1.17.3
+pkg:golang/go.opentelemetry.io/auto/sdk@v1.1.0
+pkg:golang/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@v0.60.0
+pkg:golang/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.60.0
+pkg:golang/go.opentelemetry.io/otel/metric@v1.35.0
+pkg:golang/go.opentelemetry.io/otel/trace@v1.35.0
+pkg:golang/go.opentelemetry.io/otel@v1.35.0
+pkg:golang/go4.org@v0.0.0-20230225012048-214862532bf5
+pkg:golang/golang.org/x/crypto@v0.37.0
+pkg:golang/golang.org/x/exp@v0.0.0-20241004190924-225e2abe05e6
+pkg:golang/golang.org/x/mod@v0.24.0
+pkg:golang/golang.org/x/net@v0.39.0
+pkg:golang/golang.org/x/oauth2@v0.29.0
+pkg:golang/golang.org/x/sync@v0.13.0
+pkg:golang/golang.org/x/sys@v0.32.0
+pkg:golang/golang.org/x/term@v0.31.0
+pkg:golang/golang.org/x/text@v0.24.0
+pkg:golang/golang.org/x/time@v0.11.0
+pkg:golang/google.golang.org/api@v0.229.0
+pkg:golang/google.golang.org/genproto/googleapis/api@v0.0.0-20250414145226-207652e42e2e
+pkg:golang/google.golang.org/genproto/googleapis/rpc@v0.0.0-20250414145226-207652e42e2e
+pkg:golang/google.golang.org/genproto@v0.0.0-20250303144028-a0af3efb3deb
+pkg:golang/google.golang.org/grpc@v1.72.0
+pkg:golang/google.golang.org/protobuf@v1.36.6
+pkg:golang/gopkg.in/yaml.v3@v3.0.1
diff --git a/scripts/pre-commit.sh b/scripts/pre-commit.sh
@@ -39,6 +39,13 @@ if [[ -n "${STAGED_GO_FILES}" ]]; then
     git add docs
 fi
 
+STAGED_GO_MOD_FILES=$(git diff --cached --name-only | grep -E "^go\.(mod|sum)$" || true)
+
+if [[ -n "${STAGED_GO_MOD_FILES}" ]]; then
+    make gen-purls > /dev/null
+    git add build/package/purls.txt
+fi
+
 STAGED_EVG_FILES=$(git diff --cached --name-only | grep "evergreen.yml$")
 
 for FILE in ${STAGED_EVG_FILES}
