Skip to content

Commit 0c9c5e8

Browse files
comandeo-mongocomandeo-mongo
committed
Merge branch 'master' into 3414-fix-serverless-tests
2 parents 90006c1 + 9c709b9 commit 0c9c5e8

File tree

19 files changed

+422
-249
lines changed

19 files changed

+422
-249
lines changed

‎.evergreen/tools.rb

Lines changed: 0 additions & 67 deletions
This file was deleted.

‎.github/release.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# For configuring how release notes are auto-generated.
2+
# Requires the use of labels to categorize pull requests.
3+
#
4+
# See: https://docs.github.com/en/repositories/releasing-projects-on-github/automatically-generated-release-notes

‎.github/workflows/codeql.yml

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
name: "CodeQL"
2+
3+
on:
4+
push:
5+
branches: [ "master" ]
6+
pull_request:
7+
branches: [ "master" ]
8+
schedule:
9+
- cron: '20 0 * * 0'
10+
11+
jobs:
12+
analyze:
13+
name: Analyze (${{ matrix.language }})
14+
# Runner size impacts CodeQL analysis time. To learn more, please see:
15+
# - https://gh.io/recommended-hardware-resources-for-running-codeql
16+
# - https://gh.io/supported-runners-and-hardware-resources
17+
# - https://gh.io/using-larger-runners (GitHub.com only)
18+
# Consider using larger runners or machines with greater resources for possible analysis time improvements.
19+
runs-on: 'ubuntu-latest'
20+
timeout-minutes: 360
21+
permissions:
22+
# required for all workflows
23+
security-events: write
24+
25+
# required to fetch internal or private CodeQL packs
26+
packages: read
27+
28+
# only required for workflows in private repositories
29+
actions: read
30+
contents: read
31+
32+
strategy:
33+
fail-fast: false
34+
matrix:
35+
include:
36+
- language: ruby
37+
build-mode: none
38+
steps:
39+
- name: Checkout repository
40+
uses: actions/checkout@v4
41+
42+
# Initializes the CodeQL tools for scanning.
43+
- name: Initialize CodeQL
44+
uses: github/codeql-action/init@v3
45+
with:
46+
languages: ${{ matrix.language }}
47+
build-mode: ${{ matrix.build-mode }}
48+
config: |
49+
paths-ignore:
50+
- .evergreen
51+
- spec
52+
# If you wish to specify custom queries, you can do so here or in a config file.
53+
# By default, queries listed here will override any specified in a config file.
54+
# Prefix the list here with "+" to use these queries and those in the config file.
55+
56+
# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
57+
# queries: security-extended,security-and-quality
58+
59+
# If the analyze step fails for one of the languages you are analyzing with
60+
# "We were unable to automatically build your code", modify the matrix above
61+
# to set the build mode to "manual" for that language. Then modify this step
62+
# to build your code.
63+
# ℹ️ Command-line programs to run using the OS shell.
64+
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
65+
- if: matrix.build-mode == 'manual'
66+
run: |
67+
echo 'If you are using a "manual" build mode for one or more of the' \
68+
'languages you are analyzing, replace this with the commands to build' \
69+
'your code, for example:'
70+
echo ' make bootstrap'
71+
echo ' make release'
72+
exit 1
73+
74+
- name: Perform CodeQL Analysis
75+
uses: github/codeql-action/analyze@v3
76+
with:
77+
category: "/language:${{matrix.language}}"

‎.github/workflows/release.yml

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
name: "Driver Release"
2+
run-name: "Ruby Driver Release ${{ github.ref_name }}"
3+
4+
on: workflow_dispatch
5+
6+
env:
7+
RELEASE_MESSAGE_TEMPLATE: |
8+
Version {0} of the [MongoDB Ruby Driver](https://rubygems.org/gems/mongo) is now available.
9+
10+
**Release Highlights**
11+
12+
TODO: one or more paragraphs describing important changes in this release
13+
14+
**Documentation**
15+
16+
Documentation is available at [MongoDB.com](https://www.mongodb.com/docs/ruby-driver/current/).
17+
18+
**Installation**
19+
20+
You may install this version via RubyGems, with:
21+
22+
gem install --version {0} mongo
23+
24+
jobs:
25+
release:
26+
name: "Driver Release"
27+
environment: release
28+
runs-on: 'ubuntu-latest'
29+
30+
permissions:
31+
# required for all workflows
32+
security-events: write
33+
34+
# required to fetch internal or private CodeQL packs
35+
packages: read
36+
37+
# only required for workflows in private repositories
38+
actions: read
39+
contents: write
40+
41+
# required by the mongodb-labs/drivers-github-tools/setup@v2 step
42+
# also required by `rubygems/release-gem`
43+
id-token: write
44+
45+
steps:
46+
- name: "Create temporary app token"
47+
uses: actions/create-github-app-token@v1
48+
id: app-token
49+
with:
50+
app-id: ${{ vars.APP_ID }}
51+
private-key: ${{ secrets.APP_PRIVATE_KEY }}
52+
53+
- name: "Store GitHub token in environment"
54+
run: echo "GH_TOKEN=${{ steps.app-token.outputs.token }}" >> "$GITHUB_ENV"
55+
shell: bash
56+
57+
- name: Checkout repository
58+
uses: actions/checkout@v4
59+
with:
60+
token: ${{ env.GH_TOKEN }}
61+
62+
- name: Setup Ruby
63+
uses: ruby/setup-ruby@v1
64+
with:
65+
ruby-version: '3.2'
66+
bundler-cache: true
67+
68+
- name: Setup GitHub tooling for DBX Drivers
69+
uses: mongodb-labs/drivers-github-tools/setup@v2
70+
with:
71+
aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
72+
aws_region_name: ${{ vars.AWS_REGION_NAME }}
73+
aws_secret_id: ${{ secrets.AWS_SECRET_ID }}
74+
75+
- name: Get the driver version
76+
shell: bash
77+
run: |
78+
echo "DRIVER_VERSION=$(ruby -Ilib -rmongo/version -e 'puts Mongo::VERSION')" >> "$GITHUB_ENV"
79+
80+
- name: Set output gem file name
81+
shell: bash
82+
run: |
83+
echo "GEM_FILE_NAME=mongo-${{ env.DRIVER_VERSION }}.gem" >> "$GITHUB_ENV"
84+
85+
- name: Build the gem
86+
shell: bash
87+
run: |
88+
gem build --output=${{ env.GEM_FILE_NAME }} mongo.gemspec
89+
90+
- name: Sign the gem
91+
uses: mongodb-labs/drivers-github-tools/gpg-sign@v2
92+
with:
93+
filenames: '${{ env.GEM_FILE_NAME }}'
94+
95+
- name: Create and sign the tag
96+
uses: mongodb-labs/drivers-github-tools/git-sign@v2
97+
with:
98+
command: "git tag -u ${{ env.GPG_KEY_ID }} -m 'Release tag for v${{ env.DRIVER_VERSION }}' v${{ env.DRIVER_VERSION }}"
99+
100+
- name: Push the tag to the repository
101+
shell: bash
102+
run: |
103+
git push origin v${{ env.DRIVER_VERSION }}
104+
105+
- name: Create a new release
106+
shell: bash
107+
run: gh release create v${{ env.DRIVER_VERSION }} --title ${{ env.DRIVER_VERSION }} --generate-notes --draft
108+
109+
- name: Capture the changelog
110+
shell: bash
111+
run: gh release view v${{ env.DRIVER_VERSION }} --json body --template '{{ .body }}' >> changelog
112+
113+
- name: Prepare release message
114+
shell: bash
115+
run: |
116+
echo "${{ format(env.RELEASE_MESSAGE_TEMPLATE, env.DRIVER_VERSION) }}" > release-message
117+
cat changelog >> release-message
118+
119+
- name: Update release information
120+
shell: bash
121+
run: |
122+
echo "RELEASE_URL=$(gh release edit v${{ env.DRIVER_VERSION }} --notes-file release-message)" >> "$GITHUB_ENV"
123+
124+
- name: Upload release artifacts
125+
run: gh release upload v${{ env.DRIVER_VERSION }} ${{ env.GEM_FILE_NAME }} ${{ env.RELEASE_ASSETS }}/${{ env.GEM_FILE_NAME }}.sig
126+
127+
- name: Publish the gem
128+
uses: rubygems/release-gem@v1
129+
with:
130+
await-release: false

‎README.md

Lines changed: 37 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,43 @@ MongoDB Ruby Driver
55

66
The officially supported Ruby driver for [MongoDB](https://www.mongodb.org/).
77

8-
The Ruby driver supports Ruby 2.5-3.0 and JRuby 9.2.
8+
The Ruby driver supports Ruby 2.7-3.3 and JRuby 9.3-9.4.
9+
10+
## Installation
11+
12+
Install via RubyGems, either via the command-line for ad-hoc uses:
13+
14+
$ gem install mongo
15+
16+
Or via a Gemfile for more general use:
17+
18+
gem 'mongo'
19+
20+
### Release Integrity
21+
22+
Each release of the MongoDB Ruby driver after version 2.20.0 has been automatically built and signed using the team's GPG key.
23+
24+
To verify the driver's gem file:
25+
26+
1. [Download the GPG key](https://pgp.mongodb.com/ruby-driver.asc).
27+
2. Import the key into your GPG keyring with `gpg --import ruby-driver.asc`.
28+
3. Download the gem file (if you don't already have it). You can download it from RubyGems with `gem fetch mongo`, or you can download it from the [releases page](https://github.com/mongodb/mongo-ruby-driver/releases) on GitHub.
29+
4. Download the corresponding detached signature file from the [same release](https://github.com/mongodb/mongo-ruby-driver/releases). Look at the bottom of the release that corresponds to the gem file, under the 'Assets' list, for a `.sig` file with the same version number as the gem you wish to install.
30+
5. Verify the gem with `gpg --verify mongo-X.Y.Z.gem.sig mongo-X.Y.Z.gem` (replacing `X.Y.Z` with the actual version number).
31+
32+
You are looking for text like "Good signature from "MongoDB Ruby Driver Release Signing Key <[email protected]>" in the output. If you see that, the signature was found to correspond to the given gem file.
33+
34+
(Note that other output, like "This key is not certified with a trusted signature!", is related to *web of trust* and depends on how strongly you, personally, trust the `ruby-driver.asc` key that you downloaded from us. To learn more, see https://www.gnupg.org/gph/en/manual/x334.html)
35+
36+
### Why not use RubyGems' gem-signing functionality?
37+
38+
RubyGems' own gem signing is problematic, most significantly because there is no established chain of trust related to the keys used to sign gems. RubyGems' own documentation admits that "this method of signing gems is not widely used" (see https://guides.rubygems.org/security/). Discussions about this in the RubyGems community have been off-and-on for more than a decade, and while a solution will eventually arrive, we have settled on using GPG instead for the following reasons:
39+
40+
1. Many of the other driver teams at MongoDB are using GPG to sign their product releases. Consistency with the other teams means that we can reuse existing tooling for our own product releases.
41+
2. GPG is widely available and has existing tools and procedures for dealing with web of trust (though they are admittedly quite arcane and intimidating to the uninitiated, unfortunately).
42+
43+
Ultimately, most users do not bother to verify gems, and will not be impacted by our choice of GPG over RubyGems' native method.
44+
945

1046
## Documentation
1147

0 commit comments

Comments
 (0)