Skip to content

Commit b083e2c

Browse files
jamisjamis
authored
MONGOID-5743 SSDLC Requirements (#5834)
* prep for SSDLC tasks (and remove old release flow) * address code-scanning concerns * permit code scanning on all branches * tie actions to a specific ref do we need to bump the v2 to v3 in order to get the ruby actions? * v2 * use boolean type for dry-run flag
1 parent d58d8e1 commit b083e2c

File tree

10 files changed

+260
-138
lines changed

10 files changed

+260
-138
lines changed

‎.github/workflows/cleanup.yml

+44
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
name: "Dry-Run Cleanup"
2+
run-name: "Dry Run Cleanup for ${{ github.ref }}"
3+
4+
on:
5+
workflow_dispatch:
6+
inputs:
7+
confirm:
8+
description: Indicate whether you want this workflow to run (must be "true")
9+
required: true
10+
type: string
11+
tag:
12+
description: The name of the tag (and release) to clean up
13+
required: true
14+
type: string
15+
16+
jobs:
17+
release:
18+
name: "Dry-Run Cleanup"
19+
environment: release
20+
runs-on: 'ubuntu-latest'
21+
if: ${{ inputs.confirm == 'true' }}
22+
23+
permissions:
24+
# required for all workflows
25+
security-events: write
26+
27+
# required to fetch internal or private CodeQL packs
28+
packages: read
29+
30+
# only required for workflows in private repositories
31+
actions: read
32+
contents: write
33+
34+
# required by the mongodb-labs/drivers-github-tools/setup@v2 step
35+
# also required by `rubygems/release-gem`
36+
id-token: write
37+
38+
steps:
39+
- name: "Run the cleanup action"
40+
uses: mongodb-labs/drivers-github-tools/ruby/cleanup@v2
41+
with:
42+
app_id: ${{ vars.APP_ID }}
43+
app_private_key: ${{ secrets.APP_PRIVATE_KEY }}
44+
tag: ${{ inputs.tag }}

‎.github/workflows/codeql.yml

+79
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
name: "CodeQL"
2+
3+
on:
4+
push:
5+
pull_request:
6+
schedule:
7+
- cron: '20 0 * * 0'
8+
9+
jobs:
10+
analyze:
11+
name: Analyze (${{ matrix.language }})
12+
# Runner size impacts CodeQL analysis time. To learn more, please see:
13+
# - https://gh.io/recommended-hardware-resources-for-running-codeql
14+
# - https://gh.io/supported-runners-and-hardware-resources
15+
# - https://gh.io/using-larger-runners (GitHub.com only)
16+
# Consider using larger runners or machines with greater resources for possible analysis time improvements.
17+
runs-on: 'ubuntu-latest'
18+
timeout-minutes: 360
19+
permissions:
20+
# required for all workflows
21+
security-events: write
22+
23+
# required to fetch internal or private CodeQL packs
24+
packages: read
25+
26+
# only required for workflows in private repositories
27+
actions: read
28+
contents: read
29+
30+
strategy:
31+
fail-fast: false
32+
matrix:
33+
include:
34+
- language: ruby
35+
build-mode: none
36+
steps:
37+
- name: Checkout repository
38+
uses: actions/checkout@v4
39+
40+
# Initializes the CodeQL tools for scanning.
41+
- name: Initialize CodeQL
42+
uses: github/codeql-action/init@v3
43+
with:
44+
languages: ${{ matrix.language }}
45+
build-mode: ${{ matrix.build-mode }}
46+
config: |
47+
paths-ignore:
48+
- .evergreen
49+
- spec
50+
- perf
51+
- examples
52+
- test-apps
53+
# If you wish to specify custom queries, you can do so here or in a config file.
54+
# By default, queries listed here will override any specified in a config file.
55+
# Prefix the list here with "+" to use these queries and those in the config file.
56+
57+
# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
58+
# queries: security-extended,security-and-quality
59+
60+
# If the analyze step fails for one of the languages you are analyzing with
61+
# "We were unable to automatically build your code", modify the matrix above
62+
# to set the build mode to "manual" for that language. Then modify this step
63+
# to build your code.
64+
# ℹ️ Command-line programs to run using the OS shell.
65+
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
66+
- if: matrix.build-mode == 'manual'
67+
run: |
68+
echo 'If you are using a "manual" build mode for one or more of the' \
69+
'languages you are analyzing, replace this with the commands to build' \
70+
'your code, for example:'
71+
echo ' make bootstrap'
72+
echo ' make release'
73+
exit 1
74+
75+
- name: Perform CodeQL Analysis
76+
uses: github/codeql-action/analyze@v3
77+
with:
78+
category: "/language:${{matrix.language}}"
79+

‎.github/workflows/release.yml

+67
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
name: "Mongoid Release"
2+
run-name: "Mongoid Release for ${{ github.ref }}"
3+
4+
on:
5+
workflow_dispatch:
6+
inputs:
7+
dry_run:
8+
description: Whether this is a dry run or not
9+
required: true
10+
default: true
11+
type: boolean
12+
13+
env:
14+
SILK_ASSET_GROUP: mongoid
15+
RELEASE_MESSAGE_TEMPLATE: |
16+
Version {0} of the [Mongoid ODM for MongoDB](https://rubygems.org/gems/mongoid) is now available.
17+
18+
**Release Highlights**
19+
20+
TODO: one or more paragraphs describing important changes in this release
21+
22+
**Documentation**
23+
24+
Documentation is available at [MongoDB.com](https://www.mongodb.com/docs/mongoid/current/).
25+
26+
**Installation**
27+
28+
You may install this version via RubyGems, with:
29+
30+
gem install --version {0} mongoid
31+
32+
jobs:
33+
release:
34+
name: "Mongoid Release"
35+
environment: release
36+
runs-on: 'ubuntu-latest'
37+
38+
permissions:
39+
# required for all workflows
40+
security-events: write
41+
42+
# required to fetch internal or private CodeQL packs
43+
packages: read
44+
45+
# only required for workflows in private repositories
46+
actions: read
47+
contents: write
48+
49+
# required by the mongodb-labs/drivers-github-tools/setup@v2 step
50+
# also required by `rubygems/release-gem`
51+
id-token: write
52+
53+
steps:
54+
- name: "Run the publish action"
55+
uses: mongodb-labs/drivers-github-tools/ruby/publish@v2
56+
with:
57+
app_id: ${{ vars.APP_ID }}
58+
app_private_key: ${{ secrets.APP_PRIVATE_KEY }}
59+
aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
60+
aws_region_name: ${{ vars.AWS_REGION_NAME }}
61+
aws_secret_id: ${{ secrets.AWS_SECRET_ID }}
62+
dry_run: ${{ inputs.dry_run }}
63+
gem_name: mongoid
64+
product_name: Mongoid
65+
product_id: mongoid
66+
release_message_template: ${{ env.RELEASE_MESSAGE_TEMPLATE }}
67+
silk_asset_group: ${{ env.SILK_ASSET_GROUP }}

‎Rakefile

+44-21
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22
# rubocop:todo all
33

44
require "bundler"
5-
require "bundler/gem_tasks"
65
Bundler.setup
76

87
ROOT = File.expand_path(File.join(File.dirname(__FILE__)))
@@ -11,25 +10,53 @@ $: << File.join(ROOT, 'spec/shared/lib')
1110

1211
require "rake"
1312
require "rspec/core/rake_task"
14-
require 'mrss/spec_organizer'
1513

16-
$LOAD_PATH.unshift File.expand_path("../lib", __FILE__)
17-
require "mongoid/version"
18-
19-
tasks = Rake.application.instance_variable_get('@tasks')
20-
tasks['release:do'] = tasks.delete('release')
21-
22-
task :gem => :build
14+
# stands in for the Bundler-provided `build` task, which builds the
15+
# gem for this project. Our release process builds the gems in a
16+
# particular way, in a GitHub action. This task is just to help remind
17+
# developers of that fact.
2318
task :build do
24-
system "gem build mongoid.gemspec"
19+
abort <<~WARNING
20+
`rake build` does nothing in this project. The gem must be built via
21+
the `Mongoid Release` action on GitHub, which is triggered manually when
22+
a new release is ready.
23+
WARNING
2524
end
2625

27-
task :install => :build do
28-
system "sudo gem install mongoid-#{Mongoid::VERSION}.gem"
26+
# `rake version` is used by the deployment system so get the release version
27+
# of the product beng deployed. It must do nothing more than just print the
28+
# product version number.
29+
#
30+
# See the mongodb-labs/driver-github-tools/ruby/publish Github action.
31+
desc "Print the current value of Mongoid::VERSION"
32+
task :version do
33+
require 'mongoid/version'
34+
35+
puts Mongoid::VERSION
2936
end
3037

38+
# overrides the default Bundler-provided `release` task, which also
39+
# builds the gem. Our release process assumes the gem has already
40+
# been built (and signed via GPG), so we just need `rake release` to
41+
# push the gem to rubygems.
3142
task :release do
32-
raise "Please use ./release.sh to release"
43+
require 'mongoid/version'
44+
45+
if ENV['GITHUB_ACTION'].nil?
46+
abort <<~WARNING
47+
`rake release` must be invoked from the `Mongoid Release` GitHub action,
48+
and must not be invoked locally. This ensures the gem is properly signed
49+
and distributed by the appropriate user.
50+
51+
Note that it is the `rubygems/release-gem@v1` step in the `Mongoid Release`
52+
action that invokes this task. Do not rename or remove this task, or the
53+
release-gem step will fail. Reimplement this task with caution.
54+
55+
mongoid-#{Mongoid::VERSION}.gem was NOT pushed to RubyGems.
56+
WARNING
57+
end
58+
59+
system 'gem', 'push', "mongoid-#{Mongoid::VERSION}.gem"
3360
end
3461

3562
RSpec::Core::RakeTask.new("spec") do |spec|
@@ -96,6 +123,8 @@ RUN_PRIORITY = %i(
96123
)
97124

98125
def spec_organizer
126+
require 'mrss/spec_organizer'
127+
99128
Mrss::SpecOrganizer.new(
100129
root: ROOT,
101130
classifiers: CLASSIFIERS,
@@ -131,16 +160,10 @@ task :docs => 'docs:yard'
131160
namespace :docs do
132161
desc "Generate yard documentation"
133162
task :yard do
163+
require "mongoid/version"
164+
134165
out = File.join('yard-docs', Mongoid::VERSION)
135166
FileUtils.rm_rf(out)
136167
system "yardoc -o #{out} --title mongoid-#{Mongoid::VERSION}"
137168
end
138169
end
139-
140-
namespace :release do
141-
task :check_private_key do
142-
unless File.exist?('gem-private_key.pem')
143-
raise "No private key present, cannot release"
144-
end
145-
end
146-
end

‎lib/mongoid/criteria/queryable/extensions/numeric.rb

+15-1
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,21 @@ module ClassMethods
4444
#
4545
# @return [ Object ] The converted number.
4646
def __numeric__(object)
47-
object.to_s.match?(/\A[-+]?[0-9]*[0-9.]0*\z/) ? object.to_i : Float(object)
47+
str = object.to_s
48+
raise ArgumentError if str.empty?
49+
50+
# These requirements seem a bit odd, but they're explicitly specified in the tests,
51+
# so we're obligated to keep them, for now. (This code was rewritten from a one-line
52+
# regex, due to security concerns with a polynomial regex being used on uncontrolled
53+
# data).
54+
55+
str = str.chop if str.end_with?('.')
56+
return 0 if str.empty?
57+
58+
result = Integer(str) rescue Float(object)
59+
60+
integer = result.to_i
61+
integer == result ? integer : result
4862
end
4963

5064
# Evolve the object to an integer.

‎lib/mongoid/fields.rb

+11-6
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,11 @@ module Fields
4949
# @api private
5050
INVALID_BSON_CLASSES = [ BSON::Decimal128, BSON::Int32, BSON::Int64 ].freeze
5151

52+
# The suffix for generated translated fields.
53+
#
54+
# @api private
55+
TRANSLATIONS_SFX = '_translations'
56+
5257
module ClassMethods
5358
# Returns the list of id fields for this model class, as both strings
5459
# and symbols.
@@ -101,8 +106,8 @@ def cleanse_localized_field_names(name)
101106
ar.each_with_index do |fn, i|
102107
key = fn
103108
unless klass.fields.key?(fn) || klass.relations.key?(fn)
104-
if tr = fn.match(/(.*)_translations\z/)&.captures&.first
105-
key = tr
109+
if fn.end_with?(TRANSLATIONS_SFX)
110+
key = fn.delete_suffix(TRANSLATIONS_SFX)
106111
else
107112
key = fn
108113
end
@@ -725,11 +730,11 @@ def create_field_check(name, meth)
725730
# @api private
726731
def create_translations_getter(name, meth)
727732
generated_methods.module_eval do
728-
re_define_method("#{meth}_translations") do
733+
re_define_method("#{meth}#{TRANSLATIONS_SFX}") do
729734
attributes[name] ||= {}
730735
attributes[name].with_indifferent_access
731736
end
732-
alias_method :"#{meth}_t", :"#{meth}_translations"
737+
alias_method :"#{meth}_t", :"#{meth}#{TRANSLATIONS_SFX}"
733738
end
734739
end
735740

@@ -745,14 +750,14 @@ def create_translations_getter(name, meth)
745750
# @api private
746751
def create_translations_setter(name, meth, field)
747752
generated_methods.module_eval do
748-
re_define_method("#{meth}_translations=") do |value|
753+
re_define_method("#{meth}#{TRANSLATIONS_SFX}=") do |value|
749754
attribute_will_change!(name)
750755
value&.transform_values! do |_value|
751756
field.type.mongoize(_value)
752757
end
753758
attributes[name] = value
754759
end
755-
alias_method :"#{meth}_t=", :"#{meth}_translations="
760+
alias_method :"#{meth}_t=", :"#{meth}#{TRANSLATIONS_SFX}="
756761
end
757762
end
758763

0 commit comments

Comments
 (0)