CXX-3309 Automate SBOM generation and Endor Labs scanning #1528
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
eramongodb
requested changes
Dec 5, 2025
| # See the License for the specific language governing permissions and | ||
| # limitations under the License. | ||
|
|
||
|
|
Contributor
There was a problem hiding this comment.
Suggested change
Stray whitespace?
| } | ||
| } | ||
| ``` | ||
| The `metadata.component.bom-ref` field does not need to change, but if you do change it be sure to also update the assocaited `dependencies[].ref` field. Note that the github PURL references the release tag (`rX.Y.Z`). |
Contributor
There was a problem hiding this comment.
Suggested change
| The `metadata.component.bom-ref` field does not need to change, but if you do change it be sure to also update the assocaited `dependencies[].ref` field. Note that the github PURL references the release tag (`rX.Y.Z`). | |
| The `metadata.component.bom-ref` field does not need to change, but if you do change it be sure to also update the associated `dependencies[].ref` field. Note that the github PURL references the release tag (`rX.Y.Z`). |
Typo.
Contributor
There was a problem hiding this comment.
Given these scripts are intended for use by GitHub Actions, can they be relocated into a new .github/scripts directory instead?
| CXX_STANDARD: 17 | ||
| working-directory: ${{env.BUILD}} | ||
| run: | | ||
| cmake .. -DCMAKE_BUILD_TYPE=${{env.BUILD_TYPE}} -DCMAKE_CXX_STANDARD=${{env.CXX_STANDARD}} -DENABLE_TESTS=ON |
Contributor
There was a problem hiding this comment.
Suggested change
| cmake .. -DCMAKE_BUILD_TYPE=${{env.BUILD_TYPE}} -DCMAKE_CXX_STANDARD=${{env.CXX_STANDARD}} -DENABLE_TESTS=ON | |
| cmake -DCMAKE_BUILD_TYPE="${{env.BUILD_TYPE}}" -DCMAKE_CXX_STANDARD="${{env.CXX_STANDARD}}" -DENABLE_TESTS=OFF -B . -S .. |
Recommended CMake command syntax + guard against variable expansion.
| working-directory: ${{env.BUILD}} | ||
| run: | | ||
| cmake .. -DCMAKE_BUILD_TYPE=${{env.BUILD_TYPE}} -DCMAKE_CXX_STANDARD=${{env.CXX_STANDARD}} -DENABLE_TESTS=ON | ||
| rm .gitignore # prevent exclusion of build/_deps from endorctl scan |
Contributor
There was a problem hiding this comment.
Suggested change
| rm .gitignore # prevent exclusion of build/_deps from endorctl scan | |
| echo "!_deps" >>.gitignore # prevent exclusion of build/_deps from endorctl scan |
Consider excluding the _deps directory specifically instead.
| env: | ||
| ENDOR_SCAN_EMBEDDINGS: true | ||
| with: | ||
| additional_args: '--languages=c --include-path="build/_deps/**"' |
Contributor
There was a problem hiding this comment.
Should the --languages flag use something like c,cpp instead? Catch2 (only used for tests) is a C++ library.
| --repo mongodb/mongo-cxx-driver | ||
| --branch "${branch_name:?}" | ||
| --sbom-in /pwd/etc/cyclonedx.sbom.json | ||
| --sbom-in /pwd/sbom.json |
Contributor
There was a problem hiding this comment.
Why not under etc as before? Is this required by Endor Labs?
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Objective
Changes
.github/workflows/endor_scan_and_generate_sbom.yml) triggered by edits to cmake files that:push) performs an Endor Labs SCA scan and exports an SBOM formasterorreleases/v*branches, enriches SBOM with metadata, opens a PR for updated SBOMpull_request) performs an Endor Labs SCA scan for PRs (non-blocking) and, if potential vulnerabilities were found, add a comment to PRworkflow_dispatch) workflow can also be triggered manuallyetc/purls.txtfilesbom.jsonfile is used as input instead ofetc/purls.txtetc/cyclonedx.sbom.jsontosbom.jsonfor consistency with other MDB reposetc/sbomfolder with:pyproject.tomletc/sbom/metadata.cdx.jsonetc/releasing.mdTesting
The workflow was thoroughly tested on a fork, including scenarios with missing or malformed files.
Permissions
The workflow requires the repository configuration to allow it to request write access and open PRs.
Miscellaneous
master, it may be cherry picked to the relevant release branches.