.evg.yml

stepback: true
command_type: system

pre:
  - func: "fetch source"
  - func: "export variables"

post:
  - func: "upload jar file"
  - func: "upload unit test classes"
  - func: "upload integration test classes"
  - func: "upload unit test packages"
  - func: "upload integration test packages"
  - func: "upload unit test js"
  - func: "upload integration test js"
  - func: "upload unit test css "
  - func: "upload integration test css "
  - func: "upload unit test index"
  - func: "upload integration test index"
  - func: "upload xunit test results"

buildvariants:

  - name: static-analysis
    display_name: "Static Analysis"
    run_on: [ ubuntu2204-small ]
    tasks:
      - spotless

  - name: code-quality-and-correctness
    display_name: "Code Quality and Security"
    expansions:
      _platform: ubuntu2204-64-jdk-8
    run_on: [ ubuntu2204-small ]
    tasks:
      - name: semgrep
      - name: sbom
      - name: ssdlc-artifacts-snapshot

  - name: ubuntu2204-64-jdk-8
    display_name: Ubuntu 22.04 jdk-8
    expansions:
      _platform: ubuntu2204-64-jdk-8
    run_on: ubuntu2204-large
    tasks:
      - name: "build"
      - name: "test-unit"
      - name: "test-mongo-sql-translate"
      - name: "test-adf-integration"
      # SQL-2289: integration tests. Use the actual mongosqltranslate library for testing instead of mock.
      # - name: "test-dc-integration"

  - name: amazon2-arm64-jdk-11
    display_name: Amazon Linux 2 ARM64 jdk-11
    expansions:
      _platform: amazon2-arm64-jdk-11
    run_on: amazon2-arm64-graviton3
    tasks:
      - name: "build"
      - name: "test-unit"
      - name: "test-adf-integration"

  - name: release
    display_name: "Release"
    expansions:
      _platform: ubuntu2204-64-jdk-8
    run_on: ubuntu2204-small
    tasks:
      - name: "test-smoke"
      - name: "publish-maven"
      - name: "ssdlc-artifacts-release"
      - name: "download-center-update"

tasks:
  - name: "build"
    commands:
      - func: "build jdbc driver"

  - name: "test-unit"
    commands:
      - func: "run unit test"

  - name: "test-mongo-sql-translate"
    commands:
      - func: "run mongosqltranslate library load test"

  - name: "test-adf-integration"
    commands:
      - func: "generate github token"
      - func: "run adf integration test"

  - name: "test-dc-integration"
    commands:
      - func: "run dc integration test"

  - name: "test-smoke"
    commands:
      - func: "generate github token"
      - func: "run smoke test"

  - name: "publish-maven"
    git_tag_only: true
    depends_on:
      - name: "test-smoke"
        variant: "release"
      - name: sbom
        variant: code-quality-and-correctness
    commands:
      - func: "publish maven"
      - func: "trace artifacts"

  - name: spotless
    commands:
      - func: "check spotless"

  - name: download-center-update
    git_tag_only: true
    depends_on:
      - name: "publish-maven"
        variant: "release"
    commands:
      - func: "update download center feed"

  - name: semgrep
    exec_timeout_secs: 3600 # 1h 
    commands:
      - func: "static code analysis"

  - name: sbom
    commands:
      - func: "generate sbom"
      - func: "upload sbom"
      - func: "push SBOM Lite to Silk"
      - func: "pull augmented SBOM from Silk"
      - func: "scan sbom"

  - name: ssdlc-artifacts-release
    run_on: ubuntu2204-small
    git_tag_only: true
    depends_on:
      - name: "publish-maven"
        variant: "release"
      - name: semgrep
        variant: code-quality-and-correctness
    exec_timeout_secs: 300 # 5m
    commands:
      - func: "publish augmented SBOM"
      - func: "publish static code analysis"
      - func: "generate compliance report"
      - func: "publish compliance report"

  - name: ssdlc-artifacts-snapshot
    run_on: ubuntu2204-small
    allow_for_git_tag: false
    depends_on:
      - name: sbom
        variant: code-quality-and-correctness
      - name: semgrep
        variant: code-quality-and-correctness
    exec_timeout_secs: 300 # 5m
    commands:
      - func: "publish augmented SBOM"
      - func: "publish static code analysis"
      - func: "generate compliance report"
      - func: "publish compliance report"

functions:
  "push SBOM Lite to Silk":
    - command: shell.exec
      type: test
      params:
        shell: bash
        working_dir: mongo-jdbc-driver
        script: |
          ${PREPARE_SHELL}
          cat << EOF > silkbomb.env
          SILK_CLIENT_ID=${SILK_CLIENT_ID}
          SILK_CLIENT_SECRET=${SILK_CLIENT_SECRET}
          EOF

          ls -lrt $SSDLC_DIR

          echo "SBOM_LITE_NAME = $SBOM_LITE_NAME"

          echo "-- Uploading initial SBOM Lite to Silk --"
          docker run -i --platform="linux/amd64" --rm -v "$PWD":/pwd \
          --env-file silkbomb.env \
          artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:1.0 \
          upload --silk-asset-group ${SILK_ASSET_GROUP} --sbom-in /pwd/artifacts/ssdlc/$SBOM_LITE_NAME
          echo "-------------------------------"

  "pull augmented SBOM from Silk":
    - command: ec2.assume_role
      params:
        role_arn: ${assume_role_arn}
        duration_seconds: 3600
    - command: shell.exec
      type: test
      params:
        shell: bash
        working_dir: mongo-jdbc-driver
        script: |
          ${PREPARE_SHELL}
          cat << EOF > silkbomb.env
          SILK_CLIENT_ID=${SILK_CLIENT_ID}
          SILK_CLIENT_SECRET=${SILK_CLIENT_SECRET}
          EOF

          echo "AUGMENTED_SBOM_NAME = $AUGMENTED_SBOM_NAME"

          echo "-- Downloading augmented SBOM --"
          docker run -i --platform="linux/amd64" --rm -v "$PWD":/pwd \
          --env-file silkbomb.env \
          artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:1.0 \
          download --silk-asset-group ${SILK_ASSET_GROUP} --sbom-out /pwd/artifacts/ssdlc/$AUGMENTED_SBOM_NAME
          echo "-------------------------------"

          ls -lrt $SSDLC_DIR
    - command: s3.put
      params:
        aws_key: ${AWS_ACCESS_KEY_ID}
        aws_secret: ${AWS_SECRET_ACCESS_KEY}
        aws_session_token: ${AWS_SESSION_TOKEN}
        local_file: mongo-jdbc-driver/artifacts/ssdlc/${AUGMENTED_SBOM_NAME}
        remote_file: artifacts/${version_id}/ssdlc/${AUGMENTED_SBOM_NAME}
        content_type: application/json
        bucket: evg-bucket-mongo-jdbc-driver
        permissions: public-read

  "publish augmented SBOM":
    - command: ec2.assume_role
      params:
        role_arn: ${assume_role_arn}
        duration_seconds: 3600
    - command: s3.get
      params:
        aws_key: ${AWS_ACCESS_KEY_ID}
        aws_secret: ${AWS_SECRET_ACCESS_KEY}
        aws_session_token: ${AWS_SESSION_TOKEN}
        local_file: artifacts/ssdlc/mongodb-jdbc-${MDBJDBC_VER}.sbom.json
        remote_file: artifacts/${version_id}/ssdlc/${AUGMENTED_SBOM_NAME}
        content_type: application/json
        bucket: evg-bucket-mongo-jdbc-driver
    - command: s3.put
      params:
        aws_key: ${release_aws_key}
        aws_secret: ${release_aws_secret}
        local_file: artifacts/ssdlc/mongodb-jdbc-${MDBJDBC_VER}.sbom.json
        remote_file: mongo-jdbc-driver/mongodb-jdbc-${MDBJDBC_VER}.sbom.json
        content_type: application/json
        bucket: translators-connectors-releases
        permissions: public-read
        display_name: mongodb-jdbc-${MDBJDBC_VER}.sbom.json

  "generate sbom":
    - command: shell.exec
      type: test
      params:
        shell: bash
        working_dir: mongo-jdbc-driver
        script: |
          ${PREPARE_SHELL}
          set -o errexit
          
          mkdir -p $SBOM_TOOL_DIR
          
          echo "------------------------------------"
          echo "Generating SBOM"
          echo "------------------------------------"
          ./gradlew clean cyclonedxBom -PcyclonedxBomDestination=$SSDLC_DIR -PcyclonedxBomName=sbom_without_team_name
    - command: shell.exec
      type: test
      params:
        shell: bash
        working_dir: mongo-jdbc-driver
        script: |
          ${PREPARE_SHELL}
          set -o errexit
          
          JQ_URL="https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-linux-amd64"
          
          echo "-- Downloading JQ $JQ_URL --"
          curl -L -o $SBOM_TOOL_DIR/jq "$JQ_URL" \
            --silent \
            --fail \
            --max-time 60 \
            --retry 5 \
            --retry-delay 0
          chmod +x ./$SBOM_TOOL_DIR/jq
          
          echo "------------------------------------"
          echo "Adding team name to SBOM"
          echo "------------------------------------"
          jq '.components[].properties += [{"name": "internal:team_responsible", "value": "Atlas SQL"}]' $SBOM_WITHOUT_TEAM_NAME > $SBOM_LITE
          
          echo "------------------------------------"
          echo "Done generating SBOM"
          echo "------------------------------------"

  "upload sbom":
    - command: ec2.assume_role
      params:
        role_arn: ${assume_role_arn}
        duration_seconds: 3600
    - command: s3.put
      params:
        aws_key: ${AWS_ACCESS_KEY_ID}
        aws_secret: ${AWS_SECRET_ACCESS_KEY}
        aws_session_token: ${AWS_SESSION_TOKEN}
        local_files_include_filter:
          - ${SBOM_LITE_NAME}
        remote_file: artifacts/${version_id}/ssdlc/
        content_type: application/json
        bucket: evg-bucket-mongo-jdbc-driver
        permissions: public-read

  "scan sbom":
    command: shell.exec
    type: test
    params:
      shell: bash
      working_dir: mongo-jdbc-driver
      script: |
        ${PREPARE_SHELL}
        set -o errexit
        
        # Install Grype
        echo "-- Downloading Grype --"
        curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b $SBOM_TOOL_DIR
        echo "------------------------------------"
        
        echo "-- Scanning dependency for vulnerabilities --"
        ./$SBOM_TOOL_DIR/grype sbom:$SBOM_LITE --fail-on low
        echo "---------------------------------------------"
        echo "<<<< Done scanning SBOM"

  "build jdbc driver":
    command: shell.exec
    type: test
    params:
      shell: bash
      working_dir: mongo-jdbc-driver
      script: |
          ${PREPARE_SHELL}
          ./gradlew -Dorg.gradle.java.home=${JAVA_HOME} clean -x test -x integrationTest spotlessApply build --rerun-tasks

  "check spotless":
    command: shell.exec
    type: test
    params:
      shell: bash
      working_dir: mongo-jdbc-driver
      script: |
          ${PREPARE_SHELL}
          ./gradlew spotlessCheck

  "run unit test":
    command: shell.exec
    type: test
    params:
      shell: bash
      working_dir: mongo-jdbc-driver
      script: |
          ${PREPARE_SHELL}
          ./gradlew -Dorg.gradle.java.home=${JAVA_HOME} clean test

  "run mongosqltranslate library load test":
    command: shell.exec
    type: test
    params:
      shell: bash
      working_dir: mongo-jdbc-driver
      script: |
        ${PREPARE_SHELL}
        set -e
        
        # Test loading library from path specified in ENV variable
        MONGOSQL_TRANSLATE_PATH="$PWD/src/test/resources/MongoSqlLibraryTest/libmongosqltranslate.so" \
            ./gradlew runMongoSQLTranslateLibTest -PtestMethod=testLibraryLoadingWithEnvironmentVariable
        
        # Move library file to where MongoDriver class is located
        mkdir -p build/classes/java/
        mv -f src/test/resources/MongoSqlLibraryTest/libmongosqltranslate.so build/classes/java/
        
        # Test loading library from same directory as where the JDBC driver is located
        ./gradlew runMongoSQLTranslateLibTest -PtestMethod=testLibraryLoadingFromDriverPath

  "generate github token":
    command: github.generate_token
    params:
      owner: 10gen
      repo: mongohouse
      expansion_name: github_token

  "run adf integration test":
    command: shell.exec
    type: test
    params:
      env:
        GITHUB_TOKEN: "${github_token}"
      shell: bash
      working_dir: mongo-jdbc-driver
      script: |
          ${PREPARE_SHELL}
          ./resources/run_adf.sh start &&
          ./gradlew -Dorg.gradle.java.home=${JAVA_HOME} runDataLoader &&
          ./gradlew -Dorg.gradle.java.home=${JAVA_HOME} clean integrationTest \
              -x test --tests ADFIntegrationTest > gradle_output.log 2>&1 &
          GRADLE_PID=$!

          echo "Gradle process started with PID $GRADLE_PID"

          # On Amazon Linux 2 hosts, the gradlew integrationTest command was hanging indefinitely.
          # This monitoring approach will detect build completion or failure even when the Gradle 
          # process doesn't terminate properly and allows the task to complete.
          SECONDS=0
          TIMEOUT=1800  # 30 minute timeout

          while true; do
              if grep -q "BUILD SUCCESSFUL" gradle_output.log; then
                  echo "Build successful!"
                  EXITCODE=0
                  break
              fi

              if grep -q "BUILD FAILED" gradle_output.log; then
                  echo "Build failed!"
                  EXITCODE=1
                  break
              fi
              
              if (( SECONDS > TIMEOUT )); then
                  echo "$TIMEOUT second timeout reached. Exiting with failure."
                  EXITCODE=1
                  break
              fi
              
              # Check if Gradle process is still running
              if ! kill -0 $GRADLE_PID 2>/dev/null; then
                  echo "Gradle process has finished."
                  wait $GRADLE_PID
                  EXITCODE=$?
                  break
              fi
              
              sleep 5
          done

          cat gradle_output.log
          
          kill $GRADLE_PID 2>/dev/null || true

          ./resources/run_adf.sh stop
          
          echo "Integration test exit code: $EXITCODE"
          exit $EXITCODE

  "run dc integration test":
    command: shell.exec
    type: test
    params:
      shell: bash
      working_dir: mongo-jdbc-driver
      script: |
        ${PREPARE_SHELL}

        case ${_platform} in
        ubuntu2204-64-jdk-8 | ubuntu2204-64-jdk-11)
          mdb_version_com="mongodb-linux-x86_64-ubuntu2204-7.0.14"
          mdb_version_ent="mongodb-linux-x86_64-enterprise-ubuntu2204-7.0.14"
          arch="x64"
        ;;
        *)
          echo "ERROR: invalid value for \${_platform}: '$_platform'"
          echo "Allowed values: 'ubuntu2204-64-jdk-8', 'ubuntu2204-64-jdk-11'"
          exit 1
        ;;
        esac
        
        # Move library file to where MongoDriver class is located
        mkdir -p build/classes/java/
        mv -f src/test/resources/MongoSqlLibraryTest/libmongosqltranslate.so build/classes/java/
        
        # Download and run local community and enterprise mongods.
        ./resources/start_local_mdb.sh $mdb_version_com $mdb_version_ent $arch
        
        # Run the tests.
        ./gradlew integrationTest \
            -x test --tests DCIntegrationTest > gradle_output.log 2>&1 &
        GRADLE_PID=$!

        echo "Gradle process started with PID $GRADLE_PID"
        
        # On Amazon Linux 2 hosts, the gradlew integrationTest command was hanging indefinitely.
        # This monitoring approach will detect build completion or failure even when the Gradle 
        # process doesn't terminate properly and allows the task to complete.
        SECONDS=0
        TIMEOUT=1800  # 30 minute timeout
        while true; do
          if grep -q "BUILD SUCCESSFUL" gradle_output.log; then
              echo "Build successful!"
              EXITCODE=0
              break
          fi
          if grep -q "BUILD FAILED" gradle_output.log; then
              echo "Build failed!"
              EXITCODE=1
              break
          fi
        
          if (( SECONDS > TIMEOUT )); then
              echo "$TIMEOUT second timeout reached. Exiting with failure."
              EXITCODE=1
              break
          fi

          # Check if Gradle process is still running
          if ! kill -0 $GRADLE_PID 2>/dev/null; then
              echo "Gradle process has finished."
              wait $GRADLE_PID
              EXITCODE=$?
              break
          fi

          sleep 5
        done

        cat gradle_output.log
      
        kill $GRADLE_PID 2>/dev/null || true
      
        pkill mongod
      
        echo "Integration test exit code: $EXITCODE"
        exit $EXITCODE

  "trace artifacts":
    command: papertrail.trace
    params:
      work_dir: mongo-jdbc-driver
      key_id: ${papertrail_id}
      secret_key: ${papertrail_key}
      product: mongo-jdbc-driver
      version: ${MDBJDBC_VER}
      filenames:
        - "build/libs/*.jar"

  "run smoke test":
    command: shell.exec
    type: test
    params:
      env:
        GITHUB_TOKEN: "${github_token}"
      working_dir: mongo-jdbc-driver
      script: |
        ${PREPARE_SHELL}
        ./resources/run_adf.sh start &&
        ./gradlew runDataLoader &&
        ./gradlew clean shadowJar &&
        ./gradlew :smoketest:test -Psmoketest
        EXITCODE=$?
        ./resources/run_adf.sh stop
        exit $EXITCODE

  "export variables":
    - command: shell.exec
      params:
        shell: bash
        silent: true
        working_dir: mongo-jdbc-driver
        script: |

          # set the state needed irrespective of _platform
          ARTIFACTS_DIR=artifacts
          S3_ARTIFACTS_DIR='mongo-jdbc-driver/artifacts/${version_id}/${build_variant}'
          AUGMENTED_SBOM_NAME="mongo-jdbc-driver.augmented.sbom.json"
          COMPLIANCE_REPORT_NAME="mongodb-jdbc-compliance-report.md"
          STATIC_CODE_ANALYSIS_NAME="mongo-jdbc-driver.sast.sarif"

          # Get the version from trigger.
          # Tag triggered runs are releases and the version is set in the tag.
          # Other runs are snapshot builds (periodic builds or patches)
          if [[ "${triggered_by_git_tag}" != "" ]]; then
            export MDBJDBC_VER=$(echo ${triggered_by_git_tag} | sed s/v//)
          else
            export MDBJDBC_VER=snapshot
          fi

          case ${_platform} in
          ubuntu2204-64-jdk-8)
               JAVA_HOME=/opt/java/jdk8
          ;;
          ubuntu2204-64-jdk-11)
               JAVA_HOME=/opt/java/jdk11
          ;;
          amazon2-arm64-jdk-11)
               JAVA_HOME=/usr/lib/jvm/java-11
          ;;
          *)
               echo "ERROR: invalid value for \${_platform}: '$_platform'"
               echo "Allowed values: 'amazon2-arm64-jdk-11', 'ubuntu2204-64-jdk-8', 'ubuntu2204-64-jdk-11'"
               exit 1
          ;;
          esac

          # export any environment variables that will be needed by subprocesses
          export PROJECT_DIRECTORY="$(pwd)"

          export SBOM_LITE_NAME="mongo-jdbc-driver.cdx.json"
          export AUGMENTED_SBOM_NAME="$AUGMENTED_SBOM_NAME"
          export COMPLIANCE_REPORT_NAME=$COMPLIANCE_REPORT_NAME
          export STATIC_CODE_ANALYSIS_NAME=$STATIC_CODE_ANALYSIS_NAME

          export SSDLC_DIR="$ARTIFACTS_DIR/ssdlc"
          mkdir -p $SSDLC_DIR

          # create expansions from values calculated above
          mkdir -p $ARTIFACTS_DIR
          cat <<EOT > $ARTIFACTS_DIR/expansions.yml
          S3_ARTIFACTS_DIR: "$S3_ARTIFACTS_DIR"
          MDBJDBC_VER: "$MDBJDBC_VER"
          JAVA_HOME: "$JAVA_HOME"
          SBOM_LITE_NAME: "$SBOM_LITE_NAME"
          AUGMENTED_SBOM_NAME: "$AUGMENTED_SBOM_NAME"
          STATIC_CODE_ANALYSIS_NAME: "$STATIC_CODE_ANALYSIS_NAME"
          COMPLIANCE_REPORT_NAME: "$COMPLIANCE_REPORT_NAME"
          SSDLC_DIR: "$SSDLC_DIR"
          PREPARE_SHELL: |
            export ADF_TEST_LOCAL_USER=${adf_test_local_user}
            export ADF_TEST_LOCAL_PWD=${adf_test_local_pwd}
            export ADF_TEST_LOCAL_AUTH_DB=${adf_test_local_auth_db}
            export MDB_TEST_LOCAL_PORT=${mdb_test_local_port}
            export ADF_TEST_USER=${adf_test_user}
            export ADF_TEST_PWD=${adf_test_pwd}
            export ADF_TEST_HOST=${adf_test_host}
            export ADF_TEST_AUTH_DB=${adf_test_auth_db}
            export SRV_TEST_HOST=${srv_test_host}
            export SRV_TEST_USER=${srv_test_user}
            export SRV_TEST_PWD=${srv_test_pwd}
            export SRV_TEST_AUTH_DB=${srv_test_auth_db}
            export LOCAL_MDB_PORT_COM=${local_mdb_port_com}
            export LOCAL_MDB_PORT_ENT=${local_mdb_port_ent}
            export LOCAL_MDB_USER=${local_mdb_user}
            export LOCAL_MDB_PWD=${local_mdb_pwd}
            export JAVA_HOME=${JAVA_HOME}
            export PROJECT_DIRECTORY=${PROJECT_DIRECTORY}
            export MDBJDBC_VER=${MDBJDBC_VER}
          
            # ssdlc relevant variables
            export SBOM_WITHOUT_TEAM_NAME=$ARTIFACTS_DIR/ssdlc/sbom_without_team_name.json
            export SBOM_TOOL_DIR="sbom_generations"
            export SBOM_LITE_NAME="$SBOM_LITE_NAME"
            export AUGMENTED_SBOM_NAME="$AUGMENTED_SBOM_NAME"
            export SSDLC_DIR="$SSDLC_DIR"
            export SBOM_LITE="$ARTIFACTS_DIR/ssdlc/$SBOM_LITE_NAME"
            export COMPLIANCE_REPORT_NAME="$COMPLIANCE_REPORT_NAME"
            export STATIC_CODE_ANALYSIS_NAME="$STATIC_CODE_ANALYSIS_NAME"          
          EOT

    - command: expansions.update
      params:
        file: mongo-jdbc-driver/artifacts/expansions.yml

  "fetch jdbc files":
    - command: s3.get
      params:
        working_dir: mongo-jdbc-driver
        aws_key: ${aws_key}
        aws_secret: ${aws_secret}
        local_file: mongo-jdbc-driver/build/libs/mongodb-jdbc-${MDBJDBC_VER}.jar
        remote_file: ${S3_ARTIFACTS_DIR}/mongodb-jdbc-${MDBJDBC_VER}.jar
        bucket: mciuploads

  "fetch source":
    - command: shell.exec
      params:
        shell: bash
        silent: true
        script: |
          rm -rf mongo-jdbc-driver
    - command: git.get_project
      params:
        directory: mongo-jdbc-driver

  "upload unit test classes":
    - command: s3.put
      params:
        silent: true
        aws_key: ${aws_key}
        aws_secret: ${aws_secret}
        local_files_include_filter:
            - mongo-jdbc-driver/build/reports/tests/test/classes/*.html
        remote_file: ${S3_ARTIFACTS_DIR}/test/classes/
        content_type: text/html
        bucket: mciuploads
        permissions: public-read
        display_name: "Unit Test Classes"
        visibility: none

  "upload integration test classes":
    - command: s3.put
      params:
        silent: true
        aws_key: ${aws_key}
        aws_secret: ${aws_secret}
        local_files_include_filter:
            - mongo-jdbc-driver/build/reports/tests/integrationTest/classes/*.html
        remote_file: ${S3_ARTIFACTS_DIR}/integrationTest/classes/
        content_type: text/html
        bucket: mciuploads
        permissions: public-read
        display_name: "Integration Test Classes"
        visibility: none

  "upload unit test packages":
    - command: s3.put
      params:
        silent: true
        aws_key: ${aws_key}
        aws_secret: ${aws_secret}
        local_files_include_filter:
            - mongo-jdbc-driver/build/reports/tests/test/packages/*.html
        remote_file: ${S3_ARTIFACTS_DIR}/test/packages/
        content_type: text/html
        bucket: mciuploads
        permissions: public-read
        display_name: "Unit Test Packages"
        visibility: none

  "upload integration test packages":
    - command: s3.put
      params:
        silent: true
        aws_key: ${aws_key}
        aws_secret: ${aws_secret}
        local_files_include_filter:
            - mongo-jdbc-driver/build/reports/tests/integrationTest/packages/*.html
        remote_file: ${S3_ARTIFACTS_DIR}/integrationTest/packages/
        content_type: text/html
        bucket: mciuploads
        permissions: public-read
        display_name: "Integration Test Packages"
        visibility: none

  "upload unit test index":
    - command: s3.put
      params:
        silent: true
        aws_key: ${aws_key}
        aws_secret: ${aws_secret}
        local_file: mongo-jdbc-driver/build/reports/tests/test/index.html
        remote_file: ${S3_ARTIFACTS_DIR}/test/index.html
        content_type: text/html
        bucket: mciuploads
        permissions: public-read
        display_name: "Unit Test Results"

  "upload integration test index":
    - command: s3.put
      params:
        silent: true
        aws_key: ${aws_key}
        aws_secret: ${aws_secret}
        local_file: mongo-jdbc-driver/build/reports/tests/integrationTest/index.html
        remote_file: ${S3_ARTIFACTS_DIR}/integrationTest/index.html
        content_type: text/html
        bucket: mciuploads
        permissions: public-read
        display_name: "Integration Test Results"

  "upload unit test css ":
    - command: s3.put
      params:
        silent: true
        aws_key: ${aws_key}
        aws_secret: ${aws_secret}
        local_files_include_filter:
            - mongo-jdbc-driver/build/reports/tests/test/css/*.css
        remote_file: ${S3_ARTIFACTS_DIR}/test/css/
        content_type: text/css
        bucket: mciuploads
        permissions: public-read
        display_name: "Unit Test CSS"
        visibility: none

  "upload integration test css ":
    - command: s3.put
      params:
        silent: true
        aws_key: ${aws_key}
        aws_secret: ${aws_secret}
        local_files_include_filter:
            - mongo-jdbc-driver/build/reports/tests/integrationTest/css/*.css
        remote_file: ${S3_ARTIFACTS_DIR}/integrationTest/css/
        content_type: text/css
        bucket: mciuploads
        permissions: public-read
        display_name: "Integration Test CSS"
        visibility: none

  "upload unit test js":
    - command: s3.put
      params:
        silent: true
        aws_key: ${aws_key}
        aws_secret: ${aws_secret}
        local_files_include_filter:
            - mongo-jdbc-driver/build/reports/tests/test/js/*.js
        remote_file: ${S3_ARTIFACTS_DIR}/test/js/
        content_type: application/javascript
        bucket: mciuploads
        permissions: public-read
        display_name: "Unit Test JS"
        visibility: none

  "upload integration test js":
    - command: s3.put
      params:
        silent: true
        aws_key: ${aws_key}
        aws_secret: ${aws_secret}
        local_files_include_filter:
            - mongo-jdbc-driver/build/reports/tests/integrationTest/js/*.js
        remote_file: ${S3_ARTIFACTS_DIR}/integrationTest/js/
        content_type: application/javascript
        bucket: mciuploads
        permissions: public-read
        display_name: "Integration Test JS"
        visibility: none

  "upload xunit test results":
    - command: attach.xunit_results
      params:
        silent: true
        file: mongo-jdbc-driver/build/test-results/*/TEST-*.xml

  "upload jar file":
    - command: s3.put
      params:
        silent: true
        aws_key: ${aws_key}
        aws_secret: ${aws_secret}
        local_file: mongo-jdbc-driver/build/libs/mongodb-jdbc-${MDBJDBC_VER}.jar
        remote_file: ${S3_ARTIFACTS_DIR}/mongodb-jdbc-${MDBJDBC_VER}.jar
        content_type: application/java-archive
        bucket: mciuploads
        permissions: public-read
        display_name: "JDBC Driver (.jar)"

  "publish maven":
    - command: shell.exec
      type: test
      params:
        shell: bash
        silent: true
        working_dir: mongo-jdbc-driver
        script: |
          PROJECT_DIRECTORY="$(pwd)" NEXUS_PROFILE_ID=${NEXUS_PROFILE_ID} NEXUS_TOKEN_NAME=${NEXUS_TOKEN_NAME} NEXUS_TOKEN=${NEXUS_TOKEN} NEXUS_URL=${NEXUS_URL} SIGNING_PASSWORD=${SIGNING_PASSWORD} SIGNING_KEY_ID=${SIGNING_KEY_ID} RING_FILE_GPG_BASE64=${RING_FILE_GPG_BASE64} ./gradle/publish.sh

  "update download center feed":
    - command: shell.exec
      params:
        shell: bash
        working_dir: mongo-jdbc-driver
        script: |
          echo "Version = ${MDBJDBC_VER}"
          sed -i "s@{RELEASE_VERSION}@${MDBJDBC_VER}@" mongo-jdbc-downloads_template.json
          echo "-------------------------"
          cat mongo-jdbc-downloads_template.json
          echo "-------------------------"
    - command: s3.put
      params:
        aws_key: ${release_aws_key}
        aws_secret: ${release_aws_secret}
        local_file: mongo-jdbc-driver/mongo-jdbc-downloads_template.json
        remote_file: mongo-jdbc-driver/mongo-jdbc-downloads.json
        bucket: translators-connectors-releases
        permissions: public-read
        content_type: application/json

  "static code analysis":
    - command: ec2.assume_role
      params:
        role_arn: ${assume_role_arn}
        duration_seconds: 3600
    - command: shell.exec
      type: test
      params:
        shell: bash
        working_dir: mongo-jdbc-driver
        script: |
          echo "Running static code analysis with Semgrep..."
          
          venv='venv'
          # Setup or use the existing virtualenv for semgrep
          if [[ -f "$venv/bin/activate" ]]; then
            echo 'using existing virtualenv'
            . "$venv"/bin/activate
          else
            echo 'Creating new virtualenv'
            python3 -m virtualenv "$venv"
            echo 'Activating new virtualenv'
            . "$venv"/bin/activate
          fi

          python3 -m pip install semgrep

          # confirm
          semgrep --version
          set +e
          semgrep --config p/java --verbose --exclude "vendor" --error --severity=ERROR --sarif-output=${STATIC_CODE_ANALYSIS_NAME} > mongo-jdbc-driver.sast.cmd.verbose.out 2>&1
          SCAN_RESULT=$?
          set -e

          # Exit with a failure if the scan found an issue
          exit $SCAN_RESULT
    - command: s3.put
      params:
        aws_key: ${AWS_ACCESS_KEY_ID}
        aws_secret: ${AWS_SECRET_ACCESS_KEY}
        aws_session_token: ${AWS_SESSION_TOKEN}
        local_files_include_filter:
          - mongo-jdbc-driver.sast.*
        remote_file: artifacts/${version_id}/ssdlc/
        content_type: application/json
        bucket: evg-bucket-mongo-jdbc-driver
        permissions: public-read

  "publish static code analysis":
    - command: ec2.assume_role
      params:
        role_arn: ${assume_role_arn}
        duration_seconds: 3600
    - command: s3.get
      params:
        aws_key: ${AWS_ACCESS_KEY_ID}
        aws_secret: ${AWS_SECRET_ACCESS_KEY}
        aws_session_token: ${AWS_SESSION_TOKEN}
        local_file: artifacts/ssdlc/mongodb-jdbc-${MDBJDBC_VER}.sast.sarif
        remote_file: artifacts/${version_id}/ssdlc/${STATIC_CODE_ANALYSIS_NAME}
        content_type: application/json
        bucket: evg-bucket-mongo-jdbc-driver
    - command: s3.put
      params:
        aws_key: ${release_aws_key}
        aws_secret: ${release_aws_secret}
        local_file: artifacts/ssdlc/mongodb-jdbc-${MDBJDBC_VER}.sast.sarif
        remote_file: mongo-jdbc-driver/mongodb-jdbc-${MDBJDBC_VER}.sast.sarif
        content_type: application/json
        bucket: translators-connectors-releases
        permissions: public-read
        display_name: mongodb-jdbc-${MDBJDBC_VER}.sast.sarif


  "generate compliance report":
    - command: shell.exec
      type: test
      params:
        shell: bash
        working_dir: mongo-jdbc-driver
        script: |
          echo "Author = ${author}"
          echo "Author email = ${author_email}"
          echo "Version = ${MDBJDBC_VER}"
          SBOM_URL="https://translators-connectors-releases.s3.amazonaws.com/mongo-jdbc-driver/mongodb-jdbc-${MDBJDBC_VER}.sbom.json"
          SARIF_URL="https://translators-connectors-releases.s3.amazonaws.com/mongo-jdbc-driver/mongodb-jdbc-${MDBJDBC_VER}.sast.sarif"
          echo "Sbom url = $SBOM_URL"
          echo "Sarif Url = $SARIF_URL"
          
          echo "----- Generating ${COMPLIANCE_REPORT_NAME} -----"
          
          # Copy template
          cp resources/release/mongo_jdbc_compliance_report_template.md ${COMPLIANCE_REPORT_NAME}
          
          # Update the version
          echo "Update the version"
          echo "sed -i.bu "s,%VERSION%,${MDBJDBC_VER},g" ${COMPLIANCE_REPORT_NAME}"
          sed -i.bu "s,%VERSION%,${MDBJDBC_VER},g" ${COMPLIANCE_REPORT_NAME}
          
          # Update the SBOM link
          echo "Update the SBOM link"
          echo "sed -i.bu "s,%SBOM_URL%,$SBOM_URL,g"${COMPLIANCE_REPORT_NAME}"
          sed -i.bu "s,%SBOM_URL%,$SBOM_URL,g" ${COMPLIANCE_REPORT_NAME}
          
          # Update the SARIF link
          echo "Update the SARIF link"
          echo "sed -i.bu "s,%SARIF_URL%,$SARIF_URL,g" ${COMPLIANCE_REPORT_NAME}"
          sed -i.bu "s,%SARIF_URL%,$SARIF_URL,g" ${COMPLIANCE_REPORT_NAME}
          
          # Update the author information
          echo "Update the author name"
          echo "sed -i.bu "s,%AUTHOR%,${author},g" ${COMPLIANCE_REPORT_NAME}"
          sed -i.bu "s,%AUTHOR%,${author},g" ${COMPLIANCE_REPORT_NAME}
          
          echo "update the author email"
          echo "sed -i.bu "s,%AUTHOR_EMAIL%,${author_email},g" ${COMPLIANCE_REPORT_NAME}"
          sed -i.bu "s,%AUTHOR_EMAIL%,${author_email},g" ${COMPLIANCE_REPORT_NAME}
          echo "---------------------------"
    - command: ec2.assume_role
      params:
        role_arn: ${assume_role_arn}
        duration_seconds: 3600
    - command: s3.put
      params:
        aws_key: ${AWS_ACCESS_KEY_ID}
        aws_secret: ${AWS_SECRET_ACCESS_KEY}
        aws_session_token: ${AWS_SESSION_TOKEN}
        local_file: mongo-jdbc-driver/${COMPLIANCE_REPORT_NAME}
        remote_file: artifacts/${version_id}/ssdlc/${COMPLIANCE_REPORT_NAME}
        content_type: text/markdown
        bucket: evg-bucket-mongo-jdbc-driver
        permissions: public-read

  "publish compliance report":
    - command: ec2.assume_role
      params:
        role_arn: ${assume_role_arn}
        duration_seconds: 3600
    - command: s3.get
      params:
        aws_key: ${AWS_ACCESS_KEY_ID}
        aws_secret: ${AWS_SECRET_ACCESS_KEY}
        aws_session_token: ${AWS_SESSION_TOKEN}
        local_file: artifacts/ssdlc/mongodb-jdbc-${MDBJDBC_VER}-compliance-report.md
        remote_file: artifacts/${version_id}/ssdlc/${COMPLIANCE_REPORT_NAME}
        content_type: text/markdown
        bucket: evg-bucket-mongo-jdbc-driver
    - command: s3.put
      params:
        aws_key: ${release_aws_key}
        aws_secret: ${release_aws_secret}
        local_file: artifacts/ssdlc/mongodb-jdbc-${MDBJDBC_VER}-compliance-report.md
        remote_file: mongo-jdbc-driver/mongodb-jdbc-${MDBJDBC_VER}-compliance-report.md
        content_type: text/markdown
        bucket: translators-connectors-releases
        permissions: public-read