.evg.yml

stepback: true
command_type: system

ignore:
  - "*.md"

variables:
  - &assume_role_cmd
    command: ec2.assume_role
    params:
      role_arn: ${assume_role_arn}
      duration_seconds: 3600
  - &evg_bucket_config
    aws_key: ${AWS_ACCESS_KEY_ID}
    aws_secret: ${AWS_SECRET_ACCESS_KEY}
    aws_session_token: ${AWS_SESSION_TOKEN}
    bucket: evg-bucket-mongo-jdbc-driver

pre:
  - func: "fetch source"
  - func: "export variables"

post:
  - func: "upload unit test classes"
  - func: "upload integration test classes"
  - func: "upload smoke test classes"
  - func: "upload unit test packages"
  - func: "upload integration test packages"
  - func: "upload smoke test packages"
  - func: "upload unit test js"
  - func: "upload integration test js"
  - func: "upload smoke test js"
  - func: "upload unit test css "
  - func: "upload integration test css "
  - func: "upload smoke test css "
  - func: "upload unit test index"
  - func: "upload integration test index"
  - func: "upload xunit test results"
  - func: "upload smoke test index"

buildvariants:

  - name: static-analysis
    display_name: "Static Analysis"
    run_on: [ ubuntu2204-small ]
    tasks:
      - spotless

  - name: code-quality-and-correctness
    display_name: "Code Quality and Security"
    expansions:
      _platform: ubuntu2204-64-jdk-8
    run_on: [ ubuntu2204-small ]
    tasks:
      - name: semgrep
      - name: sbom
      - name: ssdlc-artifacts-snapshot

  - name: ubuntu2204-64-jdk-8
    display_name: Ubuntu 22.04 jdk-8
    expansions:
      _platform: ubuntu2204-64-jdk-8
    run_on: ubuntu2204-large
    tasks:
      - name: "test-unit"
      - name: "test-mongo-sql-translate"
      - name: "test-adf-integration"
      # SQL-2289: integration tests. Use the actual mongosqltranslate library for testing instead of mock.
      # - name: "test-dc-integration"

  - name: amazon2-arm64-jdk-11
    display_name: Amazon Linux 2 ARM64 jdk-11
    expansions:
      _platform: amazon2-arm64-jdk-11
    run_on: amazon2-arm64-graviton3
    tasks:
      - name: "test-unit"
      - name: "test-adf-integration"

  - name: release
    display_name: "Release"
    expansions:
      _platform: ubuntu2204-64-jdk-8
    run_on: ubuntu2204-small
    tasks:
      - name: "build"
      - name: "test-smoke"
      - name: "publish-maven"
      - name: "ssdlc-artifacts-release"
      - name: "download-center-update"

tasks:
  - name: "build"
    commands:
      - func: "build jdbc driver"
      - func: "upload jar file"

  - name: "test-unit"
    commands:
      - func: "run unit test"

  - name: "test-mongo-sql-translate"
    commands:
      - func: "run mongosqltranslate library load test"

  - name: "test-adf-integration"
    commands:
      - func: "generate github token"
      - func: "run adf integration test"

  - name: "test-dc-integration"
    commands:
      - func: "run dc integration test"

  - name: "test-smoke"
    depends_on:
        - name: "build"
          variant: "release"
    commands:
      - func: "fetch jdbc shadow jar"
      - func: "generate github token"
      - func: "run smoke test"

  - name: "publish-maven"
    git_tag_only: true
    depends_on:
      - name: "test-smoke"
        variant: "release"
      - name: sbom
        variant: code-quality-and-correctness
    commands:
      - func: "publish maven"
      - func: "trace artifacts"

  - name: spotless
    commands:
      - func: "check spotless"

  - name: download-center-update
    git_tag_only: true
    depends_on:
      - name: "publish-maven"
        variant: "release"
    commands:
      - func: "update download center feed"

  - name: semgrep
    exec_timeout_secs: 3600 # 1h
    commands:
      - func: "static code analysis"

  - name: sbom
    commands:
      - func: "generate sbom"
      - func: "upload sbom"
      - func: "augment sbom"
      - func: "scan sbom"

  - name: ssdlc-artifacts-release
    run_on: ubuntu2204-small
    git_tag_only: true
    depends_on:
      - name: "publish-maven"
        variant: "release"
      - name: semgrep
        variant: code-quality-and-correctness
    exec_timeout_secs: 300 # 5m
    commands:
      - func: "publish augmented SBOM"
      - func: "publish static code analysis"
      - func: "generate compliance report"
      - func: "publish compliance report"

  - name: ssdlc-artifacts-snapshot
    run_on: ubuntu2204-small
    allow_for_git_tag: false
    depends_on:
      - name: sbom
        variant: code-quality-and-correctness
      - name: semgrep
        variant: code-quality-and-correctness
    exec_timeout_secs: 300 # 5m
    commands:
      - func: "publish augmented SBOM"
      - func: "publish static code analysis"
      - func: "generate compliance report"
      - func: "publish compliance report"

functions:
  "augment sbom":
    - command: ec2.assume_role
      display_name: Assume IAM role with permissions to pull Kondukto API token
      params:
        role_arn: ${kondukto_role_arn}
    - command: shell.exec
      display_name: Pull Kondukto API token from AWS Secrets Manager and write it to file
      params:
        silent: true
        shell: bash
        working_dir: mongo-jdbc-driver
        include_expansions_in_env: [AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN]
        script: |
          # use AWS CLI to get the Kondukto API token from AWS Secrets Manager
          kondukto_token=$(aws secretsmanager get-secret-value --secret-id "kondukto-token" --region "us-east-1" --query 'SecretString' --output text)
          if [ $? -ne 0 ]; then
              exit 1
          fi
          # set the KONDUKTO_TOKEN environment variable
          echo "KONDUKTO_TOKEN=$kondukto_token" > ${workdir}/kondukto_credentials.env
    - command: shell.exec
      type: test
      params:
        shell: bash
        working_dir: mongo-jdbc-driver
        script: |
          ${PREPARE_SHELL}

          ls -lrt $SSDLC_DIR

          echo "SBOM_LITE_NAME = $SBOM_LITE_NAME"

          echo "AUGMENTED_SBOM_NAME = $AUGMENTED_SBOM_NAME"

          echo "-- Augmenting SBOM Lite --"
          docker run -i --platform="linux/amd64" --rm -v "$PWD":/pwd \
          --env-file ${workdir}/kondukto_credentials.env \
          artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:2.0 \
          augment --repo mongodb/mongo-jdbc-driver --branch ${branch_name} --sbom-in /pwd/artifacts/ssdlc/$SBOM_LITE_NAME --sbom-out /pwd/artifacts/ssdlc/$AUGMENTED_SBOM_NAME
          echo "-------------------------------"

          ls -lrt $SSDLC_DIR
    - command: ec2.assume_role
      params:
        role_arn: ${assume_role_arn}
        duration_seconds: 3600
    - command: s3.put
      params:
        <<: *evg_bucket_config
        local_file: mongo-jdbc-driver/artifacts/ssdlc/${AUGMENTED_SBOM_NAME}
        remote_file: artifacts/${version_id}/ssdlc/${AUGMENTED_SBOM_NAME}
        content_type: application/json
        permissions: public-read

  "publish augmented SBOM":
    - *assume_role_cmd
    - command: s3.get
      params:
        <<: *evg_bucket_config
        local_file: artifacts/ssdlc/mongodb-jdbc-${MDBJDBC_VER}.sbom.json
        remote_file: artifacts/${version_id}/ssdlc/${AUGMENTED_SBOM_NAME}
        content_type: application/json
    - command: s3.put
      params:
        aws_key: ${release_aws_key}
        aws_secret: ${release_aws_secret}
        local_file: artifacts/ssdlc/mongodb-jdbc-${MDBJDBC_VER}.sbom.json
        remote_file: mongo-jdbc-driver/mongodb-jdbc-${MDBJDBC_VER}.sbom.json
        content_type: application/json
        bucket: translators-connectors-releases
        permissions: public-read
        display_name: mongodb-jdbc-${MDBJDBC_VER}.sbom.json

  "generate sbom":
    - command: shell.exec
      type: test
      params:
        shell: bash
        working_dir: mongo-jdbc-driver
        script: |
          ${PREPARE_SHELL}
          set -o errexit

          mkdir -p $SBOM_TOOL_DIR

          echo "------------------------------------"
          echo "Generating SBOM"
          echo "------------------------------------"
          ./gradlew clean cyclonedxBom -PcyclonedxBomDestination=$SSDLC_DIR -PcyclonedxBomName=sbom_without_team_name
    - command: shell.exec
      type: test
      params:
        shell: bash
        working_dir: mongo-jdbc-driver
        script: |
          ${PREPARE_SHELL}
          set -o errexit

          JQ_URL="https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-linux-amd64"

          echo "-- Downloading JQ $JQ_URL --"
          curl -L -o $SBOM_TOOL_DIR/jq "$JQ_URL" \
            --silent \
            --fail \
            --max-time 60 \
            --retry 5 \
            --retry-delay 0
          chmod +x ./$SBOM_TOOL_DIR/jq

          echo "------------------------------------"
          echo "Adding team name to SBOM"
          echo "------------------------------------"
          jq '.components[].properties += [{"name": "internal:team_responsible", "value": "Atlas SQL"}]' $SBOM_WITHOUT_TEAM_NAME > $SBOM_LITE

          echo "------------------------------------"
          echo "Done generating SBOM"
          echo "------------------------------------"

  "upload sbom":
    - *assume_role_cmd
    - command: s3.put
      params:
        <<: *evg_bucket_config
        local_files_include_filter:
          - ${SBOM_LITE_NAME}
        remote_file: artifacts/${version_id}/ssdlc/
        content_type: application/json
        permissions: public-read

  "scan sbom":
    command: shell.exec
    type: test
    params:
      shell: bash
      working_dir: mongo-jdbc-driver
      script: |
        ${PREPARE_SHELL}
        set -o errexit

        # Install Grype
        echo "-- Downloading Grype --"
        curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b $SBOM_TOOL_DIR
        echo "------------------------------------"

        echo "-- Scanning dependency for vulnerabilities --"
        ./$SBOM_TOOL_DIR/grype sbom:$SBOM_LITE --fail-on low
        echo "---------------------------------------------"
        echo "<<<< Done scanning SBOM"

  "build jdbc driver":
    command: shell.exec
    type: test
    params:
      shell: bash
      working_dir: mongo-jdbc-driver
      script: |
        ${PREPARE_SHELL}
        if [[ "${triggered_by_git_tag}" != "" ]]; then
          EXTRA_PROP="-PisTagTriggered"
        fi
        ./gradlew clean generateLicenseReport --rerun-tasks && \
        echo -e "$(cat resources/third_party_header.txt)\n$(cat build/reports/dependency-license/THIRD-PARTY-LICENSE.txt)" > build/reports/dependency-license/THIRD-PARTY-LICENSE.txt && \
        ./gradlew -Dorg.gradle.java.home=${JAVA_HOME} $EXTRA_PROP -x test -x integrationTest spotlessApply build shadowjar --rerun-tasks

  "check spotless":
    command: shell.exec
    type: test
    params:
      shell: bash
      working_dir: mongo-jdbc-driver
      script: |
        ${PREPARE_SHELL}
        ./gradlew spotlessCheck

  "run unit test":
    command: shell.exec
    type: test
    params:
      shell: bash
      working_dir: mongo-jdbc-driver
      script: |
        ${PREPARE_SHELL}
        ./gradlew -Dorg.gradle.java.home=${JAVA_HOME} clean test

  "run mongosqltranslate library load test":
    command: shell.exec
    type: test
    params:
      shell: bash
      working_dir: mongo-jdbc-driver
      script: |
        ${PREPARE_SHELL}
        set -e

        # Test loading library from path specified in ENV variable
        MONGOSQL_TRANSLATE_PATH="$PWD/src/test/resources/MongoSqlLibraryTest/libmongosqltranslate.so" \
            ./gradlew runMongoSQLTranslateLibTest -PtestMethod=testLibraryLoadingWithEnvironmentVariable

        # Move library file to where MongoDriver class is located
        mkdir -p build/classes/java/
        mv -f src/test/resources/MongoSqlLibraryTest/libmongosqltranslate.so build/classes/java/

        # Test loading library from same directory as where the JDBC driver is located
        ./gradlew runMongoSQLTranslateLibTest -PtestMethod=testLibraryLoadingFromDriverPath

  "generate github token":
    command: github.generate_token
    params:
      owner: 10gen
      repo: mongohouse
      expansion_name: github_token

  "run adf integration test":
    command: shell.exec
    type: test
    params:
      env:
        GITHUB_TOKEN: "${github_token}"
      shell: bash
      working_dir: mongo-jdbc-driver
      script: |
          ${PREPARE_SHELL}
          ./resources/run_adf.sh start &&
          ./gradlew -Dorg.gradle.java.home=${JAVA_HOME} runDataLoader &&
          ./gradlew -Dorg.gradle.java.home=${JAVA_HOME} clean integrationTest \
              -x test --tests ADFIntegrationTest > gradle_output.log 2>&1 &
          GRADLE_PID=$!

          echo "Gradle process started with PID $GRADLE_PID"

          # On Amazon Linux 2 hosts, the gradlew integrationTest command was hanging indefinitely.
          # This monitoring approach will detect build completion or failure even when the Gradle
          # process doesn't terminate properly and allows the task to complete.
          SECONDS=0
          TIMEOUT=1800  # 30 minute timeout

          while true; do
              if grep -q "BUILD SUCCESSFUL" gradle_output.log; then
                  echo "Build successful!"
                  EXITCODE=0
                  break
              fi

              if grep -q "BUILD FAILED" gradle_output.log; then
                  echo "Build failed!"
                  EXITCODE=1
                  break
              fi

              if (( SECONDS > TIMEOUT )); then
                  echo "$TIMEOUT second timeout reached. Exiting with failure."
                  EXITCODE=1
                  break
              fi

              # Check if Gradle process is still running
              if ! kill -0 $GRADLE_PID 2>/dev/null; then
                  echo "Gradle process has finished."
                  wait $GRADLE_PID
                  EXITCODE=$?
                  break
              fi

              sleep 5
          done

          cat gradle_output.log

          kill $GRADLE_PID 2>/dev/null || true

          ./resources/run_adf.sh stop

          echo "Integration test exit code: $EXITCODE"
          exit $EXITCODE

  "run dc integration test":
    command: shell.exec
    type: test
    params:
      shell: bash
      working_dir: mongo-jdbc-driver
      script: |
        ${PREPARE_SHELL}

        case ${_platform} in
        ubuntu2204-64-jdk-8 | ubuntu2204-64-jdk-11)
          mdb_version_com="mongodb-linux-x86_64-ubuntu2204-7.0.14"
          mdb_version_ent="mongodb-linux-x86_64-enterprise-ubuntu2204-7.0.14"
          arch="x64"
        ;;
        *)
          echo "ERROR: invalid value for \${_platform}: '$_platform'"
          echo "Allowed values: 'ubuntu2204-64-jdk-8', 'ubuntu2204-64-jdk-11'"
          exit 1
        ;;
        esac

        # Move library file to where MongoDriver class is located
        mkdir -p build/classes/java/
        mv -f src/test/resources/MongoSqlLibraryTest/libmongosqltranslate.so build/classes/java/

        # Download and run local community and enterprise mongods.
        ./resources/start_local_mdb.sh $mdb_version_com $mdb_version_ent $arch

        # Run the tests.
        ./gradlew integrationTest \
            -x test --tests DCIntegrationTest > gradle_output.log 2>&1 &
        GRADLE_PID=$!

        echo "Gradle process started with PID $GRADLE_PID"

        # On Amazon Linux 2 hosts, the gradlew integrationTest command was hanging indefinitely.
        # This monitoring approach will detect build completion or failure even when the Gradle
        # process doesn't terminate properly and allows the task to complete.
        SECONDS=0
        TIMEOUT=1800  # 30 minute timeout
        while true; do
          if grep -q "BUILD SUCCESSFUL" gradle_output.log; then
              echo "Build successful!"
              EXITCODE=0
              break
          fi
          if grep -q "BUILD FAILED" gradle_output.log; then
              echo "Build failed!"
              EXITCODE=1
              break
          fi

          if (( SECONDS > TIMEOUT )); then
              echo "$TIMEOUT second timeout reached. Exiting with failure."
              EXITCODE=1
              break
          fi

          # Check if Gradle process is still running
          if ! kill -0 $GRADLE_PID 2>/dev/null; then
              echo "Gradle process has finished."
              wait $GRADLE_PID
              EXITCODE=$?
              break
          fi

          sleep 5
        done

        cat gradle_output.log

        kill $GRADLE_PID 2>/dev/null || true

        pkill mongod

        echo "Integration test exit code: $EXITCODE"
        exit $EXITCODE

  "trace artifacts":
    command: papertrail.trace
    params:
      work_dir: mongo-jdbc-driver
      key_id: ${papertrail_id}
      secret_key: ${papertrail_key}
      product: mongo-jdbc-driver
      version: ${MDBJDBC_VER}
      filenames:
        - "build/libs/*.jar"

  "run smoke test":
    command: shell.exec
    type: test
    params:
      env:
        GITHUB_TOKEN: "${github_token}"
      working_dir: mongo-jdbc-driver
      script: |
        ${PREPARE_SHELL}
        
        #Smoke test are loading the "*-all.jar" from mongo-jdbc-driver/build/libs/
        ls -lrt build/libs/
        
        ./resources/run_adf.sh start &&
        ./gradlew runDataLoader &&
        ./gradlew :smoketest:test -Psmoketest
        EXITCODE=$?
        ./resources/run_adf.sh stop         
        exit $EXITCODE

  "export variables":
    - command: shell.exec
      params:
        shell: bash
        silent: false
        working_dir: mongo-jdbc-driver
        script: |
          ARTIFACTS_DIR=artifacts
          S3_ARTIFACTS_DIR='mongo-jdbc-driver/artifacts/${version_id}/${build_variant}'

          # Get the version from trigger.
          # Tag triggered runs are releases and the version is set in the tag.
          # Other runs are snapshot builds (periodic builds or patches)
          if [[ "${triggered_by_git_tag}" != "" ]]; then
            export MDBJDBC_VER=$(echo ${triggered_by_git_tag} | sed s/v//)
          else
            export MDBJDBC_VER=snapshot
          fi
          
          # Set JAVA_HOME based on platform
          if [[ "${_platform}" == "ubuntu2204-64-jdk-8" ]]; then
              export JAVA_HOME=/opt/java/jdk8
          elif [[ "${_platform}" == "ubuntu2204-64-jdk-11" ]]; then
              export JAVA_HOME=/opt/java/jdk11
          elif [[ "${_platform}" == "amazon2-arm64-jdk-11" ]]; then
              export JAVA_HOME=/usr/lib/jvm/java-11
          else
              # According to DEVPROD, the Java toolchain should always be under `/opt/java/`
              if [ -d "/opt/java/jdk11" ]; then
                export JAVA_HOME=/opt/java/jdk11
              else
                echo >&2 "Can't find Java. `/opt/java/jdk11` does not exist"
                exit 1
              fi
          fi
          
          # set the state needed irrespective of _platform
          SBOM_WITHOUT_TEAM_NAME=$ARTIFACTS_DIR/ssdlc/sbom_without_team_name.json
          SBOM_TOOL_DIR="sbom_generations"
          SBOM_LITE_NAME="mongo-jdbc-driver.cdx.json"
          SBOM_LITE="$ARTIFACTS_DIR/ssdlc/$SBOM_LITE_NAME"
          AUGMENTED_SBOM_NAME="mongo-jdbc-driver.augmented.sbom.json"
          COMPLIANCE_REPORT_NAME="mongodb-jdbc-compliance-report.md"
          STATIC_CODE_ANALYSIS_NAME="mongo-jdbc-driver.sast.sarif"
          SSDLC_DIR="$ARTIFACTS_DIR/ssdlc"
          mkdir -p "$SSDLC_DIR"
          
          echo "=== Generated Values ==="
          echo "JDBC version = $MDBJDBC_VER"
          echo "Java home = $JAVA_HOME"
          echo "S3 artifacts dir = $S3_ARTIFACTS_DIR"
          echo "=== SSDLC Values ==="
          echo "SBOM_WITHOUT_TEAM_NAME = $SBOM_WITHOUT_TEAM_NAME"
          echo "SBOM_TOOL_DIR = $SBOM_TOOL_DIR"
          echo "SBOM Lite Name = $SBOM_LITE_NAME"
          echo "SBOM_LITE = $SBOM_LITE"
          echo "Augmented SBOM Name = $AUGMENTED_SBOM_NAME"
          echo "Compliance Report Name = $COMPLIANCE_REPORT_NAME"
          echo "Static Code Analysis Name = $STATIC_CODE_ANALYSIS_NAME"
          echo "SSDLC Directory = $SSDLC_DIR"
          
          # Write calculated values to expansions file
          mkdir -p $ARTIFACTS_DIR
          cat <<EOT > $ARTIFACTS_DIR/initial_expansions.yml
          MDBJDBC_VER: "$MDBJDBC_VER"
          JAVA_HOME: "$JAVA_HOME"
          ARTIFACTS_DIR: "$ARTIFACTS_DIR"
          S3_ARTIFACTS_DIR: "$S3_ARTIFACTS_DIR"
          SBOM_WITHOUT_TEAM_NAME: "$SBOM_WITHOUT_TEAM_NAME"
          SBOM_TOOL_DIR: "$SBOM_TOOL_DIR"
          SBOM_LITE_NAME: "$SBOM_LITE_NAME"
          SBOM_LITE: "$SBOM_LITE"
          AUGMENTED_SBOM_NAME: "$AUGMENTED_SBOM_NAME"
          COMPLIANCE_REPORT_NAME: "$COMPLIANCE_REPORT_NAME"
          STATIC_CODE_ANALYSIS_NAME: "$STATIC_CODE_ANALYSIS_NAME"
          SSDLC_DIR: "$SSDLC_DIR"
          EOT
    - command: expansions.update
      params:
        file: mongo-jdbc-driver/artifacts/initial_expansions.yml
    - command: shell.exec
      params:
        shell: bash
        add_expansions_to_env: true
        silent: true
        working_dir: mongo-jdbc-driver
        script: |

          # export any environment variables that will be needed by subprocesses
          export PROJECT_DIRECTORY="$(pwd)"

          export SBOM_LITE_NAME="$SBOM_LITE_NAME"
          export AUGMENTED_SBOM_NAME="$AUGMENTED_SBOM_NAME"
          export COMPLIANCE_REPORT_NAME="$COMPLIANCE_REPORT_NAME"
          export STATIC_CODE_ANALYSIS_NAME="$STATIC_CODE_ANALYSIS_NAME"
          export SSDLC_DIR="$SSDLC_DIR"

          # create expansions from values calculated above and in previous command
          cat <<EOT > $ARTIFACTS_DIR/expansions.yml
          S3_ARTIFACTS_DIR: "$S3_ARTIFACTS_DIR"
          MDBJDBC_VER: "$MDBJDBC_VER"
          JAVA_HOME: "$JAVA_HOME"
          SBOM_LITE_NAME: "$SBOM_LITE_NAME"
          AUGMENTED_SBOM_NAME: "$AUGMENTED_SBOM_NAME"
          STATIC_CODE_ANALYSIS_NAME: "$STATIC_CODE_ANALYSIS_NAME"
          COMPLIANCE_REPORT_NAME: "$COMPLIANCE_REPORT_NAME"
          SSDLC_DIR: "$SSDLC_DIR"
          PREPARE_SHELL: |
            export ADF_TEST_LOCAL_USER=${adf_test_local_user}
            export ADF_TEST_LOCAL_PWD=${adf_test_local_pwd}
            export ADF_TEST_LOCAL_AUTH_DB=${adf_test_local_auth_db}
            export MDB_TEST_LOCAL_PORT=${mdb_test_local_port}
            export ADF_TEST_USER=${adf_test_user}
            export ADF_TEST_PWD=${adf_test_pwd}
            export ADF_TEST_HOST=${adf_test_host}
            export ADF_TEST_AUTH_DB=${adf_test_auth_db}
            export SRV_TEST_HOST=${srv_test_host}
            export SRV_TEST_USER=${srv_test_user}
            export SRV_TEST_PWD=${srv_test_pwd}
            export SRV_TEST_AUTH_DB=${srv_test_auth_db}
            export LOCAL_MDB_PORT_COM=${local_mdb_port_com}
            export LOCAL_MDB_PORT_ENT=${local_mdb_port_ent}
            export LOCAL_MDB_USER=${local_mdb_user}
            export LOCAL_MDB_PWD=${local_mdb_pwd}
            export JAVA_HOME=${JAVA_HOME}
            export PROJECT_DIRECTORY=${PROJECT_DIRECTORY}
            export MDBJDBC_VER=${MDBJDBC_VER}

            # ssdlc relevant variables
            export SBOM_WITHOUT_TEAM_NAME=$SBOM_WITHOUT_TEAM_NAME
            export SBOM_TOOL_DIR="$SBOM_TOOL_DIR"
            export SBOM_LITE_NAME="$SBOM_LITE_NAME"
            export AUGMENTED_SBOM_NAME="$AUGMENTED_SBOM_NAME"
            export SSDLC_DIR="$SSDLC_DIR"
            export SBOM_LITE="$SBOM_LITE"
            export COMPLIANCE_REPORT_NAME="$COMPLIANCE_REPORT_NAME"
            export STATIC_CODE_ANALYSIS_NAME="$STATIC_CODE_ANALYSIS_NAME"
          EOT

    - command: expansions.update
      params:
        file: mongo-jdbc-driver/artifacts/expansions.yml

  "fetch jdbc shadow jar":
    - *assume_role_cmd
    - command: s3.get
      params:
        <<: *evg_bucket_config
        local_file: mongo-jdbc-driver/build/libs/mongodb-jdbc-${MDBJDBC_VER}-all.jar
        remote_file: ${S3_ARTIFACTS_DIR}/mongodb-jdbc-${MDBJDBC_VER}-all.jar

  "fetch source":
    - command: shell.exec
      params:
        shell: bash
        silent: true
        script: |
          rm -rf mongo-jdbc-driver
    - command: git.get_project
      params:
        directory: mongo-jdbc-driver

  "upload unit test classes":
    - *assume_role_cmd
    - command: s3.put
      params:
        silent: true
        <<: *evg_bucket_config
        local_files_include_filter:
          - mongo-jdbc-driver/build/reports/tests/test/classes/*.html
        remote_file: ${S3_ARTIFACTS_DIR}/test/classes/
        content_type: text/html
        permissions: public-read
        display_name: "Unit Test Classes"
        visibility: none

  "upload integration test classes":
    - *assume_role_cmd
    - command: s3.put
      params:
        silent: true
        <<: *evg_bucket_config
        local_files_include_filter:
          - mongo-jdbc-driver/build/reports/tests/integrationTest/classes/*.html
        remote_file: ${S3_ARTIFACTS_DIR}/integrationTest/classes/
        content_type: text/html
        permissions: public-read
        display_name: "Integration Test Classes"
        visibility: none

  "upload smoke test classes":
    - *assume_role_cmd
    - command: s3.put
      params:
        silent: true
        <<: *evg_bucket_config
        local_files_include_filter:
          - mongo-jdbc-driver/smoketest/build/reports/tests/test/classes/*.html
        remote_file: ${S3_ARTIFACTS_DIR}/smoketest/classes/
        content_type: text/html
        permissions: public-read
        display_name: "Smoke Test Classes"
        visibility: none

  "upload unit test packages":
    - *assume_role_cmd
    - command: s3.put
      params:
        silent: true
        <<: *evg_bucket_config
        local_files_include_filter:
          - mongo-jdbc-driver/build/reports/tests/test/packages/*.html
        remote_file: ${S3_ARTIFACTS_DIR}/test/packages/
        content_type: text/html
        permissions: public-read
        display_name: "Unit Test Packages"
        visibility: none

  "upload integration test packages":
    - *assume_role_cmd
    - command: s3.put
      params:
        silent: true
        <<: *evg_bucket_config
        local_files_include_filter:
          - mongo-jdbc-driver/build/reports/tests/integrationTest/packages/*.html
        remote_file: ${S3_ARTIFACTS_DIR}/integrationTest/packages/
        content_type: text/html
        permissions: public-read
        display_name: "Integration Test Packages"
        visibility: none

  "upload smoke test packages":
    - *assume_role_cmd
    - command: s3.put
      params:
        silent: true
        <<: *evg_bucket_config
        local_files_include_filter:
          - mongo-jdbc-driver/smoketest/build/reports/tests/test/packages/*.html
        remote_file: ${S3_ARTIFACTS_DIR}/smoketest/packages/
        content_type: text/html
        permissions: public-read
        display_name: "Smoke Test Packages"
        visibility: none

  "upload unit test index":
    - *assume_role_cmd
    - command: s3.put
      params:
        silent: true
        <<: *evg_bucket_config
        local_file: mongo-jdbc-driver/build/reports/tests/test/index.html
        remote_file: ${S3_ARTIFACTS_DIR}/test/index.html
        content_type: text/html
        permissions: public-read
        display_name: "Unit Test Results"

  "upload integration test index":
    - *assume_role_cmd
    - command: s3.put
      params:
        silent: true
        <<: *evg_bucket_config
        local_file: mongo-jdbc-driver/build/reports/tests/integrationTest/index.html
        remote_file: ${S3_ARTIFACTS_DIR}/integrationTest/index.html
        content_type: text/html
        permissions: public-read
        display_name: "Integration Test Results"

  "upload smoke test index":
      - *assume_role_cmd
      - command: s3.put
        params:
          silent: true
          <<: *evg_bucket_config
          local_file: mongo-jdbc-driver/smoketest/build/reports/tests/test/index.html
          remote_file: ${S3_ARTIFACTS_DIR}/smoketest/index.html
          content_type: text/html
          permissions: public-read
          display_name: "Smoke Test Results"
  
  "upload unit test css ":
    - *assume_role_cmd
    - command: s3.put
      params:
        silent: true
        <<: *evg_bucket_config
        local_files_include_filter:
          - mongo-jdbc-driver/build/reports/tests/test/css/*.css
        remote_file: ${S3_ARTIFACTS_DIR}/test/css/
        content_type: text/css
        permissions: public-read
        display_name: "Unit Test CSS"
        visibility: none

  "upload integration test css ":
    - *assume_role_cmd
    - command: s3.put
      params:
        silent: true
        <<: *evg_bucket_config
        local_files_include_filter:
          - mongo-jdbc-driver/build/reports/tests/integrationTest/css/*.css
        remote_file: ${S3_ARTIFACTS_DIR}/integrationTest/css/
        content_type: text/css
        permissions: public-read
        display_name: "Integration Test CSS"
        visibility: none

  "upload smoke test css ":
    - *assume_role_cmd
    - command: s3.put
      params:
        silent: true
        <<: *evg_bucket_config
        local_files_include_filter:
          - mongo-jdbc-driver/smoketest/build/reports/tests/test/css/*.css
        remote_file: ${S3_ARTIFACTS_DIR}/smoketest/css/
        content_type: text/css
        permissions: public-read
        display_name: "Smoke Test CSS"

  "upload unit test js":
    - *assume_role_cmd
    - command: s3.put
      params:
        silent: true
        <<: *evg_bucket_config
        local_files_include_filter:
          - mongo-jdbc-driver/build/reports/tests/test/js/*.js
        remote_file: ${S3_ARTIFACTS_DIR}/test/js/
        content_type: application/javascript
        permissions: public-read
        display_name: "Unit Test JS"
        visibility: none

  "upload integration test js":
    - *assume_role_cmd
    - command: s3.put
      params:
        silent: true
        <<: *evg_bucket_config
        local_files_include_filter:
          - mongo-jdbc-driver/build/reports/tests/integrationTest/js/*.js
        remote_file: ${S3_ARTIFACTS_DIR}/integrationTest/js/
        content_type: application/javascript
        permissions: public-read
        display_name: "Integration Test JS"
        visibility: none

  "upload smoke test js":
    - *assume_role_cmd
    - command: s3.put
      params:
        silent: true
        <<: *evg_bucket_config
        local_files_include_filter:
          - mongo-jdbc-driver/smoketest/build/reports/tests/test/js/*.js
        remote_file: ${S3_ARTIFACTS_DIR}/smoketest/js/
        content_type: application/javascript
        permissions: public-read
        display_name: "Smoke Test JS"
        visibility: none

  "upload xunit test results":
    - command: attach.xunit_results
      params:
        silent: true
        file: mongo-jdbc-driver/build/test-results/*/TEST-*.xml

  "upload jar file":
    - *assume_role_cmd
    - command: shell.exec
      type: test
      params:
        shell: bash
        working_dir: mongo-jdbc-driver
        script: |
          ${PREPARE_SHELL}
          if [ -d "build/libs" ]; then
            # A sanity check to see if expected files are indeed here
            ls -lrt build/libs
            # Rename files according to our naming scheme
            for f in ./build/libs/mongodb-jdbc-*.jar; do
              if [[ "$f" == *"-all"* ]]; then
                mv "$f" build/libs/mongodb-jdbc-${MDBJDBC_VER}-all.jar
              else
                mv "$f" build/libs/mongodb-jdbc-${MDBJDBC_VER}.jar
              fi
            done
          fi
    - command: s3.put
      params:
        silent: true
        <<: *evg_bucket_config
        local_files_include_filter:
          - mongo-jdbc-driver/build/libs/*.jar
        remote_file: ${S3_ARTIFACTS_DIR}/
        content_type: application/java-archive
        permissions: public-read

  "publish maven":
    - command: shell.exec
      type: test
      params:
        shell: bash
        silent: true
        working_dir: mongo-jdbc-driver
        script: |
          PROJECT_DIRECTORY="$(pwd)" NEXUS_PROFILE_ID=${NEXUS_PROFILE_ID} NEXUS_TOKEN_NAME=${NEXUS_TOKEN_NAME} NEXUS_TOKEN=${NEXUS_TOKEN} NEXUS_URL=${NEXUS_URL} SIGNING_PASSWORD=${SIGNING_PASSWORD} SIGNING_KEY_ID=${SIGNING_KEY_ID} RING_FILE_GPG_BASE64="${RING_FILE_GPG_BASE64}" ./gradle/publish.sh

  "update download center feed":
    - command: shell.exec
      params:
        shell: bash
        working_dir: mongo-jdbc-driver
        script: |
          echo "Version = ${MDBJDBC_VER}"
          sed -i "s@{RELEASE_VERSION}@${MDBJDBC_VER}@" mongo-jdbc-downloads_template.json
          echo "-------------------------"
          cat mongo-jdbc-downloads_template.json
          echo "-------------------------"
    - command: s3.put
      params:
        aws_key: ${release_aws_key}
        aws_secret: ${release_aws_secret}
        local_file: mongo-jdbc-driver/mongo-jdbc-downloads_template.json
        remote_file: mongo-jdbc-driver/mongo-jdbc-downloads.json
        bucket: translators-connectors-releases
        permissions: public-read
        content_type: application/json

  "static code analysis":
    - *assume_role_cmd
    - command: shell.exec
      type: test
      params:
        shell: bash
        working_dir: mongo-jdbc-driver
        script: |
          echo "Running static code analysis with Semgrep..."

          venv='venv'
          # Setup or use the existing virtualenv for semgrep
          if [[ -f "$venv/bin/activate" ]]; then
            echo 'using existing virtualenv'
            . "$venv"/bin/activate
          else
            echo 'Creating new virtualenv'
            python3 -m virtualenv "$venv"
            echo 'Activating new virtualenv'
            . "$venv"/bin/activate
          fi

          python3 -m pip install semgrep

          # confirm
          semgrep --version
          set +e
          semgrep --config p/java --verbose --exclude "vendor" --error --severity=ERROR --sarif-output=${STATIC_CODE_ANALYSIS_NAME} > mongo-jdbc-driver.sast.cmd.verbose.out 2>&1
          SCAN_RESULT=$?
          set -e

          # Exit with a failure if the scan found an issue
          exit $SCAN_RESULT
    - command: s3.put
      params:
        <<: *evg_bucket_config
        local_files_include_filter:
          - mongo-jdbc-driver.sast.*
        remote_file: artifacts/${version_id}/ssdlc/
        content_type: application/json
        permissions: public-read

  "publish static code analysis":
    - *assume_role_cmd
    - command: s3.get
      params:
        <<: *evg_bucket_config
        local_file: artifacts/ssdlc/mongodb-jdbc-${MDBJDBC_VER}.sast.sarif
        remote_file: artifacts/${version_id}/ssdlc/${STATIC_CODE_ANALYSIS_NAME}
        content_type: application/json
    - command: s3.put
      params:
        aws_key: ${release_aws_key}
        aws_secret: ${release_aws_secret}
        local_file: artifacts/ssdlc/mongodb-jdbc-${MDBJDBC_VER}.sast.sarif
        remote_file: mongo-jdbc-driver/mongodb-jdbc-${MDBJDBC_VER}.sast.sarif
        content_type: application/json
        bucket: translators-connectors-releases
        permissions: public-read
        display_name: mongodb-jdbc-${MDBJDBC_VER}.sast.sarif

  "generate compliance report":
    - command: shell.exec
      type: test
      params:
        shell: bash
        working_dir: mongo-jdbc-driver
        script: |
          echo "Author = ${author}"
          echo "Author email = ${author_email}"
          echo "Version = ${MDBJDBC_VER}"
          SBOM_URL="https://translators-connectors-releases.s3.amazonaws.com/mongo-jdbc-driver/mongodb-jdbc-${MDBJDBC_VER}.sbom.json"
          SARIF_URL="https://translators-connectors-releases.s3.amazonaws.com/mongo-jdbc-driver/mongodb-jdbc-${MDBJDBC_VER}.sast.sarif"
          echo "Sbom url = $SBOM_URL"
          echo "Sarif Url = $SARIF_URL"

          echo "----- Generating ${COMPLIANCE_REPORT_NAME} -----"

          # Copy template
          cp resources/release/mongo_jdbc_compliance_report_template.md ${COMPLIANCE_REPORT_NAME}

          # Update the version
          echo "Update the version"
          echo "sed -i.bu "s,%VERSION%,${MDBJDBC_VER},g" ${COMPLIANCE_REPORT_NAME}"
          sed -i.bu "s,%VERSION%,${MDBJDBC_VER},g" ${COMPLIANCE_REPORT_NAME}

          # Update the SBOM link
          echo "Update the SBOM link"
          echo "sed -i.bu "s,%SBOM_URL%,$SBOM_URL,g"${COMPLIANCE_REPORT_NAME}"
          sed -i.bu "s,%SBOM_URL%,$SBOM_URL,g" ${COMPLIANCE_REPORT_NAME}

          # Update the SARIF link
          echo "Update the SARIF link"
          echo "sed -i.bu "s,%SARIF_URL%,$SARIF_URL,g" ${COMPLIANCE_REPORT_NAME}"
          sed -i.bu "s,%SARIF_URL%,$SARIF_URL,g" ${COMPLIANCE_REPORT_NAME}

          # Update the author information
          echo "Update the author name"
          echo "sed -i.bu "s,%AUTHOR%,${author},g" ${COMPLIANCE_REPORT_NAME}"
          sed -i.bu "s,%AUTHOR%,${author},g" ${COMPLIANCE_REPORT_NAME}

          echo "update the author email"
          echo "sed -i.bu "s,%AUTHOR_EMAIL%,${author_email},g" ${COMPLIANCE_REPORT_NAME}"
          sed -i.bu "s,%AUTHOR_EMAIL%,${author_email},g" ${COMPLIANCE_REPORT_NAME}
          echo "---------------------------"
    - *assume_role_cmd
    - command: s3.put
      params:
        <<: *evg_bucket_config
        local_file: mongo-jdbc-driver/${COMPLIANCE_REPORT_NAME}
        remote_file: artifacts/${version_id}/ssdlc/${COMPLIANCE_REPORT_NAME}
        content_type: text/markdown
        permissions: public-read

  "publish compliance report":
    - *assume_role_cmd
    - command: s3.get
      params:
        <<: *evg_bucket_config
        local_file: artifacts/ssdlc/mongodb-jdbc-${MDBJDBC_VER}-compliance-report.md
        remote_file: artifacts/${version_id}/ssdlc/${COMPLIANCE_REPORT_NAME}
        content_type: text/markdown
    - command: s3.put
      params:
        aws_key: ${release_aws_key}
        aws_secret: ${release_aws_secret}
        local_file: artifacts/ssdlc/mongodb-jdbc-${MDBJDBC_VER}-compliance-report.md
        remote_file: mongo-jdbc-driver/mongodb-jdbc-${MDBJDBC_VER}-compliance-report.md
        content_type: text/markdown
        bucket: translators-connectors-releases
        permissions: public-read