Repository: mongodb/mongodb-atlas-cli
Pull request #3898: CLOUDP-315269: Add SSDLC report
Author: login: blva
Labels: name: atlascli
Created: 2025-05-20T15:40:28Z | Merged: 2025-05-21T15:50:47Z

<!--
Thanks for contributing to MongoDB Atlas CLI!

Before you submit your pull request, please review our contribution guidelines:
https://github.com/mongodb/mongodb-atlas-cli/blob/master/CONTRIBUTING.md

Please fill out the information below to help speed up the review process
and getting you pull request merged!
-->

## Proposed changes

<!-- 
Describe the big picture of your changes here and communicate why we should accept this pull request.
If it fixes a bug or resolves a feature request, be sure to link to that issue. 
-->

_Jira ticket:_ CLOUDP-315269

- Adds a report template based on https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/docs/releases/v2.2.1/sdlc-compliance.md 
- Adds a script to generate the report in the compliance folder, so that goreleaser picks the report up

## Checklist

<!--
Check the boxes that apply. If you're unsure about any of them, don't hesitate to ask!
We're here to help! This is simply a reminder of what we are going to look for before merging your code.
-->

- [ ] I have signed the [MongoDB CLA](https://www.mongodb.com/legal/contributor-agreement)
- [ ] I have added tests that prove my fix is effective or that my feature works
- [ ] I have added any necessary documentation in document requirements section listed in [CONTRIBUTING.md](https://github.com/mongodb/mongodb-atlas-cli/blob/master/CONTRIBUTING.md) (if appropriate)
- [ ] I have addressed the @mongodb/docs-cloud-team comments (if appropriate)
- [ ] I have updated [test/README.md](https://github.com/mongodb/mongodb-atlas-cli/blob/master/test/README.md) (if an e2e test has been added)
- [ ] I have run `make fmt` and formatted my code

## Further comments

<!--
If this is a relatively large or complex change, kick off the discussion by explaining why you chose the solution you did and what alternatives you considered, etc.

Alternatively, if this is a very minor, and self-explanatory change, feel free to remove this section.
-->



Diff:
diff --git a/build/ci/release.yml b/build/ci/release.yml
index 3d3ddb46d47..e8b6a3b856f 100644
--- a/build/ci/release.yml
+++ b/build/ci/release.yml
@@ -112,6 +112,15 @@ functions:
           --repo mongodb_mongodb-atlas-cli  \
           --branch ${branch_name}  
           rm ${workdir}/kondukto_credentials.env
+  "generate ssdlc report":
+    - command: subprocess.exec
+      params:
+        include_expansions_in_env:
+            - author
+        env:
+          AUTHOR: ${author}
+        <<: *go_options
+        binary: build/package/gen-ssdlc-report.sh
   "package":
     - command: github.generate_token
       params:
@@ -395,6 +404,7 @@ tasks:
     commands:  
       - func: "generate sbom"
       - func: "run silkbomb"
+      - func: "generate ssdlc report"
   - name: package_goreleaser
     tags: ["packaging"]
     depends_on:
diff --git a/build/package/gen-ssdlc-report.sh b/build/package/gen-ssdlc-report.sh
new file mode 100755
index 00000000000..db87b90077e
--- /dev/null
+++ b/build/package/gen-ssdlc-report.sh
@@ -0,0 +1,40 @@
+#!/bin/bash
+# Copyright 2025 MongoDB Inc
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+set -eu
+
+release_date=${DATE:-$(date -u '+%Y-%m-%d')}
+
+export DATE="${release_date}"
+VERSION=""
+VERSION=$(git tag --list 'atlascli/v*' --sort=-taggerdate | head -1 | cut -d 'v' -f 2)
+export VERSION
+export AUTHOR="${AUTHOR:-$(git config user.name)}"
+
+echo "Generating SSDLC checklist for AtlasCLI version ${VERSION}, author ${AUTHOR} and release date ${DATE}..."
+
+# Ensure compliance directory exists
+mkdir -p "compliance/"
+
+# Generate the report in compliance/ with a versioned filename
+envsubst < docs/releases/ssdlc-compliance.template.md \
+  > "compliance/ssdlc-compliance-${VERSION}.md"
+
+echo "SDLC checklist ready. Files in compliance/:"
+ls -l "compliance/"
+
+echo "Printing the generated report:"
+cat "compliance/ssdlc-compliance-${VERSION}.md"
\ No newline at end of file
diff --git a/docs/releases/ssdlc-compliance.template.md b/docs/releases/ssdlc-compliance.template.md
new file mode 100644
index 00000000000..28db0933595
--- /dev/null
+++ b/docs/releases/ssdlc-compliance.template.md
@@ -0,0 +1,30 @@
+SSDLC Compliance Report: Atlas CLI ${VERSION}
+=================================================================
+
+- Release Creator: ${AUTHOR}
+- Created On:       ${DATE}
+
+Overview:
+
+- **Product and Release Name**
+    - Atlas CLI ${VERSION}, ${DATE}.
+
+- **Process Document**
+  - https://www.mongodb.com/blog/post/how-mongodb-protects-against-supply-chain-vulnerabilities
+
+- **Tool used to track third party vulnerabilities**
+  - [Kondukto](https://arcticglow.kondukto.io/)
+
+- **Dependency Information**
+  - See SBOM Lite manifests (CycloneDX in JSON format):
+    - https://github.com/mongodb/mongodb-atlas-cli/releases/download/atlascli%2Fv${VERSION}/sbom.json
+
+- **Security Testing Report**
+  - Available as needed from Cloud Security.
+
+- **Security Assessment Report**
+  - Available as needed from Cloud Security.
+
+Assumptions and attestations:
+
+- Internal processes are used to ensure CVEs are identified and mitigated within SLAs.
\ No newline at end of file


Reviews:
user: login: blva
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-21T09:13:31Z
user: login: blva
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-21T09:24:49Z
user: login: cveticm
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-21T11:13:26Z
user: login: andreaangiolillo
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-21T12:19:40Z
user: login: blva
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-21T15:04:06Z
user: login: blva
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-21T15:04:22Z
user: login: cveticm
body: LGTM, just note for possible migration of sbom from release artifacts
state: APPROVED
author_association: COLLABORATOR
submitted_at: 2025-05-21T15:50:46Z
user: login: blva
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-21T15:53:17Z

Review comments:
diff_hunk: @@ -0,0 +1,30 @@
+SSDLC Compliance Report: Atlas CLI ${VERSION}
+=================================================================
+
+- Release Creator: ${AUTHOR}
+- Created On:       ${DATE}
+
+Overview:
+
+- **Product and Release Name**
+    - Atlas CLI ${VERSION}, ${DATE}.
+
+- **Process Document**
+  - http://go/how-we-develop-software-doc
+
+- **Tool used to track third party vulnerabilities**
+  - [Kondukto](https://arcticglow.kondukto.io/)
+
+- **Dependency Information**
+  - See SBOM Lite manifests (CycloneDX in JSON format):
+    - https://github.com/mongodb/mongodb-atlas-cli/releases/download/atlascli%2F${VERSION}/sbom.json
path: docs/releases/ssdlc-compliance.template.md
user: login: blva
body: different from K8s, who publishes it in the code, we'll link to the release artifact
created_at: 2025-05-21T09:13:30Z
author_association: COLLABORATOR
diff_hunk: @@ -0,0 +1,30 @@
+SSDLC Compliance Report: Atlas CLI ${VERSION}
path: docs/releases/ssdlc-compliance.template.md
user: login: blva
body: Based on https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/docs/releases/v2.2.1/sdlc-compliance.md 

But note i removed some items. Such as another section for vunlerabilities that was added with go vulncheck, my understanding is that we'll rely on SBOM generated w/ kondukto. Let me know if I'm missing something
created_at: 2025-05-21T09:24:48Z
author_association: COLLABORATOR
diff_hunk: @@ -0,0 +1,30 @@
+SSDLC Compliance Report: Atlas CLI ${VERSION}
+=================================================================
+
+- Release Creator: ${AUTHOR}
+- Created On:       ${DATE}
+
+Overview:
+
+- **Product and Release Name**
+    - Atlas CLI ${VERSION}, ${DATE}.
+
+- **Process Document**
+  - http://go/how-we-develop-software-doc
path: docs/releases/ssdlc-compliance.template.md
user: login: cveticm
body: A bit uncertain about using this link. I don't think this go link will work for users outside the company and it points to a draft doc. It looks like there is a more official doc linked to this one that plans to be published publicly in late June.

Should we open a ticket to track the publication of this official doc and tp change this link to once the publication is done?
created_at: 2025-05-21T11:13:25Z
author_association: COLLABORATOR
diff_hunk: @@ -0,0 +1,40 @@
+#!/bin/bash
+# Copyright 2025 MongoDB Inc
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+set -eu
+
+release_date=${DATE:-$(date -u '+%Y-%m-%d')}
+
+export DATE="${release_date}"
+VERSION=""
+VERSION=$(git tag --list 'atlascli/v*' --sort=-taggerdate | head -1 | cut -d 'v' -f 2)
+export VERSION
+export AUTHOR="${AUTHOR:-$(git config user.name)}"
path: build/package/gen-ssdlc-report.sh
user: login: andreaangiolillo
body: Should the author be MongoDB? I think that `user.name` is the [apix-bot](https://github.com/apps/apix-bot) nowdays  
created_at: 2025-05-21T12:15:58Z
author_association: COLLABORATOR
diff_hunk: @@ -0,0 +1,40 @@
+#!/bin/bash
+# Copyright 2025 MongoDB Inc
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+set -eu
+
+release_date=${DATE:-$(date -u '+%Y-%m-%d')}
+
+export DATE="${release_date}"
+VERSION=""
+VERSION=$(git tag --list 'atlascli/v*' --sort=-taggerdate | head -1 | cut -d 'v' -f 2)
+export VERSION
+export AUTHOR="${AUTHOR:-$(git config user.name)}"
path: build/package/gen-ssdlc-report.sh
user: login: blva
body: It's ok if it's the bot, the docs say "person or automation" 
created_at: 2025-05-21T15:04:06Z
author_association: COLLABORATOR
diff_hunk: @@ -0,0 +1,30 @@
+SSDLC Compliance Report: Atlas CLI ${VERSION}
+=================================================================
+
+- Release Creator: ${AUTHOR}
+- Created On:       ${DATE}
+
+Overview:
+
+- **Product and Release Name**
+    - Atlas CLI ${VERSION}, ${DATE}.
+
+- **Process Document**
+  - http://go/how-we-develop-software-doc
path: docs/releases/ssdlc-compliance.template.md
user: login: blva
body: I updated w/ the latest doc, and opening a ticket to update in our epic! thanks
created_at: 2025-05-21T15:04:22Z
author_association: COLLABORATOR
diff_hunk: @@ -0,0 +1,40 @@
+#!/bin/bash
+# Copyright 2025 MongoDB Inc
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+set -eu
+
+release_date=${DATE:-$(date -u '+%Y-%m-%d')}
+
+export DATE="${release_date}"
+VERSION=""
+VERSION=$(git tag --list 'atlascli/v*' --sort=-taggerdate | head -1 | cut -d 'v' -f 2)
+export VERSION
+export AUTHOR="${AUTHOR:-$(git config user.name)}"
+
+echo "Generating SSDLC checklist for AtlasCLI version ${VERSION}, author ${AUTHOR} and release date ${DATE}..."
+
+# Ensure compliance directory exists
+mkdir -p "compliance/"
+
+# Generate the report in compliance/ with a versioned filename
+envsubst < docs/releases/ssdlc-compliance.template.md \
+  > "compliance/ssdlc-compliance-${VERSION}.md"
+
+echo "SDLC checklist ready. Files in compliance/:"
+ls -l "compliance/"
+
+echo "Printing the generated report:"
+cat "compliance/ssdlc-compliance-${VERSION}.md"
path: build/package/gen-ssdlc-report.sh
user: login: cveticm
body: ```suggestion
ls -l "compliance/${VERSION}"

echo "Printing the generated report:"
cat "compliance/${VERSION}/ssdlc-compliance.md"
```
Just noting: If we decide to move sboms into the codebase, we'll probably want to move the report ++ sbom into a dir `compliance/${VERSION}`. 
created_at: 2025-05-21T15:50:22Z
author_association: COLLABORATOR
diff_hunk: @@ -0,0 +1,40 @@
+#!/bin/bash
+# Copyright 2025 MongoDB Inc
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+set -eu
+
+release_date=${DATE:-$(date -u '+%Y-%m-%d')}
+
+export DATE="${release_date}"
+VERSION=""
+VERSION=$(git tag --list 'atlascli/v*' --sort=-taggerdate | head -1 | cut -d 'v' -f 2)
+export VERSION
+export AUTHOR="${AUTHOR:-$(git config user.name)}"
+
+echo "Generating SSDLC checklist for AtlasCLI version ${VERSION}, author ${AUTHOR} and release date ${DATE}..."
+
+# Ensure compliance directory exists
+mkdir -p "compliance/"
+
+# Generate the report in compliance/ with a versioned filename
+envsubst < docs/releases/ssdlc-compliance.template.md \
+  > "compliance/ssdlc-compliance-${VERSION}.md"
+
+echo "SDLC checklist ready. Files in compliance/:"
+ls -l "compliance/"
+
+echo "Printing the generated report:"
+cat "compliance/ssdlc-compliance-${VERSION}.md"
path: build/package/gen-ssdlc-report.sh
user: login: blva
body: yes, we'll update this! thanks for the note
created_at: 2025-05-21T15:53:17Z
author_association: COLLABORATOR

PR comments:
user: login: github-actions[bot]
created_at: 2025-05-21T15:28:00Z
body: Coverage Report 📈
| Branch | Commit | Coverage |
|--------|--------|----------|
| master | 369f3f66b06c123e7a56ab4e63d7f1673fb3520e | 25.1% |
| CLOUDP-315269 | 015453c41da3b34f4e63a105df7daa28aedd947f | 25.1% |
|        | Difference | 0% |

<!-- Sticky Pull Request Comment -->
author_association: CONTRIBUTOR