Why

DRIVERS-2894 and DRIVERS-2898 require every release to publish a static analysis export and an SSDLC compliance report. r1.0.0-alpha1 published neither. Papertrail tracing (HIBERNATE-246) and CodeQL analysis of release refs (HIBERNATE-247) supply the inputs; nothing yet turns them into release assets.

What

Port .evergreen/ssdlc-report.sh and .evergreen/template_ssdlc_compliance_report.md from mongodb/mongo-java-driver, and add an Evergreen function that uploads both assets to the release-assets bucket under product name and product version. Attach it to publish-release and publish-snapshot, after artifact tracing.

The script:

• Polls the GitHub code-scanning analyses API for the published commit sha until both categories are present, /language:java-kotlin and /language:actions, then downloads each as SARIF into build/ssdlc/static-analysis-reports/. Evergreen and the CodeQL workflow react to the same push concurrently, and the measured lag from tag push to analysis upload was 4m36s, so a lookup without polling loses the race and writes an empty artifact.
• Fails the task on timeout or on a missing category, rather than uploading an empty directory.
• Renders the template into build/ssdlc/ssdlc_compliance_report.md, substituting product name, product version, report date, release creator and Evergreen build URL.

Both categories are exported as separate files: an artifact holding only the actions analysis would look plausible while covering none of the Java source.

Template changes beyond retargeting URLs to this repository:

• Static analysis findings: phrased around CodeQL alerts and their dismissal reasons instead of SpotBugs status values and an exclude file, and stating which commit was analysed.
• Third-party dependency information: this product depends on Hibernate ORM, the MongoDB Java driver, and Spring Boot for the starter modules, so the driver's claim that there are no dependencies to report does not carry over.

Blocked on

• ENTSEC-6511 for the GitHub App that lets Evergreen mint a token with code scanning read access.
• RNDSEC-4205 for confirmation of the S3 bucket, region and role ARN.

Verification

Exercise publish-snapshot first, then confirm by inspection that the bucket lists the report and a non-empty static-analysis-reports directory, that the SARIFs correspond to the published commit rather than the latest main, that both categories are present, and that the rendered report has no unsubstituted placeholders. Deliberately point the lookup at a commit with no analysis once, and confirm the task fails.