We ship the MongoDB connector for Microsoft Agent Framework as two packages: Python (PyPI) and .NET (NuGet). Before we publish publicly, the release process needs to meet MongoDB Product Security requirements. Most of the pipeline is already built. We need engineering to complete the setup and get the required approvals.

https://github.com/mongodb-developer/ms-agent-framework-mongodb

What we need

1. Controlled releases. Only approved people can publish, and every release goes through a reviewed, repeatable process. No one holds long-lived publishing credentials.
2. Signed releases. Every release is signed through Garasign, MongoDB’s signing service, so customers can verify it came from us.
3. SBOM and vulnerability management. Every release has a software bill of materials, and it is registered in Kondukto so dependency vulnerabilities are tracked and triaged.

Why
These are Product Security requirements for shipping an open-source connector. Without them, we can’t publish the packages.

Done when

• A test release of each package (Python and .NET) goes through approval, is signed, and is published.
• A customer can verify the signature.
• Each release includes an SBOM, and its vulnerability results show up in Kondukto.
• Product Security has signed off.