Skip to content

Commit e0186d8

Browse files
jbern0rdjbern0rd
authored
ci: add sconification workflows (#10)
1 parent 91d01df commit e0186d8

File tree

3 files changed

+156
-25
lines changed

3 files changed

+156
-25
lines changed

‎.github/workflows/ci.yaml‎

Lines changed: 61 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,8 @@ jobs:
1717

1818
prepare:
1919
name: Determine image tag
20-
runs-on: ubuntu-latest
2120
needs: build-and-test
21+
runs-on: ubuntu-latest
2222
if: |
2323
github.ref_name == 'main' ||
2424
startsWith(github.head_ref, 'feature/') ||
@@ -27,7 +27,7 @@ jobs:
2727
outputs:
2828
image_tag: ${{ steps.determine-tag.outputs.image_tag }}
2929
steps:
30-
- name: Determine Docker tag based on Git ref
30+
- name: Determine base tag
3131
id: determine-tag
3232
run: |
3333
if [ "${{ github.event_name }}" = "pull_request" ] ; then
@@ -45,14 +45,17 @@ jobs:
4545
echo "image_tag=feature-${SHORT_SHA}" | tee -a $GITHUB_OUTPUT
4646
fi
4747
48-
post-compute-oci-image:
49-
name: post-compute OCI image
48+
build-oci-image:
49+
name: Build OCI images
5050
needs: prepare
51+
strategy:
52+
matrix:
53+
package: [post-compute, pre-compute]
5154
uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/[email protected]
5255
with:
53-
image-name: docker-regis.iex.ec/tee-worker-post-compute-rust
56+
image-name: docker-regis.iex.ec/tee-worker-${{ matrix.package }}-rust
5457
image-tag: ${{ needs.prepare.outputs.image_tag }}
55-
dockerfile: post-compute/Dockerfile
58+
dockerfile: ${{ matrix.package }}/Dockerfile
5659
context: .
5760
registry: docker-regis.iex.ec
5861
push: true
@@ -64,21 +67,55 @@ jobs:
6467
username: ${{ secrets.NEXUS_USERNAME }}
6568
password: ${{ secrets.NEXUS_PASSWORD }}
6669

67-
pre-compute-oci-image:
68-
name: pre-compute OCI image
69-
needs: prepare
70-
uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/[email protected]
71-
with:
72-
image-name: docker-regis.iex.ec/tee-worker-pre-compute-rust
73-
image-tag: ${{ needs.prepare.outputs.image_tag }}
74-
dockerfile: pre-compute/Dockerfile
75-
context: .
76-
registry: docker-regis.iex.ec
77-
push: true
78-
security-scan: true
79-
security-report: "sarif"
80-
hadolint: true
81-
platforms: linux/amd64
82-
secrets:
83-
username: ${{ secrets.NEXUS_USERNAME }}
84-
password: ${{ secrets.NEXUS_PASSWORD }}
70+
build-tee-image:
71+
name: Build TEE images
72+
needs: [prepare, build-oci-image]
73+
runs-on: ubuntu-latest
74+
strategy:
75+
matrix:
76+
sconify_image:
77+
- name: registry.scontain.com/scone-debug/iexec-sconify-image-unlocked
78+
version: 5.9.1
79+
tee_worker:
80+
- binary: /app/tee-worker-post-compute
81+
img_from: docker-regis.iex.ec/tee-worker-post-compute-rust
82+
img_to: docker-regis.iex.ec/tee-worker-post-compute-rust-unlocked
83+
- binary: /app/tee-worker-pre-compute
84+
img_from: docker-regis.iex.ec/tee-worker-pre-compute-rust
85+
img_to: docker-regis.iex.ec/tee-worker-pre-compute-rust-unlocked
86+
steps:
87+
- name: Login to Scontain registry
88+
uses: docker/login-action@v3
89+
with:
90+
registry: registry.scontain.com
91+
username: ${{ secrets.SCONTAIN_REGISTRY_USERNAME }}
92+
password: ${{ secrets.SCONTAIN_REGISTRY_PAT }}
93+
- name: Login to Docker regis
94+
uses: docker/login-action@v3
95+
with:
96+
registry: docker-regis.iex.ec
97+
username: ${{ secrets.NEXUS_USERNAME }}
98+
password: ${{ secrets.NEXUS_PASSWORD }}
99+
- name: Pull sconification tools
100+
run: docker pull ${{ matrix.sconify_image.name }}:${{ matrix.sconify_image.version }}
101+
- name: Pull native image
102+
run: docker pull ${{ matrix.tee_worker.img_from }}:${{ needs.prepare.outputs.image_tag }}
103+
- name: Sconify
104+
run: |
105+
IMG_FROM=${{ matrix.tee_worker.img_from }}:${{ needs.prepare.outputs.image_tag }}
106+
IMG_TO=${{ matrix.tee_worker.img_to }}:${{ needs.prepare.outputs.image_tag }}-sconify-${{ matrix.sconify_image.version }}-debug
107+
SCONE_IMAGE=${{ matrix.sconify_image.name }}:${{ matrix.sconify_image.version }}
108+
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock $SCONE_IMAGE \
109+
sconify_iexec --cli=$SCONE_IMAGE --crosscompiler=$SCONE_IMAGE \
110+
--base=alpine:3.22 --from=$IMG_FROM --to=$IMG_TO --binary=${{ matrix.tee_worker.binary }} \
111+
--heap=1G --stack=8M --host-path=/etc/hosts --host-path=/etc/resolv.conf --no-color --verbose
112+
echo
113+
docker run --rm -e SCONE_HASH=1 $IMG_TO
114+
- name: Push TEE image
115+
run: docker push ${{ matrix.tee_worker.img_to }}:${{ needs.prepare.outputs.image_tag }}-sconify-${{ matrix.sconify_image.version }}-debug
116+
- name: Clean OCI images
117+
run: |
118+
docker image rm -f \
119+
${{ matrix.tee_worker.img_from }}:${{ needs.prepare.outputs.image_tag }} \
120+
${{ matrix.tee_worker.img_to }}:${{ needs.prepare.outputs.image_tag }}-sconify-${{ matrix.sconify_image.version }}-debug \
121+
${{ matrix.sconify_image.name }}:${{ matrix.sconify_image.version }}

‎.github/workflows/docker-build-on-tag.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ jobs:
2020
with:
2121
fetch-depth: 0
2222

23-
- name: Determine Docker tag based on Git ref
23+
- name: Determine base tag
2424
id: determine-tag
2525
run: |
2626
# Since this workflow only triggers on tags matching 'v*.*.*' we know we're always dealing with a version tag

‎.github/workflows/sconify-release.yaml‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
name: Sconify and push TEE image
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
sconify_version:
7+
default: 5.9.1-v16
8+
required: true
9+
10+
jobs:
11+
prepare:
12+
name: Determine image tag
13+
if: github.ref_type == 'tag'
14+
runs-on: ubuntu-latest
15+
outputs:
16+
binary: ${{ steps.determine-tag.outputs.binary }}
17+
image_name: ${{ steps.determine-tag.outputs.image_name }}
18+
image_tag: ${{ steps.determine-tag.outputs.image_tag }}
19+
steps:
20+
- name: Checkout code
21+
uses: actions/checkout@v4
22+
with:
23+
fetch-depth: 0
24+
25+
- name: Determine base tag
26+
id: determine-tag
27+
run: |
28+
TAG_ON_MAIN=$(git branch -r --contains ${{ github.sha }} 'origin/main')
29+
30+
if [ -z "$TAG_ON_MAIN" ] ; then
31+
echo "Error: Tag ${{ github.ref_name }} is not on main branch"
32+
echo "Tags must be created on main branch to generate X.Y.Z image tags"
33+
exit 1
34+
fi
35+
36+
GITHUB_REF_NAME="${{ github.ref_name }}"
37+
echo "Processing tag on main branch: ${{ github.ref_name }}"
38+
39+
case "$GITHUB_REF_NAME" in
40+
tee-worker-post-compute-v*)
41+
echo "binary=/app/tee-worker-post-compute" | tee -a $GITHUB_OUTPUT
42+
echo "image_name=tee-worker-post-compute-rust" | tee -a $GITHUB_OUTPUT
43+
echo "image_tag=${GITHUB_REF_NAME#tee-worker-post-compute-v}" | tee -a $GITHUB_OUTPUT
44+
;;
45+
tee-worker-pre-compute-v*)
46+
echo "binary=/app/tee-worker-pre-compute" | tee -a $GITHUB_OUTPUT
47+
echo "image_name=tee-worker-pre-compute-rust" | tee -a $GITHUB_OUTPUT
48+
echo "image_tag=${GITHUB_REF_NAME#tee-worker-pre-compute-v}" | tee -a $GITHUB_OUTPUT
49+
;;
50+
*)
51+
echo "Error: Unsupported tag ${{ github.ref_name }}"
52+
exit 1
53+
;;
54+
esac
55+
56+
build-tee-image:
57+
name: Sconify TEE image
58+
needs: prepare
59+
runs-on: ubuntu-latest
60+
env:
61+
IMG_FROM: docker-regis.iex.ec/${{ needs.prepare.outputs.image_name }}:${{ needs.prepare.outputs.image_tag }}
62+
IMG_TO: docker-regis.iex.ec/${{ needs.prepare.outputs.image_name }}:${{ needs.prepare.outputs.image_tag }}-sconify-${{ inputs.sconify_version }}-production
63+
SCONIFY_IMAGE: registry.scontain.com/scone-production/iexec-sconify-image:${{ inputs.sconify_version }}
64+
steps:
65+
- name: Login to Scontain registry
66+
uses: docker/login-action@v3
67+
with:
68+
registry: registry.scontain.com
69+
username: ${{ secrets.SCONTAIN_REGISTRY_USERNAME }}
70+
password: ${{ secrets.SCONTAIN_REGISTRY_PAT }}
71+
- name: Login to Docker regis
72+
uses: docker/login-action@v3
73+
with:
74+
registry: docker-regis.iex.ec
75+
username: ${{ secrets.NEXUS_USERNAME }}
76+
password: ${{ secrets.NEXUS_PASSWORD }}
77+
- name: Pull sconification tools
78+
run: docker pull ${{ env.SCONIFY_IMAGE }}
79+
- name: Pull native image
80+
run: docker pull ${{ env.IMG_FROM }}
81+
- name: Sconify
82+
run: |
83+
echo "${{ secrets.SCONIFY_SIGNING_PRIVATE_KEY }}" > ${{ github.workspace }}/sig.pem
84+
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v ${{ github.workspace }}/sig.pem:/sig.pem ${{ env.SCONIFY_IMAGE }} \
85+
sconify_iexec --cli=${{ env.SCONIFY_IMAGE }} --crosscompiler=${{ env.SCONIFY_IMAGE }} \
86+
--base=alpine:3.22 --from=${{ env.IMG_FROM }} --to=${{ env.IMG_TO }} --binary=${{ needs.prepare.outputs.binary }} \
87+
--heap=1G --stack=8M --host-path=/etc/hosts --host-path=/etc/resolv.conf --no-color --verbose \
88+
--scone-signer=/sig.pem
89+
echo
90+
docker run --rm -e SCONE_HASH=1 ${{ env.IMG_TO }}
91+
- name: Push TEE image
92+
run: docker push ${{ env.IMG_TO }}
93+
- name: Clean OCI images
94+
run: docker image rm -f ${{ env.IMG_FROM }} ${{ env.IMG_TO }} ${{ env.SCONIFY_IMAGE }}

0 commit comments

Comments
 (0)