WIP: Update docker image for SEV #2176
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Veracruz-CI | |
| # Controls when the workflow will run | |
| on: | |
| # Triggers the workflow on push or pull request events but only for the main branch | |
| push: | |
| branches: [ main ] | |
| pull_request: | |
| branches: [ main ] | |
| # Allows you to run this workflow manually from the Actions tab | |
| workflow_dispatch: | |
| env: | |
| WASMTIME_VERSION: v9.0.4 | |
| jobs: | |
| check: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Install cosign | |
| # https://github.com/sigstore/cosign-installer | |
| uses: sigstore/cosign-installer@1fc5bd396d372bee37d608f955b336615edf79c8 # v3.2.0 | |
| with: | |
| cosign-release: "v2.2.1" | |
| - name: Check image signature | |
| id: cosign-verify | |
| run: | | |
| COSIGN_EXPERIMENTAL=true cosign verify \ | |
| --certificate-identity-regexp 'https://github.com/veracruz-project/veracruz/.github/workflows/docker.yml@refs/heads/dreemkiller_amd_sev' \ | |
| --certificate-oidc-issuer https://token.actions.githubusercontent.com \ | |
| ghcr.io/veracruz-project/veracruz/ci@sha256:681ceebcae7f23fb60bb6c5b903600e134fd4852f0187539d995ced444f382d6 | |
| linux: | |
| runs-on: ubuntu-latest | |
| needs: [check] | |
| outputs: | |
| output: ${{ steps.check-diff.outputs.cargo-lock }} | |
| container: | |
| image: ghcr.io/veracruz-project/veracruz/ci@sha256:681ceebcae7f23fb60bb6c5b903600e134fd4852f0187539d995ced444f382d6 | |
| volumes: | |
| - ${{ github.workspace }}:/work/veracruz | |
| steps: | |
| - name: Check out the Veracruz repository | |
| uses: actions/checkout@v3 | |
| with: | |
| submodules: recursive | |
| - name: Build Veracruz-Linux | |
| id: linux-build | |
| run: | | |
| make -C /work/veracruz/workspaces linux | |
| - name: Running linux test script | |
| id: linux-build-and-test | |
| run: | | |
| make -C /work/veracruz/workspaces linux-tests | |
| - name: Move back to veracruz root | |
| run: | | |
| cd /work/veracruz | |
| git config --global --add safe.directory "$GITHUB_WORKSPACE" | |
| - name: Check modification to Cargo.lock | |
| id: check-diff | |
| run: | | |
| # Find if any Cargo.lock changed, pad them into a line and trim leading and trailing whitespace. | |
| file_changed=$(git diff --diff-filter=ACMUXTRD --name-only -- '**Cargo.lock' | tr '\n' ' ' | xargs) | |
| echo "cargo-lock=$file_changed" >> $GITHUB_OUTPUT | |
| if [ -n "$file_changed" ] ; then | |
| echo "::warning::Cargo.lock files modified"; | |
| echo "::warning::Cargo.lock change list: ${{ steps.check-diff.outputs.cargo-lock }}"; | |
| fi | |
| - name: Upload Cargo.lock files | |
| id: upload-changed-cargo-lock | |
| if: steps.check-diff.outputs.cargo-lock != '' | |
| uses: actions/upload-artifact@v3 | |
| with: | |
| name: linux | |
| path: workspaces/**/Cargo.lock | |
| - name: Prepare deployment artifacts | |
| run: | | |
| # Strip binaries | |
| strip \ | |
| workspaces/host/target/debug/freestanding-execution-engine \ | |
| workspaces/host/target/debug/generate-policy \ | |
| workspaces/linux-host/target/debug/veracruz-client \ | |
| workspaces/linux-host/target/debug/linux-veracruz-server \ | |
| workspaces/linux-runtime/target/debug/linux-runtime-manager | |
| # Copy artifacts to new directory | |
| mkdir -p artifacts | |
| cp -a \ | |
| sdk/proxy_cleanup.sh \ | |
| workspaces/ca-cert.conf \ | |
| workspaces/cert.conf \ | |
| workspaces/host/target/debug/freestanding-execution-engine \ | |
| workspaces/host/target/debug/generate-policy \ | |
| workspaces/linux-host/target/debug/veracruz-client \ | |
| workspaces/linux-host/target/debug/linux-veracruz-server \ | |
| workspaces/linux-runtime/target/debug/linux-runtime-manager \ | |
| artifacts/ | |
| - name: Upload deployment artifacts | |
| id: upload-deployment-artifacts | |
| uses: actions/upload-artifact@v3 | |
| with: | |
| name: linux_deployment_artifacts | |
| path: | | |
| artifacts/* | |
| vod-full-deployment: | |
| runs-on: ubuntu-latest | |
| needs: [linux] | |
| container: | |
| image: ghcr.io/veracruz-project/veracruz/ci@sha256:681ceebcae7f23fb60bb6c5b903600e134fd4852f0187539d995ced444f382d6 | |
| volumes: | |
| - ${{ github.workspace }}:/work/video-object-detection | |
| steps: | |
| - name: Check out the VOD repository | |
| uses: actions/checkout@v3 | |
| with: | |
| repository: 'veracruz-project/video-object-detection' | |
| ref: '20230704' | |
| submodules: recursive | |
| set-safe-directory: true | |
| - name: Build | |
| run: | | |
| # grab every bash code block for this step, remove line continuation, | |
| # and only keep lines that start with '$' (of course removing that '$' | |
| # in the process) | |
| sed -n '/```.*veracruz-ci-build/,/```/{/```/d; p}' README.md \ | |
| | sed ':a; /\\$/{N; s/\\\n//; ta}' \ | |
| | sed -n '/^ *\$/{s/^ *\$ \?//; p}' \ | |
| > README.md.veracruz-ci-build.sh | |
| # run the script | |
| bash -euxo pipefail README.md.veracruz-ci-build.sh | |
| # Add current directory to $GITHUB_PATH | |
| echo "$GITHUB_WORKSPACE" >> $GITHUB_PATH | |
| - name: Download artifacts | |
| uses: actions/download-artifact@v3 | |
| with: | |
| name: linux_deployment_artifacts | |
| path: artifacts | |
| - name: Post-process artifacts | |
| run: | | |
| chmod -R 755 artifacts | |
| # Add artifacts to $GITHUB_PATH | |
| echo "artifacts" >> $GITHUB_PATH | |
| - name: Download example video | |
| run: | | |
| # grab every bash code block for this step, remove line continuation, | |
| # and only keep lines that start with '$' (of course removing that '$' | |
| # in the process) | |
| sed -n '/```.*veracruz-ci-video/,/```/{/```/d; p}' README.md \ | |
| | sed ':a; /\\$/{N; s/\\\n//; ta}' \ | |
| | sed -n '/^ *\$/{s/^ *\$ \?//; p}' \ | |
| > README.md.veracruz-ci-video.sh | |
| # run the script | |
| bash -euxo pipefail README.md.veracruz-ci-video.sh | |
| - name: Replace big YOLO model with small one | |
| run: | | |
| cd program_data | |
| ln -sf yolov3-tiny.cfg yolov3.cfg | |
| ln -sf yolov3-tiny.weights yolov3.weights | |
| - name: Run VOD as standalone native binary | |
| run: | | |
| # grab every bash code block for this step, remove line continuation, | |
| # and only keep lines that start with '$' (of course removing that '$' | |
| # in the process) | |
| sed -n '/```.*veracruz-ci-run-native/,/```/{/```/d; p}' README.md \ | |
| | sed ':a; /\\$/{N; s/\\\n//; ta}' \ | |
| | sed -n '/^ *\$/{s/^ *\$ \?//; p}' \ | |
| > README.md.veracruz-ci-run-native.sh | |
| # run the script | |
| bash -euxo pipefail README.md.veracruz-ci-run-native.sh | |
| # Check results | |
| file output/prediction.0.jpg | grep "JPEG image data" | |
| rm -rf output | |
| - name: Run VOD in wasmtime | |
| run: | | |
| # Install wasmtime | |
| curl https://wasmtime.dev/install.sh -sSf | bash -s -- --version $WASMTIME_VERSION && \ | |
| . ~/.bashrc | |
| # grab every bash code block for this step, remove line continuation, | |
| # and only keep lines that start with '$' (of course removing that '$' | |
| # in the process) | |
| sed -n '/```.*veracruz-ci-run-wasmtime/,/```/{/```/d; p}' README.md \ | |
| | sed ':a; /\\$/{N; s/\\\n//; ta}' \ | |
| | sed -n '/^ *\$/{s/^ *\$ \?//; p}' \ | |
| > README.md.veracruz-ci-run-wasmtime.sh | |
| # run the script | |
| bash -euxo pipefail README.md.veracruz-ci-run-wasmtime.sh | |
| # Check results | |
| file output/prediction.0.jpg | grep "JPEG image data" | |
| rm -rf output | |
| - name: Run VOD in Freestanding Execution Engine | |
| run: | | |
| # grab every bash code block for this step, remove line continuation, | |
| # and only keep lines that start with '$' (of course removing that '$' | |
| # in the process) | |
| sed -n '/```.*veracruz-ci-run-fee/,/```/{/```/d; p}' README.md \ | |
| | sed ':a; /\\$/{N; s/\\\n//; ta}' \ | |
| | sed -n '/^ *\$/{s/^ *\$ \?//; p}' \ | |
| > README.md.veracruz-ci-run-fee.sh | |
| # run the script | |
| bash -euxo pipefail README.md.veracruz-ci-run-fee.sh | |
| # Check results | |
| file output/prediction.0.jpg | grep "JPEG image data" | |
| rm -rf output | |
| - name: Run VOD in Veracruz-Linux | |
| run: | | |
| POLICY_GENERATOR_PATH="artifacts/generate-policy" CLIENT_PATH="artifacts/veracruz-client" SERVER_PATH="artifacts/linux-veracruz-server" RUNTIME_MANAGER_PATH="artifacts/linux-runtime-manager" CA_CERT_CONF_PATH="artifacts/ca-cert.conf" CERT_CONF_PATH="artifacts/cert.conf" PROXY_CLEANUP_SCRIPT_PATH="artifacts/proxy_cleanup.sh" SERVER_LOG="server.log" POLICY_PATH="policy.json" ./deploy_linux_wasm.sh | |
| # Check results | |
| file prediction.0.jpg | grep "JPEG image data" | |
| - name: Upload VOD artifacts | |
| id: upload-vod-artifacts | |
| uses: actions/upload-artifact@v3 | |
| with: | |
| name: linux-vod | |
| path: | | |
| policy.json | |
| server.log | |
| nitro: | |
| runs-on: ubuntu-latest | |
| needs: [check] | |
| outputs: | |
| output: ${{ steps.check-diff.outputs.cargo-lock }} | |
| container: | |
| image: ghcr.io/veracruz-project/veracruz/ci@sha256:681ceebcae7f23fb60bb6c5b903600e134fd4852f0187539d995ced444f382d6 | |
| volumes: | |
| - ${{ github.workspace }}:/work/veracruz | |
| steps: | |
| - name: Check out the Veracruz repository | |
| uses: actions/checkout@v3 | |
| with: | |
| submodules: recursive | |
| - name: add the GITHUB_WORKSPACE into git config | |
| run: | | |
| git config --global --add safe.directory "$GITHUB_WORKSPACE" | |
| - name: Running Nitro test script | |
| id: nitro-build | |
| run: | | |
| make -C /work/veracruz/workspaces nitro | |
| - name: Check modification to Cargo.lock | |
| id: check-diff | |
| run: | | |
| file_changed=$(git diff --diff-filter=ACMUXTRD --name-only -- '**Cargo.lock' | tr '\n' ' ' | xargs) | |
| echo "cargo-lock=$file_changed" >> $GITHUB_OUTPUT | |
| if [ -n "$file_changed" ] ; then | |
| echo "::warning::Cargo.lock files modified"; | |
| echo "::warning::Cargo.lock change list: ${{ steps.check-diff.outputs.cargo-lock }}"; | |
| fi | |
| - name: Upload Cargo.lock files | |
| id: upload-changed-cargo-lock | |
| if: steps.check-diff.outputs.cargo-lock != '' | |
| uses: actions/upload-artifact@v3 | |
| with: | |
| name: nitro | |
| path: workspaces/**/Cargo.lock | |
| # tests that the docs/CLI_QUICKSTART.md is still up to date | |
| quickstart: | |
| runs-on: ubuntu-latest | |
| needs: [check] | |
| outputs: | |
| output: ${{ steps.check-diff.outputs.cargo-lock }} | |
| container: | |
| image: ghcr.io/veracruz-project/veracruz/ci@sha256:681ceebcae7f23fb60bb6c5b903600e134fd4852f0187539d995ced444f382d6 | |
| volumes: | |
| - ${{ github.workspace }}:/work/veracruz | |
| steps: | |
| - name: Check out the Veracruz repository | |
| uses: actions/checkout@v3 | |
| with: | |
| submodules: recursive | |
| - name: add the GITHUB_WORKSPACE into git config | |
| run: | | |
| git config --global --add safe.directory "$GITHUB_WORKSPACE" | |
| - name: Running docs/CLI_QUICKSTART.md | |
| id: quickstart-test | |
| run: | | |
| # grab every bash code block, remove line continuation, and only keep lines | |
| # that start with '$' (of course removing that '$' in the process) | |
| sed -n '/``` bash/,/```/{/```/d; p}' docs/CLI_QUICKSTART.md \ | |
| | sed ':a; /\\$/{N; s/\\\n//; ta}' \ | |
| | sed -n '/^\$/{s/^\$ \?//; p}' \ | |
| > CLI_QUICKSTART.md.sh | |
| # run the quickstart | |
| bash -euxo pipefail CLI_QUICKSTART.md.sh | |
| - name: Running tlstest/README.md | |
| id: tlstest | |
| run: | | |
| # Extract and execute bash code blocks from README.md: | |
| cd crates/tests/tlstest && \ | |
| sed -n '/``` bash/,/```/{/```/d; p}' README.md > README.md.sh && \ | |
| bash -euxo pipefail README.md.sh | |
| - name: Check modification to Cargo.lock | |
| id: check-diff | |
| run: | | |
| file_changed=$(git diff --diff-filter=ACMUXTRD --name-only -- '**Cargo.lock' | tr '\n' ' ' | xargs) | |
| echo "cargo-lock=$file_changed" >> $GITHUB_OUTPUT | |
| if [ -n "$file_changed" ] ; then | |
| echo "::warning::Cargo.lock files modified"; | |
| echo "::warning::Cargo.lock change list: ${{ steps.check-diff.outputs.cargo-lock }}"; | |
| fi | |
| - name: Upload Cargo.lock files | |
| id: upload-changed-cargo-lock | |
| if: steps.check-diff.outputs.cargo-lock != '' | |
| uses: actions/upload-artifact@v3 | |
| with: | |
| name: quickstart | |
| path: workspaces/**/Cargo.lock | |
| cargo-lock-check: | |
| needs: [linux, nitro, quickstart] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: linux | |
| if: needs.linux.outputs.output != '' | |
| run: | | |
| echo "::warning:: linux Cargo.lock change list: ${{ needs.linux.outputs.output }}" | |
| exit 1 | |
| - name: nitro | |
| if: needs.nitro.outputs.output != '' | |
| run: | | |
| echo "::warning:: nitro Cargo.lock change list: ${{ needs.nitro.outputs.output }}" | |
| exit 1 | |
| - name: quickstart | |
| if: needs.quickstart.outputs.output != '' | |
| run: | | |
| echo "::warning:: quickstart Cargo.lock change list: ${{ needs.quickstart.outputs.output }}" | |
| exit 1 |