Update tee-cd.yml

tlsnotary · Oct 9, 2024 · 06b60bf · 06b60bf
1 parent c9a90dc
commit 06b60bf
Showing 1 changed file with 69 additions and 58 deletions.
diff --git a/.github/workflows/tee-cd.yml b/.github/workflows/tee-cd.yml
@@ -1,6 +1,14 @@
 name: azure-tee-release
 
-on: workflow_dispatch
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'git branch'
+        required: false
+        default: 'dev'
+        type: string
+
 #on:
 #  release:
 #    types: [published]
@@ -17,34 +25,21 @@ jobs:
     runs-on: [self-hosted, linux]
     outputs:
       teeport: ${{ steps.portbump.outputs.newport}}
+      deploy: ${{ steps.portbump.outputs.deploy}}
     steps:
       - name: checkout repository
         uses: actions/checkout@v4
-      - name: apt
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y jq
       - name: update caddyfile
         id: portbump
         env:
-          RELEASE_TAG: ${{ github.event.release.tag_name }}
+          RELEASE_TAG: ${{ github.event.release.tag_name ||  inputs.ref }}
+
         run: |
-          NEXT_PORT=$(cd-scripts/azure/tee/updateproxy.sh 'cd-scripts/tee/azure/Caddyfile' $RELEASE_TAG)
+          NEXT_PORT=$(bash cd-scripts/tee/azure/updateproxy.sh 'cd-scripts/tee/azure/Caddyfile' $RELEASE_TAG)
           echo "newport=$NEXT_PORT" >> $GITHUB_OUTPUT
-      - name: Commit and push updated Caddyfile
-        env:
-          RELEASE_TAG: ${{ github.event.release.tag_name }}
-        run: |
-          handler=$RELEASE_TAG
-          if [ -z "${RELEASE_TAG}" ]; then
-            handler=dev
-          fi
-          git config user.name github-actions
-          git config user.email github-actions@github.com
-          git add .
-          git commit -m "azure tee release: ${handler}"
-          git push
+          
       - name: Deploy updated Caddyfile to server
+        if: ${{ steps.portbump.outputs.deploy == 'new' }}
         uses: appleboy/scp-action@v0.1.7
         with:
           host: ${{ secrets.AZURE_TEE_PROD_HOST }}
@@ -54,6 +49,8 @@ jobs:
           target: "~/"
 
       - name: Reload Caddy on server
+        if: ${{ steps.portbump.outputs.deploy == 'new' }}
+
         uses: appleboy/ssh-action@v1.0.3
         with:
           host: ${{ secrets.AZURE_TEE_PROD_HOST }}
@@ -95,44 +92,16 @@ jobs:
         - name: reverse proxy port
           run: echo "${{needs.update-reverse-proxy.outputs.teeport}}" | tee >> $GITHUB_STEP_SUMMARY
 
-        - name: get measurement
-          working-directory: ${{ github.workspace }}/crates/notary/server/fixture/tee
+        - name: get hardware measurement
+          working-directory: ${{ github.workspace }}/crates/notary/server/tee
           run: |
-             curl https://sh.rustup.rs -sSf | sh -s -- -y
-             . "$HOME/.cargo/env"
-             apt install libssl-dev
-             gramine-sgx-gen-private-key
-             make
-             gramine-sgx-sign -m notary-server.manifest -o notary-server.sgx
-             mr_enclave=$(gramine-sgx-sigstruct-view --verbose --output-format=json notary-server.sig |jq .mr_enclave)    
-             echo "mrenclave=$mr_enclave" >> "$GITHUB_OUTPUT"
-             echo "#### sgx mrenclave" | tee >> $GITHUB_STEP_SUMMARY
-             echo "\`\`\`${mr_enclave}\`\`\`" | tee >> $GITHUB_STEP_SUMMARY
-
-        - name: get quote from notary
-          working-directory: ${{ github.workspace }}/crates/notary/server/fixture/tee
-          id: attestation
-          run: |
-               SGX=1 make
-               gramine-sgx-sign -m notary-server.manifest -o notary-server.sgx
-               : # set up the fs like the hosted notary docker container:
-               mkdir config && cp config.yaml config && mkdir /tee && cp -R ../tee/* /tee/ && cd /tee && 
-               : # invoke sgx (use gramine-direct to emulate sgx hardware):
-               gramine-sgx notary-server &
-               sleep 5
-               quote=$(curl 127.0.0.1:7047/info | jq .quote.rawQuote)
-               echo $quote
-               echo "quote=$quote" >> $GITHUB_OUTPUT
-               echo "#### 🔒 signed quote ${quote}" | tee >> $GITHUB_STEP_SUMMARY
-               echo "${quote}" | tee >> $GITHUB_STEP_SUMMARY
-
-     
+             bash .github/scripts/gramine.sh sgx
+ 
   artifact-deploy:
+      if: ${{needs.update-reverse-proxy.outputs.deploy == 'new' }}
       environment: tee
       runs-on: [self-hosted, linux]
       needs: [ build-measure, update-reverse-proxy ]
-       # outputs:
-       # result: ${{ steps.artifact.outputs.hash}}
       steps:
         - name: auth to registry
           uses: docker/login-action@v3
@@ -159,16 +128,58 @@ jobs:
           name: Set up Docker Buildx
           uses: docker/setup-buildx-action@v3
         - name: Build and push
-
-
           uses: docker/build-push-action@v6
           with:
-            context: ${{ github.workspace }}/crates/notary/server/fixture/tee
-            # testing:
-            push: ${{ github.actor == 'maceip' }}
+            context: ${{ github.workspace }}/crates/notary/server/tee
+            push: true
             tags: notaryserverbuilds.azurecr.io/prod/notary-sgx:${{ env.GIT_COMMIT_HASH }}
             labels: ${{needs.update-reverse-proxy.outputs.teeport}}
         - name: run
           run: |
            docker run --device /dev/sgx_enclave --device /dev/sgx_provision --volume=/var/run/aesmd/aesm.socket:/var/run/aesmd/aesm.socket -p  ${{needs.update-reverse-proxy.outputs.teeport}}:7047 notaryserverbuilds.azurecr.io/prod/notary-sgx:${{ env.GIT_COMMIT_HASH }} &
+           
+  artifact-reload:
+      if: ${{needs.update-reverse-proxy.outputs.deploy != 'new' }}
+      environment: tee
+      runs-on: [self-hosted, linux]
+      needs: [ build-measure, update-reverse-proxy ]
+      steps:
+        - name: auth to registry
+          uses: docker/login-action@v3
+          with:
+            registry: notaryserverbuilds.azurecr.io
+            username: notaryserverbuilds
+            password: ${{ secrets.AZURE_CR_BUILDS_PW }}
+        - name: get code
+          uses: actions/checkout@v4
+          with:
+            repository: tlsnotary/tlsn
+            ref: quote-presentation
+        - name: sccache
+          if: github.event_name != 'release'
+          # && github.event_name != 'workflow_dispatch'
+          uses: mozilla-actions/sccache-action@v0.0.6
+        - name: set rust env for scc
+          if: github.event_name != 'release'
+          # && github.event_name != 'workflow_dispatch'
+          run: |
+            echo "SCCACHE_GHA_ENABLED=true" >> $GITHUB_ENV
+            echo "RUSTC_WRAPPER=sccache" >> $GITHUB_ENV
+        -
+          name: Set up Docker Buildx
+          uses: docker/setup-buildx-action@v3
+        - name: Build and push
+          uses: docker/build-push-action@v6
+          with:
+            context: ${{ github.workspace }}/crates/notary/server/tee
+            push: true
+            tags: notaryserverbuilds.azurecr.io/prod/notary-sgx:${{ env.GIT_COMMIT_HASH }}
+            labels: ${{needs.update-reverse-proxy.outputs.teeport}}
+        - name: run
+          run: |
+            old=$($ docker ps --filter "name=${{needs.update-reverse-proxy.outputs.teeport}}")
+            docker rm -f $old
+            docker run --name ${{needs.update-reverse-proxy.outputs.teeport}} --device /dev/sgx_enclave --device /dev/sgx_provision --volume=/var/run/aesmd/aesm.socket:/var/run/aesmd/aesm.socket -p  ${{needs.update-reverse-proxy.outputs.teeport}}:7047 notaryserverbuilds.azurecr.io/prod/notary-sgx:${{ env.GIT_COMMIT_HASH }} &
+      
+