ci: sgx ci/cd #631

maceip · 2024-10-09T10:39:20Z

ci: tee ci/cd to build and deploy sgx notary-server
Note: the cd script is temporary and should not live beyond 2024. I will replace the janky reverse proxy update.sh and docker kill / start logic with k8s / compose / helm

codecov · 2024-10-09T10:45:47Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 54.32%. Comparing base (61ff3a8) to head (90c495b).
Report is 4 commits behind head on dev.

Additional details and impacted files

@@            Coverage Diff             @@
##              dev     #631      +/-   ##
==========================================
- Coverage   54.40%   54.32%   -0.09%     
==========================================
  Files         191      192       +1     
  Lines       20454    20487      +33     
==========================================
+ Hits        11129    11130       +1     
- Misses       9325     9357      +32

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

cd-scripts/tee/azure/Caddyfile

heeckhau · 2024-10-09T11:47:47Z

.github/workflows/tee-ci.yml

+
+on:
+  push:
+    branches: [ "quote-presentation" ]


only for this branch?

heeckhau · 2024-10-09T11:49:27Z

.github/workflows/tee-ci.yml

+         run: ./target/release/notary-server --config-file /config.yml &
+       - uses: iFaxity/wait-on-action@v1
+         with:
+           resource: http-get://localhost:7047/info


Does anything need to happen to the result? Store or check maybe?

heeckhau · 2024-10-09T11:53:26Z

.github/workflows/tee-cd.yml

+          uses: actions/checkout@v4
+          with:
+            repository: tlsnotary/tlsn
+            ref: quote-presentation


Is this temporary?

heeckhau · 2024-10-09T12:29:53Z

.github/workflows/tee-cd.yml

+        - name: get measurement
+          working-directory: ${{ github.workspace }}/crates/notary/server/fixture/tee
+          run: |
+             curl https://sh.rustup.rs -sSf | sh -s -- -y


Move to script

heeckhau · 2024-10-09T12:32:17Z

.github/workflows/tee-cd.yml

+        - name: get code
+          uses: actions/checkout@v4
+          with:
+            repository: tlsnotary/tlsn


heeckhau · 2024-10-09T12:35:29Z

.github/workflows/tee-cd.yml

+          uses: docker/build-push-action@v6
+          with:
+            context: ${{ github.workspace }}/crates/notary/server/fixture/tee
+            # testing:


heeckhau · 2024-10-09T12:36:39Z

.github/workflows/tee-cd.yml

+            echo "RUSTC_WRAPPER=sccache" >> $GITHUB_ENV
+        -
+          name: Set up Docker Buildx
+          uses: docker/setup-buildx-action@v3


No need to add directory of dockerfile here? context argument?

yuroitaki

🚀 great stuff especially with the caddy reverse proxy! pretty much covered all the main features the current aws deployment setup has; the only missing piece is stopping the oldest version in the server upon a new release — currently we only maintain the 3 latest versions

yuroitaki · 2024-10-14T09:53:02Z

.github/workflows/tee-cd.yml

+
+env:
+  GIT_COMMIT_HASH: ${{ github.event.pull_request.head.sha || github.sha }}
+  GIT_COMMIT_TIMESTAMP: ${{ github.event.repository.updated_at}}


does github.event.repository.updated_at always refer to the timestamp of the head commit? It seems like the timestamp ll also be updated if someone updates e.g. the description of the repo (https://github.com/orgs/community/discussions/24442)

help me understand how you are using the timestamp value downstream

how would this workflow get triggered in a way where the timestamp value was wrong?

is someone updating the description not a relevant timestamp update?

The timestamp ll be returned as part of the /info endpoint:

{ "version": "0.1.0-alpha.7", "publicKey": "-----BEGIN PUBLIC KEY----- ...", "gitCommitHash": "99e02fb388c2e791d03c3426bd0411395bfaf453", "gitCommitTimestamp": "2024-10-14T20:23:19+02:00" }

It's just an extra metadata to let end user know 'when' the code running in the server was last updated, as it's the timestamp of "gitCommitHash", the head commit.

So ya it shouldn't be the timestamp when someone updates the repo description / create a wiki page some time after the head commit is committed.

yuroitaki · 2024-10-14T10:08:58Z

.github/workflows/tee-ci.yml

+        - name: get code
+          uses: actions/checkout@v4
+        - name: sccache
+          if: github.event_name != 'release'


tlsn release workflow is triggered by a push of the new version tag to GH upstream, so the event_name should be push instead, together with an extra tag check, i.e. if [ "${{ github.event_name }}" = "push" ] && [[ "${{ github.ref }}" = "refs/tags/"* ]]

the spirit of this line is to make sure caching is off if the event that triggered the workflow is 'release'. are you suggesting that this does not work?

cd-scripts/tee/azure/updateproxy.sh

yuroitaki · 2024-10-15T05:20:00Z

.github/workflows/tee-cd.yml

+      - name: update caddyfile
+        id: portbump
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name ||  inputs.ref }}


since we do tag push to trigger release, instead of github.event.release.tag_name, it should be $GITHUB_REF_NAME

why does github.event.release.tag_name not suffice here?

yuroitaki · 2024-10-15T05:57:14Z

.github/workflows/tee-cd.yml

+  GIT_COMMIT_TIMESTAMP: ${{ github.event.repository.updated_at}}
+
+jobs:
+  update-reverse-proxy:


can we add a check to ensure that these cd steps only run after the ci integration test passes, i.e. https://github.com/tlsnotary/tlsn/blob/main/.github/workflows/cd-server.yml#L47-L56

the trigger is on release publish, so implicity the ci step would have ran ? Or is there something im missing?

going to refactor this to be a core part of cd, needs more testing

initially this was built as a sidecar deployment, hence the trigger being post-release.

.github/workflows/tee-cd.yml

yuroitaki · 2024-10-16T06:02:35Z

For the other comments on the release trigger: instead of the release-triggered ci/cd approach, tlsn uses the tag-triggered approach — I think we prefer to ensure the new version is successfully deployed and running before the release is announced.

Anyway, as discussed yesterday in the meeting, since this tee-ci/cd will one day replace cd-server.yml (the current aws deployment), I think this ci/cd can just run upon successful completion of the ci.yml integration test job? like this

maceip · 2024-10-16T17:19:20Z

For the other comments on the release trigger: instead of the release-triggered ci/cd approach, tlsn uses the tag-triggered approach — I think we prefer to ensure the new version is successfully deployed and running before the release is announced.

Anyway, as discussed yesterday in the meeting, since this tee-ci/cd will one day replace cd-server.yml (the current aws deployment), I think this ci/cd can just run upon successful completion of the ci.yml integration test job? like this

100

i just commented somewhere above im refactoring it to fit in with cd.yml, and not as a sidecar/lesser cd -- needs more testing but will have a cut tmmrw and will ping you

heeckhau · 2024-10-22T09:32:21Z

.github/workflows/ci.yml

+    uses: ./.github/workflows/tee-cd.yml
+    with:
+      # what this is supposed to do -> $ref is the tag: e.g., v0.1.0-alpha.7; pass the $ref string to the cd script and update reverse proxy / deploy 


Suggested change

# what this is supposed to do -> $ref is the tag: e.g., v0.1.0-alpha.7; pass the $ref string to the cd script and update reverse proxy / deploy

# pass the $ref string to the cd script and update reverse proxy / deploy

# $ref is the tag: e.g., v0.1.0-alpha.7

heeckhau · 2024-10-22T09:34:03Z

.github/workflows/ci.yml

+          fail_ci_if_error: true
+  trigger-deployment:


Suggested change

trigger-deployment:

trigger-tee-deployment:

heeckhau · 2024-10-22T09:37:07Z

.github/workflows/tee-cd.yml

+#on:
+#  release:
+#    types: [published]
+#    branches:
+#      - 'releases/**'


remove or activate?

yuroitaki · 2024-10-22T11:01:20Z

.github/workflows/ci.yml

+          fail_ci_if_error: true
+  trigger-deployment:


wouldn't this deployment run everytime a PR is raised? as the trigger condition in this ci.yml is

on: push: branches: - dev tags: - "[v]?[0-9]+.[0-9]+.[0-9]+*" pull_request: ...

We can add this to the trigger-tee-deployment job:

# only for dev branch and tags if: github.event_name == 'push' && (startsWith(github.ref, 'refs/tags/') || github.ref == 'refs/heads/dev')

maceip added 3 commits October 9, 2024 12:06

ci for sgx

e166fef

+ cd

2e5dc2f

fix: bash var assign

15e45e8

maceip requested a review from yuroitaki October 9, 2024 10:39

yuroitaki requested a review from heeckhau October 9, 2024 10:41

heeckhau reviewed Oct 9, 2024

View reviewed changes

cd-scripts/tee/azure/Caddyfile Show resolved Hide resolved

Update Caddyfile

088bb44

heeckhau requested changes Oct 9, 2024

View reviewed changes

Update tee-ci.yml

c9a90dc

maceip had a problem deploying to tee October 9, 2024 20:13 — with GitHub Actions Failure

Update tee-cd.yml

06b60bf

maceip had a problem deploying to tee October 9, 2024 20:17 — with GitHub Actions Failure

Create gramine.sh

eb8d7e7

maceip had a problem deploying to tee October 9, 2024 20:20 — with GitHub Actions Failure

Update gramine.sh

863f183

maceip had a problem deploying to tee October 9, 2024 21:00 — with GitHub Actions Failure

Update tee-cd.yml

a1da7a4

maceip had a problem deploying to tee October 9, 2024 21:03 — with GitHub Actions Failure

yuroitaki reviewed Oct 15, 2024

View reviewed changes

Update updateproxy.sh

90c495b

maceip had a problem deploying to tee October 15, 2024 14:27 — with GitHub Actions Failure

Update ci.yml

ce8dcce

maceip had a problem deploying to tee October 21, 2024 15:21 — with GitHub Actions Failure

heeckhau approved these changes Oct 22, 2024

View reviewed changes

yuroitaki reviewed Oct 22, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci: sgx ci/cd #631

ci: sgx ci/cd #631

maceip commented Oct 9, 2024 •

edited

Loading

codecov bot commented Oct 9, 2024 •

edited

Loading

heeckhau Oct 9, 2024

heeckhau Oct 9, 2024

heeckhau Oct 9, 2024

heeckhau Oct 9, 2024

heeckhau Oct 9, 2024

heeckhau Oct 9, 2024

heeckhau Oct 9, 2024

yuroitaki left a comment •

edited

Loading

yuroitaki Oct 14, 2024

maceip Oct 15, 2024

yuroitaki Oct 16, 2024

yuroitaki Oct 14, 2024

maceip Oct 15, 2024

yuroitaki Oct 15, 2024

maceip Oct 15, 2024

yuroitaki Oct 15, 2024

maceip Oct 15, 2024

maceip Oct 16, 2024

yuroitaki commented Oct 16, 2024

maceip commented Oct 16, 2024

heeckhau Oct 22, 2024

heeckhau Oct 22, 2024

heeckhau Oct 22, 2024

yuroitaki Oct 22, 2024 •

edited

Loading

heeckhau Oct 22, 2024

	# what this is supposed to do -> $ref is the tag: e.g., v0.1.0-alpha.7; pass the $ref string to the cd script and update reverse proxy / deploy
	# pass the $ref string to the cd script and update reverse proxy / deploy
	# $ref is the tag: e.g., v0.1.0-alpha.7

ci: sgx ci/cd #631

Are you sure you want to change the base?

ci: sgx ci/cd #631

Conversation

maceip commented Oct 9, 2024 • edited Loading

codecov bot commented Oct 9, 2024 • edited Loading

Codecov Report

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

yuroitaki left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

yuroitaki commented Oct 16, 2024

maceip commented Oct 16, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

yuroitaki Oct 22, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

maceip commented Oct 9, 2024 •

edited

Loading

codecov bot commented Oct 9, 2024 •

edited

Loading

yuroitaki left a comment •

edited

Loading

yuroitaki Oct 22, 2024 •

edited

Loading