Repository navigation
feat(build): replace the shell pipeline and linuxkit with eiffel-build #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: [master] | |
| jobs: | |
| rust: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install the pinned toolchain | |
| run: rustup show active-toolchain || rustup toolchain install | |
| - run: cargo fmt --check | |
| - run: cargo clippy --all-targets --locked -- -D warnings | |
| - run: cargo test --workspace --locked | |
| image: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Build the eiffel image | |
| run: docker build -t eiffel:ci . | |
| - name: Build the customer example end to end | |
| run: make -C example eif EIFFEL_IMAGE=eiffel:ci | |
| - name: Check the expected outputs exist | |
| run: | | |
| set -eux | |
| cd example/bin | |
| test -s example.eif | |
| test -s example.pcrs.json | |
| sha256sum -c example.eif.sha256sum | |
| cat example.pcrs.json | |
| - name: Install QEMU | |
| id: qemu | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y --no-install-recommends qemu-system-x86 | |
| if qemu-system-x86_64 -M help | grep -q '^nitro-enclave'; then | |
| echo "available=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "::notice::qemu-system-x86_64 has no nitro-enclave machine type; skipping the boot test" | |
| echo "available=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Install vhost-device-vsock | |
| id: vsock | |
| if: steps.qemu.outputs.available == 'true' | |
| continue-on-error: true | |
| run: cargo install --locked vhost-device-vsock | |
| - name: Boot the example EIF under QEMU | |
| if: steps.qemu.outputs.available == 'true' && steps.vsock.outcome == 'success' | |
| run: .github/qemu-boot-test.sh example/bin/example.eif | |
| reproducible: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| # Everything measured into PCR0/PCR1 must be byte-identical across builds of the | |
| # same commit. eiffel-build itself is not measured and is not checked here. | |
| - name: Build the measured blobs twice from scratch | |
| run: | | |
| set -eux | |
| for run in 1 2; do | |
| docker build --no-cache --target kernel -t eiffel-kernel:$run . | |
| docker build --no-cache --target init -t eiffel-init-stage:$run . | |
| docker run --rm eiffel-kernel:$run sha256sum /out/bzImage | cut -d' ' -f1 > kernel.$run | |
| docker run --rm eiffel-init-stage:$run sha256sum /init | cut -d' ' -f1 > init.$run | |
| done | |
| diff kernel.1 kernel.2 | |
| diff init.1 init.2 |