|
| 1 | +name: Run enclave tests on EC2 instance |
| 2 | + |
| 3 | +on: |
| 4 | + pull_request: |
| 5 | + branches: |
| 6 | + - "celo-integration*" |
| 7 | + push: |
| 8 | + branches: |
| 9 | + - "celo-integration*" |
| 10 | + workflow_dispatch: |
| 11 | + |
| 12 | +permissions: |
| 13 | + id-token: write |
| 14 | + contents: read |
| 15 | + |
| 16 | +jobs: |
| 17 | + enclave-tests-on-ec2: |
| 18 | + runs-on: ubuntu-latest |
| 19 | + |
| 20 | + steps: |
| 21 | + - uses: aws-actions/configure-aws-credentials@v4 |
| 22 | + name: configure aws credentials |
| 23 | + with: |
| 24 | + role-to-assume: arn:aws:iam::437720536533:role/github-optimism-espresso-integration-access |
| 25 | + role-duration-seconds: 10800 |
| 26 | + aws-region: us-east-2 |
| 27 | + |
| 28 | + - name: Set branch name |
| 29 | + run: | |
| 30 | + if [[ "${{ github.event_name }}" == "pull_request" ]]; then |
| 31 | + echo "BRANCH_NAME=${{ github.head_ref }}" >> $GITHUB_ENV |
| 32 | + else |
| 33 | + echo "BRANCH_NAME=${{ github.ref_name }}" >> $GITHUB_ENV |
| 34 | + fi |
| 35 | +
|
| 36 | + - name: Generate SSH key pair |
| 37 | + run: | |
| 38 | + ssh-keygen -t rsa -b 4096 -f temp_ssh_key -N "" |
| 39 | + echo "Generated SSH key:" |
| 40 | + cp temp_ssh_key.pub github-ec2-key.pub |
| 41 | + cp temp_ssh_key key.pem |
| 42 | + chmod 600 key.pem |
| 43 | +
|
| 44 | + - name: Delete old key pair with the same name if needed |
| 45 | + id: check_key |
| 46 | + run: | |
| 47 | + if aws ec2 describe-key-pairs --key-names github-key >/dev/null 2>&1; then |
| 48 | + aws ec2 delete-key-pair --key-name github-key |
| 49 | + fi |
| 50 | +
|
| 51 | + - name: Import SSH public key |
| 52 | + run: | |
| 53 | + aws ec2 import-key-pair --key-name github-key --public-key-material fileb://github-ec2-key.pub |
| 54 | +
|
| 55 | + - name: Get security group ID |
| 56 | + id: sg |
| 57 | + run: | |
| 58 | + SG_ID=$(aws ec2 describe-security-groups --filters Name=group-name,Values=default --query 'SecurityGroups[0].GroupId' --output text) |
| 59 | + echo "id=$SG_ID" >> $GITHUB_OUTPUT |
| 60 | +
|
| 61 | + - name: Allow tcp in security group |
| 62 | + run: | |
| 63 | + aws ec2 authorize-security-group-ingress \ |
| 64 | + --group-id ${{ steps.sg.outputs.id }} \ |
| 65 | + --protocol tcp \ |
| 66 | + --port 22 \ |
| 67 | + --cidr 0.0.0.0/0 || true |
| 68 | +
|
| 69 | + - name: Launch EC2 Instance |
| 70 | + id: ec2 |
| 71 | + run: | |
| 72 | + AMI_ID=ami-0fe972392d04329e1 |
| 73 | + INSTANCE_ID=$(aws ec2 run-instances \ |
| 74 | + --image-id "$AMI_ID" \ |
| 75 | + --count 1 \ |
| 76 | + --instance-type m6a.2xlarge \ |
| 77 | + --key-name github-key \ |
| 78 | + --security-group-ids ${{ steps.sg.outputs.id }} \ |
| 79 | + --block-device-mappings '[{"DeviceName":"/dev/xvda","Ebs":{"VolumeSize":100,"VolumeType":"gp3","DeleteOnTermination":true}}]' \ |
| 80 | + --enclave-options 'Enabled=true' \ |
| 81 | + --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=GitHubRunner}]' \ |
| 82 | + --output text \ |
| 83 | + --query 'Instances[0].InstanceId') |
| 84 | +
|
| 85 | + echo "INSTANCE_ID=$INSTANCE_ID" >> $GITHUB_ENV |
| 86 | +
|
| 87 | + - name: Wait for instance to be running |
| 88 | + run: | |
| 89 | + aws ec2 wait instance-status-ok --instance-ids $INSTANCE_ID |
| 90 | +
|
| 91 | + - name: Get EC2 Public DNS |
| 92 | + id: dns |
| 93 | + run: | |
| 94 | + DNS=$(aws ec2 describe-instances --instance-ids $INSTANCE_ID \ |
| 95 | + --query 'Reservations[0].Instances[0].PublicDnsName' --output text) |
| 96 | + echo "DNS=$DNS" >> $GITHUB_ENV |
| 97 | + echo "dns=$DNS" >> $GITHUB_OUTPUT |
| 98 | +
|
| 99 | + - name: Install dependencies |
| 100 | + run: | |
| 101 | + echo "Current branch: $BRANCH_NAME" |
| 102 | + ssh -o StrictHostKeyChecking=no -i key.pem ec2-user@$DNS << EOF |
| 103 | + set -e |
| 104 | + sh <(curl --proto '=https' --tlsv1.2 -L https://nixos.org/nix/install) --daemon |
| 105 | + source ~/.bashrc |
| 106 | + mkdir -p ~/.config/nix |
| 107 | + echo "experimental-features = nix-command flakes" >> ~/.config/nix/nix.conf |
| 108 | + sudo yum update |
| 109 | + sudo yum install git -y |
| 110 | + sudo yum install docker -y |
| 111 | + sudo amazon-linux-extras install aws-nitro-enclaves-cli -y |
| 112 | + git clone https://github.com/EspressoSystems/optimism-espresso-integration.git |
| 113 | + cd optimism-espresso-integration |
| 114 | + git checkout "$BRANCH_NAME" |
| 115 | + git submodule update --init --recursive |
| 116 | + nix develop |
| 117 | + EOF |
| 118 | +
|
| 119 | + - name: Configure and start enclave service |
| 120 | + run: | |
| 121 | + ssh -o StrictHostKeyChecking=no -i key.pem ec2-user@$DNS << 'EOF' |
| 122 | + set -e |
| 123 | + sudo nitro-cli --version |
| 124 | + sudo systemctl stop nitro-enclaves-allocator.service |
| 125 | + echo -e '---\nmemory_mib: 4096\ncpu_count: 2' | sudo tee /etc/nitro_enclaves/allocator.yaml |
| 126 | + sudo systemctl start nitro-enclaves-allocator.service |
| 127 | + EOF |
| 128 | +
|
| 129 | + - name: Start docker service |
| 130 | + run: | |
| 131 | + ssh -o StrictHostKeyChecking=no -i key.pem ec2-user@$DNS << 'EOF' |
| 132 | + set -e |
| 133 | + sudo usermod -a -G docker ec2-user |
| 134 | + sudo service docker start |
| 135 | + sudo chown ec2-user /var/run/docker.sock |
| 136 | + EOF |
| 137 | +
|
| 138 | + # Compile contracts first to avoid text file busy error |
| 139 | + - name: Run tests |
| 140 | + run: | |
| 141 | + ssh -o StrictHostKeyChecking=no -o ServerAliveInterval=60 -o ServerAliveCountMax=5 -i key.pem ec2-user@$DNS << 'EOF' |
| 142 | + set -e |
| 143 | + cd /home/ec2-user/optimism-espresso-integration |
| 144 | + nix develop --command just compile-contracts |
| 145 | + nix develop --command just espresso-enclave-tests |
| 146 | + EOF |
| 147 | +
|
| 148 | + - name: Terminate EC2 instance |
| 149 | + if: ${{ always() }} |
| 150 | + run: | |
| 151 | + aws ec2 terminate-instances --instance-ids $INSTANCE_ID |
| 152 | + aws ec2 wait instance-terminated --instance-ids $INSTANCE_ID |
0 commit comments