fix(sconify)!: output debug-image-tag and prod-image-tag instead of debug-image and prod-image

PierreJeanjacquot · PierreJeanjacquot · commit 470f0b53f30e · 2025-07-10T15:55:14.000+02:00
diff --git a/.github/workflows/sconify.yml b/.github/workflows/sconify.yml
@@ -80,18 +80,18 @@ on:
         description: "Signing Key for Scone Production (not required with `sconify-prod: false`)"
         required: false
     outputs:
-      debug-image:
-        description: "Debug Sconified Image"
-        value: ${{ jobs.build.outputs.debug-image }}
+      debug-image-tag:
+        description: "Debug Sconified Image Tag"
+        value: ${{ jobs.build.outputs.debug-image-tag }}
       debug-mrenclave:
         description: "Debug Sconified Image MrEnclave Fingerprint"
         value: ${{ jobs.build.outputs.debug-mrenclave }}
       debug-checksum:
         description: "Debug Sconified Image Checksum"
         value: ${{ jobs.build.outputs.debug-checksum }}
-      prod-image:
-        description: "Prod Sconified Image"
-        value: ${{ jobs.build.outputs.prod-image }}
+      prod-image-tag:
+        description: "Prod Sconified Image Tag"
+        value: ${{ jobs.build.outputs.prod-image-tag }}
       prod-mrenclave:
         description: "Prod Sconified Image MrEnclave Fingerprint"
         value: ${{ jobs.build.outputs.prod-mrenclave }}
@@ -103,10 +103,10 @@ jobs:
   build:
     runs-on: ${{ inputs.runner }}
     outputs:
-      debug-image: ${{ steps.push-debug.outputs.image }}
+      debug-image-tag: ${{ steps.push-debug.outputs.tag }}
       debug-mrenclave: ${{ steps.push-debug.outputs.mrenclave }}
       debug-checksum: ${{ steps.push-debug.outputs.checksum }}
-      prod-image: ${{ steps.push-prod.outputs.image }}
+      prod-image-tag: ${{ steps.push-prod.outputs.tag }}
       prod-mrenclave: ${{ steps.push-prod.outputs.mrenclave }}
       prod-checksum: ${{ steps.push-prod.outputs.checksum }}
     steps:
@@ -116,17 +116,19 @@ jobs:
       - name: Prepare Sconify Command
         id: prepare-command
         run: |
-          FROM_IMAGE=${{ inputs.docker-registry }}/${{ inputs.image-name }}:${{ inputs.image-tag }}
-          DEBUG_IMAGE=$FROM_IMAGE-scone-debug-${{ inputs.sconify-version }}
-          echo "debug-image=$DEBUG_IMAGE"
-          echo "debug-image=$DEBUG_IMAGE" >> "$GITHUB_OUTPUT"
-          PROD_IMAGE=$FROM_IMAGE-scone-prod-${{ inputs.sconify-version }}
-          echo "prod-image=$PROD_IMAGE"
-          echo "prod-image=$PROD_IMAGE" >> "$GITHUB_OUTPUT"
+          IMAGE_REPO=${{ inputs.docker-registry }}/${{ inputs.image-name }}
+          DEBUG_IMAGE_TAG=${{ inputs.image-tag }}-scone-debug-${{ inputs.sconify-version }}
+          PROD_IMAGE_TAG=${{ inputs.image-tag }}-scone-prod-${{ inputs.sconify-version }}
+
+          echo "image-repo=$IMAGE_REPO" | tee -a "$GITHUB_OUTPUT"
+          echo "debug-image-tag=$DEBUG_IMAGE_TAG" | tee -a "$GITHUB_OUTPUT"
+          echo "prod-image-tag=$PROD_IMAGE_TAG" | tee -a "$GITHUB_OUTPUT"
+
+          # Prepare the base command for sconify
           SCONIFY_CMD="sconify_iexec"
           # REQUIRED:
           # --from
-          SCONIFY_CMD+=" --from=$FROM_IMAGE"
+          SCONIFY_CMD+=" --from=$IMAGE_REPO:${{ inputs.image-tag }}"
           # --to will be added later on
           # --binary
           SCONIFY_CMD+=" --binary=${{ inputs.binary }}"
@@ -152,8 +154,8 @@ jobs:
           # DEBUG
           # --verbose --no-color options
           SCONIFY_CMD+=" --verbose --no-color"
-          echo "sconify-base-command=$SCONIFY_CMD"
-          echo "sconify-base-command=$SCONIFY_CMD" >> "$GITHUB_OUTPUT"
+
+          echo "sconify-base-command=$SCONIFY_CMD" | tee -a "$GITHUB_OUTPUT"
 
       - name: Login to Docker Registry
         uses: docker/login-action@v3
@@ -183,16 +185,16 @@ jobs:
           -v /var/run/docker.sock:/var/run/docker.sock \
           registry.scontain.com/scone-production/iexec-sconify-image:${{ inputs.sconify-version }} \
           ${{ steps.prepare-command.outputs.sconify-base-command }} \
-          --to=${{ steps.prepare-command.outputs.debug-image }}
+          --to=${{ steps.prepare-command.outputs.image-repo }}:${{ steps.prepare-command.outputs.debug-image-tag }}
 
       - name: Push Debug Image
         if: ${{ inputs.sconify-debug }}
         id: push-debug
         run: |
-          docker push ${{ steps.prepare-command.outputs.debug-image }}
-          echo "image=${{ steps.prepare-command.outputs.debug-image }}" >> "$GITHUB_OUTPUT"
-          echo "checksum=0x$(docker image inspect ${{ steps.prepare-command.outputs.debug-image }} | jq .[0].RepoDigests[0] | sed 's/"//g' | awk -F '@sha256:' '{print $2}')" >> "$GITHUB_OUTPUT"
-          echo "mrenclave=$(docker run --rm -e SCONE_HASH=1 ${{ steps.prepare-command.outputs.debug-image }})" >> "$GITHUB_OUTPUT"
+          docker push ${{ steps.prepare-command.outputs.image-repo }}:${{ steps.prepare-command.outputs.debug-image-tag }}
+          echo "tag=${{ steps.prepare-command.outputs.debug-image-tag }}" | tee -a "$GITHUB_OUTPUT"
+          echo "checksum=0x$(docker image inspect ${{ steps.prepare-command.outputs.image-repo }}:${{ steps.prepare-command.outputs.debug-image-tag }} | jq .[0].RepoDigests[0] | sed 's/"//g' | awk -F '@sha256:' '{print $2}')" | tee -a "$GITHUB_OUTPUT"
+          echo "mrenclave=$(docker run --rm -e SCONE_HASH=1 ${{ steps.prepare-command.outputs.image-repo }}:${{ steps.prepare-command.outputs.debug-image-tag }})" | tee -a "$GITHUB_OUTPUT"
 
       - name: Sconify Image Prod
         if: ${{ inputs.sconify-prod }}
@@ -212,10 +214,10 @@ jobs:
         if: ${{ inputs.sconify-prod }}
         id: push-prod
         run: |
-          docker push ${{ steps.prepare-command.outputs.prod-image }}
-          echo "image=${{ steps.prepare-command.outputs.prod-image }}" >> "$GITHUB_OUTPUT"
-          echo "checksum=0x$(docker image inspect ${{ steps.prepare-command.outputs.prod-image }} | jq .[0].RepoDigests[0] | sed 's/"//g' | awk -F '@sha256:' '{print $2}')" >> "$GITHUB_OUTPUT"
-          echo "mrenclave=$(docker run --rm -e SCONE_HASH=1 ${{ steps.prepare-command.outputs.prod-image }})" >> "$GITHUB_OUTPUT"
+          docker push ${{ steps.prepare-command.outputs.image-repo }}:${{ steps.prepare-command.outputs.prod-image-tag }}
+          echo "tag=${{ steps.prepare-command.outputs.prod-image-tag }}" | tee -a "$GITHUB_OUTPUT"
+          echo "checksum=0x$(docker image inspect ${{ steps.prepare-command.outputs.prod-image }} | jq .[0].RepoDigests[0] | sed 's/"//g' | awk -F '@sha256:' '{print $2}')" | tee -a "$GITHUB_OUTPUT"
+          echo "mrenclave=$(docker run --rm -e SCONE_HASH=1 ${{ steps.prepare-command.outputs.prod-image }})" | tee -a "$GITHUB_OUTPUT"
 
       - name: Clean Temporary Directory
         if: always()
diff --git a/sconify/README.md b/sconify/README.md
@@ -59,10 +59,10 @@ The workflow performs the following actions:
 
 | **Output**          | **Description**                                                                    |
 | ------------------- | ---------------------------------------------------------------------------------- |
-| **debug-image**     | Debug Sconified Image (unless `inputs.sconify-debug: false`)                       |
+| **debug-image-tag** | Debug Sconified Image Tag (unless `inputs.sconify-debug: false`)                   |
 | **debug-mrenclave** | Debug Sconified Image MrEnclave Fingerprint (unless `inputs.sconify-debug: false`) |
 | **debug-checksum**  | Debug Sconified Image Checksum (unless `inputs.sconify-debug: false`)              |
-| **prod-image**      | Prod Sconified Image (unless `inputs.sconify-prod: false`)                         |
+| **prod-image-tag**  | Prod Sconified Image Tag (unless `inputs.sconify-prod: false`)                     |
 | **prod-mrenclave**  | Prod Sconified Image MrEnclave Fingerprint (unless `inputs.sconify-prod: false`)   |
 | **prod-checksum**   | Prod Sconified Image Checksum (unless `inputs.sconify-prod: false`)                |
 
@@ -127,8 +127,8 @@ jobs:
     needs: sconify
     steps:
       - run: |
-          echo "DEBUG IMAGE INFO: image=${{ needs.sconify.outputs.debug-image }} | checksum=${{ needs.sconify.outputs.debug-checksum }} | mrenclave=${{ needs.sconify.outputs.debug-mrenclave }}"
-          echo "PROD IMAGE INFO: image=${{ needs.sconify.outputs.prod-image }} | checksum=${{ needs.sconify.outputs.prod-checksum }} | mrenclave=${{ needs.sconify.outputs.prod-mrenclave }}"
+          echo "DEBUG IMAGE INFO: tag=${{ needs.sconify.outputs.debug-image-tag }} | checksum=${{ needs.sconify.outputs.debug-checksum }} | mrenclave=${{ needs.sconify.outputs.debug-mrenclave }}"
+          echo "PROD IMAGE INFO: tag=${{ needs.sconify.outputs.prod-image-tag }} | checksum=${{ needs.sconify.outputs.prod-checksum }} | mrenclave=${{ needs.sconify.outputs.prod-mrenclave }}"
 ```
 
 3. **Configure Secrets**  
