Skip to content

Commit b9727b1

Browse files
PierreJeanjacquotPierreJeanjacquot
committed
feat: add sconify workflow
1 parent 298adeb commit b9727b1

File tree

2 files changed

+325
-0
lines changed

2 files changed

+325
-0
lines changed

‎.github/workflows/sconify.yml‎

Lines changed: 185 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,185 @@
1+
name: Build, Test and Push Docker Image
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
image-name:
7+
description: "Name of Docker Image to Sconify"
8+
type: string
9+
required: true
10+
image-tag:
11+
description: "Tag of Docker Image to Sconify"
12+
type: string
13+
required: true
14+
docker-registry:
15+
description: "Docker Registry of Docker Image to Sconify"
16+
default: "docker.io"
17+
type: string
18+
sconify-version:
19+
description: "Version of the Sconify Image to use"
20+
type: string
21+
required: true
22+
fs-dir:
23+
type: string
24+
description: "File System Directory to Protect"
25+
required: true
26+
binary:
27+
type: string
28+
description: "Path to the Binary to Protect"
29+
required: true
30+
command:
31+
type: string
32+
description: "Command to Protect"
33+
required: true
34+
heap:
35+
type: string
36+
default: "1G"
37+
description: "Enclave Heap size (default 1G)"
38+
dlopen:
39+
type: number
40+
default: 1
41+
description: "dlopen mode (default 1)"
42+
sconify-debug:
43+
description: "Create Scone Debug image (default true)"
44+
default: true
45+
type: boolean
46+
sconify-prod:
47+
description: "Create Scone Production image (default true)"
48+
default: true
49+
type: boolean
50+
docker-username:
51+
type: string
52+
description: "Docker Registry Username"
53+
required: true
54+
scontain-username:
55+
type: string
56+
description: "Scontain Registry Username"
57+
required: true
58+
secrets:
59+
docker-password:
60+
description: "Docker Registry Password or Token"
61+
required: true
62+
scontain-password:
63+
description: "Scontain Registry Password or Token"
64+
required: true
65+
scone-signing-key:
66+
description: "Signing Key for Scone Production (not required with `sconify-prod: false`)"
67+
required: false
68+
outputs:
69+
debug-image:
70+
description: "Debug Sconified Image"
71+
value: ${{ jobs.build.outputs.debug-image }}
72+
debug-mrenclave:
73+
description: "Debug Sconified Image MrEnclave Fingerprint"
74+
value: ${{ jobs.build.outputs.debug-mrenclave }}
75+
debug-checksum:
76+
description: "Debug Sconified Image Checksum"
77+
value: ${{ jobs.build.outputs.debug-checksum }}
78+
prod-image:
79+
description: "Prod Sconified Image"
80+
value: ${{ jobs.build.outputs.prod-image }}
81+
prod-mrenclave:
82+
description: "Prod Sconified Image MrEnclave Fingerprint"
83+
value: ${{ jobs.build.outputs.prod-mrenclave }}
84+
prod-checksum:
85+
description: "Prod Sconified Image Checksum"
86+
value: ${{ jobs.build.outputs.prod-checksum }}
87+
88+
jobs:
89+
build:
90+
runs-on: ubuntu-latest
91+
env:
92+
FROM_IMAGE: ${{ inputs.docker-registry }}/${{ inputs.image-name }}:${{ inputs.image-tag }}
93+
DEBUG_IMAGE: ${{ inputs.docker-registry }}/${{ inputs.image-name }}:${{ inputs.image-tag }}-scone-debug-${{ inputs.sconify-version }}
94+
PROD_IMAGE: ${{ inputs.docker-registry }}/${{ inputs.image-name }}:${{ inputs.image-tag }}-scone-prod-${{ inputs.sconify-version }}
95+
outputs:
96+
debug-image: ${{ steps.push-debug.outputs.image }}
97+
debug-mrenclave: ${{ steps.push-debug.outputs.mrenclave }}
98+
debug-checksum: ${{ steps.push-debug.outputs.checksum }}
99+
prod-image: ${{ steps.push-prod.outputs.image }}
100+
prod-mrenclave: ${{ steps.push-prod.outputs.mrenclave }}
101+
prod-checksum: ${{ steps.push-prod.outputs.checksum }}
102+
steps:
103+
- name: Login to Docker Registry
104+
uses: docker/login-action@v3
105+
with:
106+
registry: ${{ inputs.docker-registry }}
107+
username: ${{ inputs.docker-username }}
108+
password: ${{ secrets.docker-password }}
109+
110+
- name: Login to Scontain Docker Registry
111+
uses: docker/login-action@v3
112+
with:
113+
registry: "registry.scontain.com"
114+
username: ${{ inputs.scontain-username }}
115+
password: ${{ secrets.scontain-password }}
116+
117+
- name: Pull Image to Sconify
118+
run: docker pull ${{ inputs.docker-registry }}/${{ inputs.image-name }}:${{ inputs.image-tag }}
119+
120+
- name: Pull Sconify Image
121+
run: docker pull registry.scontain.com/scone-production/iexec-sconify-image:${{ inputs.sconify-version }}
122+
123+
- name: Sconify Image Debug
124+
if: ${{ inputs.sconify-debug }}
125+
run: |
126+
docker run \
127+
--rm \
128+
-v /var/run/docker.sock:/var/run/docker.sock \
129+
registry.scontain.com/scone-production/iexec-sconify-image:${{ inputs.sconify-version }} \
130+
sconify_iexec \
131+
--from=$FROM_IMAGE \
132+
--to=$DEBUG_IMAGE \
133+
--binary-fs \
134+
--fs-dir=${{ inputs.fs-dir }} \
135+
--host-path=/etc/hosts \
136+
--host-path=/etc/resolv.conf \
137+
--binary=${{ inputs.binary }} \
138+
--heap=${{ inputs.heap }} \
139+
--dlopen=${{ inputs.dlopen }} \
140+
--no-color \
141+
--verbose \
142+
--command="${{ inputs.command }}"
143+
144+
- name: Push Debug Image
145+
if: ${{ inputs.sconify-debug }}
146+
id: push-debug
147+
run: |
148+
docker push $DEBUG_IMAGE
149+
echo "image=$DEBUG_IMAGE" >> "$GITHUB_OUTPUT"
150+
echo "checksum=$(docker image inspect $DEBUG_IMAGE | jq .[0].RepoDigests[0] | sed 's/"//g' | awk -F '@sha256:' '{print $2}')" >> "$GITHUB_OUTPUT"
151+
echo "mrenclave=$(docker run --rm -e SCONE_HASH=1 $DEBUG_IMAGE)" >> "$GITHUB_OUTPUT"
152+
153+
- name: Sconify Image Prod
154+
if: ${{ inputs.sconify-prod }}
155+
run: |
156+
mkdir -p $HOME/sig
157+
echo "${{ secrets.scone-signing-key }}" > $HOME/sig/enclave-key.pem
158+
docker run \
159+
--rm \
160+
-v /var/run/docker.sock:/var/run/docker.sock \
161+
-v $HOME/sig/enclave-key.pem:/sig/enclave-key.pem \
162+
registry.scontain.com/scone-production/iexec-sconify-image:${{ inputs.sconify-version }} \
163+
sconify_iexec \
164+
--from=$FROM_IMAGE \
165+
--to=$PROD_IMAGE \
166+
--binary-fs \
167+
--fs-dir=${{ inputs.fs-dir }} \
168+
--host-path=/etc/hosts \
169+
--host-path=/etc/resolv.conf \
170+
--binary=${{ inputs.binary }} \
171+
--heap=${{ inputs.heap }} \
172+
--dlopen=${{ inputs.dlopen }} \
173+
--no-color \
174+
--verbose \
175+
--command="${{ inputs.command }}" \
176+
--scone-signer=/sig/enclave-key.pem
177+
178+
- name: Push Prod Image
179+
if: ${{ inputs.sconify-prod }}
180+
id: push-prod
181+
run: |
182+
docker push $PROD_IMAGE
183+
echo "image=$PROD_IMAGE" >> "$GITHUB_OUTPUT"
184+
echo "checksum=$(docker image inspect $PROD_IMAGE | jq .[0].RepoDigests[0] | sed 's/"//g' | awk -F '@sha256:' '{print $2}')" >> "$GITHUB_OUTPUT"
185+
echo "mrenclave=$(docker run --rm -e SCONE_HASH=1 $PROD_IMAGE)" >> "$GITHUB_OUTPUT"

‎sconify/README.md‎

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
# Sconify - Reusable Workflow Documentation 🚀
2+
3+
## Overview 🌟
4+
5+
This reusable GitHub Actions workflow automates the process of sconifying a Docker image. It is configurable via inputs for the Sconification options and secrets for docker registries credentials and production enclave signing key.
6+
7+
The workflow performs the following actions:
8+
9+
- **Login to Docker Registry**
10+
- **Login to Scontain Docker Registry**
11+
- **Pull Image to Sconify** from Docker Registry
12+
- **Pull Sconify Image** from Scontain Docker Registry
13+
- [unless input `sconify-debug: false`]
14+
- **Sconify Image Debug**
15+
- **Push Debug Image** to Docker Registry and prepare outputs (`debug-image`,`debug-mrenclave`,`debug-checksum`)
16+
- [unless input `sconify-prod: false`]
17+
- **Sconify Image Prod**
18+
- **Push Prod Image** to Docker Registry and prepare outputs (`prod-image`,`prod-mrenclave`,`prod-checksum`)
19+
20+
## Workflow Inputs 🛠️
21+
22+
| **Input** | **Description** | **Required** | **Default** |
23+
| --------------------- | ------------------------------------------ | ------------ | ----------- |
24+
| **docker-username** | Docker Registry Username | Yes | - |
25+
| **scontain-username** | Scontain Registry Username | Yes | - |
26+
| **image-name** | Name of Docker Image to Sconify | Yes | - |
27+
| **image-tag** | Tag of Docker Image to Sconify | Yes | - |
28+
| **docker-registry** | Docker Registry of Docker Image to Sconify | No | docker.io |
29+
| **sconify-version** | Version of the Sconify Image to use | Yes | - |
30+
| **fs-dir** | File System Directory to Protect | Yes | - |
31+
| **binary** | Path to the Binary to Protect | Yes | - |
32+
| **command** | Command to Protect | Yes | - |
33+
| **heap** | Enclave Heap size | No | 1G |
34+
| **dlopen** | dlopen mode | No | 1 |
35+
| **sconify-debug** | Create Scone Debug image | No | true |
36+
| **sconify-prod** | Create Scone Production image | No | true |
37+
38+
### Secrets 🔐
39+
40+
| **Secret** | **Description** | **Required** |
41+
| --------------------- | ----------------------------------------------- | --------------------------------------- |
42+
| **docker-password** | Docker Registry Password or Token | Yes |
43+
| **scontain-password** | Scontain Registry Password or Token | Yes |
44+
| **scone-signing-key** | Signing Key for Scone Production (PEM RSA-3072) | Yes unless `inputs.sconify-prod: false` |
45+
46+
### Outputs 📤
47+
48+
| **Output** | **Description** |
49+
| ------------------- | ---------------------------------------------------------------------------------- |
50+
| **debug-image** | Debug Sconified Image (unless `inputs.sconify-debug: false`) |
51+
| **debug-mrenclave** | Debug Sconified Image MrEnclave Fingerprint (unless `inputs.sconify-debug: false`) |
52+
| **debug-checksum** | Debug Sconified Image Checksum (unless `inputs.sconify-debug: false`) |
53+
| **prod-image** | Prod Sconified Image (unless `inputs.sconify-prod: false`) |
54+
| **prod-mrenclave** | Prod Sconified Image MrEnclave Fingerprint (unless `inputs.sconify-prod: false`) |
55+
| **prod-checksum** | Prod Sconified Image Checksum (unless `inputs.sconify-prod: false`) |
56+
57+
## How to Use This Reusable Workflow 🔄
58+
59+
1. **Save the Workflow File**
60+
This workflow is already saved as `.github/workflows/sconify.yml` in the repository. 💾
61+
62+
2. **Call the Reusable Workflow**
63+
In another workflow file (e.g., triggered manually or by a release), invoke this reusable workflow like so:
64+
65+
```yaml
66+
name: Sconify iApp
67+
68+
on:
69+
workflow_dispatch:
70+
inputs:
71+
image-name:
72+
required: true
73+
type: string
74+
image-tag:
75+
required: true
76+
type: string
77+
sconify-debug:
78+
type: boolean
79+
default: true
80+
sconify-prod:
81+
type: boolean
82+
default: true
83+
84+
jobs:
85+
sconify:
86+
uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/sconify.yml@feat/sconify
87+
with:
88+
image-name: ${{ inputs.image-name }}
89+
image-tag: ${{ inputs.image-tag }}
90+
sconify-debug: ${{ inputs.sconify-debug }}
91+
sconify-prod: ${{ inputs.sconify-prod }}
92+
docker-registry: docker.io
93+
sconify-version: 5.9.0-v15
94+
fs-dir: /app
95+
binary: /usr/local/bin/node
96+
command: node /app/src/app.js
97+
heap: 1G
98+
dlopen: 1
99+
docker-username: ${{ vars.DOCKER_USERNAME }}
100+
scontain-username: ${{ vars.SCONTAIN_USERNAME }}
101+
secrets:
102+
docker-password: ${{ secrets.DOCKER_TOKEN }}
103+
scontain-password: ${{ secrets.SCONTAIN_TOKEN }}
104+
scone-signing-key: ${{ secrets.SCONE_SIGNING_KEY }}
105+
106+
use-sconify-output:
107+
# usually you want to deploy the sconified image as an iExec app using the sconify job outputs
108+
runs-on: ubuntu-latest
109+
needs: sconify
110+
steps:
111+
- run: |
112+
echo "DEBUG IMAGE INFO: image=${{ needs.sconify.outputs.debug-image }} | checksum=${{ needs.sconify.outputs.debug-checksum }} | mrenclave=${{ needs.sconify.outputs.debug-mrenclave }}"
113+
echo "PROD IMAGE INFO: image=${{ needs.sconify.outputs.prod-image }} | checksum=${{ needs.sconify.outputs.prod-checksum }} | mrenclave=${{ needs.sconify.outputs.prod-mrenclave }}"
114+
```
115+
116+
3. **Configure Variables**
117+
Ensure that the following variables are added to your repository's settings:
118+
119+
- `DOCKER_USERNAME`: Your Docker Registry username
120+
- `SCONTAIN_USERNAME`: Your Scontain username
121+
122+
NB: Beware if you choose to use secrets to store registries usernames;
123+
registries usernames can appear in sconified image names outputted as `outputs.debug-image` and `outputs.prod-image`, in such a case GitHub Actions blanks the outputs with this waring:
124+
125+
> Skip output 'prod-image' since it may contain secret.
126+
127+
> Skip output 'debug-image' since it may contain secret.
128+
129+
4. **Configure Secrets**
130+
Ensure that the following secrets are added to your repository's settings:
131+
- `DOCKER_PASSWORD`: Your Docker Registry password or access token
132+
- `SCONTAIN_PASSWORD`: Your Scontain password or access token
133+
- `SCONE_SIGNING_KEY`: The key to use for signing Scone Prod applications
134+
135+
## Prerequisites 📋
136+
137+
1. **Read/Write access to the image to sconify**
138+
139+
2. **Read access to Scontain's `iexec-sconify-image` image**:
140+
- You must have a Scontain account with access to the `scone-production/iexec-sconify-image` image.

0 commit comments

Comments
 (0)