feat: add sconify workflow

Author: PierreJeanjacquot

.github/workflows/sconify.yml

@@ -0,0 +1,127 @@
+name: Build, Test and Push Docker Image
+
+on:
+  workflow_call:
+    inputs:
+      image-name:
+        description: "Name of Docker Image to Sconify"
+        type: string
+        required: true
+      image-tag:
+        description: "Tag of Docker Image to Sconify"
+        type: string
+        required: true
+      docker-registry:
+        description: "Docker Registry of Docker Image to Sconify"
+        default: "docker.io"
+        type: string
+      sconify-version:
+        description: "Version of the Sconify Image to use"
+        type: string
+        required: true
+      fs-dir:
+        type: string
+        description: "File System Directory to Protect"
+        required: true
+      binary:
+        type: string
+        description: "Path to the Binary to Protect"
+        required: true
+      command:
+        type: string
+        description: "Command to Protect"
+        required: true
+      heap:
+        type: string
+        default: "1G"
+        description: "Enclave Heap size (default 1G)"
+      dlopen:
+        type: number
+        default: 1
+        description: "dlopen"
+      debug-only:
+        description: "Create Scone Debug image only"
+        default: false
+        type: boolean
+    secrets:
+      docker-username:
+        description: "Docker Registry Username"
+        required: true
+      docker-password:
+        description: "Docker Registry Password or Token"
+        required: true
+      scontain-username:
+        description: "Scontain Registry Username"
+        required: true
+      scontain-password:
+        description: "Scontain Registry Password or Token"
+        required: true
+      scone-signing-key:
+        description: "Signing Key for Scone Production (not required with `debug-only: false`)"
+        required: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          registry: registry.scontain.com
+          username: ${{ secrets.docker-username }}
+          password: ${{ secrets.docker-password }}
+
+      - name: Login to Scontain Docker Registry
+        uses: docker/login-action@v3
+        with:
+          registry: "registry.scontain.com"
+          username: ${{ secrets.scontain-username }}
+          password: ${{ secrets.scontain-password }}
+
+      - name: Pull Image to Sconify
+        run: docker pull ${{ inputs.docker-registry }}/${{ inputs.image-name }}:${{ inputs.image-tag }}
+
+      - name: Pull Sconify Image
+        run: docker pull registry.scontain.com/scone-production/iexec-sconify-image:${{ inputs.sconify-version }}
+
+      - name: Sconify Image Debug
+        run:
+          docker run registry.scontain.com/scone-production/iexec-sconify-image:${{ inputs.sconify-version }} sconify_iexec \
+          --from=${{ inputs.docker-registry }}/${{ inputs.image-name }}:${{ inputs.image-tag }} \
+          --to=${{ inputs.docker-registry }}/${{ inputs.image-name }}:${{ inputs.image-tag }}-scone-debug-${{ inputs.sconify-version }} \
+          --binary-fs \
+          --fs-dir=${{ inputs.fs-dir }}
+          --host-path=/etc/hosts \
+          --host-path=/etc/resolv.conf \
+          --binary=${{ inputs.binary }}
+          --heap=${{ inputs.heap }} \
+          --dlopen=${{ inputs.dlopen }} \
+          --no-color \
+          --verbose \
+          --command="${{ inputs.command }}"
+
+      - name: Push Debug Image
+        run: docker push ${{ inputs.docker-registry }}/${{ inputs.image-name }}:${{ inputs.image-tag }}-scone-debug-${{ inputs.sconify-version }}
+
+      - name: Sconify Image Prod
+        if: ${{ !inputs.debug-only }}
+        run: |
+          mkdir -p /sig && echo ${{ secrets.scone-signing-key }} > /sig/enclave-key.pem
+          docker run registry.scontain.com/scone-production/iexec-sconify-image:${{ inputs.sconify-version }} sconify_iexec \
+          --from=${{ inputs.docker-registry }}/${{ inputs.image-name }}:${{ inputs.image-tag }} \
+          --to=${{ inputs.docker-registry }}/${{ inputs.image-name }}:${{ inputs.image-tag }}-scone-prod-${{ inputs.sconify-version }} \
+          --binary-fs \
+          --fs-dir=${{ inputs.fs-dir }}
+          --host-path=/etc/hosts \
+          --host-path=/etc/resolv.conf \
+          --binary=${{ inputs.binary }}
+          --heap=${{ inputs.heap }} \
+          --dlopen=${{ inputs.dlopen }} \
+          --no-color \
+          --verbose \
+          --command="${{ inputs.command }}"
+          --scone-signer=/sig/enclave-key.pem
+
+      - name: Push Prod Image
+        if: ${{ !inputs.debug-only }}
+        run: docker push ${{ inputs.docker-registry }}/${{ inputs.image-name }}:${{ inputs.image-tag }}-scone-prod-${{ inputs.sconify-version }}