verifier: add local NVIDIA Blackwell GPU attestation #812
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: KBS e2e Suite | |
| on: | |
| pull_request: | |
| branches: ["main"] | |
| paths-ignore: | |
| - '**/*.md' | |
| workflow_dispatch: | |
| permissions: {} | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # Common checkout + source archive for all e2e jobs | |
| code-checkout: | |
| name: KBS - checkout & archive | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| packages: write # upload source archive as workflow artifact | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Archive source | |
| run: git archive -o kbs.tar.gz HEAD | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: kbs-source | |
| path: ./kbs.tar.gz | |
| # Sample TEE e2e (reuses kbs-e2e template) | |
| sample-e2e-amd64: | |
| name: Sample TEE e2e (amd64) | |
| needs: code-checkout | |
| uses: ./.github/workflows/workflow-call-kbs-e2e.yml | |
| permissions: | |
| contents: read | |
| packages: write # push e2e test images to GHCR | |
| with: | |
| tee: sample | |
| tarball: kbs.tar.gz | |
| sample-e2e-arm64: | |
| name: Sample TEE e2e (arm64) | |
| needs: code-checkout | |
| uses: ./.github/workflows/workflow-call-kbs-e2e.yml | |
| permissions: | |
| contents: read | |
| packages: write # push e2e test images to GHCR | |
| with: | |
| tee: sample | |
| arch: aarch64 | |
| runs-on-build: '["ubuntu-22.04-arm"]' | |
| runs-on-test: '["ubuntu-22.04-arm"]' | |
| tarball: kbs.tar.gz | |
| kbs-client-features: "cca-attester" | |
| # Vault integration e2e | |
| vault-e2e-test: | |
| name: Vault e2e | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| env: | |
| OS_VERSION: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install Rust toolchain | |
| uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 | |
| with: | |
| rustflags: "" | |
| cache: false | |
| - name: Set up rust build cache | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| continue-on-error: false | |
| with: | |
| path: | | |
| ~/.cargo/registry/index/ | |
| ~/.cargo/registry/cache/ | |
| target/ | |
| key: rust-${{ runner.arch }}-${{ env.OS_VERSION }}-${{ hashFiles('./Cargo.lock') }} | |
| - name: Run KBS Vault integration e2e (no SSL + SSL) | |
| run: make test-kbs-vault-e2e | |
| # Docker Compose/Helm e2e materials (shared via workflow artifacts) | |
| build-docker-e2e-materials: | |
| name: Build Docker/Helm e2e materials | |
| uses: ./.github/workflows/workflow-call-build-docker-e2e-materials.yml | |
| permissions: | |
| contents: read | |
| # Docker Compose cluster e2e | |
| docker-e2e-test: | |
| name: Docker Compose e2e | |
| needs: build-docker-e2e-materials | |
| strategy: | |
| matrix: | |
| instance: | |
| - ubuntu-24.04 | |
| - ubuntu-24.04-arm | |
| include: | |
| - instance: ubuntu-24.04 | |
| platform_slug: linux-amd64 | |
| - instance: ubuntu-24.04-arm | |
| platform_slug: linux-arm64 | |
| runs-on: ${{ matrix.instance }} | |
| permissions: | |
| contents: read | |
| env: | |
| OS_VERSION: ${{ matrix.instance }} | |
| steps: | |
| - name: Checkout KBS | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Download pre-built images | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: docker-e2e-images-${{ matrix.platform_slug }} | |
| path: ${{ runner.temp }}/docker-e2e-images | |
| - name: Load images | |
| run: docker load --input "${RUNNER_TEMP}/docker-e2e-images/images.tar" | |
| - name: Install Rust toolchain | |
| uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 | |
| with: | |
| rustflags: "" | |
| cache: false | |
| - name: Set up rust build cache | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| continue-on-error: false | |
| with: | |
| path: | | |
| ~/.cargo/registry/index/ | |
| ~/.cargo/registry/cache/ | |
| target/ | |
| key: rust-${{ runner.arch }}-${{ env.OS_VERSION }}-${{ hashFiles('./Cargo.lock') }} | |
| - name: Run KBS Docker Compose e2e | |
| env: | |
| SKIP_DOCKER_COMPOSE_BUILD: "1" | |
| run: make test-kbs-docker-e2e | |
| # External plugin e2e | |
| ext-plugin-e2e-test: | |
| name: External Plugin e2e | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| env: | |
| OS_VERSION: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install Rust toolchain | |
| uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 | |
| with: | |
| rustflags: "" | |
| cache: false | |
| - name: Set up rust build cache | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| continue-on-error: false | |
| with: | |
| path: | | |
| ~/.cargo/registry/index/ | |
| ~/.cargo/registry/cache/ | |
| target/ | |
| key: rust-${{ runner.arch }}-${{ env.OS_VERSION }}-${{ hashFiles('./Cargo.lock') }} | |
| - name: Install build dependencies | |
| run: sudo apt-get update && sudo apt-get install -y protobuf-compiler libprotobuf-dev libtss2-dev | |
| - name: Install TDX build dependencies | |
| run: | | |
| curl -L https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key | sudo gpg --dearmor --output /usr/share/keyrings/intel-sgx.gpg | |
| echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/intel-sgx.gpg] https://download.01.org/intel-sgx/sgx_repo/ubuntu noble main' | sudo tee /etc/apt/sources.list.d/intel-sgx.list | |
| sudo apt-get update | |
| sudo apt-get install -y libsgx-dcap-quote-verify-dev | |
| - name: Run external plugin unit tests | |
| working-directory: kbs | |
| run: make check TEST_FEATURES="external-plugin" | |
| - name: Install e2e test dependencies | |
| working-directory: kbs/test | |
| run: make install-dev-dependencies | |
| - name: Run external plugin e2e tests | |
| working-directory: kbs/test | |
| run: make e2e-ext-plugin | |
| # Sample TEE Helm e2e on a GitHub-hosted runner (always runs). | |
| helm-trustee-e2e-amd64-sample: | |
| name: Helm Trustee e2e (amd64 sample tee) | |
| needs: build-docker-e2e-materials | |
| uses: ./.github/workflows/workflow-call-helm-e2e.yml | |
| permissions: | |
| contents: read | |
| with: | |
| leg: sample | |
| runs-on: '["ubuntu-24.04"]' | |
| client-artifact: helm-e2e-kbs-client-linux-amd64 | |
| self-hosted: false |