trustee/.github/workflows/workflow-call-kbs-e2e.yml at main · trusted-execution-clusters/trustee · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
name: KBS e2e

on:
  workflow_call:
    inputs:
      tee:
        type: string
        required: true
      arch:
        type: string
        default: 'amd64'
      runs-on-build:
        type: string
        default: '["ubuntu-24.04"]'
        description: JSON representation of runner labels for build
      runs-on-test:
        type: string
        default: '["ubuntu-24.04"]'
        description: JSON representation of runner labels for test
      tarball:
        type: string
        description: Artifact containing checked out source from a prior job
        required: true
      kbs-client-features:
        type: string
        default: ""
        description: features for kbs-client

permissions: {}

# Self-hosted runners do not set -o pipefail otherwise
defaults:
  run:
    shell: bash

jobs:
  build-binaries:
    runs-on: ${{ fromJSON(inputs.runs-on-build) }}
    permissions:
      contents: read
      packages: write
    env:
      OS_VERSION: ubuntu-24.04
    steps:
    - name: Download artifacts
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1

    - name: Extract tarball
      run: tar xzf "./${INPUTS_TARBALL}"
      env:
        INPUTS_TARBALL: ${{ inputs.tarball }}

    - name: Install Rust toolchain
      uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
      with:
        components: rustfmt, clippy
        rustflags: ""
        cache: false

    - name: Set up rust build cache
      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
      continue-on-error: false
      with:
        path: |
          ~/.cargo/registry/index/
          ~/.cargo/registry/cache/
          target/
        key: rust-${{ runner.arch }}-${{ env.OS_VERSION }}-${{ hashFiles('./Cargo.lock') }}

    - name: Build KBS e2e binaries
      env:
        INPUTS_KBS_CLIENT_FEATURES: ${{ inputs.kbs-client-features }}
      run: |
        make kbs-e2e-build TEST_FEATURES="${INPUTS_KBS_CLIENT_FEATURES}"

    - name: Archive test folder
      run: tar czf test.tar.gz Makefile kbs/test

    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        path: test.tar.gz
        overwrite: true
        name: artifacts-${{ inputs.tee }}-${{ inputs.arch}}

  e2e-test:
    needs: build-binaries
    runs-on: ${{ fromJSON(inputs.runs-on-test) }}
    env:
      TEE: ${{ inputs.tee }}
      RUST_LOG: warn
    steps:
    - name: Download artifacts
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        name: artifacts-${{ inputs.tee }}-${{ inputs.arch }}

    - name: Extract test folder
      run: tar xzf ./test.tar.gz

    - name: Set up SGX/TDX certificates cache
      if: inputs.tee == 'az-tdx-vtpm'
      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
      with:
        path: .dcap-qcnl
        key: ${{ runner.os }}-dcap-qcnl

    - name: Install dependencies and run e2e test
      if: inputs.tee != 'az-tdx-vtpm' && inputs.tee != 'az-snp-vtpm'
      run: |
        sudo apt-get update
        sudo apt-get install -y make --no-install-recommends
        make test-kbs-e2e

    - name: Run e2e test (w/ sudo, includes deps)
      if: inputs.tee == 'az-tdx-vtpm' || inputs.tee == 'az-snp-vtpm'
      run: |
        sudo apt-get update
        sudo apt-get install -y make --no-install-recommends
        sudo -E make test-kbs-e2e