Skip to content
This repository was archived by the owner on Jul 30, 2025. It is now read-only.

Commit 837095f

Browse files
Marcin-RadeckiMarcin-Radecki
authored
BAC-189: CI for Shielder Prover Server (#286)
1 parent 4fdae86 commit 837095f

File tree

5 files changed

+126
-6
lines changed

5 files changed

+126
-6
lines changed

‎.github/workflows/_build-enclave-artifacts.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,10 @@ jobs:
4444
- name: Build enclave for shielder-prover-tee
4545
# yamllint disable rule:line-length
4646
run: |
47+
mkdir out
4748
nix build --override-input zkOS-monorepo "github:${GITHUB_REPOSITORY}/${{ steps.get-ref-properties.outputs.full-sha }}"
49+
cp result/shielderProverTEE/image.eif out/shielder-prover-tee-${{ steps.get-ref-properties.outputs.sha }}.eif
50+
cp result/shielderProverTEE/pcr.json out/pcr-${{ steps.get-ref-properties.outputs.sha }}.json
4851
4952
- name: Get artifact names
5053
id: get-artifact-names
@@ -56,14 +59,14 @@ jobs:
5659
uses: actions/upload-artifact@v4
5760
with:
5861
name: ${{ steps.get-artifact-names.outputs.eif }}
59-
path: tee/nix/result/shielderProverTEE/image.eif
62+
path: tee/nix/out/shielder-prover-tee-${{ steps.get-ref-properties.outputs.sha }}.eif
6063
if-no-files-found: error
6164
retention-days: 7
6265

6366
- name: Upload measurements to GH Artifacts
6467
uses: actions/upload-artifact@v4
6568
with:
6669
name: ${{ steps.get-artifact-names.outputs.measurements }}
67-
path: tee/nix/result/shielderProverTEE/pcr.json
70+
path: tee/nix/out/pcr-${{ steps.get-ref-properties.outputs.sha }}.json
6871
if-no-files-found: error
6972
retention-days: 7

‎.github/workflows/_check-vars-and-secrets.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,8 @@ jobs:
2121
-z '${{ vars.CI_TESTNET_RELAYER_SIGNER_ADDRESSES }}' || \
2222
-z '${{ vars.CI_TESTNET_STAGE_OWNER_ADDRESS }}' || \
2323
-z '${{ vars.CI_TESTNET_TS_SDK_PUBLIC_KEY }}' || \
24+
-z '${{ vars.ECR_PUBLIC_HOST }}' || \
25+
-z '${{ vars.ECR_CC_RES_PUBLIC_REGISTRY }}' || \
2426
-z '${{ vars.MAINNET_PROD_OWNER_ADDRESS }}' || \
2527
-z '${{ vars.SHIELDER_CONTRACT_ADDRESS }}'
2628
]]; then
@@ -34,6 +36,8 @@ jobs:
3436
if [[ \
3537
-z '${{ secrets.AWS_MAINNET_ECR_ACCESS_KEY }}' || \
3638
-z '${{ secrets.AWS_MAINNET_ECR_ACCESS_KEY_ID }}' || \
39+
-z '${{ secrets.AWS_MAINNET_ECR_CC_ACCESS_KEY }}' || \
40+
-z '${{ secrets.AWS_MAINNET_ECR_CC_ACCESS_KEY_ID }}' || \
3741
-z '${{ secrets.CI_GH_TOKEN }}' || \
3842
-z '${{ secrets.CI_MAINNET_DEPLOYER_PRIVATE_KEY }}' || \
3943
-z '${{ secrets.CI_TESTNET_ALICE_PRIVATE_KEY }}' || \

‎.github/workflows/build-and-push-prover-server.yml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
---
2+
name: Build and push Shielder-Prover-Server docker image (host app)
3+
4+
on:
5+
workflow_dispatch:
6+
inputs:
7+
ref:
8+
description: 'git ref: hash, branch, tag to build shielder-prover-server files from'
9+
type: string
10+
required: true
11+
12+
jobs:
13+
main:
14+
name: Build Shielder Prover Server (host app)
15+
runs-on: ubuntu-24.04
16+
steps:
17+
- name: Checkout source code
18+
uses: actions/checkout@v4
19+
with:
20+
ref: ${{ inputs.ref }}
21+
fetch-depth: 0
22+
23+
- name: Call action get-ref-properties
24+
id: get-ref-properties
25+
uses: Cardinal-Cryptography/github-actions/get-ref-properties@v7
26+
27+
- name: Login to Public Amazon ECR
28+
uses: docker/login-action@v3
29+
with:
30+
registry: ${{ vars.ECR_PUBLIC_HOST }}
31+
username: ${{ secrets.AWS_MAINNET_ECR_CC_ACCESS_KEY_ID }}
32+
password: ${{ secrets.AWS_MAINNET_ECR_CC_ACCESS_KEY }}
33+
34+
- name: DOCKER | Docker Buildx
35+
id: buildx
36+
uses: docker/setup-buildx-action@v2
37+
with:
38+
version: v0.9.1
39+
40+
- name: Build and push docker image
41+
id: build-image
42+
uses: docker/build-push-action@v3
43+
with:
44+
context: tee
45+
builder: ${{ steps.buildx.outputs.name }}
46+
file: ./tee/docker/Dockerfile
47+
push: true
48+
# yamllint disable rule:line-length
49+
tags: |
50+
${{ vars.ECR_CC_RES_PUBLIC_REGISTRY }}shielder-prover:${{ steps.get-ref-properties.outputs.sha }}
51+
${{ vars.ECR_CC_RES_PUBLIC_REGISTRY }}shielder-prover:latest

‎.github/workflows/on-release.yml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
---
2+
name: Build and add Shielder Prover Server artifacts to GitHub Release
3+
4+
on:
5+
release:
6+
types:
7+
- published
8+
9+
concurrency:
10+
group: ${{ github.ref }}-${{ github.workflow }}
11+
cancel-in-progress: false
12+
13+
jobs:
14+
check-vars-and-secrets:
15+
name: Check vars and secrets
16+
uses: ./.github/workflows/_check-vars-and-secrets.yml
17+
secrets: inherit
18+
19+
build-enclave-artifacts:
20+
name: Build enclave artifacts
21+
uses: ./.github/workflows/_build-enclave-artifacts.yml
22+
with:
23+
ref: ${{ github.ref }}
24+
25+
add-ci-artifacts-to-release:
26+
name: Add CI artifacts to the release
27+
needs:
28+
- check-vars-and-secrets
29+
- build-enclave-artifacts
30+
runs-on: ubuntu-24.04
31+
steps:
32+
- name: Checkout source code
33+
uses: actions/checkout@v4
34+
35+
- name: Call action get-ref-properties
36+
id: get-ref-properties
37+
uses: Cardinal-Cryptography/github-actions/get-ref-properties@v7
38+
39+
- name: Download enclave artifacts - EIF
40+
uses: actions/download-artifact@v4
41+
with:
42+
name: ${{ needs.build-enclave-artifacts.outputs.artifact-name-eif }}
43+
merge-multiple: true
44+
path: artifacts
45+
46+
- name: Download enclave artifacts - Measurements
47+
uses: actions/download-artifact@v4
48+
with:
49+
name: ${{ needs.build-enclave-artifacts.outputs.artifact-name-measurements }}
50+
merge-multiple: true
51+
path: artifacts
52+
53+
- name: Generate release artifacts checksum (SHA256)
54+
uses: jmgilman/actions-generate-checksum@v1
55+
with:
56+
output:
57+
checksums.txt
58+
patterns: |
59+
artifacts/*
60+
61+
- name: Add CI artifacts to the release
62+
uses: softprops/action-gh-release@v2
63+
with:
64+
files: |
65+
checksums.txt
66+
artifacts/*

‎tee/docker/Dockerfile‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,6 @@ WORKDIR /app
1515

1616
COPY --from=builder /app/target/release/shielder-prover-server .
1717

18-
COPY docker/dockerentrypoint.sh .
19-
20-
RUN chmod +x dockerentrypoint.sh
21-
2218
# Expose the default public port
2319
EXPOSE 3000
2420

0 commit comments

Comments
 (0)