Skip to content

Commit 13f2e60

Browse files
achamayouachamayou
authored
GitHub Actions release pipeline (#6325)
1 parent 8ce7b79 commit 13f2e60

File tree

2 files changed

+292
-1
lines changed

2 files changed

+292
-1
lines changed

‎.github/workflows/release.yml

+291
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,291 @@
1+
name: Release
2+
3+
on:
4+
push:
5+
tags:
6+
- "ccf-5.*"
7+
workflow_dispatch:
8+
9+
permissions:
10+
contents: write
11+
actions: read
12+
checks: write
13+
14+
jobs:
15+
make_sbom:
16+
name: SBOM Generation
17+
runs-on: ubuntu-latest
18+
steps:
19+
- uses: actions/checkout@v4
20+
with:
21+
fetch-depth: 1
22+
- name: "Install SBOM tool"
23+
run: |
24+
set -ex
25+
curl -Lo sbom-tool https://github.com/microsoft/sbom-tool/releases/latest/download/sbom-tool-linux-x64 > sbom-tool
26+
chmod +x sbom-tool
27+
shell: bash
28+
- name: "Produce SBOM"
29+
run: |
30+
set -ex
31+
CCF_VERSION=${{ github.ref_name }}
32+
CCF_VERSION=${CCF_VERSION#ccf-}
33+
./sbom-tool generate -b . -bc . -pn CCF -ps Microsoft -nsb https://sbom.microsoft -pv $CCF_VERSION -V Error
34+
shell: bash
35+
- name: "Upload SBOM"
36+
uses: actions/upload-artifact@v4
37+
with:
38+
name: sbom
39+
path: _manifest/spdx_2.2/*
40+
41+
release_notes:
42+
name: Release Notes
43+
runs-on: ubuntu-latest
44+
steps:
45+
- uses: actions/checkout@v4
46+
with:
47+
fetch-depth: 1
48+
- name: "Check Release Notes"
49+
run: |
50+
set -ex
51+
python scripts/extract-release-notes.py --target-git-version
52+
shell: bash
53+
- name: "Produce Release Notes"
54+
run: |
55+
set -ex
56+
set -o pipefail
57+
python ./scripts/extract-release-notes.py --target-git-version --describe-path-changes "./samples/constitution" | tee rel-notes.md
58+
- name: "Upload .deb Package"
59+
uses: actions/upload-artifact@v4
60+
with:
61+
name: relnotes
62+
path: rel-notes.md
63+
64+
build_release:
65+
needs: release_notes
66+
name: Build Release
67+
strategy:
68+
matrix:
69+
platform:
70+
- name: virtual
71+
image: default
72+
nodes: [self-hosted, 1ES.Pool=gha-virtual-ccf-sub]
73+
- name: snp
74+
image: default
75+
nodes: [self-hosted, 1ES.Pool=gha-virtual-ccf-sub]
76+
- name: sgx
77+
image: sgx
78+
nodes: [self-hosted, 1ES.Pool=gha-sgx-ccf-sub]
79+
container_options: --device /dev/sgx_enclave:/dev/sgx_enclave --device /dev/sgx_provision:/dev/sgx_provision -v /dev/sgx:/dev/sgx
80+
cmake_options: -DLVI_MITIGATIONS=ON
81+
runs-on: ${{ matrix.platform.nodes }}
82+
container:
83+
image: ghcr.io/microsoft/ccf/ci/${{ matrix.platform.image }}:build-26-06-2024
84+
options: "--user root --publish-all --cap-add NET_ADMIN --cap-add NET_RAW --cap-add SYS_PTRACE -v /lib/modules:/lib/modules:ro ${{ matrix.platform.container_options }}"
85+
steps:
86+
- uses: actions/checkout@v4
87+
with:
88+
fetch-depth: 0
89+
90+
- name: "Build Release ${{ matrix.platform.name }}"
91+
run: |
92+
set -ex
93+
git config --global --add safe.directory /__w/CCF/CCF
94+
mkdir build
95+
cd build
96+
cmake -GNinja -DCOMPILE_TARGET=${{ matrix.platform.name }} ${{ matrix.platform.cmake_options }} -DCLIENT_PROTOCOLS_TEST=ON ..
97+
ninja -v | tee build.log
98+
shell: bash
99+
100+
- name: "Check Mitigation Flags"
101+
run: |
102+
cd build
103+
python3 ../scripts/build-check.py < build.log SNPCC
104+
shell: bash
105+
if: ${{ matrix.platform.name == 'snp' }}
106+
107+
- name: "Install Extended Testing Tools"
108+
run: |
109+
set -ex
110+
sudo apt-get -y update
111+
sudo apt install ansible -y
112+
cd getting_started/setup_vm
113+
ansible-playbook ccf-extended-testing.yml
114+
shell: bash
115+
if: ${{ matrix.platform.name != 'snp' }}
116+
117+
- name: "Test ${{ matrix.platform.name }}"
118+
run: |
119+
set -ex
120+
cd build
121+
rm -rf /github/home/.cache
122+
mkdir -p /github/home/.cache
123+
export ASAN_SYMBOLIZER_PATH=$(realpath /usr/bin/llvm-symbolizer-15)
124+
# Unit tests
125+
./tests.sh --output-on-failure -L unit -j$(nproc --all)
126+
./tests.sh --timeout 360 --output-on-failure -LE "benchmark|perf|unit"
127+
shell: bash
128+
if: "${{ matrix.platform.name != 'snp' }}"
129+
130+
- name: "Make .deb Package"
131+
id: make_deb
132+
run: |
133+
set -ex
134+
set -o pipefail
135+
cd build
136+
cmake -L .. 2>/dev/null | grep CMAKE_INSTALL_PREFIX: | cut -d = -f 2 > /tmp/install_prefix
137+
cpack -V -G DEB
138+
INITIAL_PKG=`ls *.deb`
139+
CCF_GITHUB_PKG=${INITIAL_PKG//\~/_}
140+
if [[ "$INITIAL_PKG" != "$CCF_GITHUB_PKG" ]]; then
141+
mv $INITIAL_PKG $CCF_GITHUB_PKG
142+
fi
143+
echo "name=$CCF_GITHUB_PKG" >> $GITHUB_OUTPUT
144+
shell: bash
145+
146+
- name: "Install CCF Debian package"
147+
run: |
148+
set -ex
149+
cd build
150+
sudo apt -y install ./${{ steps.make_deb.outputs.name }}
151+
shell: bash
152+
153+
- name: "Test Installed CCF"
154+
run: |
155+
set -ex
156+
set -o pipefail
157+
cd build
158+
cat /tmp/install_prefix | xargs -i bash -c "PYTHON_PACKAGE_PATH=../python ./test_install.sh {}"
159+
shell: bash
160+
if: "${{ matrix.platform.name != 'snp' }}"
161+
162+
- name: "Recovery Benchmark for Installed CCF"
163+
run: |
164+
set -ex
165+
set -o pipefail
166+
cd build
167+
cat /tmp/install_prefix | xargs -i bash -c "PYTHON_PACKAGE_PATH=../python ./recovery_benchmark.sh {}"
168+
shell: bash
169+
if: "${{ matrix.platform.name != 'snp' }}"
170+
171+
- name: "Test Building a Sample Against Installed CCF"
172+
run: |
173+
set -ex
174+
./tests/test_install_build.sh -DCOMPILE_TARGET=${{ matrix.platform.name }}
175+
shell: bash
176+
177+
- name: "Upload .deb Package"
178+
uses: actions/upload-artifact@v4
179+
with:
180+
name: pkg-${{ matrix.platform.name }}
181+
path: build/${{ steps.make_deb.outputs.name }}
182+
183+
- name: "Upload Compatibility Report"
184+
uses: actions/upload-artifact@v4
185+
with:
186+
name: compatibility
187+
path: build/compatibility_report.json
188+
if: "${{ matrix.platform.name == 'sgx' }}"
189+
190+
- name: "Upload TLS Report"
191+
uses: actions/upload-artifact@v4
192+
with:
193+
name: tls
194+
path: build/tls_report.html
195+
if: "${{ matrix.platform.name == 'sgx' }}"
196+
197+
- name: "Build Python Wheel"
198+
id: build_wheel
199+
run: |
200+
set -ex
201+
cd python
202+
python3.8 -m venv env
203+
source ./env/bin/activate
204+
pip install -r requirements.txt
205+
pip install wheel
206+
python setup.py bdist_wheel
207+
WHL=`ls dist/*.whl`
208+
echo "name=$WHL" >> $GITHUB_OUTPUT
209+
shell: bash
210+
if: "${{ matrix.platform.name == 'sgx' }}"
211+
212+
- name: "Upload Python Wheel"
213+
uses: actions/upload-artifact@v4
214+
with:
215+
name: wheel
216+
path: python/${{ steps.build_wheel.outputs.name }}
217+
if: "${{ matrix.platform.name == 'sgx' }}"
218+
219+
- name: "Build TS Package"
220+
id: build_tstgz
221+
run: |
222+
set -ex
223+
cd js/ccf-app
224+
CCF_VERSION=$(<../../build/VERSION_LONG)
225+
CCF_VERSION=${CCF_VERSION#ccf-}
226+
echo "Setting npm package version to ${CCF_VERSION}"
227+
npm version $CCF_VERSION
228+
npm pack
229+
PKG=`ls *.tgz`
230+
echo "name=$PKG" >> $GITHUB_OUTPUT
231+
shell: bash
232+
if: "${{ matrix.platform.name == 'sgx' }}"
233+
234+
- name: "Upload TS Package"
235+
uses: actions/upload-artifact@v4
236+
with:
237+
name: tstgz
238+
path: js/ccf-app/${{ steps.build_tstgz.outputs.name }}
239+
if: "${{ matrix.platform.name == 'sgx' }}"
240+
241+
create_release:
242+
needs:
243+
- build_release
244+
- make_sbom
245+
name: Create Release
246+
runs-on: ubuntu-latest
247+
steps:
248+
- uses: actions/checkout@v4
249+
with:
250+
fetch-depth: 1
251+
- name: Download Packages
252+
uses: actions/download-artifact@v4
253+
with:
254+
path: pkg
255+
pattern: pkg-*
256+
merge-multiple: true
257+
- name: Download Release Notes
258+
uses: actions/download-artifact@v4
259+
with:
260+
name: relnotes
261+
- name: Download Compatibility Report
262+
uses: actions/download-artifact@v4
263+
with:
264+
name: compatibility
265+
- name: Download TLS Report
266+
uses: actions/download-artifact@v4
267+
with:
268+
name: tls
269+
- name: Download Python Wheel
270+
uses: actions/download-artifact@v4
271+
with:
272+
path: wheel
273+
name: wheel
274+
- name: Download TS Package
275+
uses: actions/download-artifact@v4
276+
with:
277+
path: tstgz
278+
name: tstgz
279+
- name: Download SBOM
280+
uses: actions/download-artifact@v4
281+
with:
282+
path: sbom
283+
name: sbom
284+
- run: |
285+
set -ex
286+
CCF_VERSION=${{ github.ref_name }}
287+
CCF_VERSION=${CCF_VERSION#ccf-}
288+
gh release create --title $CCF_VERSION --draft --notes-file rel-notes.md ${{ github.ref_name }} pkg/* wheel/*.whl tstgz/*.tgz sbom/* tls_report.html compatibility_report.json
289+
shell: bash
290+
env:
291+
GH_TOKEN: ${{ github.token }}

‎tests/recovery_benchmark.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ echo "** Start original service"
8888
"${ccf_install_path}"/bin/sandbox.sh --sig-tx-interval "${signature_tx_interval}" &
8989
sandbox_pid=$!
9090

91-
network_live_time=60
91+
network_live_time=120
9292
if poll_for_service_open ${network_live_time} ${sandbox_pid}; then
9393
echo "Error: Timeout waiting ${network_live_time}s for service to open"
9494
kill "$(jobs -p)"

0 commit comments

Comments
 (0)