|
19 | 19 | image_tag: ${{ steps.determine-tag.outputs.image_tag }} |
20 | 20 | steps: |
21 | 21 | - name: Checkout code |
22 | | - uses: actions/checkout@v4 |
| 22 | + uses: actions/checkout@v6 |
23 | 23 | with: |
24 | 24 | fetch-depth: 0 |
25 | 25 |
|
@@ -51,15 +51,15 @@ jobs: |
51 | 51 | echo "image_tag=dev-${SHORT_SHA}" | tee -a $GITHUB_OUTPUT |
52 | 52 | else |
53 | 53 | # This covers other branches |
54 | | - echo "Processing feature/bugfix branch ${{ github.head_ref }}" |
| 54 | + echo "Processing feat/fix branch ${{ github.head_ref }}" |
55 | 55 | echo "image_tag=feature-${SHORT_SHA}" | tee -a $GITHUB_OUTPUT |
56 | 56 | fi |
57 | 57 | fi |
58 | 58 |
|
59 | 59 | build-oci-image: |
60 | 60 | name: Build OCI image |
61 | 61 | needs: prepare |
62 | | - uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/docker-build.yml@docker-build-v2.4.0 |
| 62 | + uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/docker-build.yml@docker-build-v3.3.0 |
63 | 63 | with: |
64 | 64 | image-name: docker-regis.iex.ec/python-hello-world |
65 | 65 | image-tag: ${{ needs.prepare.outputs.image_tag }} |
|
70 | 70 | security-scan: true |
71 | 71 | security-report: "sarif" |
72 | 72 | hadolint: true |
73 | | - platforms: linux/amd64 |
| 73 | + platform: linux/amd64 |
74 | 74 | secrets: |
| 75 | + dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }} |
| 76 | + dockerhub-password: ${{ secrets.DOCKERHUB_TOKEN_PULL_ONLY }} |
75 | 77 | username: ${{ secrets.NEXUS_USERNAME }} |
76 | 78 | password: ${{ secrets.NEXUS_PASSWORD }} |
77 | | - |
78 | | - build-tee-image: |
79 | | - name: Build TEE image |
80 | | - needs: [prepare, build-oci-image] |
81 | | - runs-on: ubuntu-latest |
82 | | - env: |
83 | | - native_image: docker-regis.iex.ec/python-hello-world |
84 | | - enclave_image: docker-regis.iex.ec/python-hello-world-unlocked |
85 | | - sconify_image: registry.scontain.com/scone-debug/iexec-sconify-image-unlocked |
86 | | - sconify_version: 5.9.1 |
87 | | - steps: |
88 | | - - name: Login to Scontain registry |
89 | | - uses: docker/login-action@v3 |
90 | | - with: |
91 | | - registry: registry.scontain.com |
92 | | - username: ${{ secrets.SCONTAIN_REGISTRY_USERNAME }} |
93 | | - password: ${{ secrets.SCONTAIN_REGISTRY_PAT }} |
94 | | - - name: Login to Docker regis |
95 | | - uses: docker/login-action@v3 |
96 | | - with: |
97 | | - registry: docker-regis.iex.ec |
98 | | - username: ${{ secrets.NEXUS_USERNAME }} |
99 | | - password: ${{ secrets.NEXUS_PASSWORD }} |
100 | | - - name: Pull sconification tools |
101 | | - run: docker pull $sconify_image:$sconify_version |
102 | | - - name: Pull native image |
103 | | - run: docker pull $native_image:${{ needs.prepare.outputs.image_tag }} |
104 | | - - name: Sconify |
105 | | - run: | |
106 | | - IMG_FROM=$native_image:${{ needs.prepare.outputs.image_tag }} |
107 | | - IMG_TO=$enclave_image:${{ needs.prepare.outputs.image_tag }}-sconify-$sconify_version-debug |
108 | | - SCONE_IMAGE=$sconify_image:$sconify_version |
109 | | - docker run --rm -v /var/run/docker.sock:/var/run/docker.sock $SCONE_IMAGE \ |
110 | | - sconify_iexec --cli=$SCONE_IMAGE --crosscompiler=$SCONE_IMAGE \ |
111 | | - --from=$IMG_FROM --to=$IMG_TO --binary-fs --fs-dir=/app --binary=/usr/local/bin/python3.7 \ |
112 | | - --heap=1G --host-path=/etc/hosts --host-path=/etc/resolv.conf --no-color --verbose |
113 | | - echo |
114 | | - docker run --rm -e SCONE_HASH=1 $IMG_TO |
115 | | - - name: Push TEE image |
116 | | - run: docker push $enclave_image:${{ needs.prepare.outputs.image_tag }}-sconify-$sconify_version-debug |
117 | | - - name: Clean OCI images |
118 | | - run: | |
119 | | - docker image rm -f \ |
120 | | - $native_image:${{ needs.prepare.outputs.image_tag }} \ |
121 | | - $enclave_image:${{ needs.prepare.outputs.image_tag }}-sconify-$sconify_version-debug \ |
122 | | - $sconify_image:$sconify_version |
0 commit comments