Sandchest/.github/workflows/build-images.yml at 5e2b2a344feb6a9f75a21ee7fe450c4f832ee18a · CapSoftware/Sandchest · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
name: Build VM Images

on:
  push:
    branches: [main]
    paths:
      - 'images/**'
      - 'crates/sandchest-agent/**'

  workflow_dispatch:
    inputs:
      toolchain:
        description: 'Toolchain to build'
        required: true
        default: 'base'
        type: choice
        options:
          - base
          - node-22
          - python-3.12
          - go-1.22

concurrency:
  group: build-images
  cancel-in-progress: false

env:
  CARGO_TERM_COLOR: always

jobs:
  build:
    name: Build Images
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: x86_64-unknown-linux-musl

      - uses: Swatinem/rust-cache@v2

      - name: Install build dependencies
        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler musl-tools debootstrap e2fsprogs

      - name: Build guest agent (static musl binary)
        run: cargo build --release --package sandchest-agent --target x86_64-unknown-linux-musl

      - name: Fetch kernel
        working-directory: images
        run: make kernel

      - name: Build base rootfs with guest agent
        working-directory: images
        run: |
          sudo make rootfs \
            AGENT_BIN=../target/x86_64-unknown-linux-musl/release/sandchest-agent

      - name: Install toolchain
        if: ${{ github.event.inputs.toolchain && github.event.inputs.toolchain != 'base' }}
        working-directory: images
        run: |
          sudo make toolchain \
            TOOLCHAIN=${{ github.event.inputs.toolchain }}

      - name: Validate image
        working-directory: images
        run: ./scripts/validate-image.sh --output output/ubuntu-22.04/${{ github.event.inputs.toolchain || 'base' }}

      - name: Upload kernel to R2
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: auto
        run: |
          aws s3 cp images/kernel/vmlinux-5.10 \
            "s3://${{ secrets.R2_BUCKET }}/binaries/vmlinux/latest/vmlinux" \
            --endpoint-url "${{ secrets.R2_ENDPOINT }}"

      - name: Upload rootfs to R2
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: auto
        run: |
          TOOLCHAIN=${{ github.event.inputs.toolchain || 'base' }}
          aws s3 cp "images/output/ubuntu-22.04/${TOOLCHAIN}/rootfs.ext4" \
            "s3://${{ secrets.R2_BUCKET }}/binaries/rootfs/latest/rootfs.ext4" \
            --endpoint-url "${{ secrets.R2_ENDPOINT }}"
          aws s3 cp "images/output/ubuntu-22.04/${TOOLCHAIN}/rootfs.ext4" \
            "s3://${{ secrets.R2_BUCKET }}/binaries/rootfs/${{ github.sha }}/rootfs.ext4" \
            --endpoint-url "${{ secrets.R2_ENDPOINT }}"

      - name: Upload image artifacts
        uses: actions/upload-artifact@v4
        with:
          name: vm-images-${{ github.sha }}
          path: |
            images/kernel/vmlinux-5.10
            images/output/ubuntu-22.04/*/rootfs.ext4
            images/output/ubuntu-22.04/*/rootfs.sha256
          retention-days: 30

      - name: Deploy images to Hetzner
        env:
          HETZNER_SSH_KEY: ${{ secrets.HETZNER_SSH_KEY }}
          HETZNER_HOST: ${{ secrets.HETZNER_HOST }}
        run: |
          mkdir -p ~/.ssh
          echo "$HETZNER_SSH_KEY" > ~/.ssh/hetzner_key
          chmod 600 ~/.ssh/hetzner_key
          ssh-keyscan -H "$HETZNER_HOST" >> ~/.ssh/known_hosts 2>/dev/null

          TOOLCHAIN=${{ github.event.inputs.toolchain || 'base' }}

          scp -i ~/.ssh/hetzner_key \
            images/kernel/vmlinux-5.10 \
            "root@${HETZNER_HOST}:/var/sandchest/images/vmlinux-5.10"

          scp -i ~/.ssh/hetzner_key \
            "images/output/ubuntu-22.04/${TOOLCHAIN}/rootfs.ext4" \
            "root@${HETZNER_HOST}:/var/sandchest/images/rootfs.ext4"

          ssh -i ~/.ssh/hetzner_key "root@${HETZNER_HOST}" << 'DEPLOY'
            chmod 644 /var/sandchest/images/vmlinux-5.10
            chmod 644 /var/sandchest/images/rootfs.ext4
            echo "Images deployed:"
            ls -lh /var/sandchest/images/
          DEPLOY