trustee/.github/workflows/as-rust.yml at f5cb8fc1b51b652fc24e2d6b8742cf417805352e · confidential-containers/trustee · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
name: CoCo-AS Rust Suites
on:
  push:
    branches:
      - "main"
    paths:
      - 'attestation-service/**'
      - 'rvps/**'
      - 'deps/**'
      - '.github/workflows/as_rust.yml'
      - 'Cargo.toml'
  pull_request:
    paths:
      - 'attestation-service/**'
      - 'rvps/**'
      - 'deps/**'
      - '.github/workflows/as_rust.yml'
      - 'Cargo.toml'
  create:

permissions:
  contents: read

jobs:
  basic_ci:
    if: github.event_name == 'pull_request' || github.event_name == 'push'
    name: Check
    runs-on: ubuntu-24.04
    steps:
      - name: Code checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 1
          persist-credentials: false

      - name: Install OPA command line tool
        uses: open-policy-agent/setup-opa@950f159a49aa91f9323f36f1de81c7f6b5de9576 # v2.2.0 # v2
        with:
          version: latest

      - name: OPA policy.rego fmt and check
        working-directory: attestation-service
        run: |
          make opa-check

      - name: Install protoc
        run: |
          sudo apt-get update && sudo apt-get install -y protobuf-compiler libprotobuf-dev

      - name: Install TPM build dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libtss2-dev

      - name: Install TDX build dependencies
        run: |
          curl -L https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key | sudo gpg --dearmor --output /usr/share/keyrings/intel-sgx.gpg
          echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/intel-sgx.gpg] https://download.01.org/intel-sgx/sgx_repo/ubuntu noble main' | sudo tee /etc/apt/sources.list.d/intel-sgx.list
          sudo apt-get update
          sudo apt-get install -y libsgx-dcap-quote-verify-dev libsgx-dcap-default-qpl

      - name: Install Rust toolchain
        uses: actions-rust-lang/setup-rust-toolchain@a0b538fa0b742a6aa35d6e2c169b4bd06d225a98 # v1.15.3
        with:
          components: rustfmt, clippy

      - name: Run cargo fmt check
        run: |
          cargo fmt -p attestation-service -p reference-value-provider-service -p eventlog -p verifier -p key-value-storage -p policy-engine --check

      - name: Run rust lint check
        run: |
          cargo clippy -p attestation-service -p reference-value-provider-service -p eventlog -p verifier -p key-value-storage -p policy-engine -- -D warnings

      - name: Build
        working-directory: attestation-service
        run: |
          make

      - name: Run cargo test
        run: |
          sudo -E PATH="$PATH" -s cargo test -p attestation-service -p reference-value-provider-service -p verifier -p eventlog -p key-value-storage -p policy-engine