feat(tee-vm): enable Cartridge paymaster + VRF sidecars by default #48
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: amdsev-lint | |
| # Static analysis for the misc/AMDSEV TEE-VM tooling (mostly shell): | |
| # - shellcheck (warning severity) over every shell script | |
| # - shellcheck of the guest init script, extracted from the heredoc in | |
| # build-initrd.sh and checked as POSIX sh (it runs under busybox sh, | |
| # which is stricter than the bash the outer script is written in) | |
| # - actionlint over the amdsev-* GitHub Actions workflows | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - "misc/AMDSEV/**" | |
| - ".github/workflows/amdsev-*.yml" | |
| pull_request: | |
| paths: | |
| - "misc/AMDSEV/**" | |
| - ".github/workflows/amdsev-*.yml" | |
| concurrency: | |
| group: amdsev-lint-${{ github.ref }} | |
| cancel-in-progress: true | |
| defaults: | |
| run: | |
| working-directory: misc/AMDSEV | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: shellcheck scripts | |
| # shellcheck is preinstalled on ubuntu-latest runners. | |
| run: shellcheck -S warning build.sh start-vm.sh install.sh verify-build.sh reproduce-release.sh scripts/*.sh | |
| - name: shellcheck guest init (POSIX sh) | |
| # The init script ships inside the initrd and runs under busybox sh. | |
| # Extract it from the build-initrd.sh heredoc and lint it as sh — | |
| # bashisms that the outer bash script tolerates are real boot | |
| # failures inside the guest. | |
| run: | | |
| sed -n '/^cat > init <<.INIT_EOF.$/,/^INIT_EOF$/p' scripts/build-initrd.sh \ | |
| | sed '1d;$d' > /tmp/guest-init.sh | |
| if [ ! -s /tmp/guest-init.sh ]; then | |
| echo "Failed to extract init heredoc from scripts/build-initrd.sh" >&2 | |
| echo "(did the INIT_EOF marker change?)" >&2 | |
| exit 1 | |
| fi | |
| shellcheck -s sh -S warning /tmp/guest-init.sh | |
| - name: Unit test strip_reserved_args | |
| # Fast, no-QEMU regression test for the guest init's arg sanitizer: | |
| # extracts strip_reserved_args from build-initrd.sh and asserts it | |
| # filters reserved flags while leaving glob values (e.g. the `*` in | |
| # `--http.cors-origins *`) literal. The boot smoke test covers the | |
| # same path end to end but only in the slow amdsev-initrd-test job. | |
| run: ./scripts/test-strip-reserved-args.sh | |
| - name: Unit test parse_metrics_port | |
| # Fast, no-QEMU regression test for start-vm.sh's metrics port-forward | |
| # derivation: extracts parse_metrics_port and asserts it reads | |
| # --metrics.port out of --katana-args across forms (word/=, absent, | |
| # trailing, duplicate, glob-adjacent). The forward is otherwise only | |
| # observable by booting the enclave and scraping /metrics. | |
| run: ./scripts/test-parse-metrics-port.sh | |
| - name: Unit test install.sh helpers | |
| # Fast, no-network tests for the operator installer: validators, tag | |
| # URL-encoding, source-tarball subtree extraction, checksum gating, | |
| # config.env round-trip, and that install.sh's parse_metrics_port copy | |
| # stays in sync with start-vm.sh. The full download path is covered by | |
| # the same script under KATANA_INSTALL_TEST_NETWORK=1 (manual — the | |
| # release tarball is too heavy for every PR). | |
| run: ./scripts/test-install.sh | |
| - name: actionlint (amdsev workflows only) | |
| working-directory: . | |
| run: | | |
| bash <(curl -sSf https://raw.githubusercontent.com/rhysd/actionlint/v1.7.7/scripts/download-actionlint.bash) 1.7.7 | |
| ./actionlint -color .github/workflows/amdsev-*.yml |