mripper #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: mripper | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| project: | |
| description: "GCP project ID" | |
| required: false | |
| default: "flashbots-tests" | |
| type: string | |
| image: | |
| description: "GCP image" | |
| required: false | |
| default: "projects/ubuntu-os-cloud/global/images/ubuntu-2404-noble-amd64-v20260225" | |
| type: string | |
| network: | |
| description: "VPC network" | |
| required: false | |
| default: "default" | |
| type: string | |
| subnet: | |
| description: "VPC subnet" | |
| required: false | |
| default: "default" | |
| type: string | |
| permissions: | |
| contents: write | |
| env: | |
| PROJECT: ${{ inputs.project || 'flashbots-tests' }} | |
| IMAGE: ${{ inputs.image || 'projects/ubuntu-os-cloud/global/images/ubuntu-2404-noble-amd64-v20260225' }} | |
| NETWORK: ${{ inputs.network || 'default' }} | |
| SUBNET: ${{ inputs.subnet || 'default' }} | |
| jobs: | |
| rip: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| # us-east4-a | |
| - zone: us-east4-a | |
| machine_type: c3-standard-4 | |
| - zone: us-east4-a | |
| machine_type: c3-standard-22 | |
| - zone: us-east4-a | |
| machine_type: c3-standard-44 | |
| # us-east5-b | |
| - zone: us-east5-b | |
| machine_type: c3-standard-4 | |
| - zone: us-east5-b | |
| machine_type: c3-standard-22 | |
| - zone: us-east5-b | |
| machine_type: c3-standard-44 | |
| # europe-west4-a | |
| - zone: europe-west4-a | |
| machine_type: c3-standard-4 | |
| - zone: europe-west4-a | |
| machine_type: c3-standard-22 | |
| - zone: europe-west4-a | |
| machine_type: c3-standard-44 | |
| runs-on: ubuntu-latest | |
| name: "${{ matrix.zone }} / ${{ matrix.machine_type }}" | |
| env: | |
| INSTANCE_NAME: "mr-${{ matrix.zone }}-${{ matrix.machine_type }}-${{ github.run_id }}" | |
| ZONE: ${{ matrix.zone }} | |
| MACHINE_TYPE: ${{ matrix.machine_type }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Authenticate to GCP | |
| uses: google-github-actions/auth@v3 | |
| with: | |
| credentials_json: "${{ secrets.GCP_SA_KEY }}" | |
| - name: Set up gcloud | |
| uses: google-github-actions/setup-gcloud@v3 | |
| - name: Create VM | |
| run: | | |
| FIREWALL_RULE="${INSTANCE_NAME}-ssh" | |
| echo "FIREWALL_RULE=${FIREWALL_RULE}" >> "$GITHUB_ENV" | |
| gcloud compute instances create "$INSTANCE_NAME" \ | |
| --project="$PROJECT" \ | |
| --zone="$ZONE" \ | |
| --machine-type="$MACHINE_TYPE" \ | |
| --image="$IMAGE" \ | |
| --network="$NETWORK" \ | |
| --subnet="$SUBNET" \ | |
| --confidential-compute-type=TDX \ | |
| --maintenance-policy=TERMINATE \ | |
| --no-shielded-secure-boot \ | |
| --no-shielded-vtpm \ | |
| --boot-disk-size=10GB \ | |
| --boot-disk-type=pd-balanced \ | |
| --tags="$INSTANCE_NAME" | |
| gcloud compute firewall-rules create "$FIREWALL_RULE" \ | |
| --project="$PROJECT" \ | |
| --network="$NETWORK" \ | |
| --allow=tcp:22 \ | |
| --target-tags="$INSTANCE_NAME" \ | |
| --direction=INGRESS | |
| - name: Wait for SSH | |
| run: | | |
| for i in $(seq 1 60); do | |
| if gcloud compute ssh "$INSTANCE_NAME" \ | |
| --project="$PROJECT" --zone="$ZONE" \ | |
| --command="true" --quiet 2>/dev/null; then | |
| echo "SSH is ready" | |
| exit 0 | |
| fi | |
| sleep 5 | |
| done | |
| echo "::error::Timed out waiting for SSH" | |
| exit 1 | |
| - name: Run computed measurement | |
| run: | | |
| gcloud compute scp ./rip.sh "${INSTANCE_NAME}:/tmp/rip.sh" \ | |
| --project="$PROJECT" --zone="$ZONE" --quiet | |
| gcloud compute ssh "$INSTANCE_NAME" \ | |
| --project="$PROJECT" --zone="$ZONE" \ | |
| --command="chmod +x /tmp/rip.sh && sudo /tmp/rip.sh computed" | |
| - name: Fetch computed measurement | |
| run: | | |
| mkdir -p mr | |
| gcloud compute scp "${INSTANCE_NAME}:/tmp/dcap-computed.json" ./dcap-computed.json \ | |
| --project="$PROJECT" --zone="$ZONE" --quiet | |
| - name: Compare with existing measurement | |
| id: compare | |
| run: | | |
| PREFIX="${ZONE}_${MACHINE_TYPE}" | |
| # Find the latest existing measurement for this zone/machine combo | |
| EXISTING=$(ls -t mr/${PREFIX}_*.json 2>/dev/null | head -1 || true) | |
| if [[ -n "$EXISTING" ]] && diff -q <(jq -S . "$EXISTING") <(jq -S . ./dcap-computed.json) >/dev/null 2>&1; then | |
| echo "Computed DCAP measurement MATCHES existing: $EXISTING" | |
| echo "changed=false" >> "$GITHUB_OUTPUT" | |
| else | |
| if [[ -n "$EXISTING" ]]; then | |
| echo "Computed DCAP measurement DIFFERS from existing: $EXISTING" | |
| else | |
| echo "No existing measurement found for ${PREFIX}" | |
| fi | |
| echo "changed=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Run raw measurement | |
| if: steps.compare.outputs.changed == 'true' | |
| run: | | |
| gcloud compute ssh "$INSTANCE_NAME" \ | |
| --project="$PROJECT" --zone="$ZONE" \ | |
| --command="sudo /tmp/rip.sh raw" | |
| - name: Fetch raw measurement | |
| if: steps.compare.outputs.changed == 'true' | |
| run: | | |
| mkdir -p dcap-raw | |
| gcloud compute scp "${INSTANCE_NAME}:/tmp/dcap-raw" ./dcap-raw-result \ | |
| --project="$PROJECT" --zone="$ZONE" --quiet | |
| - name: Save results | |
| if: steps.compare.outputs.changed == 'true' | |
| run: | | |
| TIMESTAMP=$(date +%Y-%m-%dT%H%M%S) | |
| PREFIX="${ZONE}_${MACHINE_TYPE}" | |
| cp ./dcap-computed.json "mr/${PREFIX}_${TIMESTAMP}.json" | |
| cp ./dcap-raw-result "dcap-raw/${PREFIX}_${TIMESTAMP}" | |
| - name: Commit and push | |
| if: steps.compare.outputs.changed == 'true' | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| PREFIX="${ZONE}_${MACHINE_TYPE}" | |
| git add "mr/${PREFIX}_"*.json "dcap-raw/${PREFIX}_"* | |
| if git diff --cached --quiet; then | |
| echo "No changes to commit" | |
| else | |
| git commit -m "mripper: new measurement for ${PREFIX}" | |
| for i in 1 2 3 4 5; do | |
| git pull --rebase && git push && exit 0 | |
| sleep $((i * 2)) | |
| done | |
| echo "::error::Failed to push after 5 attempts" | |
| exit 1 | |
| fi | |
| - name: Cleanup VM | |
| if: always() | |
| run: | | |
| gcloud compute firewall-rules delete "$FIREWALL_RULE" \ | |
| --project="$PROJECT" --quiet 2>/dev/null || true | |
| gcloud compute instances delete "$INSTANCE_NAME" \ | |
| --project="$PROJECT" --zone="$ZONE" --quiet 2>/dev/null || true |