From aa640bc5df36fba28ceb066ac02367b531b195f6 Mon Sep 17 00:00:00 2001
From: Zeke Mostov <zeke@turnkey.io>
Date: Sat, 20 Jun 2026 18:40:14 -0400
Subject: [PATCH] Print enclave PCRs in stagex CI

---
 .github/workflows/stagex.yml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.github/workflows/stagex.yml b/.github/workflows/stagex.yml
index 28d0eb8ae..9a5335896 100644
--- a/.github/workflows/stagex.yml
+++ b/.github/workflows/stagex.yml
@@ -72,6 +72,15 @@ jobs:
         shell: 'script -q -e -c "bash {0}"'
         run: make -j$(nproc) "out/${{ matrix.name }}/index.json"
 
+      - name: Print PCRs
+        if: matrix.name == 'qos_enclave' || matrix.name == 'qos_enclave_egress'
+        run: |
+          id=$(docker create "qos-local/${{ matrix.name }}:latest")
+          docker cp "${id}:/nitro.pcrs" out/nitro.pcrs
+          docker rm "${id}"
+          echo "PCRs for ${{ matrix.name }} are:"
+          cat out/nitro.pcrs
+
       # Publish PR images so they can be deployed for testing; main is build-only.
       - name: Push PR image to GHCR and ECR
         if: github.event_name == 'pull_request'