name: SGX Hardware Mode Test

# Triggers the workflow on push and pull request labeled "SGX-hardware-test-required".
on:
  push:
  pull_request_target:
    types: labeled

env:
  nap_time: 60

jobs:
  Collect-code-coverage:
    if: github.event_name == 'push' || ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
    runs-on: ${{ matrix.self_runner }}
    strategy:
      matrix:
        self_runner: [[self-hosted, SGX1-HW], [self-hosted, SGX2-HW]]

    steps:
    - name: Clean before running
      run: |
        sudo chown -R ${{ secrets.CI_ADMIN }} "${{ github.workspace }}"

    - name: Checkout code
      if: github.event_name == 'push'
      uses: actions/checkout@v2
      with:
        submodules: true

    - name: Checkout code from fork
      # This step is only needed when the pull request is labeled.
      if: ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
      uses: actions/checkout@v2
      with:
        # For pull request, we need to merge the commit from fork to the base
        ref: refs/pull/${{ github.event.pull_request.number }}/merge
        submodules: true

    - name: Get Occlum version
      run: echo "OCCLUM_VERSION=$(grep 'Version =' src/pal/include/occlum_version.h | awk '{print $4}')" >> $GITHUB_ENV;

    - name: Create container
      run: |
        if [[ "${{ matrix.self_runner[1] }}" == "SGX1-HW" ]]; then
          occlum_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host --device /dev/isgx -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:$OCCLUM_VERSION-ubuntu18.04);
        elif [[ "${{ matrix.self_runner[1] }}" == "SGX2-HW" ]]; then
          occlum_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host -v /dev/sgx:/dev/sgx -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:$OCCLUM_VERSION-ubuntu18.04);
        else
          echo "Unsupported Hardware"
        fi;
        echo "occlum_test=$occlum_test" >> $GITHUB_ENV

    - name: Update PCCS server
      run: docker exec $occlum_test bash -c "sed -r -i 's/PCCS_URL=https:\/\/localhost:8081\/sgx\/certification\/v3\//PCCS_URL=https:\/\/sgx-dcap-server.cn-shanghai.aliyuncs.com\/sgx\/certification\/v3\//g' /etc/sgx_default_qcnl.conf"

    - name: Change download source of crates.io
      run: |
        docker exec $occlum_test bash -c "cat <<- EOF >/root/.cargo/config
        [source.crates-io]
        registry = \"https://github.com/rust-lang/crates.io-index\"
        replace-with = 'ustc'
        [source.ustc]
        registry = \"git://mirrors.ustc.edu.cn/crates.io-index\"
        EOF"

    - name: Build dependencies
      run: docker exec $occlum_test bash -c "cargo uninstall sccache || true; cd /root/occlum; make submodule"

    - name: Build source
      run: docker exec $occlum_test bash -c "source /opt/intel/sgxsdk/environment; cd /root/occlum; OCCLUM_COV=1 make install"

    - name: Integration test
      run:  docker exec $occlum_test bash -c "cd /root/occlum; make test"

    - name: Integration test with Glibc
      run:  docker exec $occlum_test bash -c "cd /root/occlum; make test-glibc"

    - name: Upload coverage report
      run: docker exec $occlum_test bash -c "cd /root/occlum/build/internal/src/libos/cargo-target/debug/deps; export CODECOV_TOKEN="${{ secrets.COV_TOKEN }}"; bash <(curl -s https://codecov.io/bash)"

    - name: Clean the environment
      if: ${{ always() }}
      run: docker stop $occlum_test


  Make-test-on-ubuntu:
    if: github.event_name == 'push' || ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
    runs-on: ${{ matrix.self_runner }}
    strategy:
      matrix:
        self_runner: [[self-hosted, SGX1-HW], [self-hosted, SGX2-HW]]

    steps:
    - name: Clean before running
      run: |
        sudo chown -R ${{ secrets.CI_ADMIN }} "${{ github.workspace }}"

    - name: Checkout code
      if: github.event_name == 'push'
      uses: actions/checkout@v2
      with:
        submodules: true

    - name: Checkout code from fork
      # This step is only needed when the pull request is labeled.
      if: ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
      uses: actions/checkout@v2
      with:
        # For pull request, we need to merge the commit from fork to the base
        ref: refs/pull/${{ github.event.pull_request.number }}/merge
        submodules: true

    - name: Get Occlum version
      run: echo "OCCLUM_VERSION=$(grep 'Version =' src/pal/include/occlum_version.h | awk '{print $4}')" >> $GITHUB_ENV;

    - name: Create container
      run: |
        if [[ "${{ matrix.self_runner[1] }}" == "SGX1-HW" ]]; then
          occlum_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host --device /dev/isgx -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:$OCCLUM_VERSION-ubuntu18.04);
        elif [[ "${{ matrix.self_runner[1] }}" == "SGX2-HW" ]]; then
          occlum_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host -v /dev/sgx:/dev/sgx -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:$OCCLUM_VERSION-ubuntu18.04);
        else
          echo "Unsupported Hardware"
        fi;
        echo "occlum_test=$occlum_test" >> $GITHUB_ENV

    - name: Update PCCS server
      run: docker exec $occlum_test bash -c "sed -r -i 's/PCCS_URL=https:\/\/localhost:8081\/sgx\/certification\/v3\//PCCS_URL=https:\/\/sgx-dcap-server.cn-shanghai.aliyuncs.com\/sgx\/certification\/v3\//g' /etc/sgx_default_qcnl.conf"

    - name: Change download source of crates.io
      run: |
        docker exec $occlum_test bash -c "cat <<- EOF >/root/.cargo/config
        [source.crates-io]
        registry = \"https://github.com/rust-lang/crates.io-index\"
        replace-with = 'ustc'
        [source.ustc]
        registry = \"git://mirrors.ustc.edu.cn/crates.io-index\"
        EOF"

    - name: Build dependencies
      run: docker exec $occlum_test bash -c "cargo uninstall sccache || true; cd /root/occlum; make submodule"

    - name: Build source
      run: docker exec $occlum_test bash -c "source /opt/intel/sgxsdk/environment; cd /root/occlum; OCCLUM_RELEASE_BUILD=y make install"

    - name: Integration test
      run:  docker exec $occlum_test bash -c "cd /root/occlum; OCCLUM_LOG_LEVEL=trace make test"

    - name: Integration test with Glibc
      run:  docker exec $occlum_test bash -c "cd /root/occlum; OCCLUM_LOG_LEVEL=trace make test-glibc"

    - name: Clean the environment
      if: ${{ always() }}
      run: docker stop $occlum_test


  C_cpp_rust_golang_embedded_mode_support_test:
    if: github.event_name == 'push' || ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
    runs-on: ${{ matrix.self_runner }}
    strategy:
      matrix:
        self_runner: [[self-hosted, SGX1-HW], [self-hosted, SGX2-HW]]

    steps:
    - name: Clean before running
      run: |
        sudo chown -R ${{ secrets.CI_ADMIN }} "${{ github.workspace }}"

    - name: Checkout code
      if: github.event_name == 'push'
      uses: actions/checkout@v2
      with:
        submodules: true

    - name: Checkout code from fork
      if: ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
      uses: actions/checkout@v2
      with:
        ref: refs/pull/${{ github.event.pull_request.number }}/merge
        submodules: true

    - name: Get Occlum version
      run: echo "OCCLUM_VERSION=$(grep 'Version =' src/pal/include/occlum_version.h | awk '{print $4}')" >> $GITHUB_ENV;

    - name: Create container
      run: |
        if [[ "${{ matrix.self_runner[1] }}" == "SGX1-HW" ]]; then
          language_support_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host --device /dev/isgx -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:$OCCLUM_VERSION-ubuntu18.04);
        elif [[ "${{ matrix.self_runner[1] }}" == "SGX2-HW" ]]; then
          language_support_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host -v /dev/sgx:/dev/sgx -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:$OCCLUM_VERSION-ubuntu18.04);
        else
          echo "Unsupported Hardware"
        fi;
        echo "language_support_test=$language_support_test" >> $GITHUB_ENV

    - name: Configure dependency source
      run: |
        docker exec $language_support_test bash -c "cat <<- EOF >/root/.cargo/config
        [source.crates-io]
        registry = \"https://github.com/rust-lang/crates.io-index\"
        replace-with = 'ustc'
        [source.ustc]
        registry = \"git://mirrors.ustc.edu.cn/crates.io-index\"
        EOF"

    - name: Build dependencies
      run: docker exec $language_support_test bash -c "cargo uninstall sccache || true; cd /root/occlum; make submodule"

    - name: Make install
      run: docker exec $language_support_test bash -c "source /opt/intel/sgxsdk/environment; cd /root/occlum; OCCLUM_RELEASE_BUILD=1 make install"

    - name: C test
      run: docker exec $language_support_test bash -c "cd /root/occlum/demos/hello_c && make;
            occlum new occlum_instance;
            cp hello_world occlum_instance/image/bin;
            cd occlum_instance && occlum build;
            occlum run /bin/hello_world"

    - name: C with encrypted image test
      run: docker exec $language_support_test bash -c "cd /root/occlum/demos/hello_c && make;
            rm -rf occlum_instance && occlum new occlum_instance;
            occlum gen-image-key occlum_instance/image_key;
            cp hello_world occlum_instance/image/bin;
            cd occlum_instance && occlum build --image-key ./image_key --buildin-image-key;
            occlum run /bin/hello_world"

    - name: C++ test
      run: docker exec $language_support_test bash -c "cd /root/occlum/demos/hello_cc && make;
            occlum new occlum_instance;
            cp hello_world occlum_instance/image/bin;
            cd occlum_instance && occlum build;
            occlum run /bin/hello_world"

    - name: Rust test
      run: docker exec $language_support_test bash -c "cd /root/occlum/demos/rust && ./run_rust_demo_on_occlum.sh"

    - name: Embedded mode test
      run: docker exec $language_support_test bash -c "cd /root/occlum/demos/embedded_mode && make;
            make test"

    - name: Run Golang sqlite test
      run: docker exec $language_support_test bash -c "export GO111MODULE=on && export GOPROXY=https://goproxy.cn;
            cd /root/occlum/demos/golang/go_sqlite/ && ./run_go_sqlite_demo.sh"

    - name: Go server set up and run
      run: docker exec $language_support_test bash -c "export GO111MODULE=on && export GOPROXY=https://goproxy.cn;
            cd /root/occlum/demos/golang/web_server && occlum-go mod init web_server && occlum-go get -u -v github.com/gin-gonic/gin;
            occlum-go build -o web_server ./web_server.go;
            ./run_golang_on_occlum.sh" &

    - name: Set up Golang grpc pingpong test
      run: docker exec $language_support_test bash -c "export GO111MODULE=on && export GOPROXY=https://goproxy.cn;
            cd /root/occlum/demos/golang/grpc_pingpong && ./prepare_ping_pong.sh"

    - name: Start Golang grpc pingpong server
      run: docker exec $language_support_test bash -c "cd /root/occlum/demos/golang/grpc_pingpong && ./run_pong_on_occlum.sh" &

    - name: Run Golang grpc ping test
      run: |
        sleep ${{ env.nap_time }};
        docker exec $language_support_test bash -c "cd /root/occlum/demos/golang/grpc_pingpong && ./run_ping_on_occlum.sh"

    # Sleeps longer to make sure the server is up.
    - name: Curl test
      run: |
        sleep ${{ env.nap_time }};
        docker exec $language_support_test bash -c "curl http://127.0.0.1:8090/ping"

    - name: Clean the environment
      if: ${{ always() }}
      run: docker stop $language_support_test


  Java_support_test:
    if: github.event_name == 'push' || ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
    runs-on: ${{ matrix.self_runner }}
    strategy:
      matrix:
        self_runner: [[self-hosted, SGX1-HW], [self-hosted, SGX2-HW]]

    steps:
    - name: Clean before running
      run: |
        sudo chown -R ${{ secrets.CI_ADMIN }} "${{ github.workspace }}"

    - name: Checkout code
      if: github.event_name == 'push'
      uses: actions/checkout@v2
      with:
        submodules: true

    - name: Checkout code from fork
      if: ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
      uses: actions/checkout@v2
      with:
        ref: refs/pull/${{ github.event.pull_request.number }}/merge
        submodules: true

    - name: Get Occlum version
      run: echo "OCCLUM_VERSION=$(grep 'Version =' src/pal/include/occlum_version.h | awk '{print $4}')" >> $GITHUB_ENV;

    - name: Create container
      run: |
        if [[ "${{ matrix.self_runner[1] }}" == "SGX1-HW" ]]; then
          java_support_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host --device /dev/isgx -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:$OCCLUM_VERSION-ubuntu18.04);
        elif [[ "${{ matrix.self_runner[1] }}" == "SGX2-HW" ]]; then
          java_support_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host -v /dev/sgx:/dev/sgx -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:$OCCLUM_VERSION-ubuntu18.04);
        else
          echo "Unsupported Hardware"
        fi;
        echo "java_support_test=$java_support_test" >> $GITHUB_ENV

    - name: Configure dependency source
      run: |
        docker exec $java_support_test bash -c "cat <<- EOF >/root/.cargo/config
        [source.crates-io]
        registry = \"https://github.com/rust-lang/crates.io-index\"
        replace-with = 'ustc'
        [source.ustc]
        registry = \"git://mirrors.ustc.edu.cn/crates.io-index\"
        EOF"

    - name: Build dependencies
      run: docker exec $java_support_test bash -c "cargo uninstall sccache || true; cd /root/occlum; make submodule"

    - name: Make install
      run: docker exec $java_support_test bash -c "source /opt/intel/sgxsdk/environment; cd /root/occlum; OCCLUM_RELEASE_BUILD=1 make install"

    - name: Compile Java
      run: docker exec $java_support_test bash -c "cd /root/occlum/demos/java && occlum-javac ./hello_world/Main.java"

    - name: Run hello world
      run: docker exec $java_support_test bash -c "cd /root/occlum/demos/java && ./run_java_on_occlum.sh hello"

    - name: Compile processBuilder demo
      run: docker exec $java_support_test bash -c "cd /root/occlum/demos/java && occlum-javac ./processBuilder/processBuilder.java"

    - name: Run processBuilder
      run: docker exec $java_support_test bash -c "cd /root/occlum/demos/java && ./run_java_on_occlum.sh processBuilder"

    - name: Clean the environment
      if: ${{ always() }}
      run: docker stop $java_support_test


  Bazel_test:
    if: github.event_name == 'push' || ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
    runs-on: ${{ matrix.self_runner }}
    strategy:
      matrix:
        self_runner: [[self-hosted, SGX1-HW], [self-hosted, SGX2-HW]]

    steps:
    - name: Clean before running
      run: |
        sudo chown -R ${{ secrets.CI_ADMIN }} "${{ github.workspace }}"

    - name: Checkout code
      if: github.event_name == 'push'
      uses: actions/checkout@v2
      with:
        submodules: true

    - name: Checkout code from fork
      if: ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
      uses: actions/checkout@v2
      with:
        ref: refs/pull/${{ github.event.pull_request.number }}/merge
        submodules: true

    - name: Get Occlum version
      run: echo "OCCLUM_VERSION=$(grep 'Version =' src/pal/include/occlum_version.h | awk '{print $4}')" >> $GITHUB_ENV;

    - name: Create container
      run: |
        if [[ "${{ matrix.self_runner[1] }}" == "SGX1-HW" ]]; then
          hello_bazel_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host --device /dev/isgx -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:$OCCLUM_VERSION-ubuntu18.04);
        elif [[ "${{ matrix.self_runner[1] }}" == "SGX2-HW" ]]; then
          hello_bazel_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host -v /dev/sgx:/dev/sgx -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:$OCCLUM_VERSION-ubuntu18.04);
        else
          echo "Unsupported Hardware"
        fi;
        echo "hello_bazel_test=$hello_bazel_test" >> $GITHUB_ENV

    - name: Configure dependency source
      run: |
        docker exec $hello_bazel_test bash -c "cat <<- EOF >/root/.cargo/config
        [source.crates-io]
        registry = \"https://github.com/rust-lang/crates.io-index\"
        replace-with = 'ustc'
        [source.ustc]
        registry = \"git://mirrors.ustc.edu.cn/crates.io-index\"
        EOF"

    - name: Build dependencies
      run: docker exec $hello_bazel_test bash -c "cargo uninstall sccache || true; cd /root/occlum; make submodule"

    - name: Make install
      run: docker exec $hello_bazel_test bash -c "source /opt/intel/sgxsdk/environment; cd /root/occlum; OCCLUM_RELEASE_BUILD=1 make install"

    - name: Config git proxy
      run: |
        docker exec $hello_bazel_test bash -c "git config --global http.proxy socks5://localhost:5432"
        docker exec $hello_bazel_test bash -c "git config --global https.proxy socks5://localhost:5432"

    - name: Install bazel
      run: docker exec $hello_bazel_test bash -c "cd /root/occlum/demos/hello_bazel && wget https://github.com/bazelbuild/bazel/releases/download/3.2.0/bazel-3.2.0-installer-linux-x86_64.sh;
              chmod +x bazel-3.2.0-installer-linux-x86_64.sh;
              ./bazel-3.2.0-installer-linux-x86_64.sh"

    - name: Build bazel dependencies
      run: docker exec $hello_bazel_test bash -c "cd /root/occlum/demos/hello_bazel && ./build_bazel_sample.sh"

    - name: Test bazel
      run: docker exec $hello_bazel_test bash -c "cd /root/occlum/demos/hello_bazel && occlum new occlum_instance;
            cp examples/cpp-tutorial/stage3/bazel-bin/main/hello-world occlum_instance/image/bin;
            cd occlum_instance && occlum build;
            occlum run /bin/hello-world"

    - name: Clean the environment
      run: docker stop $hello_bazel_test


  Fish_test:
    if: github.event_name == 'push' || ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
    runs-on: ${{ matrix.self_runner }}
    strategy:
      matrix:
        self_runner: [[self-hosted, SGX1-HW], [self-hosted, SGX2-HW]]

    steps:
    - name: Clean before running
      run: |
        sudo chown -R ${{ secrets.CI_ADMIN }} "${{ github.workspace }}"

    - name: Checkout code
      if: github.event_name == 'push'
      uses: actions/checkout@v2
      with:
        submodules: true

    - name: Checkout code from fork
      if: ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
      uses: actions/checkout@v2
      with:
        ref: refs/pull/${{ github.event.pull_request.number }}/merge
        submodules: true

    - name: Get Occlum version
      run: echo "OCCLUM_VERSION=$(grep 'Version =' src/pal/include/occlum_version.h | awk '{print $4}')" >> $GITHUB_ENV;

    - name: Create container
      run: |
        if [[ "${{ matrix.self_runner[1] }}" == "SGX1-HW" ]]; then
          fish_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host --device /dev/isgx -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:$OCCLUM_VERSION-ubuntu18.04);
        elif [[ "${{ matrix.self_runner[1] }}" == "SGX2-HW" ]]; then
          fish_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host -v /dev/sgx:/dev/sgx -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:$OCCLUM_VERSION-ubuntu18.04);
        else
          echo "Unsupported Hardware"
        fi;
        echo "fish_test=$fish_test" >> $GITHUB_ENV

    - name: Configure dependency source
      run: |
        docker exec $fish_test bash -c "cat <<- EOF >/root/.cargo/config
        [source.crates-io]
        registry = \"https://github.com/rust-lang/crates.io-index\"
        replace-with = 'ustc'
        [source.ustc]
        registry = \"git://mirrors.ustc.edu.cn/crates.io-index\"
        EOF"

    - name: Build dependencies
      run: docker exec $fish_test bash -c "cargo uninstall sccache || true; cd /root/occlum; make submodule"

    - name: Make install
      run: docker exec $fish_test bash -c "source /opt/intel/sgxsdk/environment; cd /root/occlum; OCCLUM_RELEASE_BUILD=1 make install"

    - name: Config git proxy
      run: |
        docker exec $fish_test bash -c "git config --global http.proxy socks5://localhost:5432"
        docker exec $fish_test bash -c "git config --global https.proxy socks5://localhost:5432"

    - name: Build Fish dependencies
      run: docker exec $fish_test bash -c "cd /root/occlum/demos/fish && ./download_and_build.sh"

    - name: Run Fish test
      run: docker exec $fish_test bash -c "cd /root/occlum/demos/fish && ./run_fish_test.sh"

    - name: Run Fish process rlimit test
      run: docker exec $fish_test bash -c "cd /root/occlum/demos/fish && ./run_per_process_config_test.sh"

    - name: Clean the environment
      if: ${{ always() }}
      run: docker stop $fish_test


  Xgboost_test:
    if: github.event_name == 'push' || ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
    runs-on: ${{ matrix.self_runner }}
    strategy:
      matrix:
        self_runner: [[self-hosted, SGX1-HW], [self-hosted, SGX2-HW]]

    steps:
    - name: Clean before running
      run: |
        sudo chown -R ${{ secrets.CI_ADMIN }} "${{ github.workspace }}"

    - name: Checkout code
      if: github.event_name == 'push'
      uses: actions/checkout@v2
      with:
        submodules: true

    - name: Checkout code from fork
      if: ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
      uses: actions/checkout@v2
      with:
        ref: refs/pull/${{ github.event.pull_request.number }}/merge
        submodules: true

    - name: Get Occlum version
      run: echo "OCCLUM_VERSION=$(grep 'Version =' src/pal/include/occlum_version.h | awk '{print $4}')" >> $GITHUB_ENV;

    - name: Create container
      run: |
        if [[ "${{ matrix.self_runner[1] }}" == "SGX1-HW" ]]; then
          xgboost_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host --device /dev/isgx -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:$OCCLUM_VERSION-ubuntu18.04);
        elif [[ "${{ matrix.self_runner[1] }}" == "SGX2-HW" ]]; then
          xgboost_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host -v /dev/sgx:/dev/sgx -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:$OCCLUM_VERSION-ubuntu18.04);
        else
          echo "Unsupported Hardware"
        fi;
        echo "xgboost_test=$xgboost_test" >> $GITHUB_ENV

    - name: Configure dependency source
      run: |
        docker exec $xgboost_test bash -c "cat <<- EOF >/root/.cargo/config
        [source.crates-io]
        registry = \"https://github.com/rust-lang/crates.io-index\"
        replace-with = 'ustc'
        [source.ustc]
        registry = \"git://mirrors.ustc.edu.cn/crates.io-index\"
        EOF"

    - name: Build dependencies
      run: docker exec $xgboost_test bash -c "cargo uninstall sccache || true; cd /root/occlum; make submodule"

    - name: Make install
      run: docker exec $xgboost_test bash -c "source /opt/intel/sgxsdk/environment; cd /root/occlum; OCCLUM_RELEASE_BUILD=1 make install"

    - name: Config git proxy
      run: |
        docker exec $xgboost_test bash -c "git config --global http.proxy socks5://localhost:5432"
        docker exec $xgboost_test bash -c "git config --global https.proxy socks5://localhost:5432"

    - name: Build xgboost dependencies
      run: docker exec $xgboost_test bash -c "cd /root/occlum/demos/xgboost && ./download_and_build_xgboost.sh"

    - name: Run xgboost test
      run: docker exec $xgboost_test bash -c "cd /root/occlum/demos/xgboost && make test"

    - name: Run xgboost cluster test
      run: docker exec $xgboost_test bash -c "cd /root/occlum/demos/xgboost && make test-local-cluster"

    - name: Clean the environment
      if: ${{ always() }}
      run: docker stop $xgboost_test


  Sqlite_test:
    if: github.event_name == 'push' || ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
    runs-on: ${{ matrix.self_runner }}
    strategy:
      matrix:
        self_runner: [[self-hosted, SGX1-HW], [self-hosted, SGX2-HW]]

    steps:
    - name: Clean before running
      run: |
        sudo chown -R ${{ secrets.CI_ADMIN }} "${{ github.workspace }}"

    - name: Checkout code
      if: github.event_name == 'push'
      uses: actions/checkout@v2
      with:
        submodules: true

    - name: Checkout code from fork
      if: ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
      uses: actions/checkout@v2
      with:
        ref: refs/pull/${{ github.event.pull_request.number }}/merge
        submodules: true

    - name: Get Occlum version
      run: echo "OCCLUM_VERSION=$(grep 'Version =' src/pal/include/occlum_version.h | awk '{print $4}')" >> $GITHUB_ENV;

    - name: Create container
      run: |
        if [[ "${{ matrix.self_runner[1] }}" == "SGX1-HW" ]]; then
          sqlite_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host --device /dev/isgx -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:$OCCLUM_VERSION-ubuntu18.04);
        elif [[ "${{ matrix.self_runner[1] }}" == "SGX2-HW" ]]; then
          sqlite_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host -v /dev/sgx:/dev/sgx -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:$OCCLUM_VERSION-ubuntu18.04);
        else
          echo "Unsupported Hardware"
        fi;
        echo "sqlite_test=$sqlite_test" >> $GITHUB_ENV

    - name: Configure dependency source
      run: |
        docker exec $sqlite_test bash -c "cat <<- EOF >/root/.cargo/config
        [source.crates-io]
        registry = \"https://github.com/rust-lang/crates.io-index\"
        replace-with = 'ustc'
        [source.ustc]
        registry = \"git://mirrors.ustc.edu.cn/crates.io-index\"
        EOF"

    - name: Build dependencies
      run: docker exec $sqlite_test bash -c "cargo uninstall sccache || true; cd /root/occlum; make submodule"

    - name: Make install
      run: docker exec $sqlite_test bash -c "source /opt/intel/sgxsdk/environment; cd /root/occlum; OCCLUM_RELEASE_BUILD=1 make install"

    - name: Config git proxy
      run: |
        docker exec $sqlite_test bash -c "git config --global http.proxy socks5://localhost:5432"
        docker exec $sqlite_test bash -c "git config --global https.proxy socks5://localhost:5432"

    - name: Build sqlite dependencies
      run: docker exec $sqlite_test bash -c "cd /root/occlum/demos/sqlite && ./download_and_build_sqlite.sh"

    - name: Run sqlite test
      run: docker exec $sqlite_test bash -c "cd /root/occlum/demos/sqlite && ./run_sqlite_on_occlum.sh"

    - name: Clean the environment
      if: ${{ always() }}
      run: docker stop $sqlite_test


  Python_musl_support_test:
    if: github.event_name == 'push' || ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
    runs-on: ${{ matrix.self_runner }}
    strategy:
      matrix:
        self_runner: [[self-hosted, SGX1-HW], [self-hosted, SGX2-HW]]

    steps:
    - name: Clean before running
      run: |
        sudo chown -R ${{ secrets.CI_ADMIN }} "${{ github.workspace }}"

    - name: Checkout code
      if: github.event_name == 'push'
      uses: actions/checkout@v2
      with:
        submodules: true

    - name: Checkout code from fork
      if: ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
      uses: actions/checkout@v2
      with:
        ref: refs/pull/${{ github.event.pull_request.number }}/merge
        submodules: true

    - name: Create container
      run: |
        docker pull occlumbackup/occlum:latest-ubuntu18.04-python
        if [[ "${{ matrix.self_runner[1] }}" == "SGX1-HW" ]]; then
          python_musl_support_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host --device /dev/isgx -v $GITHUB_WORKSPACE:/root/occlum occlumbackup/occlum:latest-ubuntu18.04-python);
        elif [[ "${{ matrix.self_runner[1] }}" == "SGX2-HW" ]]; then
          python_musl_support_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host -v /dev/sgx:/dev/sgx -v $GITHUB_WORKSPACE:/root/occlum occlumbackup/occlum:latest-ubuntu18.04-python);
        else
          echo "Unsupported Hardware"
        fi;
        echo "python_musl_support_test=$python_musl_support_test" >> $GITHUB_ENV

    - name: Configure dependency source
      run: |
        docker exec $python_musl_support_test bash -c "cat <<- EOF >/root/.cargo/config
        [source.crates-io]
        registry = \"https://github.com/rust-lang/crates.io-index\"
        replace-with = 'tuna'
        [source.tuna]
        registry = \"https://mirrors.tuna.tsinghua.edu.cn/git/crates.io-index.git\"
        EOF"

    - name: Build dependencies
      run: docker exec $python_musl_support_test bash -c "cargo uninstall sccache || true; cd /root/occlum; make submodule"

    - name: Make install
      run: docker exec $python_musl_support_test bash -c "source /opt/intel/sgxsdk/environment; cd /root/occlum; OCCLUM_RELEASE_BUILD=1 make install"

    - name: Run python musl support test
      run: docker exec $python_musl_support_test bash -c "cd /root/occlum/demos/python/python_musl; ./run_python_on_occlum.sh"

    - name: Check result
      run: docker exec $python_musl_support_test bash -c "cd /root/occlum/demos/python/python_musl/occlum_instance; cat smvlight.dat"

    - name: Clean the environment
      if: ${{ always() }}
      run: docker stop $python_musl_support_test


  Openvino_test:
    if: github.event_name == 'push' || ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
    runs-on: ${{ matrix.self_runner }}
    strategy:
      matrix:
        self_runner: [[self-hosted, SGX1-HW], [self-hosted, SGX2-HW]]

    steps:
    - name: Clean before running
      run: |
        sudo chown -R ${{ secrets.CI_ADMIN }} "${{ github.workspace }}"

    - name: Checkout code
      if: github.event_name == 'push'
      uses: actions/checkout@v2
      with:
        submodules: true

    - name: Checkout code from fork
      if: ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
      uses: actions/checkout@v2
      with:
        ref: refs/pull/${{ github.event.pull_request.number }}/merge
        submodules: true

    - name: Create container
      run: |
        docker pull occlumbackup/occlum:latest-ubuntu18.04-openvino
        if [[ "${{ matrix.self_runner[1] }}" == "SGX1-HW" ]]; then
          openvino_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host --device /dev/isgx -v $GITHUB_WORKSPACE:/root/occlum occlumbackup/occlum:latest-ubuntu18.04-openvino);
        elif [[ "${{ matrix.self_runner[1] }}" == "SGX2-HW" ]]; then
          openvino_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host -v /dev/sgx:/dev/sgx -v $GITHUB_WORKSPACE:/root/occlum occlumbackup/occlum:latest-ubuntu18.04-openvino);
        else
          echo "Unsupported Hardware"
        fi;
        echo "openvino_test=$openvino_test" >> $GITHUB_ENV

    - name: Configure dependency source
      run: |
        docker exec $openvino_test bash -c "cat <<- EOF >/root/.cargo/config
        [source.crates-io]
        registry = \"https://github.com/rust-lang/crates.io-index\"
        replace-with = 'ustc'
        [source.ustc]
        registry = \"git://mirrors.ustc.edu.cn/crates.io-index\"
        EOF"

    - name: Build dependencies
      run: docker exec $openvino_test bash -c "cargo uninstall sccache || true; cd /root/occlum; make submodule"

    - name: Make install
      run: docker exec $openvino_test bash -c "source /opt/intel/sgxsdk/environment; cd /root/occlum; OCCLUM_RELEASE_BUILD=1 make install"

    - name: Run openVINO benchmark
      run: docker exec $openvino_test bash -c "cd /root/demos/openvino && ./run_benchmark_on_occlum.sh"

    - name: Clean the environment
      if: ${{ always() }}
      run: docker stop $openvino_test


  Grpc_test:
    if: github.event_name == 'push' || ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
    runs-on: ${{ matrix.self_runner }}
    strategy:
      matrix:
        self_runner: [[self-hosted, SGX1-HW], [self-hosted, SGX2-HW]]

    steps:
    - name: Clean before running
      run: |
        sudo chown -R ${{ secrets.CI_ADMIN }} "${{ github.workspace }}"

    - name: Checkout code
      if: github.event_name == 'push'
      uses: actions/checkout@v2
      with:
        submodules: true

    - name: Checkout code from fork
      if: ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
      uses: actions/checkout@v2
      with:
        ref: refs/pull/${{ github.event.pull_request.number }}/merge
        submodules: true

    - name: Create container
      run: |
        docker pull occlumbackup/occlum:latest-ubuntu18.04-grpc
        if [[ "${{ matrix.self_runner[1] }}" == "SGX1-HW" ]]; then
          grpc_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host --device /dev/isgx -v $GITHUB_WORKSPACE:/root/occlum occlumbackup/occlum:latest-ubuntu18.04-grpc);
        elif [[ "${{ matrix.self_runner[1] }}" == "SGX2-HW" ]]; then
          grpc_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host -v /dev/sgx:/dev/sgx -v $GITHUB_WORKSPACE:/root/occlum occlumbackup/occlum:latest-ubuntu18.04-grpc);
        else
          echo "Unsupported Hardware"
        fi;
        echo "grpc_test=$grpc_test" >> $GITHUB_ENV

    - name: Change download source of crates.io
      run: |
        docker exec $grpc_test bash -c "cat <<- EOF >/root/.cargo/config
        [source.crates-io]
        registry = \"https://github.com/rust-lang/crates.io-index\"
        replace-with = 'ustc'
        [source.ustc]
        registry = \"git://mirrors.ustc.edu.cn/crates.io-index\"
        EOF"

    - name: Build dependencies
      run: docker exec $grpc_test bash -c "cargo uninstall sccache || true; cd /root/occlum; make submodule"

    - name: Make install
      run: docker exec $grpc_test bash -c "source /opt/intel/sgxsdk/environment; cd /root/occlum; OCCLUM_RELEASE_BUILD=y make install"

    - name: Prepare grpc sample project
      run: docker exec $grpc_test bash -c "cd /root/demos/grpc && ./prepare_client_server.sh"

    - name: Run grpc server
      run: docker exec $grpc_test bash -c "cd /root/demos/grpc && ./run_server_on_occlum.sh" &

    - name: Run grpc client
      run: |
        sleep ${{ env.nap_time }};
        docker exec $grpc_test bash -c "cd /root/demos/grpc && ./run_client_on_occlum.sh"

    - name: Clean the environment
      if: ${{ always() }}
      run: docker stop $grpc_test


  Gvisor_test:
    if: github.event_name == 'push' || ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
    runs-on: ${{ matrix.self_runner }}
    strategy:
      matrix:
        self_runner: [[self-hosted, SGX1-HW], [self-hosted, SGX2-HW]]

    steps:
    - name: Clean before running
      run: |
        sudo chown -R ${{ secrets.CI_ADMIN }} "${{ github.workspace }}"

    - name: Checkout code
      if: github.event_name == 'push'
      uses: actions/checkout@v2
      with:
        submodules: true

    - name: Checkout code from fork
      if: ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
      uses: actions/checkout@v2
      with:
        ref: refs/pull/${{ github.event.pull_request.number }}/merge
        submodules: true

    - name: Create container
      run: |
        docker pull occlumbackup/occlum:latest-ubuntu18.04-gvisor_test
        if [[ "${{ matrix.self_runner[1] }}" == "SGX1-HW" ]]; then
          gvisor_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host --device /dev/isgx -v $GITHUB_WORKSPACE:/root/occlum occlumbackup/occlum:latest-ubuntu18.04-gvisor_test);
        elif [[ "${{ matrix.self_runner[1] }}" == "SGX2-HW" ]]; then
          gvisor_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host -v /dev/sgx:/dev/sgx -v $GITHUB_WORKSPACE:/root/occlum occlumbackup/occlum:latest-ubuntu18.04-gvisor_test);
        else
          echo "Unsupported Hardware"
        fi;
        echo "gvisor_test=$gvisor_test" >> $GITHUB_ENV

    - name: Change download source of crates.io
      run: |
        docker exec $gvisor_test bash -c "cat <<- EOF >/root/.cargo/config
        [source.crates-io]
        registry = \"https://github.com/rust-lang/crates.io-index\"
        replace-with = 'ustc'
        [source.ustc]
        registry = \"git://mirrors.ustc.edu.cn/crates.io-index\"
        EOF"

    - name: Build dependencies
      run: docker exec $gvisor_test bash -c "cargo uninstall sccache || true; cd /root/occlum; make submodule"

    - name: Make install
      run: docker exec $gvisor_test bash -c "source /opt/intel/sgxsdk/environment; cd /root/occlum; OCCLUM_RELEASE_BUILD=y make install"

    - name: Run gvisor syscall test
      run: docker exec $gvisor_test bash -c "cd /root/gvisor_occlum; ./run_occlum_passed_tests.sh"

    - name: Clean the environment
      if: ${{ always() }}
      run: docker stop $gvisor_test


  Test_rpm_deploy:
    if: github.event_name == 'push'
    runs-on: ${{ matrix.self_runner }}
    strategy:
      matrix:
        self_runner: [[self-hosted, SGX1-HW], [self-hosted, SGX2-HW]]

    steps:
    - name: Clean before running
      run: |
        sudo chown -R ${{ secrets.CI_ADMIN }} "${{ github.workspace }}"

    - name: Checkout code
      if: github.event_name == 'push'
      uses: actions/checkout@v2
      with:
        submodules: false

    - name: Test deployment
      run: |
        cd demos/deployment
        if [[ "${{ matrix.self_runner[1] }}" == "SGX1-HW" ]]; then
          ./deploy_image_test.sh centos8.2
        elif [[ "${{ matrix.self_runner[1] }}" == "SGX2-HW" ]]; then
          DEVICE_OPTION="-v /dev/sgx:/dev/sgx" ./deploy_image_test.sh centos8.2
        else
          echo "Unsupported Hardware"
          exit 1
        fi;

    - name: Clean the environment
      if: ${{ always() }}
      run: |
        docker stop centos8.2_deploy_test
        docker rm -f centos8.2_deploy_test


  Test_deb_deploy:
    if: github.event_name == 'push'
    runs-on: ${{ matrix.self_runner }}
    strategy:
      matrix:
        self_runner: [[self-hosted, SGX1-HW], [self-hosted, SGX2-HW]]

    steps:
    - name: Clean before running
      run: |
        sudo chown -R ${{ secrets.CI_ADMIN }} "${{ github.workspace }}"

    - name: Checkout code
      if: github.event_name == 'push'
      uses: actions/checkout@v2
      with:
        submodules: false

    - name: Test deployment
      run: |
        cd demos/deployment
        if [[ "${{ matrix.self_runner[1] }}" == "SGX1-HW" ]]; then
          ./deploy_image_test.sh ubuntu18.04
        elif [[ "${{ matrix.self_runner[1] }}" == "SGX2-HW" ]]; then
          DEVICE_OPTION="-v /dev/sgx:/dev/sgx" ./deploy_image_test.sh ubuntu18.04
        else
          echo "Unsupported Hardware"
          exit 1
        fi;

    - name: Clean the environment
      if: ${{ always() }}
      run: |
        docker stop ubuntu18.04_deploy_test
        docker rm -f ubuntu18.04_deploy_test


# Tensorflow_serving requires binary tensorflow_serving PIC, here we compile tensorflow_model_server before workflow
  Tensorflow_serving_test:
    if: github.event_name == 'push' || ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
    runs-on: ${{ matrix.self_runner }}
    strategy:
      matrix:
        # Tensorflow serving test requires AVX512 instruction support. Only the SGX2-HW machine has support for that.
        self_runner: [[self-hosted, SGX2-HW]]

    steps:
    - name: Clean before running
      run: |
        sudo chown -R ${{ secrets.CI_ADMIN }} "${{ github.workspace }}"

    - name: Checkout code
      if: github.event_name == 'push'
      uses: actions/checkout@v2
      with:
        submodules: true

    - name: Checkout code from fork
      if: ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
      uses: actions/checkout@v2
      with:
        ref: refs/pull/${{ github.event.pull_request.number }}/merge
        submodules: true

    - name: Create container
      run: |
        docker pull occlumbackup/occlum:latest-ubuntu18.04-tf_serving
        if [[ "${{ matrix.self_runner[1] }}" == "SGX1-HW" ]]; then
          tf_serving_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host --device /dev/isgx -v $GITHUB_WORKSPACE:/root/occlum occlumbackup/occlum:latest-ubuntu18.04-tf_serving);
        elif [[ "${{ matrix.self_runner[1] }}" == "SGX2-HW" ]]; then
          tf_serving_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host -v /dev/sgx:/dev/sgx -v $GITHUB_WORKSPACE:/root/occlum occlumbackup/occlum:latest-ubuntu18.04-tf_serving);
        else
          echo "Unsupported Hardware"
        fi;
        echo "tf_serving_test=$tf_serving_test" >> $GITHUB_ENV

    - name: Change download source of crates.io
      run: |
        docker exec $tf_serving_test bash -c "cat <<- EOF >/root/.cargo/config
        [source.crates-io]
        registry = \"https://github.com/rust-lang/crates.io-index\"
        replace-with = 'ustc'
        [source.ustc]
        registry = \"git://mirrors.ustc.edu.cn/crates.io-index\"
        EOF"

    - name: Build dependencies
      run: docker exec $tf_serving_test bash -c "cd /root/occlum; make submodule"

    - name: Make install
      run: docker exec $tf_serving_test bash -c "source /opt/intel/sgxsdk/environment; cd /root/occlum; OCCLUM_RELEASE_BUILD=1 make install"

    - name: Move dependencies to current demo
      run: docker exec $tf_serving_test bash -c "mv /root/tensorflow_model_server /root/occlum/demos/tensorflow/tensorflow_serving; mv /root/resnet50-v15-fp32 /root/occlum/demos/tensorflow/tensorflow_serving"

    - name: Generate SSL
      run: docker exec $tf_serving_test bash -c "cd /root/occlum/demos/tensorflow/tensorflow_serving; ./generate_ssl_config.sh localhost"

    - name: Run tf_serving server
      run: docker exec $tf_serving_test bash -c "cd /root/occlum/demos/tensorflow/tensorflow_serving; ./run_occlum_tf_serving.sh"

    - name: Run tf_serving client
      run: |
        sleep 120;
        docker exec $tf_serving_test bash -c "cd /root/occlum/demos/tensorflow/tensorflow_serving/client; ./benchmark.sh python3 localhost:8500 ../ssl_configure/server.crt"

    - name: Clean the environment
      if: ${{ always() }}
      run: docker stop $tf_serving_test

  Remote_attestation_test:
    if: github.event_name == 'push' || ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
    runs-on: ${{ matrix.self_runner }}
    strategy:
      matrix:
        self_runner: [[self-hosted, SGX2-HW]]

    steps:
    - name: Clean before running
      run: |
        sudo chown -R ${{ secrets.CI_ADMIN }} "${{ github.workspace }}"

    - name: Checkout code
      if: github.event_name == 'push'
      uses: actions/checkout@v2
      with:
        submodules: true

    - name: Checkout code from fork
      if: ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
      uses: actions/checkout@v2
      with:
        ref: refs/pull/${{ github.event.pull_request.number }}/merge
        submodules: true

    - name: Get Occlum version
      run: echo "OCCLUM_VERSION=$(grep 'Version =' src/pal/include/occlum_version.h | awk '{print $4}')" >> $GITHUB_ENV;

    - name: Create container
      run: |
        if [[ "${{ matrix.self_runner[1] }}" == "SGX2-HW" ]]; then
          ra_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host -v /dev/sgx:/dev/sgx -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:$OCCLUM_VERSION-ubuntu18.04);
        else
          echo "Unsupported Hardware"
        fi;
        echo "ra_test=$ra_test" >> $GITHUB_ENV

    - name: Update PCCS server
      run: docker exec $ra_test bash -c "sed -r -i 's/PCCS_URL=https:\/\/localhost:8081\/sgx\/certification\/v3\//PCCS_URL=https:\/\/sgx-dcap-server.cn-shanghai.aliyuncs.com\/sgx\/certification\/v3\//g' /etc/sgx_default_qcnl.conf"

    - name: Change download source of crates.io
      run: |
        docker exec $ra_test bash -c "cat <<- EOF >/root/.cargo/config
        [source.crates-io]
        registry = \"https://github.com/rust-lang/crates.io-index\"
        replace-with = 'ustc'
        [source.ustc]
        registry = \"git://mirrors.ustc.edu.cn/crates.io-index\"
        EOF"

    - name: Build dependencies
      run: docker exec $ra_test bash -c "cargo uninstall sccache || true; cd /root/occlum; make submodule"

    - name: Build source
      run: docker exec $ra_test bash -c "source /opt/intel/sgxsdk/environment; cd /root/occlum; OCCLUM_RELEASE_BUILD=y make install"

    - name: Build and run remote attestation demo
      run: docker exec $ra_test bash -c "cd /root/occlum/demos/remote_attestation/dcap; ./run_dcap_quote_on_occlum.sh"