1104 lines
45 KiB
YAML
1104 lines
45 KiB
YAML
name: SGX Hardware Mode Test
|
|
|
|
# Triggers the workflow on push and pull request labeled "SGX-hardware-test-required".
|
|
on:
|
|
push:
|
|
pull_request_target:
|
|
types: labeled
|
|
|
|
env:
|
|
nap_time: 60
|
|
|
|
jobs:
|
|
Collect-code-coverage:
|
|
if: github.event_name == 'push' || ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
|
|
runs-on: ${{ matrix.self_runner }}
|
|
strategy:
|
|
matrix:
|
|
self_runner: [[self-hosted, SGX1-HW], [self-hosted, SGX2-HW]]
|
|
|
|
steps:
|
|
- name: Clean before running
|
|
run: |
|
|
sudo chown -R ${{ secrets.CI_ADMIN }} "${{ github.workspace }}"
|
|
|
|
- name: Checkout code
|
|
if: github.event_name == 'push'
|
|
uses: actions/checkout@v2
|
|
with:
|
|
submodules: true
|
|
|
|
- name: Checkout code from fork
|
|
# This step is only needed when the pull request is labeled.
|
|
if: ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
|
|
uses: actions/checkout@v2
|
|
with:
|
|
# For pull request, we need to merge the commit from fork to the base
|
|
ref: refs/pull/${{ github.event.pull_request.number }}/merge
|
|
submodules: true
|
|
|
|
- name: Get Occlum version
|
|
run: echo "OCCLUM_VERSION=$(grep 'Version =' src/pal/include/occlum_version.h | awk '{print $4}')" >> $GITHUB_ENV;
|
|
|
|
- name: Create container
|
|
run: |
|
|
if [[ "${{ matrix.self_runner[1] }}" == "SGX1-HW" ]]; then
|
|
occlum_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host --device /dev/isgx -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:$OCCLUM_VERSION-ubuntu18.04);
|
|
elif [[ "${{ matrix.self_runner[1] }}" == "SGX2-HW" ]]; then
|
|
occlum_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host -v /dev/sgx:/dev/sgx -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:$OCCLUM_VERSION-ubuntu18.04);
|
|
else
|
|
echo "Unsupported Hardware"
|
|
fi;
|
|
echo "occlum_test=$occlum_test" >> $GITHUB_ENV
|
|
|
|
- name: Update PCCS server
|
|
run: docker exec $occlum_test bash -c "sed -r -i 's/PCCS_URL=https:\/\/localhost:8081\/sgx\/certification\/v3\//PCCS_URL=https:\/\/sgx-dcap-server.cn-shanghai.aliyuncs.com\/sgx\/certification\/v3\//g' /etc/sgx_default_qcnl.conf"
|
|
|
|
- name: Change download source of crates.io
|
|
run: |
|
|
docker exec $occlum_test bash -c "cat <<- EOF >/root/.cargo/config
|
|
[source.crates-io]
|
|
registry = \"https://github.com/rust-lang/crates.io-index\"
|
|
replace-with = 'ustc'
|
|
[source.ustc]
|
|
registry = \"git://mirrors.ustc.edu.cn/crates.io-index\"
|
|
EOF"
|
|
|
|
- name: Build dependencies
|
|
run: docker exec $occlum_test bash -c "cargo uninstall sccache || true; cd /root/occlum; make submodule"
|
|
|
|
- name: Build source
|
|
run: docker exec $occlum_test bash -c "source /opt/intel/sgxsdk/environment; cd /root/occlum; OCCLUM_COV=1 make install"
|
|
|
|
- name: Integration test
|
|
run: docker exec $occlum_test bash -c "cd /root/occlum; make test"
|
|
|
|
- name: Integration test with Glibc
|
|
run: docker exec $occlum_test bash -c "cd /root/occlum; make test-glibc"
|
|
|
|
- name: Upload coverage report
|
|
run: docker exec $occlum_test bash -c "cd /root/occlum/build/internal/src/libos/cargo-target/debug/deps; export CODECOV_TOKEN="${{ secrets.COV_TOKEN }}"; bash <(curl -s https://codecov.io/bash)"
|
|
|
|
- name: Clean the environment
|
|
if: ${{ always() }}
|
|
run: docker stop $occlum_test
|
|
|
|
|
|
Make-test-on-ubuntu:
|
|
if: github.event_name == 'push' || ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
|
|
runs-on: ${{ matrix.self_runner }}
|
|
strategy:
|
|
matrix:
|
|
self_runner: [[self-hosted, SGX1-HW], [self-hosted, SGX2-HW]]
|
|
|
|
steps:
|
|
- name: Clean before running
|
|
run: |
|
|
sudo chown -R ${{ secrets.CI_ADMIN }} "${{ github.workspace }}"
|
|
|
|
- name: Checkout code
|
|
if: github.event_name == 'push'
|
|
uses: actions/checkout@v2
|
|
with:
|
|
submodules: true
|
|
|
|
- name: Checkout code from fork
|
|
# This step is only needed when the pull request is labeled.
|
|
if: ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
|
|
uses: actions/checkout@v2
|
|
with:
|
|
# For pull request, we need to merge the commit from fork to the base
|
|
ref: refs/pull/${{ github.event.pull_request.number }}/merge
|
|
submodules: true
|
|
|
|
- name: Get Occlum version
|
|
run: echo "OCCLUM_VERSION=$(grep 'Version =' src/pal/include/occlum_version.h | awk '{print $4}')" >> $GITHUB_ENV;
|
|
|
|
- name: Create container
|
|
run: |
|
|
if [[ "${{ matrix.self_runner[1] }}" == "SGX1-HW" ]]; then
|
|
occlum_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host --device /dev/isgx -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:$OCCLUM_VERSION-ubuntu18.04);
|
|
elif [[ "${{ matrix.self_runner[1] }}" == "SGX2-HW" ]]; then
|
|
occlum_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host -v /dev/sgx:/dev/sgx -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:$OCCLUM_VERSION-ubuntu18.04);
|
|
else
|
|
echo "Unsupported Hardware"
|
|
fi;
|
|
echo "occlum_test=$occlum_test" >> $GITHUB_ENV
|
|
|
|
- name: Update PCCS server
|
|
run: docker exec $occlum_test bash -c "sed -r -i 's/PCCS_URL=https:\/\/localhost:8081\/sgx\/certification\/v3\//PCCS_URL=https:\/\/sgx-dcap-server.cn-shanghai.aliyuncs.com\/sgx\/certification\/v3\//g' /etc/sgx_default_qcnl.conf"
|
|
|
|
- name: Change download source of crates.io
|
|
run: |
|
|
docker exec $occlum_test bash -c "cat <<- EOF >/root/.cargo/config
|
|
[source.crates-io]
|
|
registry = \"https://github.com/rust-lang/crates.io-index\"
|
|
replace-with = 'ustc'
|
|
[source.ustc]
|
|
registry = \"git://mirrors.ustc.edu.cn/crates.io-index\"
|
|
EOF"
|
|
|
|
- name: Build dependencies
|
|
run: docker exec $occlum_test bash -c "cargo uninstall sccache || true; cd /root/occlum; make submodule"
|
|
|
|
- name: Build source
|
|
run: docker exec $occlum_test bash -c "source /opt/intel/sgxsdk/environment; cd /root/occlum; OCCLUM_RELEASE_BUILD=y make install"
|
|
|
|
- name: Integration test
|
|
run: docker exec $occlum_test bash -c "cd /root/occlum; OCCLUM_LOG_LEVEL=trace make test"
|
|
|
|
- name: Integration test with Glibc
|
|
run: docker exec $occlum_test bash -c "cd /root/occlum; OCCLUM_LOG_LEVEL=trace make test-glibc"
|
|
|
|
- name: Clean the environment
|
|
if: ${{ always() }}
|
|
run: docker stop $occlum_test
|
|
|
|
|
|
C_cpp_rust_golang_embedded_mode_support_test:
|
|
if: github.event_name == 'push' || ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
|
|
runs-on: ${{ matrix.self_runner }}
|
|
strategy:
|
|
matrix:
|
|
self_runner: [[self-hosted, SGX1-HW], [self-hosted, SGX2-HW]]
|
|
|
|
steps:
|
|
- name: Clean before running
|
|
run: |
|
|
sudo chown -R ${{ secrets.CI_ADMIN }} "${{ github.workspace }}"
|
|
|
|
- name: Checkout code
|
|
if: github.event_name == 'push'
|
|
uses: actions/checkout@v2
|
|
with:
|
|
submodules: true
|
|
|
|
- name: Checkout code from fork
|
|
if: ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
|
|
uses: actions/checkout@v2
|
|
with:
|
|
ref: refs/pull/${{ github.event.pull_request.number }}/merge
|
|
submodules: true
|
|
|
|
- name: Get Occlum version
|
|
run: echo "OCCLUM_VERSION=$(grep 'Version =' src/pal/include/occlum_version.h | awk '{print $4}')" >> $GITHUB_ENV;
|
|
|
|
- name: Create container
|
|
run: |
|
|
if [[ "${{ matrix.self_runner[1] }}" == "SGX1-HW" ]]; then
|
|
language_support_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host --device /dev/isgx -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:$OCCLUM_VERSION-ubuntu18.04);
|
|
elif [[ "${{ matrix.self_runner[1] }}" == "SGX2-HW" ]]; then
|
|
language_support_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host -v /dev/sgx:/dev/sgx -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:$OCCLUM_VERSION-ubuntu18.04);
|
|
else
|
|
echo "Unsupported Hardware"
|
|
fi;
|
|
echo "language_support_test=$language_support_test" >> $GITHUB_ENV
|
|
|
|
- name: Configure dependency source
|
|
run: |
|
|
docker exec $language_support_test bash -c "cat <<- EOF >/root/.cargo/config
|
|
[source.crates-io]
|
|
registry = \"https://github.com/rust-lang/crates.io-index\"
|
|
replace-with = 'ustc'
|
|
[source.ustc]
|
|
registry = \"git://mirrors.ustc.edu.cn/crates.io-index\"
|
|
EOF"
|
|
|
|
- name: Build dependencies
|
|
run: docker exec $language_support_test bash -c "cargo uninstall sccache || true; cd /root/occlum; make submodule"
|
|
|
|
- name: Make install
|
|
run: docker exec $language_support_test bash -c "source /opt/intel/sgxsdk/environment; cd /root/occlum; OCCLUM_RELEASE_BUILD=1 make install"
|
|
|
|
- name: C test
|
|
run: docker exec $language_support_test bash -c "cd /root/occlum/demos/hello_c && make;
|
|
occlum new occlum_instance;
|
|
cp hello_world occlum_instance/image/bin;
|
|
cd occlum_instance && occlum build;
|
|
occlum run /bin/hello_world"
|
|
|
|
- name: C with encrypted image test
|
|
run: docker exec $language_support_test bash -c "cd /root/occlum/demos/hello_c && make;
|
|
rm -rf occlum_instance && occlum new occlum_instance;
|
|
occlum gen-image-key occlum_instance/image_key;
|
|
cp hello_world occlum_instance/image/bin;
|
|
cd occlum_instance && occlum build --image-key ./image_key --buildin-image-key;
|
|
occlum run /bin/hello_world"
|
|
|
|
- name: C++ test
|
|
run: docker exec $language_support_test bash -c "cd /root/occlum/demos/hello_cc && make;
|
|
occlum new occlum_instance;
|
|
cp hello_world occlum_instance/image/bin;
|
|
cd occlum_instance && occlum build;
|
|
occlum run /bin/hello_world"
|
|
|
|
- name: Rust test
|
|
run: docker exec $language_support_test bash -c "cd /root/occlum/demos/rust && ./run_rust_demo_on_occlum.sh"
|
|
|
|
- name: Embedded mode test
|
|
run: docker exec $language_support_test bash -c "cd /root/occlum/demos/embedded_mode && make;
|
|
make test"
|
|
|
|
- name: Run Golang sqlite test
|
|
run: docker exec $language_support_test bash -c "export GO111MODULE=on && export GOPROXY=https://goproxy.cn;
|
|
cd /root/occlum/demos/golang/go_sqlite/ && ./run_go_sqlite_demo.sh"
|
|
|
|
- name: Go server set up and run
|
|
run: docker exec $language_support_test bash -c "export GO111MODULE=on && export GOPROXY=https://goproxy.cn;
|
|
cd /root/occlum/demos/golang/web_server && occlum-go mod init web_server && occlum-go get -u -v github.com/gin-gonic/gin;
|
|
occlum-go build -o web_server ./web_server.go;
|
|
./run_golang_on_occlum.sh" &
|
|
|
|
- name: Set up Golang grpc pingpong test
|
|
run: docker exec $language_support_test bash -c "export GO111MODULE=on && export GOPROXY=https://goproxy.cn;
|
|
cd /root/occlum/demos/golang/grpc_pingpong && ./prepare_ping_pong.sh"
|
|
|
|
- name: Start Golang grpc pingpong server
|
|
run: docker exec $language_support_test bash -c "cd /root/occlum/demos/golang/grpc_pingpong && ./run_pong_on_occlum.sh" &
|
|
|
|
- name: Run Golang grpc ping test
|
|
run: |
|
|
sleep ${{ env.nap_time }};
|
|
docker exec $language_support_test bash -c "cd /root/occlum/demos/golang/grpc_pingpong && ./run_ping_on_occlum.sh"
|
|
|
|
# Sleeps longer to make sure the server is up.
|
|
- name: Curl test
|
|
run: |
|
|
sleep ${{ env.nap_time }};
|
|
docker exec $language_support_test bash -c "curl http://127.0.0.1:8090/ping"
|
|
|
|
- name: Clean the environment
|
|
if: ${{ always() }}
|
|
run: docker stop $language_support_test
|
|
|
|
|
|
Java_support_test:
|
|
if: github.event_name == 'push' || ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
|
|
runs-on: ${{ matrix.self_runner }}
|
|
strategy:
|
|
matrix:
|
|
self_runner: [[self-hosted, SGX1-HW], [self-hosted, SGX2-HW]]
|
|
|
|
steps:
|
|
- name: Clean before running
|
|
run: |
|
|
sudo chown -R ${{ secrets.CI_ADMIN }} "${{ github.workspace }}"
|
|
|
|
- name: Checkout code
|
|
if: github.event_name == 'push'
|
|
uses: actions/checkout@v2
|
|
with:
|
|
submodules: true
|
|
|
|
- name: Checkout code from fork
|
|
if: ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
|
|
uses: actions/checkout@v2
|
|
with:
|
|
ref: refs/pull/${{ github.event.pull_request.number }}/merge
|
|
submodules: true
|
|
|
|
- name: Get Occlum version
|
|
run: echo "OCCLUM_VERSION=$(grep 'Version =' src/pal/include/occlum_version.h | awk '{print $4}')" >> $GITHUB_ENV;
|
|
|
|
- name: Create container
|
|
run: |
|
|
if [[ "${{ matrix.self_runner[1] }}" == "SGX1-HW" ]]; then
|
|
java_support_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host --device /dev/isgx -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:$OCCLUM_VERSION-ubuntu18.04);
|
|
elif [[ "${{ matrix.self_runner[1] }}" == "SGX2-HW" ]]; then
|
|
java_support_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host -v /dev/sgx:/dev/sgx -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:$OCCLUM_VERSION-ubuntu18.04);
|
|
else
|
|
echo "Unsupported Hardware"
|
|
fi;
|
|
echo "java_support_test=$java_support_test" >> $GITHUB_ENV
|
|
|
|
- name: Configure dependency source
|
|
run: |
|
|
docker exec $java_support_test bash -c "cat <<- EOF >/root/.cargo/config
|
|
[source.crates-io]
|
|
registry = \"https://github.com/rust-lang/crates.io-index\"
|
|
replace-with = 'ustc'
|
|
[source.ustc]
|
|
registry = \"git://mirrors.ustc.edu.cn/crates.io-index\"
|
|
EOF"
|
|
|
|
- name: Build dependencies
|
|
run: docker exec $java_support_test bash -c "cargo uninstall sccache || true; cd /root/occlum; make submodule"
|
|
|
|
- name: Make install
|
|
run: docker exec $java_support_test bash -c "source /opt/intel/sgxsdk/environment; cd /root/occlum; OCCLUM_RELEASE_BUILD=1 make install"
|
|
|
|
- name: Compile Java
|
|
run: docker exec $java_support_test bash -c "cd /root/occlum/demos/java && occlum-javac ./hello_world/Main.java"
|
|
|
|
- name: Run hello world
|
|
run: docker exec $java_support_test bash -c "cd /root/occlum/demos/java && ./run_java_on_occlum.sh hello"
|
|
|
|
- name: Compile processBuilder demo
|
|
run: docker exec $java_support_test bash -c "cd /root/occlum/demos/java && occlum-javac ./processBuilder/processBuilder.java"
|
|
|
|
- name: Run processBuilder
|
|
run: docker exec $java_support_test bash -c "cd /root/occlum/demos/java && ./run_java_on_occlum.sh processBuilder"
|
|
|
|
- name: Clean the environment
|
|
if: ${{ always() }}
|
|
run: docker stop $java_support_test
|
|
|
|
|
|
Bazel_test:
|
|
if: github.event_name == 'push' || ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
|
|
runs-on: ${{ matrix.self_runner }}
|
|
strategy:
|
|
matrix:
|
|
self_runner: [[self-hosted, SGX1-HW], [self-hosted, SGX2-HW]]
|
|
|
|
steps:
|
|
- name: Clean before running
|
|
run: |
|
|
sudo chown -R ${{ secrets.CI_ADMIN }} "${{ github.workspace }}"
|
|
|
|
- name: Checkout code
|
|
if: github.event_name == 'push'
|
|
uses: actions/checkout@v2
|
|
with:
|
|
submodules: true
|
|
|
|
- name: Checkout code from fork
|
|
if: ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
|
|
uses: actions/checkout@v2
|
|
with:
|
|
ref: refs/pull/${{ github.event.pull_request.number }}/merge
|
|
submodules: true
|
|
|
|
- name: Get Occlum version
|
|
run: echo "OCCLUM_VERSION=$(grep 'Version =' src/pal/include/occlum_version.h | awk '{print $4}')" >> $GITHUB_ENV;
|
|
|
|
- name: Create container
|
|
run: |
|
|
if [[ "${{ matrix.self_runner[1] }}" == "SGX1-HW" ]]; then
|
|
hello_bazel_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host --device /dev/isgx -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:$OCCLUM_VERSION-ubuntu18.04);
|
|
elif [[ "${{ matrix.self_runner[1] }}" == "SGX2-HW" ]]; then
|
|
hello_bazel_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host -v /dev/sgx:/dev/sgx -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:$OCCLUM_VERSION-ubuntu18.04);
|
|
else
|
|
echo "Unsupported Hardware"
|
|
fi;
|
|
echo "hello_bazel_test=$hello_bazel_test" >> $GITHUB_ENV
|
|
|
|
- name: Configure dependency source
|
|
run: |
|
|
docker exec $hello_bazel_test bash -c "cat <<- EOF >/root/.cargo/config
|
|
[source.crates-io]
|
|
registry = \"https://github.com/rust-lang/crates.io-index\"
|
|
replace-with = 'ustc'
|
|
[source.ustc]
|
|
registry = \"git://mirrors.ustc.edu.cn/crates.io-index\"
|
|
EOF"
|
|
|
|
- name: Build dependencies
|
|
run: docker exec $hello_bazel_test bash -c "cargo uninstall sccache || true; cd /root/occlum; make submodule"
|
|
|
|
- name: Make install
|
|
run: docker exec $hello_bazel_test bash -c "source /opt/intel/sgxsdk/environment; cd /root/occlum; OCCLUM_RELEASE_BUILD=1 make install"
|
|
|
|
- name: Config git proxy
|
|
run: |
|
|
docker exec $hello_bazel_test bash -c "git config --global http.proxy socks5://localhost:5432"
|
|
docker exec $hello_bazel_test bash -c "git config --global https.proxy socks5://localhost:5432"
|
|
|
|
- name: Install bazel
|
|
run: docker exec $hello_bazel_test bash -c "cd /root/occlum/demos/hello_bazel && wget https://github.com/bazelbuild/bazel/releases/download/3.2.0/bazel-3.2.0-installer-linux-x86_64.sh;
|
|
chmod +x bazel-3.2.0-installer-linux-x86_64.sh;
|
|
./bazel-3.2.0-installer-linux-x86_64.sh"
|
|
|
|
- name: Build bazel dependencies
|
|
run: docker exec $hello_bazel_test bash -c "cd /root/occlum/demos/hello_bazel && ./build_bazel_sample.sh"
|
|
|
|
- name: Test bazel
|
|
run: docker exec $hello_bazel_test bash -c "cd /root/occlum/demos/hello_bazel && occlum new occlum_instance;
|
|
cp examples/cpp-tutorial/stage3/bazel-bin/main/hello-world occlum_instance/image/bin;
|
|
cd occlum_instance && occlum build;
|
|
occlum run /bin/hello-world"
|
|
|
|
- name: Clean the environment
|
|
run: docker stop $hello_bazel_test
|
|
|
|
|
|
Fish_test:
|
|
if: github.event_name == 'push' || ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
|
|
runs-on: ${{ matrix.self_runner }}
|
|
strategy:
|
|
matrix:
|
|
self_runner: [[self-hosted, SGX1-HW], [self-hosted, SGX2-HW]]
|
|
|
|
steps:
|
|
- name: Clean before running
|
|
run: |
|
|
sudo chown -R ${{ secrets.CI_ADMIN }} "${{ github.workspace }}"
|
|
|
|
- name: Checkout code
|
|
if: github.event_name == 'push'
|
|
uses: actions/checkout@v2
|
|
with:
|
|
submodules: true
|
|
|
|
- name: Checkout code from fork
|
|
if: ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
|
|
uses: actions/checkout@v2
|
|
with:
|
|
ref: refs/pull/${{ github.event.pull_request.number }}/merge
|
|
submodules: true
|
|
|
|
- name: Get Occlum version
|
|
run: echo "OCCLUM_VERSION=$(grep 'Version =' src/pal/include/occlum_version.h | awk '{print $4}')" >> $GITHUB_ENV;
|
|
|
|
- name: Create container
|
|
run: |
|
|
if [[ "${{ matrix.self_runner[1] }}" == "SGX1-HW" ]]; then
|
|
fish_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host --device /dev/isgx -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:$OCCLUM_VERSION-ubuntu18.04);
|
|
elif [[ "${{ matrix.self_runner[1] }}" == "SGX2-HW" ]]; then
|
|
fish_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host -v /dev/sgx:/dev/sgx -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:$OCCLUM_VERSION-ubuntu18.04);
|
|
else
|
|
echo "Unsupported Hardware"
|
|
fi;
|
|
echo "fish_test=$fish_test" >> $GITHUB_ENV
|
|
|
|
- name: Configure dependency source
|
|
run: |
|
|
docker exec $fish_test bash -c "cat <<- EOF >/root/.cargo/config
|
|
[source.crates-io]
|
|
registry = \"https://github.com/rust-lang/crates.io-index\"
|
|
replace-with = 'ustc'
|
|
[source.ustc]
|
|
registry = \"git://mirrors.ustc.edu.cn/crates.io-index\"
|
|
EOF"
|
|
|
|
- name: Build dependencies
|
|
run: docker exec $fish_test bash -c "cargo uninstall sccache || true; cd /root/occlum; make submodule"
|
|
|
|
- name: Make install
|
|
run: docker exec $fish_test bash -c "source /opt/intel/sgxsdk/environment; cd /root/occlum; OCCLUM_RELEASE_BUILD=1 make install"
|
|
|
|
- name: Config git proxy
|
|
run: |
|
|
docker exec $fish_test bash -c "git config --global http.proxy socks5://localhost:5432"
|
|
docker exec $fish_test bash -c "git config --global https.proxy socks5://localhost:5432"
|
|
|
|
- name: Build Fish dependencies
|
|
run: docker exec $fish_test bash -c "cd /root/occlum/demos/fish && ./download_and_build.sh"
|
|
|
|
- name: Run Fish test
|
|
run: docker exec $fish_test bash -c "cd /root/occlum/demos/fish && ./run_fish_test.sh"
|
|
|
|
- name: Run Fish process rlimit test
|
|
run: docker exec $fish_test bash -c "cd /root/occlum/demos/fish && ./run_per_process_config_test.sh"
|
|
|
|
- name: Clean the environment
|
|
if: ${{ always() }}
|
|
run: docker stop $fish_test
|
|
|
|
|
|
Xgboost_test:
|
|
if: github.event_name == 'push' || ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
|
|
runs-on: ${{ matrix.self_runner }}
|
|
strategy:
|
|
matrix:
|
|
self_runner: [[self-hosted, SGX1-HW], [self-hosted, SGX2-HW]]
|
|
|
|
steps:
|
|
- name: Clean before running
|
|
run: |
|
|
sudo chown -R ${{ secrets.CI_ADMIN }} "${{ github.workspace }}"
|
|
|
|
- name: Checkout code
|
|
if: github.event_name == 'push'
|
|
uses: actions/checkout@v2
|
|
with:
|
|
submodules: true
|
|
|
|
- name: Checkout code from fork
|
|
if: ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
|
|
uses: actions/checkout@v2
|
|
with:
|
|
ref: refs/pull/${{ github.event.pull_request.number }}/merge
|
|
submodules: true
|
|
|
|
- name: Get Occlum version
|
|
run: echo "OCCLUM_VERSION=$(grep 'Version =' src/pal/include/occlum_version.h | awk '{print $4}')" >> $GITHUB_ENV;
|
|
|
|
- name: Create container
|
|
run: |
|
|
if [[ "${{ matrix.self_runner[1] }}" == "SGX1-HW" ]]; then
|
|
xgboost_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host --device /dev/isgx -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:$OCCLUM_VERSION-ubuntu18.04);
|
|
elif [[ "${{ matrix.self_runner[1] }}" == "SGX2-HW" ]]; then
|
|
xgboost_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host -v /dev/sgx:/dev/sgx -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:$OCCLUM_VERSION-ubuntu18.04);
|
|
else
|
|
echo "Unsupported Hardware"
|
|
fi;
|
|
echo "xgboost_test=$xgboost_test" >> $GITHUB_ENV
|
|
|
|
- name: Configure dependency source
|
|
run: |
|
|
docker exec $xgboost_test bash -c "cat <<- EOF >/root/.cargo/config
|
|
[source.crates-io]
|
|
registry = \"https://github.com/rust-lang/crates.io-index\"
|
|
replace-with = 'ustc'
|
|
[source.ustc]
|
|
registry = \"git://mirrors.ustc.edu.cn/crates.io-index\"
|
|
EOF"
|
|
|
|
- name: Build dependencies
|
|
run: docker exec $xgboost_test bash -c "cargo uninstall sccache || true; cd /root/occlum; make submodule"
|
|
|
|
- name: Make install
|
|
run: docker exec $xgboost_test bash -c "source /opt/intel/sgxsdk/environment; cd /root/occlum; OCCLUM_RELEASE_BUILD=1 make install"
|
|
|
|
- name: Config git proxy
|
|
run: |
|
|
docker exec $xgboost_test bash -c "git config --global http.proxy socks5://localhost:5432"
|
|
docker exec $xgboost_test bash -c "git config --global https.proxy socks5://localhost:5432"
|
|
|
|
- name: Build xgboost dependencies
|
|
run: docker exec $xgboost_test bash -c "cd /root/occlum/demos/xgboost && ./download_and_build_xgboost.sh"
|
|
|
|
- name: Run xgboost test
|
|
run: docker exec $xgboost_test bash -c "cd /root/occlum/demos/xgboost && make test"
|
|
|
|
- name: Run xgboost cluster test
|
|
run: docker exec $xgboost_test bash -c "cd /root/occlum/demos/xgboost && make test-local-cluster"
|
|
|
|
- name: Clean the environment
|
|
if: ${{ always() }}
|
|
run: docker stop $xgboost_test
|
|
|
|
|
|
Sqlite_test:
|
|
if: github.event_name == 'push' || ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
|
|
runs-on: ${{ matrix.self_runner }}
|
|
strategy:
|
|
matrix:
|
|
self_runner: [[self-hosted, SGX1-HW], [self-hosted, SGX2-HW]]
|
|
|
|
steps:
|
|
- name: Clean before running
|
|
run: |
|
|
sudo chown -R ${{ secrets.CI_ADMIN }} "${{ github.workspace }}"
|
|
|
|
- name: Checkout code
|
|
if: github.event_name == 'push'
|
|
uses: actions/checkout@v2
|
|
with:
|
|
submodules: true
|
|
|
|
- name: Checkout code from fork
|
|
if: ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
|
|
uses: actions/checkout@v2
|
|
with:
|
|
ref: refs/pull/${{ github.event.pull_request.number }}/merge
|
|
submodules: true
|
|
|
|
- name: Get Occlum version
|
|
run: echo "OCCLUM_VERSION=$(grep 'Version =' src/pal/include/occlum_version.h | awk '{print $4}')" >> $GITHUB_ENV;
|
|
|
|
- name: Create container
|
|
run: |
|
|
if [[ "${{ matrix.self_runner[1] }}" == "SGX1-HW" ]]; then
|
|
sqlite_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host --device /dev/isgx -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:$OCCLUM_VERSION-ubuntu18.04);
|
|
elif [[ "${{ matrix.self_runner[1] }}" == "SGX2-HW" ]]; then
|
|
sqlite_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host -v /dev/sgx:/dev/sgx -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:$OCCLUM_VERSION-ubuntu18.04);
|
|
else
|
|
echo "Unsupported Hardware"
|
|
fi;
|
|
echo "sqlite_test=$sqlite_test" >> $GITHUB_ENV
|
|
|
|
- name: Configure dependency source
|
|
run: |
|
|
docker exec $sqlite_test bash -c "cat <<- EOF >/root/.cargo/config
|
|
[source.crates-io]
|
|
registry = \"https://github.com/rust-lang/crates.io-index\"
|
|
replace-with = 'ustc'
|
|
[source.ustc]
|
|
registry = \"git://mirrors.ustc.edu.cn/crates.io-index\"
|
|
EOF"
|
|
|
|
- name: Build dependencies
|
|
run: docker exec $sqlite_test bash -c "cargo uninstall sccache || true; cd /root/occlum; make submodule"
|
|
|
|
- name: Make install
|
|
run: docker exec $sqlite_test bash -c "source /opt/intel/sgxsdk/environment; cd /root/occlum; OCCLUM_RELEASE_BUILD=1 make install"
|
|
|
|
- name: Config git proxy
|
|
run: |
|
|
docker exec $sqlite_test bash -c "git config --global http.proxy socks5://localhost:5432"
|
|
docker exec $sqlite_test bash -c "git config --global https.proxy socks5://localhost:5432"
|
|
|
|
- name: Build sqlite dependencies
|
|
run: docker exec $sqlite_test bash -c "cd /root/occlum/demos/sqlite && ./download_and_build_sqlite.sh"
|
|
|
|
- name: Run sqlite test
|
|
run: docker exec $sqlite_test bash -c "cd /root/occlum/demos/sqlite && ./run_sqlite_on_occlum.sh"
|
|
|
|
- name: Clean the environment
|
|
if: ${{ always() }}
|
|
run: docker stop $sqlite_test
|
|
|
|
|
|
Python_musl_support_test:
|
|
if: github.event_name == 'push' || ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
|
|
runs-on: ${{ matrix.self_runner }}
|
|
strategy:
|
|
matrix:
|
|
self_runner: [[self-hosted, SGX1-HW], [self-hosted, SGX2-HW]]
|
|
|
|
steps:
|
|
- name: Clean before running
|
|
run: |
|
|
sudo chown -R ${{ secrets.CI_ADMIN }} "${{ github.workspace }}"
|
|
|
|
- name: Checkout code
|
|
if: github.event_name == 'push'
|
|
uses: actions/checkout@v2
|
|
with:
|
|
submodules: true
|
|
|
|
- name: Checkout code from fork
|
|
if: ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
|
|
uses: actions/checkout@v2
|
|
with:
|
|
ref: refs/pull/${{ github.event.pull_request.number }}/merge
|
|
submodules: true
|
|
|
|
- name: Create container
|
|
run: |
|
|
docker pull occlumbackup/occlum:latest-ubuntu18.04-python
|
|
if [[ "${{ matrix.self_runner[1] }}" == "SGX1-HW" ]]; then
|
|
python_musl_support_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host --device /dev/isgx -v $GITHUB_WORKSPACE:/root/occlum occlumbackup/occlum:latest-ubuntu18.04-python);
|
|
elif [[ "${{ matrix.self_runner[1] }}" == "SGX2-HW" ]]; then
|
|
python_musl_support_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host -v /dev/sgx:/dev/sgx -v $GITHUB_WORKSPACE:/root/occlum occlumbackup/occlum:latest-ubuntu18.04-python);
|
|
else
|
|
echo "Unsupported Hardware"
|
|
fi;
|
|
echo "python_musl_support_test=$python_musl_support_test" >> $GITHUB_ENV
|
|
|
|
- name: Configure dependency source
|
|
run: |
|
|
docker exec $python_musl_support_test bash -c "cat <<- EOF >/root/.cargo/config
|
|
[source.crates-io]
|
|
registry = \"https://github.com/rust-lang/crates.io-index\"
|
|
replace-with = 'tuna'
|
|
[source.tuna]
|
|
registry = \"https://mirrors.tuna.tsinghua.edu.cn/git/crates.io-index.git\"
|
|
EOF"
|
|
|
|
- name: Build dependencies
|
|
run: docker exec $python_musl_support_test bash -c "cargo uninstall sccache || true; cd /root/occlum; make submodule"
|
|
|
|
- name: Make install
|
|
run: docker exec $python_musl_support_test bash -c "source /opt/intel/sgxsdk/environment; cd /root/occlum; OCCLUM_RELEASE_BUILD=1 make install"
|
|
|
|
- name: Run python musl support test
|
|
run: docker exec $python_musl_support_test bash -c "cd /root/occlum/demos/python/python_musl; ./run_python_on_occlum.sh"
|
|
|
|
- name: Check result
|
|
run: docker exec $python_musl_support_test bash -c "cd /root/occlum/demos/python/python_musl/occlum_instance; cat smvlight.dat"
|
|
|
|
- name: Clean the environment
|
|
if: ${{ always() }}
|
|
run: docker stop $python_musl_support_test
|
|
|
|
|
|
Openvino_test:
|
|
if: github.event_name == 'push' || ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
|
|
runs-on: ${{ matrix.self_runner }}
|
|
strategy:
|
|
matrix:
|
|
self_runner: [[self-hosted, SGX1-HW], [self-hosted, SGX2-HW]]
|
|
|
|
steps:
|
|
- name: Clean before running
|
|
run: |
|
|
sudo chown -R ${{ secrets.CI_ADMIN }} "${{ github.workspace }}"
|
|
|
|
- name: Checkout code
|
|
if: github.event_name == 'push'
|
|
uses: actions/checkout@v2
|
|
with:
|
|
submodules: true
|
|
|
|
- name: Checkout code from fork
|
|
if: ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
|
|
uses: actions/checkout@v2
|
|
with:
|
|
ref: refs/pull/${{ github.event.pull_request.number }}/merge
|
|
submodules: true
|
|
|
|
- name: Create container
|
|
run: |
|
|
docker pull occlumbackup/occlum:latest-ubuntu18.04-openvino
|
|
if [[ "${{ matrix.self_runner[1] }}" == "SGX1-HW" ]]; then
|
|
openvino_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host --device /dev/isgx -v $GITHUB_WORKSPACE:/root/occlum occlumbackup/occlum:latest-ubuntu18.04-openvino);
|
|
elif [[ "${{ matrix.self_runner[1] }}" == "SGX2-HW" ]]; then
|
|
openvino_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host -v /dev/sgx:/dev/sgx -v $GITHUB_WORKSPACE:/root/occlum occlumbackup/occlum:latest-ubuntu18.04-openvino);
|
|
else
|
|
echo "Unsupported Hardware"
|
|
fi;
|
|
echo "openvino_test=$openvino_test" >> $GITHUB_ENV
|
|
|
|
- name: Configure dependency source
|
|
run: |
|
|
docker exec $openvino_test bash -c "cat <<- EOF >/root/.cargo/config
|
|
[source.crates-io]
|
|
registry = \"https://github.com/rust-lang/crates.io-index\"
|
|
replace-with = 'ustc'
|
|
[source.ustc]
|
|
registry = \"git://mirrors.ustc.edu.cn/crates.io-index\"
|
|
EOF"
|
|
|
|
- name: Build dependencies
|
|
run: docker exec $openvino_test bash -c "cargo uninstall sccache || true; cd /root/occlum; make submodule"
|
|
|
|
- name: Make install
|
|
run: docker exec $openvino_test bash -c "source /opt/intel/sgxsdk/environment; cd /root/occlum; OCCLUM_RELEASE_BUILD=1 make install"
|
|
|
|
- name: Run openVINO benchmark
|
|
run: docker exec $openvino_test bash -c "cd /root/demos/openvino && ./run_benchmark_on_occlum.sh"
|
|
|
|
- name: Clean the environment
|
|
if: ${{ always() }}
|
|
run: docker stop $openvino_test
|
|
|
|
|
|
Grpc_test:
|
|
if: github.event_name == 'push' || ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
|
|
runs-on: ${{ matrix.self_runner }}
|
|
strategy:
|
|
matrix:
|
|
self_runner: [[self-hosted, SGX1-HW], [self-hosted, SGX2-HW]]
|
|
|
|
steps:
|
|
- name: Clean before running
|
|
run: |
|
|
sudo chown -R ${{ secrets.CI_ADMIN }} "${{ github.workspace }}"
|
|
|
|
- name: Checkout code
|
|
if: github.event_name == 'push'
|
|
uses: actions/checkout@v2
|
|
with:
|
|
submodules: true
|
|
|
|
- name: Checkout code from fork
|
|
if: ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
|
|
uses: actions/checkout@v2
|
|
with:
|
|
ref: refs/pull/${{ github.event.pull_request.number }}/merge
|
|
submodules: true
|
|
|
|
- name: Create container
|
|
run: |
|
|
docker pull occlumbackup/occlum:latest-ubuntu18.04-grpc
|
|
if [[ "${{ matrix.self_runner[1] }}" == "SGX1-HW" ]]; then
|
|
grpc_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host --device /dev/isgx -v $GITHUB_WORKSPACE:/root/occlum occlumbackup/occlum:latest-ubuntu18.04-grpc);
|
|
elif [[ "${{ matrix.self_runner[1] }}" == "SGX2-HW" ]]; then
|
|
grpc_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host -v /dev/sgx:/dev/sgx -v $GITHUB_WORKSPACE:/root/occlum occlumbackup/occlum:latest-ubuntu18.04-grpc);
|
|
else
|
|
echo "Unsupported Hardware"
|
|
fi;
|
|
echo "grpc_test=$grpc_test" >> $GITHUB_ENV
|
|
|
|
- name: Change download source of crates.io
|
|
run: |
|
|
docker exec $grpc_test bash -c "cat <<- EOF >/root/.cargo/config
|
|
[source.crates-io]
|
|
registry = \"https://github.com/rust-lang/crates.io-index\"
|
|
replace-with = 'ustc'
|
|
[source.ustc]
|
|
registry = \"git://mirrors.ustc.edu.cn/crates.io-index\"
|
|
EOF"
|
|
|
|
- name: Build dependencies
|
|
run: docker exec $grpc_test bash -c "cargo uninstall sccache || true; cd /root/occlum; make submodule"
|
|
|
|
- name: Make install
|
|
run: docker exec $grpc_test bash -c "source /opt/intel/sgxsdk/environment; cd /root/occlum; OCCLUM_RELEASE_BUILD=y make install"
|
|
|
|
- name: Prepare grpc sample project
|
|
run: docker exec $grpc_test bash -c "cd /root/demos/grpc && ./prepare_client_server.sh"
|
|
|
|
- name: Run grpc server
|
|
run: docker exec $grpc_test bash -c "cd /root/demos/grpc && ./run_server_on_occlum.sh" &
|
|
|
|
- name: Run grpc client
|
|
run: |
|
|
sleep ${{ env.nap_time }};
|
|
docker exec $grpc_test bash -c "cd /root/demos/grpc && ./run_client_on_occlum.sh"
|
|
|
|
- name: Clean the environment
|
|
if: ${{ always() }}
|
|
run: docker stop $grpc_test
|
|
|
|
|
|
Gvisor_test:
|
|
if: github.event_name == 'push' || ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
|
|
runs-on: ${{ matrix.self_runner }}
|
|
strategy:
|
|
matrix:
|
|
self_runner: [[self-hosted, SGX1-HW], [self-hosted, SGX2-HW]]
|
|
|
|
steps:
|
|
- name: Clean before running
|
|
run: |
|
|
sudo chown -R ${{ secrets.CI_ADMIN }} "${{ github.workspace }}"
|
|
|
|
- name: Checkout code
|
|
if: github.event_name == 'push'
|
|
uses: actions/checkout@v2
|
|
with:
|
|
submodules: true
|
|
|
|
- name: Checkout code from fork
|
|
if: ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
|
|
uses: actions/checkout@v2
|
|
with:
|
|
ref: refs/pull/${{ github.event.pull_request.number }}/merge
|
|
submodules: true
|
|
|
|
- name: Create container
|
|
run: |
|
|
docker pull occlumbackup/occlum:latest-ubuntu18.04-gvisor_test
|
|
if [[ "${{ matrix.self_runner[1] }}" == "SGX1-HW" ]]; then
|
|
gvisor_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host --device /dev/isgx -v $GITHUB_WORKSPACE:/root/occlum occlumbackup/occlum:latest-ubuntu18.04-gvisor_test);
|
|
elif [[ "${{ matrix.self_runner[1] }}" == "SGX2-HW" ]]; then
|
|
gvisor_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host -v /dev/sgx:/dev/sgx -v $GITHUB_WORKSPACE:/root/occlum occlumbackup/occlum:latest-ubuntu18.04-gvisor_test);
|
|
else
|
|
echo "Unsupported Hardware"
|
|
fi;
|
|
echo "gvisor_test=$gvisor_test" >> $GITHUB_ENV
|
|
|
|
- name: Change download source of crates.io
|
|
run: |
|
|
docker exec $gvisor_test bash -c "cat <<- EOF >/root/.cargo/config
|
|
[source.crates-io]
|
|
registry = \"https://github.com/rust-lang/crates.io-index\"
|
|
replace-with = 'ustc'
|
|
[source.ustc]
|
|
registry = \"git://mirrors.ustc.edu.cn/crates.io-index\"
|
|
EOF"
|
|
|
|
- name: Build dependencies
|
|
run: docker exec $gvisor_test bash -c "cargo uninstall sccache || true; cd /root/occlum; make submodule"
|
|
|
|
- name: Make install
|
|
run: docker exec $gvisor_test bash -c "source /opt/intel/sgxsdk/environment; cd /root/occlum; OCCLUM_RELEASE_BUILD=y make install"
|
|
|
|
- name: Run gvisor syscall test
|
|
run: docker exec $gvisor_test bash -c "cd /root/gvisor_occlum; ./run_occlum_passed_tests.sh"
|
|
|
|
- name: Clean the environment
|
|
if: ${{ always() }}
|
|
run: docker stop $gvisor_test
|
|
|
|
|
|
Test_rpm_deploy:
|
|
if: github.event_name == 'push'
|
|
runs-on: ${{ matrix.self_runner }}
|
|
strategy:
|
|
matrix:
|
|
self_runner: [[self-hosted, SGX1-HW], [self-hosted, SGX2-HW]]
|
|
|
|
steps:
|
|
- name: Clean before running
|
|
run: |
|
|
sudo chown -R ${{ secrets.CI_ADMIN }} "${{ github.workspace }}"
|
|
|
|
- name: Checkout code
|
|
if: github.event_name == 'push'
|
|
uses: actions/checkout@v2
|
|
with:
|
|
submodules: false
|
|
|
|
- name: Test deployment
|
|
run: |
|
|
cd demos/deployment
|
|
if [[ "${{ matrix.self_runner[1] }}" == "SGX1-HW" ]]; then
|
|
./deploy_image_test.sh centos8.2
|
|
elif [[ "${{ matrix.self_runner[1] }}" == "SGX2-HW" ]]; then
|
|
DEVICE_OPTION="-v /dev/sgx:/dev/sgx" ./deploy_image_test.sh centos8.2
|
|
else
|
|
echo "Unsupported Hardware"
|
|
exit 1
|
|
fi;
|
|
|
|
- name: Clean the environment
|
|
if: ${{ always() }}
|
|
run: |
|
|
docker stop centos8.2_deploy_test
|
|
docker rm -f centos8.2_deploy_test
|
|
|
|
|
|
Test_deb_deploy:
|
|
if: github.event_name == 'push'
|
|
runs-on: ${{ matrix.self_runner }}
|
|
strategy:
|
|
matrix:
|
|
self_runner: [[self-hosted, SGX1-HW], [self-hosted, SGX2-HW]]
|
|
|
|
steps:
|
|
- name: Clean before running
|
|
run: |
|
|
sudo chown -R ${{ secrets.CI_ADMIN }} "${{ github.workspace }}"
|
|
|
|
- name: Checkout code
|
|
if: github.event_name == 'push'
|
|
uses: actions/checkout@v2
|
|
with:
|
|
submodules: false
|
|
|
|
- name: Test deployment
|
|
run: |
|
|
cd demos/deployment
|
|
if [[ "${{ matrix.self_runner[1] }}" == "SGX1-HW" ]]; then
|
|
./deploy_image_test.sh ubuntu18.04
|
|
elif [[ "${{ matrix.self_runner[1] }}" == "SGX2-HW" ]]; then
|
|
DEVICE_OPTION="-v /dev/sgx:/dev/sgx" ./deploy_image_test.sh ubuntu18.04
|
|
else
|
|
echo "Unsupported Hardware"
|
|
exit 1
|
|
fi;
|
|
|
|
- name: Clean the environment
|
|
if: ${{ always() }}
|
|
run: |
|
|
docker stop ubuntu18.04_deploy_test
|
|
docker rm -f ubuntu18.04_deploy_test
|
|
|
|
|
|
# Tensorflow_serving requires binary tensorflow_serving PIC, here we compile tensorflow_model_server before workflow
|
|
Tensorflow_serving_test:
|
|
if: github.event_name == 'push' || ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
|
|
runs-on: ${{ matrix.self_runner }}
|
|
strategy:
|
|
matrix:
|
|
# Tensorflow serving test requires AVX512 instruction support. Only the SGX2-HW machine has support for that.
|
|
self_runner: [[self-hosted, SGX2-HW]]
|
|
|
|
steps:
|
|
- name: Clean before running
|
|
run: |
|
|
sudo chown -R ${{ secrets.CI_ADMIN }} "${{ github.workspace }}"
|
|
|
|
- name: Checkout code
|
|
if: github.event_name == 'push'
|
|
uses: actions/checkout@v2
|
|
with:
|
|
submodules: true
|
|
|
|
- name: Checkout code from fork
|
|
if: ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
|
|
uses: actions/checkout@v2
|
|
with:
|
|
ref: refs/pull/${{ github.event.pull_request.number }}/merge
|
|
submodules: true
|
|
|
|
- name: Create container
|
|
run: |
|
|
docker pull occlumbackup/occlum:latest-ubuntu18.04-tf_serving
|
|
if [[ "${{ matrix.self_runner[1] }}" == "SGX1-HW" ]]; then
|
|
tf_serving_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host --device /dev/isgx -v $GITHUB_WORKSPACE:/root/occlum occlumbackup/occlum:latest-ubuntu18.04-tf_serving);
|
|
elif [[ "${{ matrix.self_runner[1] }}" == "SGX2-HW" ]]; then
|
|
tf_serving_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host -v /dev/sgx:/dev/sgx -v $GITHUB_WORKSPACE:/root/occlum occlumbackup/occlum:latest-ubuntu18.04-tf_serving);
|
|
else
|
|
echo "Unsupported Hardware"
|
|
fi;
|
|
echo "tf_serving_test=$tf_serving_test" >> $GITHUB_ENV
|
|
|
|
- name: Change download source of crates.io
|
|
run: |
|
|
docker exec $tf_serving_test bash -c "cat <<- EOF >/root/.cargo/config
|
|
[source.crates-io]
|
|
registry = \"https://github.com/rust-lang/crates.io-index\"
|
|
replace-with = 'ustc'
|
|
[source.ustc]
|
|
registry = \"git://mirrors.ustc.edu.cn/crates.io-index\"
|
|
EOF"
|
|
|
|
- name: Build dependencies
|
|
run: docker exec $tf_serving_test bash -c "cd /root/occlum; make submodule"
|
|
|
|
- name: Make install
|
|
run: docker exec $tf_serving_test bash -c "source /opt/intel/sgxsdk/environment; cd /root/occlum; OCCLUM_RELEASE_BUILD=1 make install"
|
|
|
|
- name: Move dependencies to current demo
|
|
run: docker exec $tf_serving_test bash -c "mv /root/tensorflow_model_server /root/occlum/demos/tensorflow/tensorflow_serving; mv /root/resnet50-v15-fp32 /root/occlum/demos/tensorflow/tensorflow_serving"
|
|
|
|
- name: Generate SSL
|
|
run: docker exec $tf_serving_test bash -c "cd /root/occlum/demos/tensorflow/tensorflow_serving; ./generate_ssl_config.sh localhost"
|
|
|
|
- name: Run tf_serving server
|
|
run: docker exec $tf_serving_test bash -c "cd /root/occlum/demos/tensorflow/tensorflow_serving; ./run_occlum_tf_serving.sh"
|
|
|
|
- name: Run tf_serving client
|
|
run: |
|
|
sleep 120;
|
|
docker exec $tf_serving_test bash -c "cd /root/occlum/demos/tensorflow/tensorflow_serving/client; ./benchmark.sh python3 localhost:8500 ../ssl_configure/server.crt"
|
|
|
|
- name: Clean the environment
|
|
if: ${{ always() }}
|
|
run: docker stop $tf_serving_test
|
|
|
|
Remote_attestation_test:
|
|
if: github.event_name == 'push' || ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
|
|
runs-on: ${{ matrix.self_runner }}
|
|
strategy:
|
|
matrix:
|
|
self_runner: [[self-hosted, SGX2-HW]]
|
|
|
|
steps:
|
|
- name: Clean before running
|
|
run: |
|
|
sudo chown -R ${{ secrets.CI_ADMIN }} "${{ github.workspace }}"
|
|
|
|
- name: Checkout code
|
|
if: github.event_name == 'push'
|
|
uses: actions/checkout@v2
|
|
with:
|
|
submodules: true
|
|
|
|
- name: Checkout code from fork
|
|
if: ${{ contains(github.event.pull_request.labels.*.name, 'SGX-hardware-test-required') }}
|
|
uses: actions/checkout@v2
|
|
with:
|
|
ref: refs/pull/${{ github.event.pull_request.number }}/merge
|
|
submodules: true
|
|
|
|
- name: Get Occlum version
|
|
run: echo "OCCLUM_VERSION=$(grep 'Version =' src/pal/include/occlum_version.h | awk '{print $4}')" >> $GITHUB_ENV;
|
|
|
|
- name: Create container
|
|
run: |
|
|
if [[ "${{ matrix.self_runner[1] }}" == "SGX2-HW" ]]; then
|
|
ra_test=$(docker run -itd --privileged --rm --env CARGO_HTTP_MULTIPLEXING=false --net host -v /dev/sgx:/dev/sgx -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:$OCCLUM_VERSION-ubuntu18.04);
|
|
else
|
|
echo "Unsupported Hardware"
|
|
fi;
|
|
echo "ra_test=$ra_test" >> $GITHUB_ENV
|
|
|
|
- name: Update PCCS server
|
|
run: docker exec $ra_test bash -c "sed -r -i 's/PCCS_URL=https:\/\/localhost:8081\/sgx\/certification\/v3\//PCCS_URL=https:\/\/sgx-dcap-server.cn-shanghai.aliyuncs.com\/sgx\/certification\/v3\//g' /etc/sgx_default_qcnl.conf"
|
|
|
|
- name: Change download source of crates.io
|
|
run: |
|
|
docker exec $ra_test bash -c "cat <<- EOF >/root/.cargo/config
|
|
[source.crates-io]
|
|
registry = \"https://github.com/rust-lang/crates.io-index\"
|
|
replace-with = 'ustc'
|
|
[source.ustc]
|
|
registry = \"git://mirrors.ustc.edu.cn/crates.io-index\"
|
|
EOF"
|
|
|
|
- name: Build dependencies
|
|
run: docker exec $ra_test bash -c "cargo uninstall sccache || true; cd /root/occlum; make submodule"
|
|
|
|
- name: Build source
|
|
run: docker exec $ra_test bash -c "source /opt/intel/sgxsdk/environment; cd /root/occlum; OCCLUM_RELEASE_BUILD=y make install"
|
|
|
|
- name: Build and run remote attestation demo
|
|
run: docker exec $ra_test bash -c "cd /root/occlum/demos/remote_attestation/dcap; ./run_dcap_quote_on_occlum.sh"
|