From a5270dad5e5a8cb1f91213e42a23ff2c40705d01 Mon Sep 17 00:00:00 2001 From: Nick Pellegrino Date: Thu, 15 Oct 2026 12:40:44 -0400 Subject: [PATCH] Bump openauction for the attestation gzip cap; build the enclave image as a PR check openauction#106 caps AttestationCOSEGzip.Decompress at 64 KiB; the arbitration validator calls it on caller-supplied bytes through the type alias. Docker Build now runs only after Go passes on main, and pull requests get a build-only docker-build job, so a PR's Docker Build no longer starts a Build EIF run that measures main's tip. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/docker.yml | 4 ++++ .github/workflows/eif-build.yml | 6 ++---- .github/workflows/go.yml | 31 +++++++++++++++++++++++++++++++ go.mod | 2 +- go.sum | 4 ++-- 5 files changed, 40 insertions(+), 7 deletions(-) diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 7568692..2aae748 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -3,6 +3,10 @@ on: workflow_run: workflows: ["Go"] types: [completed] + # Pull requests get a build-only check from the docker-build job in go.yml. + # A run from any other branch would also start Build EIF, which sees this + # run as main's tip and measures that commit again. + branches: [main] jobs: enclave: diff --git a/.github/workflows/eif-build.yml b/.github/workflows/eif-build.yml index 95f3470..1289fab 100644 --- a/.github/workflows/eif-build.yml +++ b/.github/workflows/eif-build.yml @@ -59,10 +59,8 @@ jobs: runs-on: ubuntu-latest # Publication is gated in docker.yml: it publishes only for a push to this # repository's default branch, so an automated run measures an image from - # that path. The trigger is coarser than the gate: head_* on a Docker Build - # run always reports the default-branch tip whatever triggered it, so a run - # started by a pull request's build measures that tip, and the [skip-build] - # check below is what stops it in the common case. A workflow_dispatch run + # that path. head_* on a Docker Build run always reports the default-branch + # tip, so docker.yml runs only for Go runs on main. A workflow_dispatch run # measures the image_tag it is given; when that is set, the EIF is not # published to ECR and update-pcrs is skipped. # The [skip-build] marker is matched with startsWith, not contains: a squash diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml index 3dccef8..3e85f0d 100644 --- a/.github/workflows/go.yml +++ b/.github/workflows/go.yml @@ -37,3 +37,34 @@ jobs: run: mise run //:lint - name: go mod tidy run: mise run //:tidy + + # Build-only check of the enclave image on pull requests, so a broken image + # build shows on the PR. docker.yml builds and publishes after Go passes on main. + docker-build: + if: github.event_name == 'pull_request' + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7 + with: + persist-credentials: false + - name: Install mise + uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # ratchet:jdx/mise-action@v5 + with: + version: "2026.10.2" + - name: go build bin/tee-arbiter-enclave + run: | + CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -a -ldflags '-extldflags "-static"' -tags netgo -o ./bin/tee-arbiter-enclave ./cmd/enclave-server + - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # ratchet:docker/setup-qemu-action@v4 + - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # ratchet:docker/setup-buildx-action@v4 + with: + platforms: linux/arm64 + - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # ratchet:docker/build-push-action@v7 + with: + context: . + file: enclave-image/Dockerfile + platforms: linux/arm64 + push: false + sbom: true + provenance: mode=max + build-args: | + ENCLAVE_MAX_WORKERS=50 diff --git a/go.mod b/go.mod index 1be91b4..05d61fb 100644 --- a/go.mod +++ b/go.mod @@ -3,7 +3,7 @@ module github.com/cloudx-io/openarbiter go 1.27 require ( - github.com/cloudx-io/openauction v0.0.0-20260812214016-a621e06f88df + github.com/cloudx-io/openauction v0.0.0-20261015162644-6894ac2467d7 github.com/edgebitio/nitro-enclaves-sdk-go v1.0.1-0.20221110205443-8a5476ff3cc2 github.com/fxamacker/cbor/v2 v2.9.4 github.com/google/uuid v1.6.0 diff --git a/go.sum b/go.sum index fe118aa..25401d1 100644 --- a/go.sum +++ b/go.sum @@ -1,5 +1,5 @@ -github.com/cloudx-io/openauction v0.0.0-20260812214016-a621e06f88df h1:lbvIvjN5UQ/tP/Advt64swyO/CoOh5xLzwvhrAxOnCM= -github.com/cloudx-io/openauction v0.0.0-20260812214016-a621e06f88df/go.mod h1:elTEhlCoYhN10xb9sKhr75HKEOVI23cj4Vz+o0j/uR8= +github.com/cloudx-io/openauction v0.0.0-20261015162644-6894ac2467d7 h1:z+D1TYU2bfiXQXEfdJ/kVXHPygg2dkFrj5q1nM28Q7I= +github.com/cloudx-io/openauction v0.0.0-20261015162644-6894ac2467d7/go.mod h1:xWX1ftwEJkh/YdPUxxQysvj3DV4eEsPwe9DuhzYgEts= github.com/edgebitio/nitro-enclaves-sdk-go v1.0.1-0.20221110205443-8a5476ff3cc2 h1:pskJ0eUeBFqfoviPOHCiQ0FjgyAAkhmkSd7tQNqaK4U= github.com/edgebitio/nitro-enclaves-sdk-go v1.0.1-0.20221110205443-8a5476ff3cc2/go.mod h1:hDAX5hYfgVR/TzewAODjCifHo3urkCACUnsMeFDkt2Y= github.com/fxamacker/cbor/v2 v2.2.0/go.mod h1:TA1xS00nchWmaBnEIxPSE5oHLuJBAVvqrtAnWBwBCVo=