Bump openauction for the attestation gzip cap; build the enclave image as a PR check

.github/workflows/docker.yml

@@ -3,6 +3,10 @@ on:
   workflow_run:
     workflows: ["Go"]
     types: [completed]
+    # Pull requests get a build-only check from the docker-build job in go.yml.
+    # A run from any other branch would also start Build EIF, which sees this
+    # run as main's tip and measures that commit again.
+    branches: [main]
 
 jobs:
   enclave:

.github/workflows/eif-build.yml

@@ -59,10 +59,8 @@ jobs:
     runs-on: ubuntu-latest
     # Publication is gated in docker.yml: it publishes only for a push to this
     # repository's default branch, so an automated run measures an image from
-    # that path. The trigger is coarser than the gate: head_* on a Docker Build
-    # run always reports the default-branch tip whatever triggered it, so a run
-    # started by a pull request's build measures that tip, and the [skip-build]
-    # check below is what stops it in the common case. A workflow_dispatch run
+    # that path. head_* on a Docker Build run always reports the default-branch
+    # tip, so docker.yml runs only for Go runs on main. A workflow_dispatch run
     # measures the image_tag it is given; when that is set, the EIF is not
     # published to ECR and update-pcrs is skipped.
     # The [skip-build] marker is matched with startsWith, not contains: a squash

.github/workflows/go.yml

@@ -37,3 +37,34 @@ jobs:
         run: mise run //:lint
       - name: go mod tidy
         run: mise run //:tidy
+
+  # Build-only check of the enclave image on pull requests, so a broken image
+  # build shows on the PR. docker.yml builds and publishes after Go passes on main.
+  docker-build:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Install mise
+        uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # ratchet:jdx/mise-action@v5
+        with:
+          version: "2026.10.2"
+      - name: go build bin/tee-arbiter-enclave
+        run: |
+          CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -a -ldflags '-extldflags "-static"' -tags netgo -o ./bin/tee-arbiter-enclave ./cmd/enclave-server
+      - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # ratchet:docker/setup-qemu-action@v4
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # ratchet:docker/setup-buildx-action@v4
+        with:
+          platforms: linux/arm64
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # ratchet:docker/build-push-action@v7
+        with:
+          context: .
+          file: enclave-image/Dockerfile
+          platforms: linux/arm64
+          push: false
+          sbom: true
+          provenance: mode=max
+          build-args: |
+            ENCLAVE_MAX_WORKERS=50

go.mod

@@ -3,7 +3,7 @@ module github.com/cloudx-io/openarbiter
 go 1.27
 
 require (
-	github.com/cloudx-io/openauction v0.0.0-20260812214016-a621e06f88df
+	github.com/cloudx-io/openauction v0.0.0-20261015162644-6894ac2467d7
 	github.com/edgebitio/nitro-enclaves-sdk-go v1.0.1-0.20221110205443-8a5476ff3cc2
 	github.com/fxamacker/cbor/v2 v2.9.4
 	github.com/google/uuid v1.6.0

go.sum

@@ -1,5 +1,5 @@
-github.com/cloudx-io/openauction v0.0.0-20260812214016-a621e06f88df h1:lbvIvjN5UQ/tP/Advt64swyO/CoOh5xLzwvhrAxOnCM=
-github.com/cloudx-io/openauction v0.0.0-20260812214016-a621e06f88df/go.mod h1:elTEhlCoYhN10xb9sKhr75HKEOVI23cj4Vz+o0j/uR8=
+github.com/cloudx-io/openauction v0.0.0-20261015162644-6894ac2467d7 h1:z+D1TYU2bfiXQXEfdJ/kVXHPygg2dkFrj5q1nM28Q7I=
+github.com/cloudx-io/openauction v0.0.0-20261015162644-6894ac2467d7/go.mod h1:xWX1ftwEJkh/YdPUxxQysvj3DV4eEsPwe9DuhzYgEts=
 github.com/edgebitio/nitro-enclaves-sdk-go v1.0.1-0.20221110205443-8a5476ff3cc2 h1:pskJ0eUeBFqfoviPOHCiQ0FjgyAAkhmkSd7tQNqaK4U=
 github.com/edgebitio/nitro-enclaves-sdk-go v1.0.1-0.20221110205443-8a5476ff3cc2/go.mod h1:hDAX5hYfgVR/TzewAODjCifHo3urkCACUnsMeFDkt2Y=
 github.com/fxamacker/cbor/v2 v2.2.0/go.mod h1:TA1xS00nchWmaBnEIxPSE5oHLuJBAVvqrtAnWBwBCVo=