feat: add POST /v1/enclave-assignment and an attestation-verifying client #38
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Builds the secure-enclave EIF and validates its PCR generation. | |
| name: Build Enclave EIF | |
| on: | |
| pull_request: | |
| paths: | |
| - "secure-enclave/**" | |
| - "shared/**" | |
| - "Cargo.toml" | |
| - "Cargo.lock" | |
| - "rust-toolchain.toml" | |
| - "scripts/build-eif.sh" | |
| - ".github/workflows/build-enclave-eif.yml" | |
| push: | |
| branches: | |
| - main | |
| tags: | |
| - "v*" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| env: | |
| NITRO_CLI_VERSION: v1.4.2 | |
| jobs: | |
| build-enclave-eif: | |
| name: Build enclave EIF | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| - name: Mint biometric-engines access token | |
| id: biometric-engines-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3 | |
| with: | |
| client-id: ${{ secrets.BIOMETRIC_ENGINES_APP_ID }} | |
| private-key: ${{ secrets.BIOMETRIC_ENGINES_APP_PRIVATE_KEY }} | |
| owner: worldcoin | |
| repositories: biometric-engines | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable | |
| - name: Cache nitro-cli build | |
| uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 | |
| with: | |
| path: target/eif/aws-nitro-enclaves-cli-${{ env.NITRO_CLI_VERSION }} | |
| key: nitro-cli-${{ runner.os }}-${{ env.NITRO_CLI_VERSION }} | |
| - name: Prepare nitro-cli log directory | |
| run: sudo install -d -m 1777 /var/log/nitro_enclaves | |
| - name: Build EIF and PCRs | |
| env: | |
| GIT_HUB_TOKEN: ${{ steps.biometric-engines-token.outputs.token }} | |
| # TODO: Remove when models are injected into the enclave at runtime. | |
| SKIP_MODEL_DOWNLOAD: "true" | |
| run: scripts/build-eif.sh target/eif | |
| - name: Publish PCR measurements | |
| run: | | |
| { | |
| echo '### Enclave PCR measurements' | |
| echo '```json' | |
| cat target/eif/pcrs.json | |
| echo '```' | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| - name: Upload PCR measurements | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: enclave-pcrs | |
| path: target/eif/pcrs.json | |
| if-no-files-found: error |