Skip to content

Commit 14ddf01

Browse files
Takaros999Takaros999
authored
feat(enclave): run face matching in matches flow (#11)
* feat: add enclave face comparison placeholder * feat: run face matching in enclave matches flow * fix(ci): authenticate private git dependencies * fix(ci): use biometric engines app token * fix(ci): pass app token to cargo deny * fix(ci): scope license checks to public dependencies * fix(ci): keep advisories non-blocking * fix(ci): build model-free eif for pull requests * fix(ci): simplify model-free eif build
1 parent 82aa60a commit 14ddf01

26 files changed

Lines changed: 2987 additions & 265 deletions

File tree

‎.dockerignore‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,15 @@
11
# Build artifacts and VCS metadata — never needed in the image build context.
22
target/
33
**/target/
4+
build/
45
.git/
56
.github/
67

8+
# The placeholder Face Engine graph only loads these two private model artifacts.
9+
models/*
10+
!models/face_embedding_generator.onnx
11+
!models/rgbnet.onnx
12+
713
# Local editor / OS cruft.
814
.vscode/
915
.idea/

‎.github/workflows/build-docker.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,15 @@ jobs:
4141
- name: Checkout code
4242
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
4343

44+
- name: Mint biometric-engines access token
45+
id: biometric-engines-token
46+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
47+
with:
48+
client-id: ${{ secrets.BIOMETRIC_ENGINES_APP_ID }}
49+
private-key: ${{ secrets.BIOMETRIC_ENGINES_APP_PRIVATE_KEY }}
50+
owner: worldcoin
51+
repositories: biometric-engines
52+
4453
- name: Resolve version
4554
id: version
4655
if: github.ref_type == 'tag' || inputs.version != ''
@@ -93,6 +102,8 @@ jobs:
93102
cache-from: type=gha
94103
cache-to: type=gha,mode=max
95104
platforms: linux/amd64
105+
secrets: |
106+
GITHUB_TOKEN=${{ steps.biometric-engines-token.outputs.token }}
96107
97108
- name: Attest build provenance
98109
if: github.event_name != 'pull_request'

‎.github/workflows/build-enclave-eif.yml‎

Lines changed: 16 additions & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
1-
# Builds the secure-enclave EIF and pushes the carrier image to GHCR.
2-
# Pull requests build without publishing.
3-
name: Build Enclave EIF Image
1+
# Builds the secure-enclave EIF and validates its PCR generation.
2+
name: Build Enclave EIF
43

54
on:
65
pull_request:
@@ -18,11 +17,6 @@ on:
1817
tags:
1918
- "v*"
2019
workflow_dispatch:
21-
inputs:
22-
version:
23-
description: "Version tag to publish (including v prefix, e.g. v0.1.0)"
24-
required: false
25-
type: string
2620

2721
permissions:
2822
contents: read
@@ -32,17 +26,21 @@ env:
3226

3327
jobs:
3428
build-enclave-eif:
35-
name: Build enclave EIF + carrier image
29+
name: Build enclave EIF
3630
runs-on: ubuntu-latest
37-
permissions:
38-
contents: read
39-
id-token: write
40-
packages: write
41-
attestations: write
4231
steps:
4332
- name: Checkout code
4433
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
4534

35+
- name: Mint biometric-engines access token
36+
id: biometric-engines-token
37+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
38+
with:
39+
client-id: ${{ secrets.BIOMETRIC_ENGINES_APP_ID }}
40+
private-key: ${{ secrets.BIOMETRIC_ENGINES_APP_PRIVATE_KEY }}
41+
owner: worldcoin
42+
repositories: biometric-engines
43+
4644
- name: Install Rust toolchain
4745
uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
4846

@@ -52,28 +50,14 @@ jobs:
5250
path: target/eif/aws-nitro-enclaves-cli-${{ env.NITRO_CLI_VERSION }}
5351
key: nitro-cli-${{ runner.os }}-${{ env.NITRO_CLI_VERSION }}
5452

55-
- name: Resolve version
56-
id: version
57-
if: github.ref_type == 'tag' || inputs.version != ''
58-
env:
59-
INPUT_VERSION: ${{ inputs.version }}
60-
run: |
61-
if [[ -n "$INPUT_VERSION" ]]; then
62-
VERSION="$INPUT_VERSION"
63-
else
64-
VERSION="$GITHUB_REF_NAME"
65-
fi
66-
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
67-
if [[ "$VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
68-
echo "is_stable=true" >> "$GITHUB_OUTPUT"
69-
else
70-
echo "is_stable=false" >> "$GITHUB_OUTPUT"
71-
fi
72-
7353
- name: Prepare nitro-cli log directory
7454
run: sudo install -d -m 1777 /var/log/nitro_enclaves
7555

7656
- name: Build EIF and PCRs
57+
env:
58+
GIT_HUB_TOKEN: ${{ steps.biometric-engines-token.outputs.token }}
59+
# TODO: Remove when models are injected into the enclave at runtime.
60+
SKIP_MODEL_DOWNLOAD: "true"
7761
run: scripts/build-eif.sh target/eif
7862

7963
- name: Publish PCR measurements
@@ -91,44 +75,3 @@ jobs:
9175
name: enclave-pcrs
9276
path: target/eif/pcrs.json
9377
if-no-files-found: error
94-
95-
- name: Docker meta
96-
id: meta
97-
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
98-
with:
99-
images: ghcr.io/${{ github.repository }}-enclave-eif
100-
tags: |
101-
type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' || steps.version.outputs.is_stable == 'true' }}
102-
type=sha
103-
type=raw,value=${{ steps.version.outputs.version }},enable=${{ steps.version.outputs.version != '' }}
104-
105-
- name: Set up Docker Buildx
106-
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
107-
108-
- name: Login to GitHub Container Registry
109-
if: github.event_name != 'pull_request'
110-
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
111-
with:
112-
registry: ghcr.io
113-
username: ${{ github.actor }}
114-
password: ${{ secrets.GITHUB_TOKEN }}
115-
116-
- name: Build and push carrier image
117-
id: build
118-
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
119-
with:
120-
# Context is the EIF output dir so the .eif is always included.
121-
context: target/eif
122-
file: secure-enclave/Dockerfile.eif
123-
push: ${{ github.event_name != 'pull_request' }}
124-
tags: ${{ steps.meta.outputs.tags }}
125-
labels: ${{ steps.meta.outputs.labels }}
126-
platforms: linux/amd64
127-
128-
- name: Attest build provenance
129-
if: github.event_name != 'pull_request'
130-
uses: actions/attest-build-provenance@ef244123eb79f2f7a7e75d99086184180e6d0018 # v1
131-
with:
132-
push-to-registry: true
133-
subject-name: ghcr.io/${{ github.repository }}-enclave-eif
134-
subject-digest: ${{ steps.build.outputs.digest }}

‎.github/workflows/ci.yml‎

Lines changed: 56 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ permissions:
1111

1212
env:
1313
CARGO_TERM_COLOR: always
14+
CARGO_NET_GIT_FETCH_WITH_CLI: true
1415
RUST_BACKTRACE: 1
1516

1617
jobs:
@@ -30,10 +31,25 @@ jobs:
3031
runs-on: ubuntu-latest
3132
steps:
3233
- uses: actions/checkout@v4
34+
- name: Mint biometric-engines access token
35+
id: biometric-engines-token
36+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
37+
with:
38+
client-id: ${{ secrets.BIOMETRIC_ENGINES_APP_ID }}
39+
private-key: ${{ secrets.BIOMETRIC_ENGINES_APP_PRIVATE_KEY }}
40+
owner: worldcoin
41+
repositories: biometric-engines
3342
- uses: dtolnay/rust-toolchain@1.97.0
3443
with:
3544
components: clippy
3645
- uses: Swatinem/rust-cache@v2
46+
- name: Configure private Git dependencies
47+
env:
48+
BIOMETRIC_ENGINES_TOKEN: ${{ steps.biometric-engines-token.outputs.token }}
49+
run: |
50+
git config --global \
51+
url."https://x-access-token:${BIOMETRIC_ENGINES_TOKEN}@github.com/worldcoin/biometric-engines".insteadOf \
52+
"https://github.com/worldcoin/biometric-engines"
3753
- name: Run Clippy
3854
run: cargo clippy --locked --all-targets --all-features --
3955

@@ -42,8 +58,23 @@ jobs:
4258
runs-on: ubuntu-latest
4359
steps:
4460
- uses: actions/checkout@v4
61+
- name: Mint biometric-engines access token
62+
id: biometric-engines-token
63+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
64+
with:
65+
client-id: ${{ secrets.BIOMETRIC_ENGINES_APP_ID }}
66+
private-key: ${{ secrets.BIOMETRIC_ENGINES_APP_PRIVATE_KEY }}
67+
owner: worldcoin
68+
repositories: biometric-engines
4569
- uses: dtolnay/rust-toolchain@1.97.0
4670
- uses: Swatinem/rust-cache@v2
71+
- name: Configure private Git dependencies
72+
env:
73+
BIOMETRIC_ENGINES_TOKEN: ${{ steps.biometric-engines-token.outputs.token }}
74+
run: |
75+
git config --global \
76+
url."https://x-access-token:${BIOMETRIC_ENGINES_TOKEN}@github.com/worldcoin/biometric-engines".insteadOf \
77+
"https://github.com/worldcoin/biometric-engines"
4778
- name: Build debug
4879
run: cargo build --locked --verbose
4980
- name: Build release
@@ -54,8 +85,23 @@ jobs:
5485
runs-on: ubuntu-latest
5586
steps:
5687
- uses: actions/checkout@v4
88+
- name: Mint biometric-engines access token
89+
id: biometric-engines-token
90+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
91+
with:
92+
client-id: ${{ secrets.BIOMETRIC_ENGINES_APP_ID }}
93+
private-key: ${{ secrets.BIOMETRIC_ENGINES_APP_PRIVATE_KEY }}
94+
owner: worldcoin
95+
repositories: biometric-engines
5796
- uses: dtolnay/rust-toolchain@1.97.0
5897
- uses: Swatinem/rust-cache@v2
98+
- name: Configure private Git dependencies
99+
env:
100+
BIOMETRIC_ENGINES_TOKEN: ${{ steps.biometric-engines-token.outputs.token }}
101+
run: |
102+
git config --global \
103+
url."https://x-access-token:${BIOMETRIC_ENGINES_TOKEN}@github.com/worldcoin/biometric-engines".insteadOf \
104+
"https://github.com/worldcoin/biometric-engines"
59105
- name: Run tests
60106
run: cargo test --locked --all --verbose
61107

@@ -67,10 +113,19 @@ jobs:
67113
checks:
68114
- advisories
69115
- bans licenses sources
70-
continue-on-error: ${{ matrix.checks == 'advisories' }}
71116
steps:
72117
- uses: actions/checkout@v4
118+
- name: Mint biometric-engines access token
119+
id: biometric-engines-token
120+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
121+
with:
122+
client-id: ${{ secrets.BIOMETRIC_ENGINES_APP_ID }}
123+
private-key: ${{ secrets.BIOMETRIC_ENGINES_APP_PRIVATE_KEY }}
124+
owner: worldcoin
125+
repositories: biometric-engines
73126
- uses: EmbarkStudios/cargo-deny-action@v2
127+
continue-on-error: ${{ matrix.checks == 'advisories' }}
74128
with:
75129
command: check ${{ matrix.checks }}
76130
rust-version: 1.97.0
131+
credentials: https://x-access-token:${{ steps.biometric-engines-token.outputs.token }}@github.com

‎.gitignore‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,3 +15,15 @@ Thumbs.db
1515
# Environment
1616
.env
1717
.env.local
18+
19+
# Private Face Engine model artifacts
20+
models/
21+
22+
# Python
23+
**/__pycache__/
24+
25+
# Enclave
26+
*.eif
27+
28+
# Local biometric fixtures used by the E2E client
29+
e2e/**/fixtures/

0 commit comments

Comments
 (0)