feat(enclave): run face matching in matches flow

.dockerignore

@@ -1,9 +1,15 @@
 # Build artifacts and VCS metadata — never needed in the image build context.
 target/
 **/target/
+build/
 .git/
 .github/
 
+# The placeholder Face Engine graph only loads these two private model artifacts.
+models/*
+!models/face_embedding_generator.onnx
+!models/rgbnet.onnx
+
 # Local editor / OS cruft.
 .vscode/
 .idea/

.github/workflows/build-docker.yml

@@ -73,6 +73,15 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
+      - name: Check private dependency token
+        env:
+          GIT_HUB_TOKEN: ${{ secrets.GIT_HUB_TOKEN }}
+        run: |
+          if [[ -z "$GIT_HUB_TOKEN" ]]; then
+            echo "::error::GIT_HUB_TOKEN is required to fetch private dependencies"
+            exit 1
+          fi
+
       - name: Login to GitHub Container Registry
         if: github.event_name != 'pull_request'
         uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
@@ -93,6 +102,8 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
           platforms: linux/amd64
+          secrets: |
+            GITHUB_TOKEN=${{ secrets.GIT_HUB_TOKEN }}
 
       - name: Attest build provenance
         if: github.event_name != 'pull_request'

.github/workflows/build-enclave-eif.yml

@@ -74,6 +74,8 @@ jobs:
         run: sudo install -d -m 1777 /var/log/nitro_enclaves
 
       - name: Build EIF and PCRs
+        env:
+          GIT_HUB_TOKEN: ${{ secrets.GIT_HUB_TOKEN }}
         run: scripts/build-eif.sh target/eif
 
       - name: Publish PCR measurements

.github/workflows/ci.yml

@@ -11,6 +11,7 @@ permissions:
 
 env:
   CARGO_TERM_COLOR: always
+  CARGO_NET_GIT_FETCH_WITH_CLI: true
   RUST_BACKTRACE: 1
 
 jobs:
@@ -34,6 +35,17 @@ jobs:
         with:
           components: clippy
       - uses: Swatinem/rust-cache@v2
+      - name: Configure private Git dependencies
+        env:
+          GIT_HUB_TOKEN: ${{ secrets.GIT_HUB_TOKEN }}
+        run: |
+          if [[ -z "$GIT_HUB_TOKEN" ]]; then
+            echo "::error::GIT_HUB_TOKEN is required to fetch private dependencies"
+            exit 1
+          fi
+          git config --global \
+            url."https://${GIT_HUB_TOKEN}:x-oauth-basic@github.com/".insteadOf \
+            "https://github.com/"
       - name: Run Clippy
         run: cargo clippy --locked --all-targets --all-features --
 
@@ -44,6 +56,17 @@ jobs:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@1.97.0
       - uses: Swatinem/rust-cache@v2
+      - name: Configure private Git dependencies
+        env:
+          GIT_HUB_TOKEN: ${{ secrets.GIT_HUB_TOKEN }}
+        run: |
+          if [[ -z "$GIT_HUB_TOKEN" ]]; then
+            echo "::error::GIT_HUB_TOKEN is required to fetch private dependencies"
+            exit 1
+          fi
+          git config --global \
+            url."https://${GIT_HUB_TOKEN}:x-oauth-basic@github.com/".insteadOf \
+            "https://github.com/"
       - name: Build debug
         run: cargo build --locked --verbose
       - name: Build release
@@ -56,6 +79,17 @@ jobs:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@1.97.0
       - uses: Swatinem/rust-cache@v2
+      - name: Configure private Git dependencies
+        env:
+          GIT_HUB_TOKEN: ${{ secrets.GIT_HUB_TOKEN }}
+        run: |
+          if [[ -z "$GIT_HUB_TOKEN" ]]; then
+            echo "::error::GIT_HUB_TOKEN is required to fetch private dependencies"
+            exit 1
+          fi
+          git config --global \
+            url."https://${GIT_HUB_TOKEN}:x-oauth-basic@github.com/".insteadOf \
+            "https://github.com/"
       - name: Run tests
         run: cargo test --locked --all --verbose
 
@@ -70,6 +104,17 @@ jobs:
     continue-on-error: ${{ matrix.checks == 'advisories' }}
     steps:
       - uses: actions/checkout@v4
+      - name: Configure private Git dependencies
+        env:
+          GIT_HUB_TOKEN: ${{ secrets.GIT_HUB_TOKEN }}
+        run: |
+          if [[ -z "$GIT_HUB_TOKEN" ]]; then
+            echo "::error::GIT_HUB_TOKEN is required to fetch private dependencies"
+            exit 1
+          fi
+          git config --global \
+            url."https://${GIT_HUB_TOKEN}:x-oauth-basic@github.com/".insteadOf \
+            "https://github.com/"
       - uses: EmbarkStudios/cargo-deny-action@v2
         with:
           command: check ${{ matrix.checks }}

.gitignore

@@ -15,3 +15,15 @@ Thumbs.db
 # Environment
 .env
 .env.local
+
+# Private Face Engine model artifacts
+models/
+
+# Python
+**/__pycache__/
+
+# Enclave
+*.eif
+
+# Local biometric fixtures used by the E2E client
+e2e/**/fixtures/