Skip to content

Commit 79ab41e

Browse files
PierreJeanjacquotPierreJeanjacquot
committed
docs: sconify documentation
1 parent f273ec6 commit 79ab41e

File tree

2 files changed

+142
-1
lines changed

2 files changed

+142
-1
lines changed

‎.github/workflows/sconify.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -100,7 +100,7 @@ jobs:
100100
prod-mrenclave: ${{ steps.push-prod.outputs.mrenclave }}
101101
prod-checksum: ${{ steps.push-prod.outputs.checksum }}
102102
steps:
103-
- name: Login to Docker Hub
103+
- name: Login to Docker Registry
104104
uses: docker/login-action@v3
105105
with:
106106
registry: ${{ inputs.docker-registry }}

‎sconify/README.md

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
# Sconify - Reusable Workflow Documentation 🚀
2+
3+
## Overview 🌟
4+
5+
This reusable GitHub Actions workflow automates the process of sconifying a Docker image. It is configurable via inputs for the Sconification options and secrets for docker registries credentials and production enclave signing key.
6+
7+
The workflow performs the following actions:
8+
9+
- **Login to Docker Registry**
10+
- **Login to Scontain Docker Registry**
11+
- **Pull Image to Sconify** from Docker Registry
12+
- **Pull Sconify Image** from Scontain Docker Registry
13+
- [unless input `sconify-debug: false`]
14+
- **Sconify Image Debug**
15+
- **Push Debug Image** to Docker Registry and prepare outputs (`debug-image`,`debug-mrenclave`,`debug-checksum`)
16+
- [unless input `sconify-prod: false`]
17+
- **Sconify Image Prod**
18+
- **Push Prod Image** to Docker Registry and prepare outputs (`prod-image`,`prod-mrenclave`,`prod-checksum`)
19+
20+
## Workflow Inputs 🛠️
21+
22+
| **Input** | **Description** | **Required** | **Default** |
23+
| --------------------- | ------------------------------------------ | ------------ | ----------- |
24+
| **docker-username** | Docker Registry Username | Yes | - |
25+
| **scontain-username** | Scontain Registry Username | Yes | - |
26+
| **image-name** | Name of Docker Image to Sconify | Yes | - |
27+
| **image-tag** | Tag of Docker Image to Sconify | Yes | - |
28+
| **docker-registry** | Docker Registry of Docker Image to Sconify | No | docker.io |
29+
| **sconify-version** | Version of the Sconify Image to use | Yes | - |
30+
| **fs-dir** | File System Directory to Protect | Yes | - |
31+
| **binary** | Path to the Binary to Protect | Yes | - |
32+
| **command** | Command to Protect | Yes | - |
33+
| **heap** | Enclave Heap size | No | 1G |
34+
| **dlopen** | dlopen mode | No | 1 |
35+
| **sconify-debug** | Create Scone Debug image | No | true |
36+
| **sconify-prod** | Create Scone Production image | No | true |
37+
38+
### Secrets 🔐
39+
40+
| **Secret** | **Description** | **Required** |
41+
| --------------------- | ----------------------------------------------- | --------------------------------------- |
42+
| **docker-password** | Docker Registry Password or Token | Yes |
43+
| **scontain-password** | Scontain Registry Password or Token | Yes |
44+
| **scone-signing-key** | Signing Key for Scone Production (PEM RSA-3072) | Yes unless `inputs.sconify-prod: false` |
45+
46+
### Outputs 📤
47+
48+
| **Output** | **Description** |
49+
| ------------------- | ---------------------------------------------------------------------------------- |
50+
| **debug-image** | Debug Sconified Image (unless `inputs.sconify-debug: false`) |
51+
| **debug-mrenclave** | Debug Sconified Image MrEnclave Fingerprint (unless `inputs.sconify-debug: false`) |
52+
| **debug-checksum** | Debug Sconified Image Checksum (unless `inputs.sconify-debug: false`) |
53+
| **prod-image** | Prod Sconified Image (unless `inputs.sconify-prod: false`) |
54+
| **prod-mrenclave** | Prod Sconified Image MrEnclave Fingerprint (unless `inputs.sconify-prod: false`) |
55+
| **prod-checksum** | Prod Sconified Image Checksum (unless `inputs.sconify-prod: false`) |
56+
57+
## How to Use This Reusable Workflow 🔄
58+
59+
1. **Save the Workflow File**
60+
This workflow is already saved as `.github/workflows/sconify.yml` in the repository. 💾
61+
62+
2. **Call the Reusable Workflow**
63+
In another workflow file (e.g., triggered manually or by a release), invoke this reusable workflow like so:
64+
65+
```yaml
66+
name: Sconify iApp
67+
68+
on:
69+
workflow_dispatch:
70+
inputs:
71+
image-name:
72+
required: true
73+
type: string
74+
image-tag:
75+
required: true
76+
type: string
77+
sconify-debug:
78+
type: boolean
79+
default: true
80+
sconify-prod:
81+
type: boolean
82+
default: true
83+
84+
jobs:
85+
sconify:
86+
uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/sconify.yml@feat/sconify
87+
with:
88+
image-name: ${{ inputs.image-name }}
89+
image-tag: ${{ inputs.image-tag }}
90+
sconify-debug: ${{ inputs.sconify-debug }}
91+
sconify-prod: ${{ inputs.sconify-prod }}
92+
docker-registry: docker.io
93+
sconify-version: 5.9.0-v15
94+
fs-dir: /app
95+
binary: /usr/local/bin/node
96+
command: node /app/src/app.js
97+
heap: 1G
98+
dlopen: 1
99+
docker-username: ${{ vars.DOCKER_USERNAME }}
100+
scontain-username: ${{ vars.SCONTAIN_USERNAME }}
101+
secrets:
102+
docker-password: ${{ secrets.DOCKER_TOKEN }}
103+
scontain-password: ${{ secrets.SCONTAIN_TOKEN }}
104+
scone-signing-key: ${{ secrets.SCONE_SIGNING_KEY }}
105+
106+
use-sconify-output:
107+
# usually you want to deploy the sconified image as an iExec app using the sconify job outputs
108+
runs-on: ubuntu-latest
109+
needs: sconify
110+
steps:
111+
- run: |
112+
echo "DEBUG IMAGE INFO: image=${{ needs.sconify.outputs.debug-image }} | checksum=${{ needs.sconify.outputs.debug-checksum }} | mrenclave=${{ needs.sconify.outputs.debug-mrenclave }}"
113+
echo "PROD IMAGE INFO: image=${{ needs.sconify.outputs.prod-image }} | checksum=${{ needs.sconify.outputs.prod-checksum }} | mrenclave=${{ needs.sconify.outputs.prod-mrenclave }}"
114+
```
115+
116+
3. **Configure Variables**
117+
Ensure that the following variables are added to your repository's settings:
118+
119+
- `DOCKERHUB_USERNAME`: Your DockerHub username
120+
- `SCONTAIN_USERNAME`: Your Scontain username
121+
122+
NB: Beware if you choose to use secrets to store registries usernames;
123+
registries usernames can appear in sconified image names outputted as `outputs.debug-image` and `outputs.prod-image`, in such a case GitHub Actions blanks the outputs with this waring:
124+
125+
> Skip output 'prod-image' since it may contain secret.
126+
127+
> Skip output 'debug-image' since it may contain secret.
128+
129+
4. **Configure Secrets**
130+
Ensure that the following secrets are added to your repository's settings:
131+
- `DOCKERHUB_USERNAME`: Your DockerHub username
132+
- `DOCKERHUB_PASSWORD`: Your DockerHub password or access token
133+
- `SCONTAIN_PASSWORD`: Your Scontain password or access token
134+
- `SCONE_SIGNING_KEY`: The key to use for signing Scone Prod applications
135+
136+
## Prerequisites 📋
137+
138+
1. **Read/Write access to the image to sconify**
139+
140+
2. **Read access to Scontain's `iexec-sconify-image` image**:
141+
- You must have a Scontain account with access to the `scone-production/iexec-sconify-image` image.

0 commit comments

Comments
 (0)