Repository navigation
build(deps): bump ubuntu from 513c074 to cd21a4f in /container
#1424
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Integration (Emulation Mode) | |
| # Trigger on push and pull request events | |
| on: | |
| push: | |
| paths-ignore: | |
| - "**.md" | |
| - "doc/**" | |
| pull_request: | |
| paths-ignore: | |
| - "**.md" | |
| - "doc/**" | |
| workflow_dispatch: | |
| env: | |
| AS: nasm | |
| RUST_TOOLCHAIN: 1.88.0 | |
| TOOLCHAIN_PROFILE: minimal | |
| permissions: | |
| contents: read | |
| jobs: | |
| emulation-tests: | |
| name: ${{ matrix.test-name }} | |
| runs-on: ubuntu-22.04 | |
| timeout-minutes: 60 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - test-name: "Build and Test (Skip RA)" | |
| test-type: "skip-ra" | |
| install-jq: 'false' | |
| timeout-seconds: 300 | |
| test-command: "./migtdemu.sh --skip-ra --debug --both --no-sudo --log-level info" | |
| artifact-name: "skip-ra-test-logs" | |
| - test-name: "Policy v2 with Mock Report" | |
| test-type: "policy-v2" | |
| install-jq: 'true' | |
| timeout-seconds: 900 | |
| test-command: "./migtdemu.sh --policy-v2 --policy-file ./config/AzCVMEmu/policy_v2_signed.json --policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain.pem --mock-report --both --no-sudo --log-level info" | |
| artifact-name: "policy-v2-test-logs" | |
| - test-name: "Policy v2 with Mock Report and IGVM Attest" | |
| test-type: "policy-v2-igvm" | |
| install-jq: 'true' | |
| timeout-seconds: 900 | |
| test-command: "./migtdemu.sh --policy-v2 --policy-file ./config/AzCVMEmu/policy_v2_signed.json --policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain.pem --mock-report --features igvm-attest --both --no-sudo --log-level info" | |
| artifact-name: "policy-v2-igvm-test-logs" | |
| - test-name: "Rebind Prepare (Skip RA)" | |
| test-type: "rebind-skip-ra" | |
| install-jq: 'true' | |
| timeout-seconds: 300 | |
| test-command: "./migtdemu.sh --operation rebind-prepare --policy-file ./config/AzCVMEmu/policy_v2_signed.json --policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain.pem --skip-ra --debug --both --no-sudo --log-level info" | |
| artifact-name: "rebind-skip-ra-test-logs" | |
| - test-name: "Rebind Prepare (Mock Report)" | |
| test-type: "rebind-mock" | |
| install-jq: 'true' | |
| timeout-seconds: 900 | |
| test-command: "./migtdemu.sh --operation rebind-prepare --policy-file ./config/AzCVMEmu/policy_v2_signed.json --policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain.pem --mock-report --both --no-sudo --log-level info" | |
| artifact-name: "rebind-mock-test-logs" | |
| - test-name: "SPDM Migration (Skip RA)" | |
| test-type: "spdm-skip-ra" | |
| install-jq: 'false' | |
| timeout-seconds: 300 | |
| test-command: "./migtdemu.sh --skip-ra --debug --features spdm_attestation --both --no-sudo --log-level info" | |
| artifact-name: "spdm-skip-ra-test-logs" | |
| - test-name: "SPDM Policy v2 with Mock Report" | |
| test-type: "spdm-policy-v2" | |
| install-jq: 'true' | |
| timeout-seconds: 900 | |
| test-command: "./migtdemu.sh --policy-v2 --policy-file ./config/AzCVMEmu/policy_v2_signed.json --policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain.pem --mock-report --features spdm_attestation --both --no-sudo --log-level info" | |
| artifact-name: "spdm-policy-v2-test-logs" | |
| - test-name: "SPDM Rebind Prepare (Skip RA)" | |
| test-type: "spdm-rebind-skip-ra" | |
| install-jq: 'true' | |
| timeout-seconds: 300 | |
| test-command: "./migtdemu.sh --operation rebind-prepare --policy-file ./config/AzCVMEmu/policy_v2_signed.json --policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain.pem --skip-ra --debug --features spdm_attestation --both --no-sudo --log-level info" | |
| artifact-name: "spdm-rebind-skip-ra-test-logs" | |
| - test-name: "Mock Quote Retry" | |
| test-type: "mock-quote-retry" | |
| install-jq: 'false' | |
| timeout-seconds: 900 | |
| test-command: "./migtdemu.sh --mock-report --mock-quote-retry --features igvm-attest --both --no-sudo --log-level info" | |
| artifact-name: "mock-quote-retry-test-logs" | |
| - test-name: "Policy v2 Key Rotation (Mock Report)" | |
| test-type: "policy-v2-key-rotation" | |
| install-jq: 'true' | |
| timeout-seconds: 900 | |
| test-command: "./migtdemu.sh --policy-v2 --src-policy-file ./config/AzCVMEmu/policy_v2_signed_a.json --src-policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain_a.pem --dst-policy-file ./config/AzCVMEmu/policy_v2_signed_b.json --dst-policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain_b.pem --mock-report --both --no-sudo --log-level info" | |
| artifact-name: "policy-v2-key-rotation-test-logs" | |
| - test-name: "Policy v2 Key Rotation with IGVM Attest" | |
| test-type: "policy-v2-key-rotation-igvm" | |
| install-jq: 'true' | |
| timeout-seconds: 900 | |
| test-command: "./migtdemu.sh --policy-v2 --src-policy-file ./config/AzCVMEmu/policy_v2_signed_a.json --src-policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain_a.pem --dst-policy-file ./config/AzCVMEmu/policy_v2_signed_b.json --dst-policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain_b.pem --mock-report --features igvm-attest --both --no-sudo --log-level info" | |
| artifact-name: "policy-v2-key-rotation-igvm-test-logs" | |
| - test-name: "SPDM Policy v2 Key Rotation (Mock Report)" | |
| test-type: "spdm-policy-v2-key-rotation" | |
| install-jq: 'true' | |
| timeout-seconds: 900 | |
| test-command: "./migtdemu.sh --policy-v2 --src-policy-file ./config/AzCVMEmu/policy_v2_signed_a.json --src-policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain_a.pem --dst-policy-file ./config/AzCVMEmu/policy_v2_signed_b.json --dst-policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain_b.pem --mock-report --features spdm_attestation --both --no-sudo --log-level info" | |
| artifact-name: "spdm-policy-v2-key-rotation-test-logs" | |
| - test-name: "Policy v2 Policy + TCB Mapping Leaf Rotation (Mock Report)" | |
| test-type: "policy-v2-policy-mapping-rotation" | |
| install-jq: 'true' | |
| timeout-seconds: 900 | |
| test-command: "./migtdemu.sh --policy-v2 --src-policy-file ./config/AzCVMEmu/policy_v2_signed_a.json --src-policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain_a.pem --dst-policy-file ./config/AzCVMEmu/policy_v2_signed_pm_b.json --dst-policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain_b.pem --mock-report --both --no-sudo --log-level info" | |
| artifact-name: "policy-v2-policy-mapping-rotation-test-logs" | |
| - test-name: "Policy v2 All Three Chains Rotation (Mock Report)" | |
| test-type: "policy-v2-all-chains-rotation" | |
| install-jq: 'true' | |
| timeout-seconds: 900 | |
| test-command: "./migtdemu.sh --policy-v2 --src-policy-file ./config/AzCVMEmu/policy_v2_signed_a.json --src-policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain_a.pem --dst-policy-file ./config/AzCVMEmu/policy_v2_signed_pmi_b.json --dst-policy-issuer-chain-file ./config/AzCVMEmu/policy_issuer_chain_b.pem --mock-report --both --no-sudo --log-level info" | |
| artifact-name: "policy-v2-all-chains-rotation-test-logs" | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout sources | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: recursive | |
| - name: Setup build environment | |
| uses: ./.github/actions/setup-build-environment | |
| with: | |
| install-tpm-tools: 'true' | |
| install-jq: ${{ matrix.install-jq }} | |
| - name: Build MigTD for skip-ra test | |
| if: matrix.test-type == 'skip-ra' | |
| run: | | |
| echo "Building MigTD with AzCVMEmu and test features for emulation testing..." | |
| cargo build --features "AzCVMEmu,test_disable_ra_and_accept_all" --no-default-features | |
| - name: Build MigTD for rebind skip-ra test | |
| if: matrix.test-type == 'rebind-skip-ra' | |
| run: | | |
| echo "Building MigTD with AzCVMEmu, policy_v2, and skip-RA features for rebind testing..." | |
| cargo build --features "AzCVMEmu,policy_v2,test_disable_ra_and_accept_all" --no-default-features | |
| - name: Build MigTD for SPDM skip-ra test | |
| if: matrix.test-type == 'spdm-skip-ra' | |
| run: | | |
| echo "Building MigTD with AzCVMEmu, SPDM attestation, and skip-RA features..." | |
| export SPDM_CONFIG="$(pwd)/config/spdm_config.json" | |
| cargo build --features "AzCVMEmu,test_disable_ra_and_accept_all,spdm_attestation" --no-default-features | |
| - name: Build MigTD for SPDM rebind skip-ra test | |
| if: matrix.test-type == 'spdm-rebind-skip-ra' | |
| run: | | |
| echo "Building MigTD with AzCVMEmu, SPDM attestation, policy_v2, and skip-RA features..." | |
| export SPDM_CONFIG="$(pwd)/config/spdm_config.json" | |
| cargo build --features "AzCVMEmu,policy_v2,test_disable_ra_and_accept_all,spdm_attestation" --no-default-features | |
| - name: Verify emulation script | |
| if: matrix.test-type == 'skip-ra' || matrix.test-type == 'rebind-skip-ra' || matrix.test-type == 'spdm-skip-ra' || matrix.test-type == 'spdm-rebind-skip-ra' | |
| run: | | |
| if [[ ! -f "./migtdemu.sh" ]]; then | |
| echo "Error: migtdemu.sh not found" | |
| exit 1 | |
| fi | |
| if [[ ! -f "./target/debug/migtd" ]]; then | |
| echo "Error: debug migtd binary not found after build" | |
| exit 1 | |
| fi | |
| echo "Emulation script and binary are ready" | |
| - name: Prepare scripts | |
| run: | | |
| chmod +x ./migtdemu.sh | |
| chmod +x ./sh_script/build_AzCVMEmu_policy_and_test.sh | |
| - name: Generate policy files | |
| if: matrix.install-jq == 'true' | |
| run: | | |
| echo "Generating AzCVMEmu policy files with mock measurements..." | |
| ./sh_script/build_AzCVMEmu_policy_and_test.sh --mock-report --skip-test | |
| echo "Policy files generated:" | |
| ls -la config/AzCVMEmu/policy_v2_signed*.json config/AzCVMEmu/policy_issuer_chain*.pem | |
| - name: Run test | |
| id: test_run | |
| run: | | |
| echo "Running: ${{ matrix.test-name }}" | |
| echo "Command: ${{ matrix.test-command }}" | |
| set +e | |
| timeout ${{ matrix.timeout-seconds }} ${{ matrix.test-command }} | |
| EXIT_CODE=$? | |
| set -e | |
| echo "Test completed with exit code: $EXIT_CODE" | |
| if [[ $EXIT_CODE -eq 0 ]]; then | |
| echo "✅ Test completed successfully" | |
| echo "test_status=success" >> $GITHUB_OUTPUT | |
| elif [[ $EXIT_CODE -eq 124 ]]; then | |
| echo "❌ Test timed out after ${{ matrix.timeout-seconds }} seconds" | |
| echo "test_status=timeout" >> $GITHUB_OUTPUT | |
| exit 1 | |
| else | |
| echo "❌ Test failed with exit code $EXIT_CODE" | |
| echo "test_status=failed" >> $GITHUB_OUTPUT | |
| exit $EXIT_CODE | |
| fi | |
| - name: Check test outputs | |
| if: always() | |
| run: | | |
| echo "=== Test Execution Summary ===" | |
| echo "Test: ${{ matrix.test-name }}" | |
| echo "Status: ${{ steps.test_run.outputs.test_status || 'unknown' }}" | |
| DEST_LOG=$(ls dest_*_out.log 2>/dev/null | head -1) | |
| if [[ -n "$DEST_LOG" ]]; then | |
| DEST_LOG_SIZE=$(wc -l < "$DEST_LOG") | |
| echo "Destination log found ($DEST_LOG): $DEST_LOG_SIZE lines" | |
| echo "" | |
| echo "=== Last 50 lines of destination log ===" | |
| tail -n 50 "$DEST_LOG" | |
| echo "" | |
| echo "=== First 20 lines of destination log ===" | |
| head -n 20 "$DEST_LOG" | |
| else | |
| echo "No destination log file found" | |
| fi | |
| # Check policy files for policy v2 tests | |
| if [[ "${{ matrix.test-type }}" == "policy-v2" || "${{ matrix.test-type }}" == "policy-v2-igvm" ]]; then | |
| if [[ -f "config/AzCVMEmu/policy_v2_signed.json" ]]; then | |
| POLICY_SIZE=$(wc -c < config/AzCVMEmu/policy_v2_signed.json) | |
| echo "" | |
| echo "Policy file generated: ${POLICY_SIZE} bytes" | |
| fi | |
| if [[ -f "config/AzCVMEmu/policy_issuer_chain.pem" ]]; then | |
| echo "Certificate chain file generated" | |
| fi | |
| fi | |
| # Check key rotation files for key rotation tests | |
| if [[ "${{ matrix.test-type }}" == "policy-v2-key-rotation" || "${{ matrix.test-type }}" == "policy-v2-key-rotation-igvm" || "${{ matrix.test-type }}" == "spdm-policy-v2-key-rotation" ]]; then | |
| echo "" | |
| echo "=== Key Rotation Artifacts ===" | |
| FAIL=0 | |
| for variant in a b; do | |
| POLICY="config/AzCVMEmu/policy_v2_signed_${variant}.json" | |
| CHAIN="config/AzCVMEmu/policy_issuer_chain_${variant}.pem" | |
| if [[ -f "$POLICY" ]]; then | |
| POLICY_SIZE=$(wc -c < "$POLICY") | |
| echo "Policy (${variant}): ${POLICY_SIZE} bytes" | |
| else | |
| echo "❌ Missing policy file: $POLICY" | |
| FAIL=1 | |
| fi | |
| if [[ -f "$CHAIN" ]]; then | |
| echo "Certificate chain (${variant}): present" | |
| else | |
| echo "❌ Missing certificate chain: $CHAIN" | |
| FAIL=1 | |
| fi | |
| done | |
| if [[ "$FAIL" -eq 1 ]]; then | |
| echo "❌ Key rotation artifacts incomplete" | |
| exit 1 | |
| fi | |
| echo "✅ Key rotation artifacts generated successfully" | |
| fi | |
| # Check for core dumps (skip-ra test) | |
| if [[ "${{ matrix.test-type }}" == "skip-ra" ]]; then | |
| if ls core* 1> /dev/null 2>&1; then | |
| echo "" | |
| echo "=== Core dumps found ===" | |
| ls -la core* | |
| fi | |
| fi | |
| # Verify retry messages for mock-quote-retry test | |
| if [[ "${{ matrix.test-type }}" == "mock-quote-retry" ]]; then | |
| echo "" | |
| echo "=== Verifying quote retry logs ===" | |
| FAIL=0 | |
| for LOG in migtd_migration_source.log migtd_migration_destination.log; do | |
| if [[ ! -f "$LOG" ]]; then | |
| echo "❌ Missing log file: $LOG" | |
| FAIL=1 | |
| continue | |
| fi | |
| RETRY_COUNT=$(grep -ac "Simulating quote failure" "$LOG" || true) | |
| SUCCESS_COUNT=$(grep -ac "Quote generated successfully" "$LOG" || true) | |
| echo "$LOG: $RETRY_COUNT retry failures, $SUCCESS_COUNT successes" | |
| if [[ "$RETRY_COUNT" -ne 5 ]]; then | |
| echo "❌ Expected 5 retry failures in $LOG, got $RETRY_COUNT" | |
| FAIL=1 | |
| fi | |
| if [[ "$SUCCESS_COUNT" -lt 1 ]]; then | |
| echo "❌ Expected at least 1 success in $LOG" | |
| FAIL=1 | |
| fi | |
| done | |
| if [[ "$FAIL" -eq 1 ]]; then | |
| echo "" | |
| echo "Dumping retry-related log lines:" | |
| grep -a "retry\|Simulating\|Quote generated\|GetQuote failed" migtd_migration_source.log migtd_migration_destination.log || true | |
| exit 1 | |
| fi | |
| echo "✅ Quote retry verification passed (5 failures + success on both sides)" | |
| fi | |
| - name: Upload test artifacts on failure | |
| if: failure() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: ${{ matrix.artifact-name }}-${{ github.run_id }} | |
| path: | | |
| dest_*_out.log | |
| *.log | |
| core* | |
| config/AzCVMEmu/policy_v2_signed.json | |
| config/AzCVMEmu/policy_v2_signed_a.json | |
| config/AzCVMEmu/policy_v2_signed_b.json | |
| config/AzCVMEmu/policy_v2_signed_pm_b.json | |
| config/AzCVMEmu/policy_v2_signed_pmi_b.json | |
| config/AzCVMEmu/policy_issuer_chain.pem | |
| config/AzCVMEmu/policy_issuer_chain_a.pem | |
| config/AzCVMEmu/policy_issuer_chain_b.pem | |
| target/release/migtd | |
| retention-days: 7 | |
| if-no-files-found: ignore | |
| - name: Report final status | |
| if: always() | |
| run: | | |
| echo "=== ${{ matrix.test-name }} ===" | |
| case "${{ steps.test_run.outputs.test_status }}" in | |
| "success") | |
| echo "🎉 Test passed successfully!" | |
| ;; | |
| "timeout") | |
| echo "⏰ Test timed out after ${{ matrix.timeout-seconds }} seconds" | |
| echo "Check logs for hanging processes or infinite loops." | |
| ;; | |
| "failed"|*) | |
| echo "❌ Test failed" | |
| echo "Check the test logs above and uploaded artifacts for debugging details." | |
| ;; | |
| esac |