action.yaml

name: Tinfoil Nitro Enclave Build Action
description: |
  Builds, attests, and publishes AWS Nitro Enclave images.

author: Tinfoil

inputs:
  docker-context:
    description: "Docker build context"
    required: false
    default: "."
  github-token:
    description: "GitHub token"
    required: true

runs:
  using: "composite"
  steps:
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Build main image
      uses: docker/build-push-action@v5
      with:
        context: ${{ inputs.docker-context }}
        push: false
        load: true
        tags: enclave-image:latest

    - name: Build EIF image
      shell: bash
      run: |
        docker run --rm \
          -v /var/run/docker.sock:/var/run/docker.sock \
          -v $(pwd):/output \
          -e EIF_FILE=enclave.eif \
          -e INFO_FILE=enclave-info.json \
          -e DOCKER_IMAGE=enclave-image:latest \
          ghcr.io/tinfoilanalytics/eif-builder:e41cf52bd11eabce7080bc9f427554a7c6f46d8e

    - name: Extract measurements predicate
      shell: bash
      run: |
        jq -r ".Measurements" enclave-info.json > predicate.json
        ls -lh enclave*

    - name: Attest
      uses: actions/attest@v1
      id: attest
      with:
        subject-path: enclave.eif
        predicate-type: https://tinfoil.sh/predicate/aws-nitro-enclave/v1
        predicate-path: predicate.json

    - uses: oras-project/setup-oras@v1

    - name: Log into ghcr.io
      uses: docker/login-action@v3
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ inputs.github-token }}

    - name: Build OCI image
      shell: bash
      run: |
        oras push \
            --export-manifest manifest.json \
            "ghcr.io/${{ github.repository }}:${{ github.ref_name }}" \
            "enclave.eif" \
            "enclave-info.json"

    - name: Generate release notes
      id: generate-release-notes
      shell: bash
      run: |
        RELEASE_NOTES=$(cat << EOF
        OCI image: [\`ghcr.io/${{ github.repository }}:${{ github.ref_name }}\`](https://ghcr.io/${{ github.repository }}:${{ github.ref_name }})
        EIF hash: $(sha256sum enclave.eif | cut -d ' ' -f 1)
        Measurements:
        \`\`\`
        $(cat predicate.json)
        \`\`\`
        EOF
        )
        echo "release-notes<<EOF" >> "$GITHUB_OUTPUT"
        echo "${RELEASE_NOTES}" >> "$GITHUB_OUTPUT"
        echo "EOF" >> "$GITHUB_OUTPUT"

    - name: Create release
      uses: softprops/action-gh-release@v2
      with:
        files: |
          enclave-info.json
        body: ${{ steps.generate-release-notes.outputs.release-notes }}