Skip to content

ci: build the enclave image as a PR check and run Docker Build only for main - #108

Merged
nickpell merged 1 commit into
mainfrom
nick/oa-pr-docker-check
Oct 15, 2026
Merged

ci: build the enclave image as a PR check and run Docker Build only for main#108
nickpell merged 1 commit into
mainfrom
nick/oa-pr-docker-check

Conversation

@nickpell

@nickpell nickpell commented Oct 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Summary

  • Pull requests get a build-only enclave image check as a new docker-build job in the Go workflow. It builds the arm64 image with no AWS credentials and no push, and it shows as a check on the PR.
  • Docker Build's workflow_run trigger is limited to Go runs on main. A workflow_run-triggered Docker Build always reports head_branch: main and main's tip as its head_sha, whatever branch it built. So a PR's Docker Build passed Build EIF's main-branch gate, and a second EIF build measured main's latest commit. When that happened before the real image was pushed, the spare EIF build failed with "manifest unknown".
  • Fork PRs now get the image check too: the job needs no secrets and runs with the read-only pull_request token.

Impact

  • Metric: Build EIF runs that built (not skipped), compared with the distinct commits they built; and Docker Build runs, compared with Go push runs on main
  • Before: 47 EIF builds for 40 distinct commits, 2 of them extra builds that failed with "manifest unknown" (5971f47, 2026-10-12); 132 Docker Build runs for 79 Go push runs on main (30 days to 2026-10-15 ~14:50 UTC)
  • Query: gh api --paginate "repos/cloudx-io/openauction/actions/workflows/eif-build.yml/runs?created=>FROM&per_page=100" --jq '.workflow_runs[] | select(.conclusion != "skipped") | .head_sha' | sort | uniq -c (builds = sum, distinct commits = line count); the same with docker.yml, and with go.yml filtered to .event == "push" (GitHub Actions API)
  • Measure after: 30 days after merge, over the 30 days since merge

Notes for reviewers

93b30e5 made Docker Build run after Go on every branch so that PRs get Docker build validation. #61 kept that while restricting publication, and #73 narrowed it to branches in this repository. This PR keeps the validation and moves it into the Go workflow. A workflow_run run never appears in a PR's checks, so a failed validation build was only visible in the Actions tab: the one failed Docker Build in the 30 days above was a PR validation run (nick/group-eif-pcr-redirects, 2026-10-09).

Docker Build changes take effect only after merge, because workflow_run workflows use the definition on main. The docker-build job runs on this PR.

Pre-merge checklist

  • Workflow lint passes: Ratchet Lint in CI, and actionlint 1.7.12 on both changed workflows with no findings
  • The new docker-build check passes on this PR, building the arm64 image without pushing (all steps green on e0feef2; test and lint also pass)
  • Diff contains no unintended changes

Post-deploy/apply verification

  • The first push to main after merge starts one Docker Build, which publishes the commit's image, and one Build EIF, which records the commit's PCRs in a [skip-build] Update PCR measurements commit (Go 38767583806 → Docker Build 38767669083 checked out e2d4a95 and pushed its arm64 image → Build EIF 38768298414 green → PCR commit 6894ac2; no other Docker Build run since the merge)
  • A PR's Go run after merge starts no Docker Build run, and its docker-build job runs on the PR (test(enclave): make the PCR and nil-attester tests check what they claim; drop curl from the EIF builder setup #109 at be16d0c: Go run 38907322819 completed 2026-10-16 13:26:24 UTC with docker-build job 116994067818 green; no Docker Build run started after it)
  • Impact measured: After recorded in the Impact section from its query (waiting: readable from 2026-11-14)

🤖 Generated with Claude Code

@nickpell @claude
ci: build the enclave image as a PR check and run Docker Build only f…
e0feef2 
…or main

Pull request Go runs started Docker Build through workflow_run. Those runs
were invisible on the PR, and because a workflow_run-triggered run reports
main's tip, Build EIF's main-branch gate let them start a second EIF build
for main's latest commit, which fails when the real image is not yet pushed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@nickpell
nickpell requested a balanced review from Copilot October 15, 2026 16:09
Copilot AI reviewed Oct 15, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

No blocking issues were identified in the build-only job or branch restriction.

0 open findings

What changed in this PR

Moves enclave image validation into PR checks while restricting downstream Docker builds to Go runs on main.

Changes:

  • Adds an ARM64 build-only PR job without AWS credentials or image publication, including for forks.
  • Filters Docker Build’s workflow_run trigger to main to prevent redundant EIF builds.
File Description
.github/​workflows/​go.yml Adds the PR-only enclave image build check.
.github/​workflows/​docker.yml Restricts Go-triggered Docker builds to main.

🧠 Review effort: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@nickpell
nickpell merged commit e2d4a95 into main Oct 15, 2026
5 checks passed
@nickpell
nickpell deleted the nick/oa-pr-docker-check branch October 15, 2026 16:16
@nickpell nickpell mentioned this pull request Oct 15, 2026
Merged
6 of 7 tasks
nickpell added a commit to cloudx-io/openarbiter that referenced this pull request Oct 15, 2026
@nickpell @claude
Bump openauction for the attestation gzip cap; build the enclave imag…
721ac4b 
…e as a PR check (#59)

## Summary

- Bump `github.com/cloudx-io/openauction` from `a621e06` (2026-08-12) to
`6894ac2` to pick up cloudx-io/openauction#106, which caps
`AttestationCOSEGzip.Decompress` output at 64 KiB.
`enclaveapi.AttestationCOSEGzip` is an alias of openauction's type, and
`ValidateArbitrationAttestation` calls `Decompress` on caller-supplied
bytes before any signature check, so an attestation of a few kilobytes
could inflate without limit in the validator's memory. With this bump,
an 87 KB input that inflates to 64 MiB is rejected with "attestation
exceeds 65536 bytes". The only other changes between the two openauction
versions in the packages imported here are additions (deal fields) and
removals of functions not used here (`URLEncode`, `ExtractCOSEPayload`).
The PCR and certificate functions are unchanged, and no other module
moves.
- Pull requests get a build-only enclave image check as a new
`docker-build` job in the Go workflow. It builds the arm64 image with no
AWS credentials and no push, and it shows as a check on the PR. The same
change as cloudx-io/openauction#108.
- Docker Build's `workflow_run` trigger is limited to Go runs on `main`.
A `workflow_run`-triggered Docker Build always reports `main`'s tip as
its `head_sha`, so a PR's Docker Build could start a Build EIF run that
measured `main`'s latest commit again. The Build EIF gate comment is
updated to match.

## Impact

- Metric: Build EIF runs that built (not skipped), compared with the
distinct commits they built; and Docker Build runs, compared with Go
push runs on `main`
- Before: 34 EIF builds for 31 distinct commits; 97 Docker Build runs
for 60 Go push runs on `main` (2026-09-15 16:39 to 2026-10-15 16:39 UTC)
- Query: `gh api --paginate
"repos/cloudx-io/openarbiter/actions/workflows/eif-build.yml/runs?created=>FROM&per_page=100"
--jq '.workflow_runs[] | select(.conclusion != "skipped") | .head_sha' |
sort | uniq -c` (builds = sum, distinct commits = line count); the same
with `docker.yml`, and with `go.yml` filtered to `.event == "push"`
(GitHub Actions API)
- Measure after: 30 days after merge, over the 30 days since merge

## Notes for reviewers

#21 recorded that Build EIF's trigger is coarser
than the publish gate, so a pull request's Docker Build could start a
Build EIF run that measures `main`'s tip. It left the fix as a separate
change. #1 adopted openauction's CI, where
[93b30e5](cloudx-io/openauction@93b30e5)
ran Docker Build after Go on every branch on purpose to validate PR
image builds, and #33 kept that. This PR keeps the
validation and moves it into the Go workflow. A `workflow_run` run never
appears in a PR's checks, so its result was visible only in the Actions
tab.

Docker Build and Build EIF changes take effect only after merge, because
`workflow_run` workflows use the definitions on `main`. The
`docker-build` job runs on this PR.

## Pre-merge checklist

- [x] Tests pass in CI (test green on a5270da; locally all packages pass
except `TestGetSystemInfo_LiveProcfs`, which reads /proc/meminfo and
fails on macOS on main too)
- [x] Lint passes: golangci-lint and `go mod tidy` in CI, Ratchet Lint,
and actionlint 1.7.12 on the three changed workflows
- [x] The new `docker-build` check passes on this PR, building the arm64
image without pushing
- [x] Diff contains no unintended changes

## Post-deploy/apply verification

- [ ] The first push to `main` after merge starts one Docker Build,
which publishes the commit's image, and one Build EIF, which records the
commit's PCRs in a `[skip-build] Update PCR measurements` commit
- [ ] A PR's Go run after merge starts no Docker Build run, and its
`docker-build` job runs on the PR
- [ ] Impact measured: After recorded in the Impact section from its
query

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@nickpell