Add SNP and SGX

microsoft · Jun 13, 2024 · 13c3d0c · 13c3d0c
1 parent 317022d
commit 13c3d0c
Showing 1 changed file with 42 additions and 3 deletions.
diff --git a/.github/workflows/ci-containers-ghcr.yml b/.github/workflows/ci-containers-ghcr.yml
@@ -36,7 +36,7 @@ jobs:
           images: ${{ env.REGISTRY }}/${{ github.repository }}/ci
 
       - name: Build and push Virtual container
-        id: push
+        id: push_virtual
         uses: docker/build-push-action@v5
         with:
           context: .
@@ -48,9 +48,48 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}-virtual-clang15
           labels: ${{ steps.meta.outputs.labels }}
 
-      - name: Generate artifact attestation
+      - name: Build and push SNP container
+        id: push_snp
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: ./docker/ccf_ci
+          build-args: |
+            platform=snp
+            clang_version=15
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}-snp-clang15
+          labels: ${{ steps.meta.outputs.labels }}
+
+      - name: Build and push SGX container
+        id: push_sgx
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: ./docker/ccf_ci
+          build-args: |
+            platform=sgx
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}-sgx
+          labels: ${{ steps.meta.outputs.labels }}
+
+      - name: Attest Virtual container
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ github.repository }}/ci
+          subject-digest: ${{ steps.push_virtual.outputs.digest }}
+          push-to-registry: true
+
+      - name: Attest SNP container
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ github.repository }}/ci
+          subject-digest: ${{ steps.push_sgx.outputs.digest }}
+          push-to-registry: true
+
+      - name: Attest SGX container
         uses: actions/attest-build-provenance@v1
         with:
           subject-name: ${{ env.REGISTRY }}/${{ github.repository }}/ci
-          subject-digest: ${{ steps.push.outputs.digest }}
+          subject-digest: ${{ steps.push_sgx.outputs.digest }}
           push-to-registry: true