Skip to content

Commit bde0d03

Browse files
kvinwangkvinwang
committed
merge: resolve spdx-check.yml conflict (keep CI_RUNNER override + checkout@v5)
Merge origin/master into merge/cloud-into-mainline to clear the PR conflict. Only conflict was .github/workflows/spdx-check.yml: kept the branch's vars.CI_RUNNER runner override and adopted master's actions/checkout@v5 bump. master's emit_runtime_event hardening (EMIT_LOCK) auto-merged cleanly with the cloud TPM PCR-extend path; the lock now covers both TDX and TPM extension.
2 parents 48da24c + c5046ab commit bde0d03

171 files changed

Lines changed: 9624 additions & 24430 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/docker-build-check.yml‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
gateway:
1919
runs-on: ubuntu-latest
2020
steps:
21-
- uses: actions/checkout@v4
21+
- uses: actions/checkout@v5
2222

2323
- name: Set up Docker Buildx
2424
uses: docker/setup-buildx-action@v3
@@ -62,7 +62,9 @@ jobs:
6262
kms:
6363
runs-on: ubuntu-latest
6464
steps:
65-
- uses: actions/checkout@v4
65+
- uses: actions/checkout@v5
66+
with:
67+
submodules: recursive
6668

6769
- name: Set up Docker Buildx
6870
uses: docker/setup-buildx-action@v3
@@ -103,16 +105,18 @@ jobs:
103105
build/shared/verify-pinned-packages.sh kms-builder-check:latest \
104106
kms/dstack-app/builder/shared/builder-pinned-packages.txt
105107
108+
- name: Install Foundry
109+
uses: foundry-rs/foundry-toolchain@v1
110+
106111
- name: Build KMS contracts
107112
run: |
108113
cd kms/auth-eth
109-
npm ci
110-
npx hardhat compile
114+
forge build
111115
112116
verifier:
113117
runs-on: ubuntu-latest
114118
steps:
115-
- uses: actions/checkout@v4
119+
- uses: actions/checkout@v5
116120

117121
- name: Set up Docker Buildx
118122
uses: docker/setup-buildx-action@v3

‎.github/workflows/foundry-test.yml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# SPDX-FileCopyrightText: © 2025 Phala Network <dstack@phala.network>
2+
#
3+
# SPDX-License-Identifier: Apache-2.0
4+
5+
name: KMS Auth-ETH Foundry Tests
6+
7+
on:
8+
push:
9+
paths:
10+
- 'kms/auth-eth/**'
11+
- '.github/workflows/foundry-test.yml'
12+
pull_request:
13+
paths:
14+
- 'kms/auth-eth/**'
15+
- '.github/workflows/foundry-test.yml'
16+
workflow_dispatch:
17+
18+
permissions:
19+
contents: read
20+
21+
env:
22+
FOUNDRY_PROFILE: ci
23+
24+
jobs:
25+
check:
26+
name: Foundry project
27+
runs-on: ubuntu-latest
28+
defaults:
29+
run:
30+
working-directory: kms/auth-eth
31+
steps:
32+
- uses: actions/checkout@v5
33+
with:
34+
submodules: recursive
35+
36+
- name: Install Foundry
37+
uses: foundry-rs/foundry-toolchain@v1
38+
39+
- name: Show Forge version
40+
run: |
41+
forge --version
42+
43+
- name: Run Forge fmt
44+
run: |
45+
forge fmt --check
46+
id: fmt
47+
48+
- name: Run Forge build
49+
run: |
50+
forge build --sizes
51+
id: build
52+
53+
- name: Run Forge tests
54+
run: |
55+
forge test --ffi -vvv
56+
id: test

‎.github/workflows/gateway-release.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ jobs:
2020
runs-on: ubuntu-latest
2121
steps:
2222
- name: Checkout repository
23-
uses: actions/checkout@v4
23+
uses: actions/checkout@v5
2424

2525
- name: Parse version from tag
2626
run: |
@@ -68,7 +68,7 @@ jobs:
6868
push-to-registry: true
6969

7070
- name: GitHub Release
71-
uses: softprops/action-gh-release@v1
71+
uses: softprops/action-gh-release@v2
7272
with:
7373
name: "Gateway Release v${{ env.VERSION }}"
7474
body: |

‎.github/workflows/js-sdk-release.yml‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
# SPDX-FileCopyrightText: © 2025 Phala Network <dstack@phala.network>
2+
#
3+
# SPDX-License-Identifier: Apache-2.0
4+
5+
name: Publish JS SDK to npm
6+
on:
7+
push:
8+
tags: ['js-sdk-v*']
9+
workflow_dispatch:
10+
inputs:
11+
npm_tag:
12+
description: 'npm dist-tag (latest, beta, canary)'
13+
required: true
14+
default: 'latest'
15+
type: choice
16+
options:
17+
- latest
18+
- beta
19+
- canary
20+
21+
permissions:
22+
id-token: write
23+
contents: write
24+
25+
jobs:
26+
publish:
27+
runs-on: ubuntu-latest
28+
steps:
29+
- uses: actions/checkout@v5
30+
31+
- uses: actions/setup-node@v5
32+
with:
33+
node-version: '20'
34+
registry-url: 'https://registry.npmjs.org'
35+
36+
- name: Upgrade npm for trusted publishers support
37+
run: |
38+
npm install -g npm@latest
39+
echo "npm: $(npm --version)"
40+
41+
- name: Verify OIDC token availability
42+
run: |
43+
if [ -n "${ACTIONS_ID_TOKEN_REQUEST_URL}" ] && [ -n "${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" ]; then
44+
echo "OIDC token available"
45+
else
46+
echo "OIDC token NOT available"
47+
echo "Check workflow permissions include 'id-token: write'"
48+
exit 1
49+
fi
50+
51+
- name: Verify repository configuration
52+
working-directory: sdk/js
53+
run: |
54+
echo "Checking repository consistency..."
55+
GIT_REPO=$(git remote get-url origin | sed 's/.*github.com[/:]//; s/.git$//')
56+
PKG_REPO=$(node -e "console.log(require('./package.json').repository?.url || '')" | sed 's|https://github.com/||; s|git+||; s|.git$||')
57+
echo "Git remote: $GIT_REPO"
58+
echo "package.json: $PKG_REPO"
59+
if [ "$GIT_REPO" != "$PKG_REPO" ]; then
60+
echo "Repository mismatch!"
61+
echo "This will cause 422 error during publish"
62+
exit 1
63+
fi
64+
echo "Repositories match"
65+
66+
- name: Install dependencies
67+
working-directory: sdk/js
68+
run: npm install
69+
70+
- name: Build
71+
working-directory: sdk/js
72+
run: npm run build
73+
74+
- name: Determine version and npm dist-tag
75+
id: tag
76+
working-directory: sdk/js
77+
run: |
78+
PKG_VERSION=$(node -e "console.log(require('./package.json').version)")
79+
if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
80+
VERSION="$PKG_VERSION"
81+
echo "tag=${{ github.event.inputs.npm_tag }}" >> "$GITHUB_OUTPUT"
82+
else
83+
TAG_VERSION="${GITHUB_REF_NAME#js-sdk-v}"
84+
if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
85+
echo "::error::tag version ($TAG_VERSION) does not match package.json version ($PKG_VERSION)"
86+
exit 1
87+
fi
88+
VERSION="$TAG_VERSION"
89+
# auto-detect from git tag: js-sdk-v0.5.8-beta.1 -> beta
90+
if echo "$VERSION" | grep -qiE '(beta|alpha|rc|preview)'; then
91+
echo "tag=beta" >> "$GITHUB_OUTPUT"
92+
else
93+
echo "tag=latest" >> "$GITHUB_OUTPUT"
94+
fi
95+
fi
96+
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
97+
98+
- name: Publish to npm
99+
working-directory: sdk/js
100+
run: |
101+
NPM_TAG="${{ steps.tag.outputs.tag }}"
102+
echo "Publishing with dist-tag: $NPM_TAG"
103+
npm publish --access public --provenance --tag "$NPM_TAG"
104+
105+
- name: GitHub Release
106+
if: github.event_name == 'push'
107+
uses: softprops/action-gh-release@v2
108+
with:
109+
name: "JS SDK v${{ steps.tag.outputs.version }}"
110+
body: |
111+
## npm Package
112+
113+
**Package**: `@phala/dstack-sdk@${{ steps.tag.outputs.version }}`
114+
115+
**Install**: `npm install @phala/dstack-sdk@${{ steps.tag.outputs.version }}`
116+
117+
**Dist-tag**: `${{ steps.tag.outputs.tag }}`
118+
119+
**Registry**: https://www.npmjs.com/package/@phala/dstack-sdk/v/${{ steps.tag.outputs.version }}

‎.github/workflows/kms-release.yml‎

Lines changed: 9 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ jobs:
2020
runs-on: ubuntu-latest
2121
steps:
2222
- name: Checkout repository
23-
uses: actions/checkout@v4
23+
uses: actions/checkout@v5
2424

2525
- name: Parse version from tag
2626
run: |
@@ -68,26 +68,22 @@ jobs:
6868
subject-digest: ${{ steps.build-and-push.outputs.digest }}
6969
push-to-registry: true
7070

71-
- name: Setup Node.js
72-
uses: actions/setup-node@v4
73-
with:
74-
node-version: '18'
75-
cache: 'npm'
76-
cache-dependency-path: kms/auth-eth/package-lock.json
71+
- name: Install Foundry
72+
uses: foundry-rs/foundry-toolchain@v1
7773

78-
- name: Install dependencies and compile contracts
74+
- name: Compile contracts with Foundry
7975
run: |
8076
cd kms/auth-eth
81-
npm ci
82-
npx hardhat compile
77+
forge install
78+
forge build
8379
8480
- name: GitHub Release
85-
uses: softprops/action-gh-release@v1
81+
uses: softprops/action-gh-release@v2
8682
with:
8783
name: "KMS Release v${{ env.VERSION }}"
8884
files: |
89-
kms/auth-eth/artifacts/contracts/DstackKms.sol/DstackKms.json
90-
kms/auth-eth/artifacts/contracts/DstackApp.sol/DstackApp.json
85+
kms/auth-eth/out/DstackKms.sol/DstackKms.json
86+
kms/auth-eth/out/DstackApp.sol/DstackApp.json
9187
body: |
9288
## Docker Image Information
9389

‎.github/workflows/prek-check.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
runs-on: ubuntu-latest
1919

2020
steps:
21-
- uses: actions/checkout@v4
21+
- uses: actions/checkout@v5
2222
with:
2323
fetch-depth: 0
2424

‎.github/workflows/python-sdk-release.yml‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
# SPDX-FileCopyrightText: © 2025 Phala Network <dstack@phala.network>
2+
#
3+
# SPDX-License-Identifier: Apache-2.0
4+
5+
name: Publish Python SDK to PyPI
6+
on:
7+
push:
8+
tags: ['python-sdk-v*']
9+
workflow_dispatch:
10+
inputs:
11+
target:
12+
description: 'Publish target'
13+
required: true
14+
default: 'pypi'
15+
type: choice
16+
options:
17+
- pypi
18+
- testpypi
19+
20+
permissions:
21+
id-token: write
22+
contents: write
23+
24+
jobs:
25+
publish:
26+
runs-on: ubuntu-latest
27+
steps:
28+
- uses: actions/checkout@v5
29+
30+
- uses: actions/setup-python@v5
31+
with:
32+
python-version: '3.11'
33+
34+
- name: Install PDM
35+
run: pip install pdm
36+
37+
- name: Build distribution
38+
working-directory: sdk/python
39+
run: pdm build
40+
41+
- name: Parse and verify version
42+
id: version
43+
working-directory: sdk/python
44+
run: |
45+
PKG_VERSION=$(python -c "
46+
import re
47+
with open('pyproject.toml') as f:
48+
m = re.search(r'^version\s*=\s*\"([^\"]+)\"', f.read(), re.M)
49+
print(m.group(1) if m else '')
50+
")
51+
if [ -z "$PKG_VERSION" ]; then
52+
echo "::error::failed to parse version from pyproject.toml"
53+
exit 1
54+
fi
55+
if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
56+
VERSION="$PKG_VERSION"
57+
else
58+
TAG_VERSION="${GITHUB_REF_NAME#python-sdk-v}"
59+
if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
60+
echo "::error::tag version ($TAG_VERSION) does not match pyproject.toml version ($PKG_VERSION)"
61+
exit 1
62+
fi
63+
VERSION="$TAG_VERSION"
64+
fi
65+
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
66+
67+
- name: Publish to PyPI
68+
if: github.event_name == 'push' || github.event.inputs.target == 'pypi'
69+
uses: pypa/gh-action-pypi-publish@release/v1
70+
with:
71+
packages-dir: sdk/python/dist
72+
73+
- name: Publish to TestPyPI
74+
if: github.event_name == 'workflow_dispatch' && github.event.inputs.target == 'testpypi'
75+
uses: pypa/gh-action-pypi-publish@release/v1
76+
with:
77+
repository-url: https://test.pypi.org/legacy/
78+
packages-dir: sdk/python/dist
79+
80+
- name: GitHub Release
81+
if: github.event_name == 'push'
82+
uses: softprops/action-gh-release@v2
83+
with:
84+
name: "Python SDK v${{ steps.version.outputs.version }}"
85+
body: |
86+
## PyPI Package
87+
88+
**Package**: `dstack-sdk ${{ steps.version.outputs.version }}`
89+
90+
**Install**: `pip install dstack-sdk==${{ steps.version.outputs.version }}`
91+
92+
**Registry**: https://pypi.org/project/dstack-sdk/${{ steps.version.outputs.version }}/

‎.github/workflows/rust.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717
rust-checks:
1818
runs-on: ${{ vars.CI_RUNNER || 'ubuntu-latest' }}
1919
steps:
20-
- uses: actions/checkout@v4
20+
- uses: actions/checkout@v5
2121

2222
- name: Install Rust
2323
uses: dtolnay/rust-toolchain@1.86

0 commit comments

Comments
 (0)