Repository navigation
Add managed local API controls to Maple Agent #1131
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: OpenSecret EIF approval checks | |
| on: | |
| push: | |
| branches: [master] | |
| pull_request: | |
| branches: [master] | |
| workflow_dispatch: | |
| # Cache writes are not PCR approval, release publication, or deployment. | |
| # OIDC is limited to master and same-repository PRs in the trusted job below. | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: opensecret-eif-${{ github.event_name }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| changes: | |
| uses: ./.github/workflows/opensecret-change-detection.yml | |
| eif-candidate: | |
| name: EIF candidate build (PR, ${{ matrix.mode }}) | |
| needs: changes | |
| # Build measured-input changes before merge without requiring or changing | |
| # PCR approvals. Only same-repository PRs may use the trusted cache. | |
| if: >- | |
| ${{ | |
| always() && !cancelled() && | |
| github.event_name == 'pull_request' && | |
| github.event.pull_request.head.repo.full_name == github.repository && | |
| needs.changes.result == 'success' && | |
| needs.changes.outputs.eif == 'true' && | |
| needs.changes.outputs.pcr_approvals == 'false' | |
| }} | |
| permissions: | |
| contents: read | |
| id-token: write | |
| runs-on: blacksmith-8vcpu-ubuntu-2404-arm | |
| timeout-minutes: 180 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| mode: [dev, prod] | |
| env: | |
| EIF_MODE: ${{ matrix.mode }} | |
| OPENSECRET_DEV_POSTGRES: "0" | |
| OPENSECRET_DEV_ENV: "0" | |
| OPENSECRET_DEV_CONTAINERS: "0" | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| persist-credentials: false | |
| submodules: recursive | |
| fetch-depth: 0 | |
| - name: Install pinned Determinate Nix for FlakeHub authentication | |
| uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3 | |
| with: | |
| source-tag: v3.23.3 | |
| github-token: "" | |
| - name: Verify pinned Nix runtime | |
| run: bash scripts/ci/verify-nix-runtime.sh | |
| - name: Reuse FlakeHub with an Actions cache fallback | |
| uses: DeterminateSystems/flakehub-cache-action@1f9a51a2959d3e26c7838c6f3bf9f48acae525ea # v3 | |
| with: | |
| diff-store: true | |
| # No Actions artifact, attestation, signing, or release is produced here. | |
| # The Nix cache is only a build cache, not an approved deployment handoff. | |
| - name: Build PR candidate without signing or publication | |
| shell: bash | |
| run: | | |
| echo 'PR diagnostic only: source_sha is the PR merge ref, not a release source commit. No approved artifact is uploaded.' >> "$GITHUB_STEP_SUMMARY" | |
| bash scripts/ci/build_opensecret_eif.sh "$EIF_MODE" "$RUNNER_TEMP/eif-candidate-$EIF_MODE" | |
| - name: Inspect exact PR candidate user ramdisk CA bundle | |
| shell: bash | |
| run: python3 scripts/ci/verify_opensecret_eif_rootfs.py "$EIF_MODE" "$RUNNER_TEMP/eif-candidate-$EIF_MODE" "$GITHUB_SHA" | |
| eif: | |
| name: EIF/PCR approval match (${{ matrix.mode }}) | |
| needs: changes | |
| # PR comparison requires an actual edit to one of the four approval files. | |
| # A selector failure fails the changes job, not a speculative PCR comparison. | |
| if: >- | |
| ${{ | |
| always() && !cancelled() && | |
| ( | |
| (github.event_name == 'workflow_dispatch' && github.ref != 'refs/heads/master') || | |
| (github.event_name == 'pull_request' && | |
| github.event.pull_request.head.repo.full_name != github.repository && | |
| needs.changes.result == 'success' && | |
| needs.changes.outputs.pcr_approvals == 'true') | |
| ) | |
| }} | |
| runs-on: ubuntu-24.04-arm | |
| timeout-minutes: 90 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| mode: [dev, prod] | |
| env: | |
| EIF_MODE: ${{ matrix.mode }} | |
| OPENSECRET_DEV_POSTGRES: "0" | |
| OPENSECRET_DEV_ENV: "0" | |
| OPENSECRET_DEV_CONTAINERS: "0" | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| persist-credentials: false | |
| submodules: recursive | |
| fetch-depth: 0 | |
| - name: Install pinned Nix | |
| uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3 | |
| with: | |
| source-tag: v3.23.3 | |
| github-token: "" | |
| - name: Verify pinned Nix runtime | |
| run: bash scripts/ci/verify-nix-runtime.sh | |
| # Fork PRs cannot authenticate to FlakeHub. GitHub scopes cache writes | |
| # to the PR merge ref; those entries cannot populate master's cache. | |
| - name: Reuse branch-scoped Nix cache without FlakeHub credentials | |
| uses: DeterminateSystems/magic-nix-cache-action@3c034b51a9deec0a09ef1df8b436ac5db50fae94 | |
| with: | |
| source-revision: 4cc363589df8090801c098cdcde1bdd42562318a | |
| use-flakehub: disabled | |
| use-gha-cache: enabled | |
| - name: Build EIF and compare approved measurements | |
| shell: bash | |
| run: bash scripts/ci/check_opensecret_eif.sh "$EIF_MODE" | |
| eif-trusted: | |
| name: EIF/PCR approval match (trusted, ${{ matrix.mode }}) | |
| needs: changes | |
| # Trust the PR's head repository, not its branch name or author's association. | |
| # Forks and missing head-repository metadata stay in the unprivileged job. | |
| if: >- | |
| ${{ | |
| always() && !cancelled() && | |
| ( | |
| (github.event_name == 'pull_request' && | |
| github.event.pull_request.head.repo.full_name == github.repository && | |
| needs.changes.result == 'success' && | |
| needs.changes.outputs.pcr_approvals == 'true') || | |
| (github.ref == 'refs/heads/master' && | |
| ( | |
| github.event_name == 'workflow_dispatch' || | |
| (github.event_name == 'push' && | |
| (needs.changes.result != 'success' || needs.changes.outputs.eif != 'false')) | |
| )) | |
| ) | |
| }} | |
| permissions: | |
| contents: read | |
| id-token: write | |
| runs-on: blacksmith-8vcpu-ubuntu-2404-arm | |
| timeout-minutes: 180 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| mode: [dev, prod] | |
| env: | |
| EIF_MODE: ${{ matrix.mode }} | |
| OPENSECRET_DEV_POSTGRES: "0" | |
| OPENSECRET_DEV_ENV: "0" | |
| OPENSECRET_DEV_CONTAINERS: "0" | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| persist-credentials: false | |
| submodules: recursive | |
| fetch-depth: 0 | |
| - name: Install pinned Determinate Nix for FlakeHub authentication | |
| uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3 | |
| with: | |
| source-tag: v3.23.3 | |
| github-token: "" | |
| - name: Verify pinned Nix runtime | |
| run: bash scripts/ci/verify-nix-runtime.sh | |
| - name: Reuse FlakeHub with an Actions cache fallback | |
| uses: DeterminateSystems/flakehub-cache-action@1f9a51a2959d3e26c7838c6f3bf9f48acae525ea # v3 | |
| with: | |
| # Cache substituted paths without forcing a second cache upload. | |
| diff-store: true | |
| - name: Build EIF and compare approved measurements | |
| shell: bash | |
| run: bash scripts/ci/check_opensecret_eif.sh "$EIF_MODE" |