updated github actions unit test yml, added Rocky 8.8 Dockerfile

.ci/docker/Dockerfile.rocky88ci

@@ -0,0 +1,63 @@
+FROM rockylinux:8.8
+
+# Purpose: This image is designed for HIRS ci testing on Rocky Linux
+# Date Modified: 8/10/23
+# Notes:
+# * This image installs java, installs project dependencies, and runs gradlew to download gradlew
+# dependencies. This saves time during a docker run. This also means the image should be
+# re-built and re-posted to github each time the following occurs:
+# 1) add/update a dependency
+# 2) update gradle
+# If not re-built, the docker run will still work, but will take longer as it downloads updates
+# * Steps to login to registry, build image, tag image with ghcr.io registry, and push to registry:
+# $ cat pat.txt | docker login ghcr.io -u iadgovuser## --password-stdin
+# Note: pat requires permissions "upload packages from GitHub Package Registry" and possibly "repo"
+# $ docker build . -f Dockerfile.rocky88ci -t hirs-rocky8-ci:latest
+# Note: may need to use --no-cache when building, if 'git clone HIRS' or 'gradlew' is cached
+# (bc need any updated dependencies)
+# $ docker image tag hirs-rocky8-ci:latest ghcr.io/nsacyber/hirs/hirs-rocky8-ci:latest
+# $ docker push ghcr.io/nsacyber/hirs/hirs-rocky8-ci:latest
+
+# Update package installer
+RUN dnf -y update
+
+# Install Java 17
+RUN dnf -y install java-17-openjdk-devel
+
+# Set Environment Variables
+#ENV JAVA_HOME=/usr/lib/jvm/java-17-openjdk
+#ENV PATH="$JAVA_HOME/bin:$PATH"
+
+# Ports needed for system-level tests
+EXPOSE 8080
+EXPOSE 8443
+
+# Install HIRS dependencies
+RUN dnf -y install mariadb-server initscripts firewalld policycoreutils net-tools git && dnf clean all
+# maybe: libtool cmake make gcc-c++ sudo vim wget openssl openssl-devel protobuf tpm2-tools libcurl-devel libssh-devel
+# prob not: rpmdevtools tpm2-tss-devel tpm2-abrmd protobuf-compiler protobuf-devel python36 log4cplus-devel re2-devel tpm2-tss-devel tpm2-abrmd-devel
+
+# Install PACCOR for Device Info Gathering
+# RUN mkdir paccor && pushd paccor && wget https://github.com/nsacyber/paccor/releases/download/v1.1.4r6/paccor-1.1.4-6.noarch.rpm && yum -y install paccor-*.rpm && popd
+
+# Install TPM Emulator for Provisioning
+# RUN mkdir ibmtpm && pushd ibmtpm && wget --no-check-certificate https://downloads.sourceforge.net/project/ibmswtpm2/ibmtpm1332.tar.gz && tar -zxvf ibmtpm1332.tar.gz && cd src && make -j5 && popd
+
+# Install Microsoft dotnet and rpm package tool
+# RUN wget https://dot.net/v1/dotnet-install.sh
+# RUN sh dotnet-install.sh --os linux --channel LTS
+# ENV PATH="/root/.dotnet:${PATH}"
+# RUN wget https://packages.microsoft.com/rhel/8/prod/packages-microsoft-prod.rpm
+# RUN dnf -y install packages-microsoft-prod.rpm
+# RUN dnf makecache
+# RUN dnf -y install dotnet-sdk-6.0
+# RUN dotnet tool install --global dotnet-rpm
+# ?? need this?: RUN PATH="~/.dotnet/tools:${PATH}"
+
+# Checkout HIRS main branch and run gradlew to install gradlew dependencies, then delete HIRS
+# Use '--depth=1' so as to not download the history of all commits
+RUN git clone -b main --depth=1 https://github.com/nsacyber/HIRS.git /hirsTemp
+WORKDIR "/hirsTemp"
+RUN /bin/bash -c './gradlew clean build'
+WORKDIR "/"
+RUN rm -rf /hirsTemp

.github/workflows/hirs_unit_tests.yml

@@ -1,147 +1,98 @@
 # This workflow will build HIRS, run unit tests, and create HIRS artifacts
+# Updated: 8/15/23
 
 name: HIRS Build and Unit Test
 
 on:
+ # Runs this workflow whenever there is a push to main from a branch annotated with "v3"
  push:
  branches:
- - '*v2*'
- - 'master'
-  # allows you to run this workflow manually from the Actions tab
+ - '*v3*'
+ - 'main'
+ # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:
 
 jobs:
- # run the unit tests and package HIRS ACA, provisoner, and tools
- ACA_Provisioner_unit_tests:
- runs-on: ubuntu-latest
- permissions:
- contents: read
- packages: write
-
+ # Run the unit tests and package HIRS ACA, provisoner, and tools
+ ACA_Provisioner_Unit_Tests:
+ runs-on: ubuntu-latest # Configures the job to run on the latest version of an Ubuntu Linux runner
  steps:
- - uses: actions/checkout@v2
- - name: Set up JDK 11
- uses: actions/setup-java@v2
- with:
- java-version: '8'
- distribution: 'adopt'
- server-id: github # Value of the distributionManagement/repository/id field of the pom.xml
- settings-path: ${{ github.workspace }} # location for the settings.xml file
- # Build will either archive war files if the build is successful, otherwise a set of build report will be archived
- - name: directory setup
+ - uses: actions/checkout@v3 # run v3 of actions/checkout action, which checks out your repository onto the runner
+ # Build will archive build reports and will create a failedFile if build is not successful
+ - name: Directory setup
  run: |
- mkdir -p artifacts/wars
- mkdir -p artifacts/reports/HIRS_AttestationCA
- mkdir -p artifacts/reports/HIRS_AttestationCAPortal
- mkdir -p artifacts/reports/HIRS_Provisioner
- mkdir -p artifacts/reports/HIRS_ProvisionerTPM2
- mkdir -p artifacts/reports/HIRS_Structs
- mkdir -p artifacts/reports/HIRS_Utils
- mkdir -p artifacts/reports/tcg_rim_tool
- mkdir -p artifacts/reports/tcg_eventlog_tool
- # Run the provisioner and ACA unit tests via gradle build in an Centos 7 Docker container 
- - name: Build HIRS and run Unit tests
+  mkdir -p artifacts/githubActionsResults
+  mkdir -p artifacts/reports/HIRS_AttestationCA
+  mkdir -p artifacts/reports/HIRS_AttestationCAPortal
+  mkdir -p artifacts/reports/HIRS_Provisioner
+  mkdir -p artifacts/reports/HIRS_ProvisionerTPM2
+  mkdir -p artifacts/reports/HIRS_Structs
+  mkdir -p artifacts/reports/HIRS_Utils
+  mkdir -p artifacts/reports/tcg_rim_tool
+  mkdir -p artifacts/reports/tcg_eventlog_tool
+ # Run the provisioner and ACA unit tests via gradle build in a Rocky Docker container
+ - name: Build HIRS and run unit tests
  run: |
- echo ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }} | docker login -u ${{ secrets.DOCKER_HUB_USERNAME }} --password-stdin
- docker run --rm \
- -v $(pwd):/HIRS hirs/hirs-ci:centos7 /bin/bash \
- -c 'pushd /HIRS; \
- gradle_status=0; \
-
- ./gradlew :HIRS_AttestationCA:clean :HIRS_AttestationCA:build :HIRS_AttestationCA:test; \
- if (( $? != "0" )) ; then gradle_status=1; fi; \
- cp -r /HIRS/HIRS_AttestationCA/build/reports/ /HIRS/artifacts/reports/HIRS_AttestationCA/.; \
- ./gradlew :HIRS_AttestationCAPortal:clean :HIRS_AttestationCAPortal:build :HIRS_AttestationCAPortal:test; \
- if (( $? != "0" )) ; then gradle_status=1; fi; \
- cp -r /HIRS/HIRS_AttestationCAPortal/build/reports/ /HIRS/artifacts/reports/HIRS_AttestationCAPortal/.; \
- ./gradlew :HIRS_Provisioner:clean :HIRS_Provisioner:build :HIRS_Provisioner:test; \
- if (( $? != "0" )) ; then gradle_status=1; fi; \
- cp -r /HIRS/HIRS_Provisioner/build/reports/ /HIRS/artifacts/reports/HIRS_Provisioner/.; \
- ./gradlew :HIRS_ProvisionerTPM2:clean :HIRS_ProvisionerTPM2:build :HIRS_ProvisionerTPM2:test; \
- if (( $? != "0" )) ; then gradle_status=1; fi; \
- cp -r /HIRS/HIRS_ProvisionerTPM2/docs/ /HIRS/artifacts/reports/HIRS_ProvisionerTPM2/.; \
- ./gradlew :HIRS_Structs:clean :HIRS_Structs:build :HIRS_Structs:test; \
- if (( $? != "0" )) ; then gradle_status=1; fi; \
- cp -r /HIRS/HIRS_Structs/build/reports/ /HIRS/artifacts/reports/HIRS_Structs/.; \
- ./gradlew :HIRS_Utils:clean :HIRS_Utils:build :HIRS_Utils:test; \
- if (( $? != "0" )) ; then gradle_status=1; fi; \
- cp -r /HIRS/HIRS_Utils/build/reports/ /HIRS/artifacts/reports/HIRS_Utils/.; \
- ./gradlew :TPM_Utils:clean :TPM_Utils:build :TPM_Utils:test; \
- if (( $? != "0" )) ; then gradle_status=1; fi; \
- 
- # Use the war file archive to fail the Build ACA tests by not placing them in the artifacts folder 
- if (( $gradle_status == "0" )) ; then \
- cp /HIRS/HIRS_AttestationCA/build/libs/HIRS_AttestationCA.war /HIRS/artifacts/wars/.; \
- cp /HIRS/HIRS_AttestationCAPortal/build/libs/HIRS_AttestationCAPortal.war /HIRS/artifacts/wars/.; \
- echo "Build Worked"; \
- else \
- echo "Build Failed"; \
- fi; popd;' \
- - name: Archive Report files 
- uses: actions/upload-artifact@v2
+ 
+ # log into and run docker (note: must set up secrets in github for ghcr username and access_token)
+ echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u $ --password-stdin
+ 
+ # docker run options:
+ # create a mount between curr directory on the runner and the HIRS folder created by the cloning of HIRS repo
+ # -v $(pwd):/HIRS
+ # image used for the container, given by <repository>:<tag_name>
+ # rocky8: ghcr.io/nsacyber/hirs/hirs-rocky8-ci:latest [repo: https://github.com/orgs/nsacyber/packages]
+ # bash commands to clean/build/test each subproject
+ # /bin/bash -c '<commands>'
+ docker run --rm \
+ -v $(pwd):/HIRS \
+ ghcr.io/nsacyber/hirs/hirs-rocky8-ci:latest /bin/bash -c \
+ 'pushd /HIRS
+ gradle_status=0
+ 
+ # git added a feature that gives error if user is not owner of the top-level directory; need to override this
+ git config --global --add safe.directory /HIRS
+ 
+ # clean, build and run unit tests on all sub-projects; copy build reports to an artifacts directory
+ ./gradlew :HIRS_AttestationCA:clean :HIRS_AttestationCA:build :HIRS_AttestationCA:test
+ if (( $? != "0" )) ; then gradle_status=1; fi
+ #cp -r /HIRS/HIRS_AttestationCA/build/reports/ /HIRS/artifacts/reports/HIRS_AttestationCA/.
+ ./gradlew :HIRS_AttestationCAPortal:clean :HIRS_AttestationCAPortal:build :HIRS_AttestationCAPortal:test
+ if (( $? != "0" )) ; then gradle_status=1; fi
+ #cp -r /HIRS/HIRS_AttestationCAPortal/build/reports/ /HIRS/artifacts/reports/HIRS_AttestationCAPortal/.
+ #./gradlew :HIRS_Provisioner:clean :HIRS_Provisioner:build :HIRS_Provisioner:test
+ #if (( $? != "0" )) ; then gradle_status=1; fi
+ #cp -r /HIRS/HIRS_Provisioner/build/reports/ /HIRS/artifacts/reports/HIRS_Provisioner/.
+ #./gradlew :HIRS_ProvisionerTPM2:clean :HIRS_ProvisionerTPM2:build :HIRS_ProvisionerTPM2:test
+ #if (( $? != "0" )) ; then gradle_status=1; fi
+ #cp -r /HIRS/HIRS_ProvisionerTPM2/docs/ /HIRS/artifacts/reports/HIRS_ProvisionerTPM2/.
+ #./gradlew :HIRS_Structs:clean :HIRS_Structs:build :HIRS_Structs:test
+ #if (( $? != "0" )) ; then gradle_status=1; fi
+ #cp -r /HIRS/HIRS_Structs/build/reports/ /HIRS/artifacts/reports/HIRS_Structs/.
+ ./gradlew :HIRS_Utils:clean :HIRS_Utils:build :HIRS_Utils:test
+ if (( $? != "0" )) ; then gradle_status=1; fi
+ cp -r /HIRS/HIRS_Utils/build/reports/ /HIRS/artifacts/reports/HIRS_Utils/.
+ #./gradlew :TPM_Utils:clean :TPM_Utils:build :TPM_Utils:test
+ #if (( $? != "0" )) ; then gradle_status=1; fi
+ 
+ # Create "fail file" to fail the Build ACA tests if gradle exited with anything other than 0 
+ if (( $gradle_status == "0" )) ; then
+ echo "In docker: Build Passed"
+ else
+ echo "In docker: Build Failed"
+ touch /HIRS/artifacts/githubActionsResults/buildFailed.txt
+ fi; popd;'
+ # Upload build report files
+ - name: Archive report files
+ uses: actions/upload-artifact@v3
  with:
  name: HIRS_Build_Reports
  path: artifacts/reports/*
  if-no-files-found: ignore
- # if-no-files-found used to fail the ACA unti tests
- - name: Archive WAR files 
- uses: actions/upload-artifact@v2
+ # If buildFailed file exists, use that to fail the ACA unit tests
+ - name: Fail if build or unit test failed
+ if: ${{ hashFiles('artifacts/githubActionsResults/buildFailed.txt') != '' }}
+ uses: actions/github-script@v6
  with:
- name: WAR_Files
- path: artifacts/wars/*
- if-no-files-found: error 
- # Process eventlog and rim tool seperately to save time building
- tcg_eventlog_tool_tests:
- runs-on: ubuntu-latest
- permissions:
- contents: read
- packages: write
- steps:
- - uses: actions/checkout@v2
- - name: Set up JDK 8
- uses: actions/setup-java@v2
- with:
- java-version: '8'
- distribution: 'adopt'
- server-id: github # Value of the distributionManagement/repository/id field of the pom.xml
- settings-path: ${{ github.workspace }} # location for the settings.xml file
- - name: build and test event log tool
- run: |
- mkdir -p artifacts/reports/tcg_eventlog_tool;
- ./gradlew :tools/tcg_eventlog_tool:build :tools/tcg_eventlog_tool:test;
- if (( $? != "0" )) ; then 
- cp -r tools/tcg_eventlog_tool/build/reports/ artifacts/reports/tcg_eventlog_tool/.; 
- fi
- - name: Archive Report files 
- uses: actions/upload-artifact@v2
- with:
- name: tcg_eventlog_tool_reports
- path: artifacts/reports/*
- if-no-files-found: ignore
- tcg_rim_tool_tests:
- runs-on: ubuntu-latest
- permissions:
- contents: read
- packages: write
- steps:
- - uses: actions/checkout@v2
- - name: Set up JDK 8
- uses: actions/setup-java@v2
- with:
- java-version: '8'
- distribution: 'adopt'
- server-id: github # Value of the distributionManagement/repository/id field of the pom.xml
- settings-path: ${{ github.workspace }} # location for the settings.xml file
- - name: build and test event log tool
- run: |
- mkdir -p artifacts/reports/tcg_rim_tool;
- ./gradlew :tools/tcg_rim_tool:build :tools/tcg_rim_tool:test;
- if (( $? != "0" )) ; then 
- cp -r tools/tcg_rim_tool/build/reports/ artifacts/reports/tcg_rim_tool/.; 
- fi
- - name: Archive Report files 
- uses: actions/upload-artifact@v2
- with:
- name: tcg_rim_tool_reports
- path: artifacts/reports/*
- if-no-files-found: ignore
+ script: |
+ core.setFailed('Build or Unit Test Failed')