chore: add slsa support for tfhe-versionable #33
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Publish new release of tfhe-cuda-backend on crates.io. | ||
| name: Publish CUDA release | ||
| on: | ||
| workflow_dispatch: | ||
| inputs: | ||
| dry_run: | ||
| description: "Dry-run" | ||
| type: boolean | ||
| default: true | ||
| env: | ||
| ACTION_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} | ||
| SLACK_CHANNEL: ${{ secrets.SLACK_CHANNEL }} | ||
| SLACK_ICON: https://pbs.twimg.com/profile_images/1274014582265298945/OjBKP9kn_400x400.png | ||
| SLACK_USERNAME: ${{ secrets.BOT_USERNAME }} | ||
| SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }} | ||
| jobs: | ||
| verify_tag: | ||
| uses: ./.github/workflows/verify_tagged_commit.yml | ||
| secrets: | ||
| RELEASE_TEAM: ${{ secrets.RELEASE_TEAM }} | ||
| READ_ORG_TOKEN: ${{ secrets.READ_ORG_TOKEN }} | ||
| setup-instance: | ||
| name: Setup instance (publish-cuda-release) | ||
| needs: verify_tag | ||
| runs-on: ubuntu-latest | ||
| outputs: | ||
| runner-name: ${{ steps.start-instance.outputs.label }} | ||
| steps: | ||
| - name: Start instance | ||
| id: start-instance | ||
| uses: zama-ai/slab-github-runner@79939325c3c429837c10d6041e4fd8589d328bac | ||
| with: | ||
| mode: start | ||
| github-token: ${{ secrets.SLAB_ACTION_TOKEN }} | ||
| slab-url: ${{ secrets.SLAB_BASE_URL }} | ||
| job-secret: ${{ secrets.JOB_SECRET }} | ||
| backend: aws | ||
| profile: gpu-build | ||
| publish-cuda-release: | ||
| name: Publish CUDA Release | ||
| needs: setup-instance | ||
| runs-on: ${{ needs.setup-instance.outputs.runner-name }} | ||
| strategy: | ||
| fail-fast: false | ||
| # explicit include-based build matrix, of known valid options | ||
| matrix: | ||
| include: | ||
| - os: ubuntu-22.04 | ||
| cuda: "12.2" | ||
| gcc: 9 | ||
| env: | ||
| CUDA_PATH: /usr/local/cuda-${{ matrix.cuda }} | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | ||
| with: | ||
| fetch-depth: 0 | ||
| token: ${{ secrets.FHE_ACTIONS_TOKEN }} | ||
| - name: Set up home | ||
| run: | | ||
| echo "HOME=/home/ubuntu" >> "${GITHUB_ENV}" | ||
| - name: Install latest stable | ||
| uses: dtolnay/rust-toolchain@a54c7afa936fefeb4456b2dd8068152669aa8203 | ||
| with: | ||
| toolchain: stable | ||
| - name: Export CUDA variables | ||
| if: ${{ !cancelled() }} | ||
| run: | | ||
| echo "$CUDA_PATH/bin" >> "${GITHUB_PATH}" | ||
| { | ||
| echo "CUDA_PATH=$CUDA_PATH"; | ||
| echo "LD_LIBRARY_PATH=$CUDA_PATH/lib:$LD_LIBRARY_PATH"; | ||
| echo "CUDACXX=/usr/local/cuda-${{ matrix.cuda }}/bin/nvcc"; | ||
| } >> "${GITHUB_ENV}" | ||
| # Specify the correct host compilers | ||
| - name: Export gcc and g++ variables | ||
| if: ${{ !cancelled() }} | ||
| run: | | ||
| { | ||
| echo "CC=/usr/bin/gcc-${{ matrix.gcc }}"; | ||
| echo "CXX=/usr/bin/g++-${{ matrix.gcc }}"; | ||
| echo "CUDAHOSTCXX=/usr/bin/g++-${{ matrix.gcc }}"; | ||
| echo "HOME=/home/ubuntu"; | ||
| } >> "${GITHUB_ENV}" | ||
| - name: Prepare package | ||
| run: | | ||
| cargo package -p tfhe-cuda-backend | ||
| - name: generate hash | ||
| id: hash | ||
| run: cd target/package && echo "hash=$(sha256sum ./*.crate | base64 -w0)" >> "${GITHUB_OUTPUT}" | ||
| provenance: | ||
| if: ${{ !inputs.dry_run }} | ||
| needs: [package] | ||
| uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0 | ||
| permissions: | ||
| # Needed to detect the GitHub Actions environment | ||
| actions: read | ||
| # Needed to create the provenance via GitHub OIDC | ||
| id-token: write | ||
| # Needed to upload assets/artifacts | ||
| contents: write | ||
| with: | ||
| # SHA-256 hashes of the Crate package. | ||
| base64-subjects: ${{ needs.package.outputs.hash }} | ||
| publish-cuda-release: | ||
| name: Publish CUDA Release | ||
| needs: [setup-instance, package] # for comparing hashes | ||
| runs-on: ${{ needs.setup-instance.outputs.runner-name }} | ||
| strategy: | ||
| fail-fast: false | ||
| # explicit include-based build matrix, of known valid options | ||
| matrix: | ||
| include: | ||
| - os: ubuntu-22.04 | ||
| cuda: "12.2" | ||
| gcc: 9 | ||
| steps: | ||
| - name: Publish crate.io package | ||
| env: | ||
| CRATES_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }} | ||
| DRY_RUN: ${{ inputs.dry_run && '--dry-run' || '' }} | ||
| run: | | ||
| cargo publish -p tfhe-cuda-backend --token ${{ env.CRATES_TOKEN }} ${{ env.DRY_RUN }} | ||
| - name: Generate hash | ||
| id: published_hash | ||
| run: cd target/package && echo "pub_hash=$(sha256sum ./*.crate | base64 -w0)" >> "${GITHUB_OUTPUT}" | ||
| - name: Slack notification (hashes comparison) | ||
| if: ${{ needs.package.outputs.hash != steps.published_hash.outputs.pub_hash }} | ||
| continue-on-error: true | ||
| uses: rtCamp/action-slack-notify@c33737706dea87cd7784c687dadc9adf1be59990 # v2.3.2 | ||
| env: | ||
| SLACK_COLOR: failure | ||
| SLACK_CHANNEL: ${{ secrets.SLACK_CHANNEL }} | ||
| SLACK_ICON: https://pbs.twimg.com/profile_images/1274014582265298945/OjBKP9kn_400x400.png | ||
| SLACK_MESSAGE: "SLSA tfhe-cuda-backend crate - hash comparison failure: (${{ env.ACTION_RUN_URL }})" | ||
| SLACK_USERNAME: ${{ secrets.BOT_USERNAME }} | ||
| SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }} | ||
| - name: Slack Notification | ||
| if: ${{ failure() }} | ||
| continue-on-error: true | ||
| uses: rtCamp/action-slack-notify@c33737706dea87cd7784c687dadc9adf1be59990 # v2.3.2 | ||
| env: | ||
| SLACK_COLOR: ${{ job.status }} | ||
| SLACK_MESSAGE: "tfhe-cuda-backend release finished with status: ${{ job.status }}. (${{ env.ACTION_RUN_URL }})" | ||
| teardown-instance: | ||
| name: Teardown instance (publish-release) | ||
| if: ${{ always() && needs.setup-instance.result == 'success' }} | ||
| needs: [ setup-instance, publish-cuda-release ] | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Stop instance | ||
| id: stop-instance | ||
| uses: zama-ai/slab-github-runner@79939325c3c429837c10d6041e4fd8589d328bac | ||
| with: | ||
| mode: stop | ||
| github-token: ${{ secrets.SLAB_ACTION_TOKEN }} | ||
| slab-url: ${{ secrets.SLAB_BASE_URL }} | ||
| job-secret: ${{ secrets.JOB_SECRET }} | ||
| label: ${{ needs.setup-instance.outputs.runner-name }} | ||
| - name: Slack Notification | ||
| if: ${{ failure() }} | ||
| continue-on-error: true | ||
| uses: rtCamp/action-slack-notify@c33737706dea87cd7784c687dadc9adf1be59990 | ||
| env: | ||
| SLACK_COLOR: ${{ job.status }} | ||
| SLACK_MESSAGE: "Instance teardown (publish-cuda-release) finished with status: ${{ job.status }}. (${{ env.ACTION_RUN_URL }})" | ||
