Add optional Runpod untrusted-caller lab #6
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Verification | |
| 'on': | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| clean-container-smoke: | |
| name: Clean Docker and real-swtpm smoke | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 45 | |
| steps: | |
| - name: Check out source | |
| uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 | |
| with: | |
| persist-credentials: false | |
| - name: Install pinned uv | |
| uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 | |
| with: | |
| version: "0.12.5" | |
| enable-cache: false | |
| - name: Audit locked core and worker dependencies | |
| run: | | |
| uv sync --frozen --extra dev | |
| uv run --frozen pip-audit | |
| uv run --frozen pip-audit \ | |
| -r examples/runpod-untrusted-caller/requirements.lock | |
| - name: Validate Compose configuration | |
| run: docker compose config --quiet | |
| - name: Build verification image without cache | |
| run: docker compose build --pull --no-cache | |
| - name: Run verification against real swtpm | |
| run: docker compose up --abort-on-container-exit --exit-code-from verify verify | |
| - name: Remove containers, volumes, and network | |
| if: always() | |
| run: docker compose down --volumes --remove-orphans | |
| - name: Build isolated untrusted-caller worker | |
| run: | | |
| docker build --platform linux/amd64 \ | |
| --tag atcap-runpod-holder:ci \ | |
| examples/runpod-untrusted-caller | |
| - name: Run worker smoke without network or privileges | |
| run: | | |
| docker run --rm --platform linux/amd64 --network none --read-only \ | |
| --env TMPDIR=/run/worker-tmp \ | |
| --tmpfs /run/worker-tmp:rw,noexec,nosuid,size=16m \ | |
| --cap-drop ALL --security-opt no-new-privileges \ | |
| atcap-runpod-holder:ci sh -c \ | |
| 'python /opt/worker/self_test.py && python /opt/worker/handler_self_test.py' | |
| test "$(docker image inspect atcap-runpod-holder:ci --format '{{.Architecture}}')" = amd64 | |
| test "$(docker image inspect atcap-runpod-holder:ci --format '{{.Config.User}}')" = 10001:10001 |