Run tests in CI with runner

.github/workflows/reproducibility.yaml

@@ -45,14 +45,17 @@ jobs:
 
       # Build artifacts that are supposed to be reproducible.
       - name: Build Rust server
-        run: ./scripts/docker_run ./scripts/build_server -s base
+        run: |
+          ./scripts/docker_run ./scripts/runner build-server --server-variant=base
 
       - name: Build examples
-        run: ./scripts/docker_run ./scripts/build_examples
+        run: |
+          ./scripts/docker_run ./scripts/runner run-examples --run-clients=false --run-server=false
 
       # Generate an index of the hashes of the reproducible artifacts.
       - name: Generate Reproducibility Index
-        run: ./scripts/docker_run ./scripts/build_reproducibility_index
+        run: |
+          ./scripts/docker_run ./scripts/build_reproducibility_index
 
       # Remove all files from the "out" folder.
       - name: Clear "out" folder

cloudbuild.yaml

@@ -31,15 +31,6 @@ steps:
     timeout: 5m
     args: ['./scripts/git_init']
 
-  # Make sure that the Bazel server is unpacked and initialized, by calling `bazel info` (any other
-  # Bazel command would probably do).
-  - name: 'gcr.io/oak-ci/oak:latest'
-    id: bazel_init
-    entrypoint: 'bazel'
-    waitFor: ['git_init']
-    timeout: 5m
-    args: ['info']
-
   - name: 'gcr.io/oak-ci/oak:latest'
     id: cargo_crev
     entrypoint: 'bash'
@@ -48,76 +39,27 @@ steps:
     args: ['./scripts/run_cargo_crev']
 
   - name: 'gcr.io/oak-ci/oak:latest'
-    id: check_formatting
+    id: runner_ci
     waitFor: ['git_init']
-    timeout: 30m
-    entrypoint: 'bash'
-    args: ['./scripts/check_formatting']
-
-  - name: 'gcr.io/oak-ci/oak:latest'
-    id: build_server_no_debug
-    waitFor: ['bazel_init', 'check_formatting']
-    timeout: 60m
-    entrypoint: 'bash'
-    args: ['./scripts/build_server', '-s', 'logless']
-
-  - name: 'gcr.io/oak-ci/oak:latest'
-    id: build_server
-    waitFor: ['build_server_no_debug']
     timeout: 60m
     entrypoint: 'bash'
-    args: ['./scripts/build_server', '-s', 'base']
+    args: ['./scripts/runner', '--commands', 'run-ci']
 
   # Package the Hello World application in a Docker image.
   - name: 'gcr.io/oak-ci/oak:latest'
     id: build_server_docker
-    waitFor: ['build_server']
-    timeout: 60m
-    entrypoint: 'bash'
-    args: ['./scripts/build_example', '-e', 'hello_world', '-i', 'base']
-
-  - name: 'gcr.io/oak-ci/oak:latest'
-    id: run_tests
-    waitFor: ['build_server_docker']
-    timeout: 60m
-    entrypoint: 'bash'
-    args: ['./scripts/run_tests']
-
-  - name: 'gcr.io/oak-ci/oak:latest'
-    id: run_tests_tsan
-    waitFor: ['run_tests']
-    timeout: 60m
-    entrypoint: 'bash'
-    args: ['./scripts/run_tests_tsan']
-
-  - name: 'gcr.io/oak-ci/oak:latest'
-    id: run_examples
-    waitFor: ['run_tests_tsan']
-    timeout: 60m
-    entrypoint: 'bash'
-    args: ['./scripts/run_examples', '-s', 'base']
-
-  - name: 'gcr.io/oak-ci/oak:latest'
-    id: run_examples_cpp
-    waitFor: ['run_examples']
-    timeout: 60m
-    entrypoint: 'bash'
-    args: ['./scripts/run_examples', '-s', 'base', '-a', 'cpp']
-
-  - name: 'gcr.io/oak-ci/oak:latest'
-    id: build_experimental
-    waitFor: ['run_tests']
+    waitFor: ['git_init']
     timeout: 60m
     entrypoint: 'bash'
-    args: ['./scripts/build_experimental']
-
-  # Run clang-tidy after the examples finish running, since they share the same `output_base`.
-  - name: 'gcr.io/oak-ci/oak:latest'
-    id: run_clang_tidy
-    waitFor: ['run_examples_cpp']
-    timeout: 30m
-    entrypoint: 'bash'
-    args: ['./scripts/run_clang_tidy']
+    args:
+      [
+        './scripts/runner',
+        'run-examples',
+        '--example-name=hello_world',
+        '--run-server=false',
+        '--run-clients=false',
+        '--build-docker',
+      ]
 
   - name: 'gcr.io/oak-ci/oak:latest'
     id: generate_root_ca_certs
@@ -130,13 +72,7 @@ steps:
   # ignored by git.
   - name: 'gcr.io/oak-ci/oak:latest'
     id: git_check_diff
-    waitFor:
-      [
-        'git_init',
-        'run_clang_tidy',
-        'run_examples_cpp',
-        'generate_root_ca_certs',
-      ]
+    waitFor: ['git_init', 'runner_ci', 'generate_root_ca_certs']
     timeout: 5m
     entrypoint: 'bash'
     args: ['./scripts/git_check_diff']
@@ -169,20 +105,6 @@ steps:
     entrypoint: 'bash'
     args: ['./scripts/build_examples_android']
 
-  - name: 'gcr.io/oak-ci/oak:latest'
-    id: check_cargo_deny
-    waitFor: ['check_formatting', 'git_check_diff']
-    timeout: 30m
-    entrypoint: 'bash'
-    args: ['./scripts/check_cargo_deny']
-
-  - name: 'gcr.io/oak-ci/oak:latest'
-    id: check_docs
-    waitFor: ['check_formatting', 'git_check_diff']
-    timeout: 30m
-    entrypoint: 'bash'
-    args: ['./scripts/check_docs']
-
 # Copy compiled enclave binary to Google Cloud Storage.
 # See:
 # - https://pantheon.corp.google.com/storage/browser/artifacts.oak-ci.appspot.com/test/?project=oak-ci

docs/CONTRIBUTING.md

@@ -65,9 +65,8 @@ are squashed against the correct commit if necessary.
 ### Rust
 
 - Make sure code is [`cargo clippy`](https://crates.io/crates/clippy) clean.
-- Use the [`scripts/format`](/scripts/format) scripts to keep Rust code
-  formatted consistently, according to our
-  [`rustfmt` configuration](/.rustfmt.toml).
+- Use the `./scripts/runner format` command to keep Rust code formatted
+  consistently, according to our [`rustfmt` configuration](/.rustfmt.toml).
 - Use the [`scripts/check_docs`](/scripts/check_docs) script to check for
   warnings from
   [`cargo doc`](https://doc.rust-lang.org/cargo/commands/cargo-doc.html) and

docs/INSTALL-OSX.md

@@ -60,20 +60,20 @@ retrieved from a Google Cloud Docker repository.
 The Oak Runtime and its dependencies are built with the following script:
 
 ```bash
-./scripts/build_server
+./scripts/runner build-server
 ```
 
 Build a particular example, say `hello_world`, with:
 
 ```bash
-./scripts/build_example -e hello_world
+./scripts/runner run-examples --example-name=hello_world
 ```
 
 Note that the Runtime server requires a particular Oak Application to run, and
 so relies on the previous section.
 
 ```bash
-./scripts/run_server -e hello_world
+./scripts/runner run-examples --run-clients=false --example-name=hello_world
 ```
 
 In a separate terminal, run an example client that connects to the Oak Runtime
@@ -82,13 +82,12 @@ needed, so the client will connect to the already-running server of the previous
 step):
 
 ```bash
-./scripts/run_example -s none -e hello_world
+./scripts/runner run-examples --run-server=false --example-name=hello_world
 ```
 
 ## Codebase Tools
 
 The Oak codebase also makes use of several linting tools. To run these, and
-their wrapper scripts (e.g. [`scripts/format`](/scripts/format) and
-[`scripts/check_formatting`](/scripts/check_formatting)), the OS X versions of
-the tools will need to be installed. Check the top-level
-[`Dockerfile`](/Dockerfile) for the set of required tools.
+their wrapper scripts (e.g. `./scripts/runner format`), the OS X versions of the
+tools will need to be installed. Check the top-level [`Dockerfile`](/Dockerfile)
+for the set of required tools.

docs/development.md

@@ -16,7 +16,7 @@ To build and run one of the Oak example applications under Docker, run:
 
 ```bash
 ./scripts/docker_pull  # retrieve cached Docker image for faster builds
-./scripts/docker_run ./scripts/run_example -e hello_world
+./scripts/docker_run ./scripts/runner run-examples --example-name=hello_world
 ```
 
 This should build the Runtime, an Oak Application and a client for the
@@ -118,13 +118,13 @@ Running one of the example Oak applications will confirm that all core
 prerequisites have been installed. Run one inside Docker with:
 
 ```bash
-./scripts/docker_run ./scripts/run_example -e hello_world
+./scripts/docker_run ./scripts/runner run-examples --example-name=hello_world
 ```
 
 or, if all prerequisites are available on the local system, outside of Docker:
 
 ```bash
-./scripts/run_example -e hello_world
+./scripts/runner run-examples --example-name=hello_world
 ```
 
 That script:
@@ -151,7 +151,7 @@ to a WebAssembly module and then serializes it into a binary application
 configuration file to be loaded to the Oak Server:
 
 ```bash
-./scripts/build_example -e hello_world
+./scripts/runner run-examples --run-server=false --run-clients=false --example-name=hello_world
 ```
 
 This binary application configuration file includes the compiled Wasm code for
@@ -172,7 +172,7 @@ The following command builds the Oak Runtime server. An initial build will take
 some time, but subsequent builds should be cached and so run much faster.
 
 ```bash
-./scripts/build_server
+./scripts/runner build-server
 ```
 
 ### Run Runtime Server
@@ -182,7 +182,7 @@ Oak Application (which must already have been compiled into WebAssembly and
 built into a serialized configuration, as [described above](#build-application).
 
 ```bash
-./scripts/run_server -e hello_world
+./scripts/runner run-examples --run-clients=false --example-name=hello_world
 ```
 
 In the end, you should end up with an Oak server running, end with log output
@@ -202,7 +202,7 @@ client of an example Oak Application (as [described above](#build-application)),
 and runs the client code locally.
 
 ```bash
-./scripts/run_example -s none -e hello_world
+./scripts/runner run-examples --run-server=false --logs --example-name=hello_world
 ```
 
 The `-s none` option indicates that the script expects to find an

docs/programming-oak.md

@@ -244,17 +244,17 @@ translator = { path = "examples/hello_world/bin/translator.wasm" }
 ```
 
 All these steps are implemented as a part of the
-`./scripts/build_example -e hello_world` script.
+`./scripts/runner run-examples --example-name=hello_world` script.
 
 ### Starting the Oak Application
 
-The Oak Application is then loaded using the Oak Runner:
+The Oak Application is then started using the Oak Loader:
 
 ```bash
-./scripts/run_server -f "${PWD}/config.bin"
+./oak/server/target/x86_64-unknown-linux-musl/release/oak_loader --application=./examples/hello_world/bin/config.bin
 ```
 
-The Oak Runner will launch an [Oak Runtime](concepts.md#oak-runtime), and this
+The Oak Loader will launch an [Oak Runtime](concepts.md#oak-runtime), and this
 Runtime will check the provided Wasm module(s) and application configuration.
 Assuming everything is correct (e.g. the Nodes all have a main entrypoint and
 only expect to link to the Oak [host functions](abi.md#host-functions)), the Oak

examples/abitest/example.toml

@@ -1,5 +1,9 @@
 name = "abitest"
 
+[application]
+manifest = "examples/abitest/config/config.toml"
+out = "examples/abitest/bin/config.bin"
+
 [modules]
 module_0 = { Cargo = { cargo_manifest = "examples/abitest/module_0/rust/Cargo.toml" } }
 module_1 = { Cargo = { cargo_manifest = "examples/abitest/module_1/rust/Cargo.toml" } }

examples/aggregator/README.md

@@ -37,13 +37,7 @@ a Sparse Vector - a dictionary with integer keys.
 Build and run the Aggregator with the following command:
 
 ```bash
-./scripts/build_example -e aggregator
-./scripts/build_server -s base
-cargo run --release --target=x86_64-unknown-linux-musl --manifest-path=oak/server/rust/oak_loader/Cargo.toml -- \
-  --application=./examples/aggregator/bin/config.bin \
-  --grpc-tls-private-key=./examples/certs/local/local.key \
-  --grpc-tls-certificate=./examples/certs/local/local.pem \
-  --root-tls-certificate=./examples/certs/local/ca.pem
+./scripts/runner run-examples --run-clients=false --example-name=aggregator
 ```
 
 Aggregator code is in `common` and `module` directories (where `common` defines
@@ -56,12 +50,7 @@ Simple client that connects to the Aggregator and sends a data sample via gRPC.
 Build and run the Client with the following command:
 
 ```bash
-./scripts/build_example -e aggregator
-./bazel-client-bin/examples/aggregator/client/client \
-  --address=localhost:8080 \
-  --ca_cert=./examples/certs/local/ca.pem \
-  --bucket=test \
-  --data=1:10,2:20,3:30
+./scripts/runner run-examples --run-server=false --example-name=aggregator
 ```
 
 A common use case is to keep running the client until the aggregation threshold

examples/aggregator/example.toml

@@ -1,5 +1,9 @@
 name = "aggregator"
 
+[application]
+manifest = "examples/aggregator/config/config.toml"
+out = "examples/aggregator/bin/config.bin"
+
 [modules]
 module = { Cargo = { cargo_manifest = "examples/aggregator/module/rust/Cargo.toml" } }
 

examples/aggregator/scripts/docker_push

@@ -11,7 +11,7 @@ declare -a images backend_images
 mapfile -t images < <(find ./examples/aggregator/bin -name aggregator.tar)
 mapfile -t backend_images < <(find ./examples/aggregator/bin -name aggregator_backend.tar)
 if [[ ${#images[@]} -eq 0 || ${#backend_images[@]} -eq 0 ]]; then
-  echo "Docker images have not been built, run './scripts/build_example -e aggregator -i base'"
+  echo "Docker images have not been built, run './scripts/runner run-examples --example-name=aggregator --build-docker'"
   exit 1
 fi
 if [[ ${#images[@]} -gt 1 || ${#backend_images[@]} -gt 1 ]]; then

examples/authentication/README.md

@@ -36,19 +36,14 @@ https://pantheon.corp.google.com/apis/credentials/oauthclient/691249393555-0h52j
 Click on `DOWNLOAD JSON` and save the file. This file contains sensitive
 information, so **do not share this file or add it to the repository**.
 
-To test the authentication client application with the downloaded file, ensure
-that the "Hello World" example has been built by running:
+To test the authentication client application with the downloaded file, run the
+server using:
 
 ```bash
-./scripts/build_example -e hello_world
-```
-
-Then run the server using:
-
-```bash
-./scripts/run_server \
-    -e hello_world \
-    -c ./client_secret_691249393555-0h52jim9ni9clkpd5chi82q9ccn44ebm.apps.googleusercontent.com.json
+./scripts/runner run-examples \
+    --example-name=hello_world \
+    --run-clients=false \
+    --server-additional-args=--oidc-client=./client_secret_691249393555-0h52jim9ni9clkpd5chi82q9ccn44ebm.apps.googleusercontent.com.json
 ```
 
 While the Oak server is running with the OpenID Connect authentication service