e2e-suites.yml

# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

# Runs testkit suites in tmachine environments on CI. Each matrix row names a
# tmachine environment and installer, the family (a workspace under
# tests/suites/) and the package in it, and the runner label for the
# environment's architecture. `openshell-test-runner` builds the tests, boots
# the environment, runs them inside it and checks the results.

name: E2E Suites

on:
  workflow_call:
    inputs:
      source-sha:
        description: Source revision of the prepared candidate artifacts
        required: true
        type: string
      integration-inputs-artifact-id:
        description: Immutable ID of the prepared integration inputs artifact
        required: true
        type: string
    secrets:
      CACHIX_AUTH_TOKEN:
        description: Token used to push Nix builds, such as the test runner, to Cachix
        required: false

permissions:
  actions: read
  contents: read
  packages: read

# github.workflow is the caller's name here, so scope the group to this
# workflow to avoid colliding with (and cancelling) the caller's other jobs.
concurrency:
  group: ${{ github.workflow }}-e2e-suites-${{ github.ref }}
  cancel-in-progress: true

jobs:
  suites:
    name: E2E suites (${{ matrix.family }}/${{ matrix.package }}, ${{ matrix.environment }}, ${{ matrix.installer }})
    strategy:
      fail-fast: false
      matrix:
        include:
          # amd64 only: CI has no arm64 runner with KVM for tmachine,
          # and the caller only builds amd64 inputs.
          - environment: ubuntu-docker-rootful
            installer: deb
            family: conformance
            package: sandbox
            runner: ubuntu-24.04
          - environment: ubuntu-docker-rootful-keycloak
            installer: deb
            family: features
            package: keycloak-provider-refresh
            runner: ubuntu-24.04
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 90
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs['source-sha'] }}
          persist-credentials: false

      - name: Enable KVM access
        run: |
          set -euo pipefail
          if [[ ! -c /dev/kvm ]]; then
            echo "::error::The runner did not expose /dev/kvm"
            exit 1
          fi
          sudo chmod 0666 /dev/kvm
          exec 3<>/dev/kvm
          exec 3>&-

      - uses: ./.github/actions/setup-nix
        with:
          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}

      - name: Cache tmachine disks
        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
        with:
          path: ~/.cache/tmachine
          # tmachine keys its disk layers on a hash of the Ansible tree, the
          # environments' playbook lists and setup inputs (config.nix, and
          # files such as the Keycloak realm file) and the cache versions in
          # setup.rs and install.rs. actions/cache doesn't save after an
          # exact key hit, so a key that misses one of those would rebuild the
          # changed layers on every run. Environments share no layers, and
          # only the first job to save a key gets its disks in, so each
          # environment and installer needs its own key. No restore-keys
          # fallback: restoring an older entry would carry its stale disks
          # into the new one, which then only grows.
          key: tmachine-${{ runner.os }}-${{ runner.arch }}-${{ matrix.environment }}-${{ matrix.installer }}-${{ hashFiles('tests/tmachine/ansible/**', 'tests/tmachine/config.nix', 'tests/tmachine/images.nix', 'tests/tmachine/src/qemu/setup.rs', 'tests/tmachine/src/qemu/install.rs', 'scripts/keycloak-realm.json') }}

      - name: Download integration inputs
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          artifact-ids: ${{ inputs['integration-inputs-artifact-id'] }}
          path: artifacts

      - name: Run the suites in this environment
        env:
          ENVIRONMENT: ${{ matrix.environment }}
          INSTALLER: ${{ matrix.installer }}
          FAMILY: ${{ matrix.family }}
          PACKAGE: ${{ matrix.package }}
        run: |
          # Retry dependency preparation, then run the suites once. The runner
          # builds the suites for the guest, so it needs no prepared archives.
          nix build --no-link .#openshell-test-runner || nix build --no-link .#openshell-test-runner
          nix run .#openshell-test-runner -- \
            --environment "${ENVIRONMENT}" \
            --installer "${INSTALLER}" \
            --family "${FAMILY}" \
            --package "${PACKAGE}" \
            --results artifacts/test-results

      # The results directory holds the JUnit report (junit.xml), the nextest
      # log, and the guest's diagnostics when the run failed. The log and the
      # report are collected even when the run timed out.
      # The runner exits with 1 when a test failed and 2 when the run could
      # not complete.
      - name: Upload results
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: e2e-results-${{ matrix.family }}-${{ matrix.package }}-${{ matrix.environment }}-${{ matrix.installer }}
          path: artifacts/test-results
          if-no-files-found: ignore
          retention-days: 7

  result:
    name: E2E suites result
    needs: [suites]
    if: always()
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: ./.github/actions/check-job-results
        with:
          results: ${{ toJSON(needs) }}