integration-runner.yml

# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

name: Integration Test Runner

on:
  workflow_call:
    inputs:
      source-sha:
        description: Source revision of the prepared candidate artifacts
        required: true
        type: string
      integration-inputs-artifact-id:
        description: Immutable ID of the prepared integration inputs artifact
        required: true
        type: string
      category:
        description: Integration-test category, used for the job name and concurrency key
        required: false
        type: string
      test-matrix:
        description: JSON array of environment, installer, and testsuite combinations
        required: false
        type: string
        default: >-
          [
            {"environment":"ubuntu-docker-rootful","installer":"deb","testsuite":"conformance"},
            {"environment":"ubuntu-k3s","installer":"k3s","testsuite":"conformance"},
            {"environment":"ubuntu-k3s","installer":"k3s-ha","testsuite":"conformance"},
            {"environment":"fedora-podman-rootful","installer":"rpm","testsuite":"conformance"},
            {"environment":"fedora-podman-rootless","installer":"rpm","testsuite":"conformance"}
          ]

permissions:
  actions: read
  contents: read
  packages: read

concurrency:
  group: ${{ github.workflow }}-integration-${{ inputs.category }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  integration:
    name: Integration test (${{ inputs.category }}, ${{ matrix.environment }}, ${{ matrix.installer }}, ${{ matrix.testsuite }})
    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJSON(inputs['test-matrix']) }}
    runs-on: ubuntu-24.04
    timeout-minutes: 90
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs['source-sha'] }}
          persist-credentials: false

      - name: Enable KVM access
        run: |
          set -euo pipefail
          if [[ ! -c /dev/kvm ]]; then
            echo "::error::The runner did not expose /dev/kvm"
            exit 1
          fi
          sudo chmod 0666 /dev/kvm
          exec 3<>/dev/kvm
          exec 3>&-

      - uses: ./.github/actions/setup-nix

      - name: Cache tmachine disks
        if: matrix.environment != 'ubuntu-k3s'
        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
        with:
          path: ~/.cache/tmachine
          key: tmachine-${{ runner.os }}-${{ runner.arch }}

      - name: Download integration inputs
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          artifact-ids: ${{ inputs['integration-inputs-artifact-id'] }}
          path: artifacts

      - name: Run test suite
        env:
          ENVIRONMENT: ${{ matrix.environment }}
          INSTALLER: ${{ matrix.installer }}
          TESTSUITE: ${{ matrix.testsuite }}
        run: |
          # Retry dependency preparation, then execute the test suite once.
          nix build --no-link .#tmachine || nix build --no-link .#tmachine
          nix run .#tmachine -- test "${ENVIRONMENT}" "${INSTALLER}" "${TESTSUITE}"

      - name: Upload tmachine diagnostics
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: tmachine-diagnostics-${{ inputs.category }}-${{ matrix.environment }}-${{ matrix.installer }}-${{ matrix.testsuite }}
          path: artifacts/tmachine-diagnostics
          if-no-files-found: ignore
          retention-days: 7