ci(e2e): pass prebuilt artifacts to rootless podman vm

Signed-off-by: Evan Lezar <elezar@nvidia.com>

Author: elezar

.github/actions/setup-e2e-sandbox/action.yml

@@ -0,0 +1,29 @@
+name: Setup E2E Sandbox
+description: Download an architecture-matched prebuilt OpenShell sandbox binary for E2E tests
+
+inputs:
+  artifact-prefix:
+    description: Artifact name prefix; linux-<arch> is appended automatically
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Download prebuilt sandbox
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        name: ${{ format('{0}-linux-{1}', inputs.artifact-prefix, runner.arch == 'X64' && 'amd64' || 'arm64') }}
+        path: .e2e/prebuilt-sandbox
+
+    - name: Configure prebuilt sandbox
+      shell: bash
+      run: |
+        set -euo pipefail
+        sandbox="$GITHUB_WORKSPACE/.e2e/prebuilt-sandbox/openshell-sandbox"
+        if [[ ! -f "$sandbox" ]]; then
+          echo "downloaded artifact is missing $sandbox" >&2
+          exit 1
+        fi
+        chmod +x "$sandbox"
+        "$sandbox" --version
+        echo "OPENSHELL_SANDBOX_BIN=$sandbox" >> "$GITHUB_ENV"

.github/workflows/branch-e2e.yml

@@ -136,6 +136,7 @@ jobs:
       runner: linux-arm64-cpu8
       cli-artifact-prefix: rust-binary-cli
       gateway-artifact-prefix: rust-binary-gateway
+      sandbox-artifact-prefix: rust-binary-sandbox
       vm-driver-artifact-name: driver-vm-linux-amd64
 
   gpu-e2e:

.github/workflows/e2e-test.yml

@@ -27,6 +27,11 @@ on:
         required: false
         type: string
         default: ""
+      sandbox-artifact-prefix:
+        description: "Optional prebuilt sandbox artifact prefix (artifact suffix is linux-<arch>)"
+        required: false
+        type: string
+        default: ""
       vm-driver-artifact-name:
         description: "Optional prebuilt VM driver artifact name"
         required: false
@@ -144,6 +149,21 @@ jobs:
           ref: ${{ inputs['checkout-ref'] || github.sha }}
           persist-credentials: false
 
+      - name: Use prebuilt OpenShell CLI
+        uses: ./.github/actions/setup-e2e-cli
+        with:
+          artifact-prefix: ${{ inputs.cli-artifact-prefix }}
+
+      - name: Use prebuilt OpenShell gateway
+        uses: ./.github/actions/setup-e2e-gateway
+        with:
+          artifact-prefix: ${{ inputs.gateway-artifact-prefix }}
+
+      - name: Use prebuilt OpenShell sandbox
+        uses: ./.github/actions/setup-e2e-sandbox
+        with:
+          artifact-prefix: ${{ inputs.sandbox-artifact-prefix }}
+
       - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
         with:
           github_access_token: ${{ secrets.GITHUB_TOKEN }}
@@ -175,7 +195,20 @@ jobs:
             pkg-config
 
       - name: Run rootless Podman E2E
-        run: mise run --no-deps --skip-deps e2e:podman:rootless
+        run: |
+          set -euo pipefail
+
+          args=(
+            --vm ubuntu-26-04
+            --with podman-rootless
+            --host-cli-bin "$OPENSHELL_BIN"
+            --gateway-bin "$OPENSHELL_GATEWAY_BIN"
+            --sandbox-bin "$OPENSHELL_SANDBOX_BIN"
+            --gateway-config e2e/configs/gateway/podman.toml
+            --suite smoke
+          )
+
+          mise x -- e2e/run.sh "${args[@]}"
 
   e2e-vm:
     name: E2E (rust-vm-${{ matrix.suite }})

.github/workflows/release-dev.yml

@@ -69,8 +69,16 @@ jobs:
       cargo-version: ${{ needs.compute-versions.outputs.cargo_version }}
       auditable: true
 
+  build-cli:
+    needs: [compute-versions]
+    uses: ./.github/workflows/docker-build.yml
+    with:
+      component: cli
+      cargo-version: ${{ needs.compute-versions.outputs.cargo_version }}
+      auditable: true
+
   e2e:
-    needs: [build-gateway, build-supervisor]
+    needs: [build-gateway, build-supervisor, build-cli]
     permissions:
       actions: read
       contents: read
@@ -79,6 +87,9 @@ jobs:
     with:
       image-tag: ${{ github.sha }}
       runner: linux-arm64-cpu8
+      cli-artifact-prefix: rust-binary-cli
+      gateway-artifact-prefix: rust-binary-gateway
+      sandbox-artifact-prefix: rust-binary-sandbox
 
   tag-ghcr-dev:
     name: Tag GHCR Images as Dev

.github/workflows/release-tag.yml

@@ -93,8 +93,18 @@ jobs:
       checkout-ref: ${{ inputs.tag || github.ref }}
       auditable: true
 
+  build-cli:
+    needs: [compute-versions]
+    uses: ./.github/workflows/docker-build.yml
+    with:
+      component: cli
+      cargo-version: ${{ needs.compute-versions.outputs.cargo_version }}
+      image-tag: ${{ needs.compute-versions.outputs.source_sha }}
+      checkout-ref: ${{ inputs.tag || github.ref }}
+      auditable: true
+
   e2e:
-    needs: [compute-versions, build-gateway, build-supervisor]
+    needs: [compute-versions, build-gateway, build-supervisor, build-cli]
     permissions:
       actions: read
       contents: read
@@ -104,6 +114,9 @@ jobs:
       image-tag: ${{ needs.compute-versions.outputs.source_sha }}
       checkout-ref: ${{ inputs.tag || github.ref }}
       runner: linux-arm64-cpu8
+      cli-artifact-prefix: rust-binary-cli
+      gateway-artifact-prefix: rust-binary-gateway
+      sandbox-artifact-prefix: rust-binary-sandbox
 
   tag-ghcr-release:
     name: Tag GHCR Images for Release

e2e/run.sh

@@ -25,6 +25,9 @@ Usage:
 Options:
   --vm DISTRO          Run the gateway in a Nix test guest
   --with CONFIG        Apply a Nix test-guest configuration; repeatable
+  --host-cli-bin PATH  Use a prebuilt host openshell CLI instead of building it
+  --gateway-bin PATH   Use a prebuilt openshell-gateway instead of building it
+  --sandbox-bin PATH   Use a prebuilt openshell-sandbox instead of building it
   --gateway-config PATH
                        Fully resolved gateway TOML
   --suite NAME         Rust suite at e2e/rust/tests/NAME.rs
@@ -92,6 +95,9 @@ catalog_has_entry() {
 
 vm=
 gateway_config=
+gateway_bin=
+host_cli_bin=
+sandbox_bin=
 suite_name=
 with_configurations=()
 
@@ -107,6 +113,21 @@ while [ "$#" -gt 0 ]; do
 		with_configurations+=("$2")
 		shift 2
 		;;
+	--host-cli-bin)
+		require_value "$1" "$#" "${2:-}"
+		host_cli_bin="$(resolve_file "$2")" || die "--host-cli-bin does not name a file: $2"
+		shift 2
+		;;
+	--gateway-bin)
+		require_value "$1" "$#" "${2:-}"
+		gateway_bin="$(resolve_file "$2")" || die "--gateway-bin does not name a file: $2"
+		shift 2
+		;;
+	--sandbox-bin)
+		require_value "$1" "$#" "${2:-}"
+		sandbox_bin="$(resolve_file "$2")" || die "--sandbox-bin does not name a file: $2"
+		shift 2
+		;;
 	--gateway-config)
 		require_value "$1" "$#" "${2:-}"
 		gateway_config=$2
@@ -230,49 +251,68 @@ target_dir="$(e2e_cargo_target_dir "${ROOT}" mise x -- cargo)"
 
 ensure_build_nofile_limit
 
-echo "==> Building native host openshell CLI"
-mise x -- cargo build "${cargo_jobs[@]+"${cargo_jobs[@]}"}" -p openshell-cli --bin openshell
-host_cli_bin="${target_dir}/debug/openshell"
-
-echo "==> Preparing ${linux_musl_target} build target"
-mise x -- rustup target add "${linux_musl_target}" >/dev/null
+if [ -n "${host_cli_bin}" ]; then
+	echo "==> Using host openshell CLI: ${host_cli_bin}"
+else
+	echo "==> Building native host openshell CLI"
+	mise x -- cargo build "${cargo_jobs[@]+"${cargo_jobs[@]}"}" -p openshell-cli --bin openshell
+	host_cli_bin="${target_dir}/debug/openshell"
+fi
 
-echo "==> Building Linux openshell-sandbox (${linux_musl_target})"
-mise x -- cargo zigbuild "${cargo_jobs[@]+"${cargo_jobs[@]}"}" \
-	--release \
-	--target "${linux_musl_target}" \
-	-p openshell-sandbox \
-	--bin openshell-sandbox
-linux_sandbox_bin="${target_dir}/${linux_musl_target}/release/openshell-sandbox"
+if [ -n "${sandbox_bin}" ]; then
+	echo "==> Using Linux openshell-sandbox: ${sandbox_bin}"
+	linux_sandbox_bin="${sandbox_bin}"
+else
+	echo "==> Preparing ${linux_musl_target} build target"
+	mise x -- rustup target add "${linux_musl_target}" >/dev/null
+
+	echo "==> Building Linux openshell-sandbox (${linux_musl_target})"
+	mise x -- cargo zigbuild "${cargo_jobs[@]+"${cargo_jobs[@]}"}" \
+		--release \
+		--target "${linux_musl_target}" \
+		-p openshell-sandbox \
+		--bin openshell-sandbox
+	linux_sandbox_bin="${target_dir}/${linux_musl_target}/release/openshell-sandbox"
+fi
 
 host_gateway_bin=
 guest_gateway_bin=
 if [ "${mode}" = host ]; then
-	echo "==> Building native host openshell-gateway"
-	mise x -- cargo build "${cargo_jobs[@]+"${cargo_jobs[@]}"}" \
-		-p openshell-server \
-		--bin openshell-gateway \
-		--features bundled-z3
-	host_gateway_bin="${target_dir}/debug/openshell-gateway"
-else
-	echo "==> Preparing ${linux_gateway_rust_target} build target"
-	mise x -- rustup target add "${linux_gateway_rust_target}" >/dev/null
-	echo "==> Building Linux openshell-gateway (${linux_gateway_zig_target})"
-	(
-		eval "$(
-			"${ROOT}/tasks/scripts/setup-zig-cc-wrapper.sh" \
-				"${linux_gateway_zig_target}" \
-				"${linux_gateway_zig_target}" \
-				"${target_dir}/zig-gnu-wrapper/e2e"
-		)"
-		mise x -- cargo zigbuild "${cargo_jobs[@]+"${cargo_jobs[@]}"}" \
-			--release \
-			--target "${linux_gateway_zig_target}" \
+	if [ -n "${gateway_bin}" ]; then
+		echo "==> Using host openshell-gateway: ${gateway_bin}"
+		host_gateway_bin="${gateway_bin}"
+	else
+		echo "==> Building native host openshell-gateway"
+		mise x -- cargo build "${cargo_jobs[@]+"${cargo_jobs[@]}"}" \
 			-p openshell-server \
 			--bin openshell-gateway \
 			--features bundled-z3
-	)
-	guest_gateway_bin="${target_dir}/${linux_gateway_rust_target}/release/openshell-gateway"
+		host_gateway_bin="${target_dir}/debug/openshell-gateway"
+	fi
+else
+	if [ -n "${gateway_bin}" ]; then
+		echo "==> Using Linux openshell-gateway: ${gateway_bin}"
+		guest_gateway_bin="${gateway_bin}"
+	else
+		echo "==> Preparing ${linux_gateway_rust_target} build target"
+		mise x -- rustup target add "${linux_gateway_rust_target}" >/dev/null
+		echo "==> Building Linux openshell-gateway (${linux_gateway_zig_target})"
+		(
+			eval "$(
+				"${ROOT}/tasks/scripts/setup-zig-cc-wrapper.sh" \
+					"${linux_gateway_zig_target}" \
+					"${linux_gateway_zig_target}" \
+					"${target_dir}/zig-gnu-wrapper/e2e"
+			)"
+			mise x -- cargo zigbuild "${cargo_jobs[@]+"${cargo_jobs[@]}"}" \
+				--release \
+				--target "${linux_gateway_zig_target}" \
+				-p openshell-server \
+				--bin openshell-gateway \
+				--features bundled-z3
+		)
+		guest_gateway_bin="${target_dir}/${linux_gateway_rust_target}/release/openshell-gateway"
+	fi
 fi
 
 expected_binaries=("${host_cli_bin}" "${linux_sandbox_bin}")

nix/test-guest/configuration/podman.yml

@@ -27,7 +27,16 @@
         name: podman
         state: present
 
-    - name: Verify Podman
+    - name: Enable the rootless Podman API socket
+      ansible.builtin.systemd_service:
+        name: podman.socket
+        scope: user
+        enabled: true
+        state: started
+      become: false
+
+    - name: Verify rootless Podman
       ansible.builtin.command:
         cmd: podman info
+      become: false
       changed_when: false