ci(e2e): start Linux and tmachine jobs without waiting on macOS or package builds

.github/actions/build-vm-driver/action.yml

@@ -0,0 +1,75 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Build VM Driver
+description: Assemble the compressed VM runtime and build openshell-driver-vm
+
+inputs:
+  arch:
+    description: Guest architecture used to select the Linux sandbox and VM init artifacts
+    required: true
+  triple:
+    description: Rust target triple of the driver
+    required: true
+  supervisor-artifact:
+    description: Artifact containing the openshell-supervisor binary embedded in the runtime
+    required: true
+  cargo-version:
+    description: Cargo package version embedded in the binary
+    required: true
+  supervisor-image-tag:
+    description: Default supervisor image tag embedded in the binary
+    required: false
+    default: ""
+  entitlements-file:
+    description: Path to an entitlements plist for macOS ad-hoc codesigning
+    required: false
+    default: ""
+runs:
+  using: composite
+  steps:
+    - name: Download openshell-sandbox
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        name: openshell-sandbox-${{ inputs.arch }}-unknown-linux-musl
+        path: sandbox
+
+    - name: Download openshell-supervisor
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        name: ${{ inputs.supervisor-artifact }}
+        path: supervisor
+
+    - name: Download VM guest init
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        name: openshell-vm-init-${{ inputs.arch }}-unknown-linux-musl
+        path: vm-init
+
+    - name: Build VM runtime
+      shell: nix develop -c bash -euo pipefail {0}
+      run: |
+        # HTTP 416 is not retried by Nix; restart the build once on failure.
+        nix build .#vm-runtime || nix build .#vm-runtime
+
+    - name: Assemble compressed VM runtime
+      shell: nix develop -c bash -euo pipefail {0}
+      run: |
+        compressed_dir="${RUNNER_TEMP}/vm-runtime-compressed"
+        install -d "$compressed_dir"
+        cp result/compressed/*.zst "$compressed_dir/"
+        zstd -19 -T1 sandbox/openshell-sandbox -o "$compressed_dir/openshell-sandbox.zst"
+        zstd -19 -T1 supervisor/openshell-supervisor -o "$compressed_dir/openshell-supervisor.zst"
+        zstd -19 -T1 vm-init/openshell-vm-init -o "$compressed_dir/openshell-vm-init.zst"
+
+    - name: Build openshell-driver-vm
+      uses: ./.github/actions/build-rust-binary
+      env:
+        OPENSHELL_VM_RUNTIME_COMPRESSED_DIR: ${{ runner.temp }}/vm-runtime-compressed
+      with:
+        package: openshell-driver-vm
+        binary: openshell-driver-vm
+        triple: ${{ inputs.triple }}
+        cargo-version: ${{ inputs.cargo-version }}
+        supervisor-image-tag: ${{ inputs.supervisor-image-tag }}
+        entitlements-file: ${{ inputs.entitlements-file }}

.github/workflows/branch-e2e.yml

@@ -101,11 +101,21 @@ jobs:
             echo "rpm_release=$rpm_release"
           } >> "$GITHUB_OUTPUT"
 
-  build-binaries:
+  build-binaries-linux:
     needs: version
     permissions:
       contents: read
-    uses: ./.github/workflows/build-binaries.yml
+    uses: ./.github/workflows/build-binaries-linux.yml
+    with:
+      cargo-version: ${{ needs.version.outputs.cargo }}
+    secrets:
+      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
+  build-binaries-macos:
+    needs: version
+    permissions:
+      contents: read
+    uses: ./.github/workflows/build-binaries-macos.yml
     with:
       cargo-version: ${{ needs.version.outputs.cargo }}
     secrets:
@@ -183,19 +193,30 @@ jobs:
           triple: ${{ matrix.triple }}
           cargo-version: ${{ needs.version.outputs.cargo }}
 
-  build-vm-driver:
-    needs: [pr_metadata, version, build-binaries]
+  build-vm-driver-linux:
+    needs: [pr_metadata, version, build-binaries-linux]
+    if: needs.pr_metadata.outputs.run_core_e2e == 'true'
+    permissions:
+      contents: read
+    uses: ./.github/workflows/build-vm-driver-linux.yml
+    with:
+      cargo-version: ${{ needs.version.outputs.cargo }}
+    secrets:
+      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
+  build-vm-driver-macos:
+    needs: [pr_metadata, version, build-binaries-linux, build-binaries-macos]
     if: needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       contents: read
-    uses: ./.github/workflows/build-vm-driver.yml
+    uses: ./.github/workflows/build-vm-driver-macos.yml
     with:
       cargo-version: ${{ needs.version.outputs.cargo }}
     secrets:
       CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
   build-images:
-    needs: [pr_metadata, build-binaries]
+    needs: [pr_metadata, build-binaries-linux]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_any_e2e == 'true'
     permissions:
       contents: read
@@ -204,7 +225,7 @@ jobs:
 
   build-deb:
     name: Build Debian packages
-    needs: [pr_metadata, version, build-binaries, build-vm-driver]
+    needs: [pr_metadata, version, build-binaries-linux, build-vm-driver-linux]
     if: needs.pr_metadata.outputs.run_integration == 'true'
     permissions:
       contents: read
@@ -216,7 +237,7 @@ jobs:
 
   build-rpm:
     name: Build RPM packages
-    needs: [pr_metadata, version, build-binaries]
+    needs: [pr_metadata, version, build-binaries-linux]
     if: needs.pr_metadata.outputs.run_integration == 'true'
     permissions:
       actions: read
@@ -228,8 +249,48 @@ jobs:
       rpm-release: ${{ needs.version.outputs.rpm_release }}
       cargo-version: ${{ needs.version.outputs.cargo }}
 
+  # Test inputs don't depend on the packages, so build them while the packages
+  # build instead of in prepare-integration.
+  build-tmachine-test-inputs:
+    name: Build tmachine test inputs
+    needs: [pr_metadata]
+    if: needs.pr_metadata.outputs.run_integration == 'true'
+    permissions:
+      contents: read
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          ref: ${{ github.sha }}
+      - uses: ./.github/actions/setup-nix
+      - name: Build test archives
+        run: |
+          # Retry dependency preparation, then generate artifacts once.
+          nix build --no-link .#build-artifacts-test-archives || nix build --no-link .#build-artifacts-test-archives
+          nix run .#build-artifacts-test-archives
+      - name: Build test workload images
+        run: |
+          # Retry dependency preparation, then generate artifacts once.
+          nix build --no-link .#build-artifacts-test-images || nix build --no-link .#build-artifacts-test-images
+          nix run .#build-artifacts-test-images
+      - name: Package Helm chart
+        run: |
+          # Retry dependency preparation, then generate artifacts once.
+          nix build --no-link .#build-artifacts-helm || nix build --no-link .#build-artifacts-helm
+          nix run .#build-artifacts-helm
+      - name: Upload tmachine test inputs
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: openshell-tmachine-test-inputs
+          path: artifacts
+          compression-level: 0
+          retention-days: 5
+          if-no-files-found: error
+
   prepare-integration:
-    needs: [pr_metadata, build-binaries, build-images, build-deb, build-rpm]
+    needs: [pr_metadata, build-binaries-linux, build-images, build-deb, build-rpm, build-tmachine-test-inputs]
     if: needs.pr_metadata.outputs.run_integration == 'true'
     permissions:
       actions: read
@@ -239,6 +300,7 @@ jobs:
     with:
       deb-artifact-name: deb-linux-amd64
       rpm-artifact-name: rpm-linux-x86_64
+      test-inputs-artifact-name: openshell-tmachine-test-inputs
 
   # Run driver-independent conformance tests.
   conformance-integration:
@@ -306,7 +368,7 @@ jobs:
         ]
 
   docker-e2e:
-    needs: [pr_metadata, build-binaries, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -318,7 +380,7 @@ jobs:
       runner: linux-arm64-cpu8
 
   podman-e2e:
-    needs: [pr_metadata, build-binaries, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -331,7 +393,7 @@ jobs:
         [{"suite":"ci","runner":"ubuntu-26.04","podman_major":"5","podman_package_version":"5.7.0+ds2-3build1","conmon_package_version":"2.1.13+ds1-2","cmd":"mise run --no-deps --skip-deps e2e:podman:ci"}]
 
   podman-additional-ca-e2e:
-    needs: [pr_metadata, build-binaries, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -344,7 +406,7 @@ jobs:
         [{"suite":"additional-ca","runner":"ubuntu-26.04","podman_major":"5","podman_package_version":"5.7.0+ds2-3build1","conmon_package_version":"2.1.13+ds1-2","cmd":"OPENSHELL_E2E_PODMAN_TEST=additional_ca mise run --no-deps --skip-deps e2e:podman"}]
 
   vm-e2e:
-    needs: [pr_metadata, build-binaries, build-vm-driver]
+    needs: [pr_metadata, build-binaries-linux, build-vm-driver-linux]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -353,7 +415,7 @@ jobs:
     uses: ./.github/workflows/e2e-vm-test.yml
 
   vm-additional-ca-e2e:
-    needs: [pr_metadata, build-binaries, build-vm-driver]
+    needs: [pr_metadata, build-binaries-linux, build-vm-driver-linux]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -365,7 +427,7 @@ jobs:
       test-name: additional_ca
 
   docker-external-driver-e2e:
-    needs: [pr_metadata, build-binaries, build-gateway-plain, build-external-drivers, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-gateway-plain, build-external-drivers, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -381,7 +443,7 @@ jobs:
         [{"suite":"external-driver","cmd":"mise run --no-deps --skip-deps e2e:docker:external-driver","apt_packages":"openssh-client","python_proto":false,"mcp":false}]
 
   podman-external-driver-e2e:
-    needs: [pr_metadata, build-binaries, build-gateway-plain, build-external-drivers, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-gateway-plain, build-external-drivers, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -396,7 +458,7 @@ jobs:
         [{"suite":"external-driver","runner":"ubuntu-26.04","podman_major":"5","podman_package_version":"5.7.0+ds2-3build1","conmon_package_version":"2.1.13+ds1-2","cmd":"mise run --no-deps --skip-deps e2e:podman:external-driver"}]
 
   vm-external-driver-e2e:
-    needs: [pr_metadata, build-binaries, build-gateway-plain, build-vm-driver]
+    needs: [pr_metadata, build-binaries-linux, build-gateway-plain, build-vm-driver-linux]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -409,7 +471,7 @@ jobs:
       e2e-task: e2e:vm:external-driver
 
   gpu-e2e:
-    needs: [pr_metadata, build-binaries, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_gpu_e2e == 'true'
     permissions:
       actions: read
@@ -420,7 +482,7 @@ jobs:
       image-tag: ${{ github.sha }}
 
   kubernetes-e2e:
-    needs: [pr_metadata, build-binaries, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     strategy:
       fail-fast: false
@@ -450,7 +512,7 @@ jobs:
       test-name: ${{ matrix.test_name }}
 
   kubernetes-app-listener-e2e:
-    needs: [pr_metadata, build-binaries, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     strategy:
       fail-fast: false
@@ -487,7 +549,7 @@ jobs:
       listener-takeover: ${{ matrix.takeover }}
 
   kubernetes-workspace-managed-e2e:
-    needs: [pr_metadata, build-binaries, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -500,7 +562,7 @@ jobs:
       e2e-task: e2e:kubernetes:workspace-managed
 
   kubernetes-external-driver-e2e:
-    needs: [pr_metadata, build-binaries, build-gateway-plain, build-external-drivers, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-gateway-plain, build-external-drivers, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -516,7 +578,7 @@ jobs:
       cluster-images: sandbox supervisor
 
   kubernetes-workspace-operator-e2e:
-    needs: [pr_metadata, build-binaries, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -529,7 +591,7 @@ jobs:
       e2e-task: e2e:kubernetes:workspace-operator
 
   kubernetes-ha-e2e:
-    needs: [pr_metadata, build-binaries, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_kubernetes_ha_e2e == 'true'
     permissions:
       actions: read
@@ -546,7 +608,7 @@ jobs:
       use-envoy-gateway: true
 
   kubernetes-credential-drivers-e2e:
-    needs: [pr_metadata, build-binaries, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_kubernetes_credential_drivers_e2e == 'true'
     permissions:
       actions: read
@@ -562,6 +624,8 @@ jobs:
     name: Core E2E result
     needs:
       - pr_metadata
+      - build-binaries-macos
+      - build-vm-driver-macos
       - conformance-integration
       - feature-specific-integration
       - driver-specific-integration
@@ -591,7 +655,7 @@ jobs:
 
   gpu-e2e-result:
     name: GPU E2E result
-    needs: [pr_metadata, gpu-e2e]
+    needs: [pr_metadata, build-binaries-macos, gpu-e2e]
     if: always() && needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_gpu_e2e == 'true'
     runs-on: ubuntu-latest
     steps:
@@ -604,7 +668,7 @@ jobs:
 
   kubernetes-ha-e2e-result:
     name: Kubernetes HA E2E result
-    needs: [pr_metadata, kubernetes-ha-e2e]
+    needs: [pr_metadata, build-binaries-macos, kubernetes-ha-e2e]
     if: always() && needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_kubernetes_ha_e2e == 'true'
     runs-on: ubuntu-latest
     steps:
@@ -617,7 +681,7 @@ jobs:
 
   kubernetes-credential-drivers-e2e-result:
     name: Kubernetes Credential Drivers E2E result
-    needs: [pr_metadata, kubernetes-credential-drivers-e2e]
+    needs: [pr_metadata, build-binaries-macos, kubernetes-credential-drivers-e2e]
     if: always() && needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_kubernetes_credential_drivers_e2e == 'true'
     runs-on: ubuntu-latest
     steps: