ci(e2e): start Linux and tmachine jobs without waiting on macOS or package builds

.github/workflows/branch-e2e.yml

@@ -101,11 +101,21 @@ jobs:
             echo "rpm_release=$rpm_release"
           } >> "$GITHUB_OUTPUT"
 
-  build-binaries:
+  build-binaries-linux:
     needs: version
     permissions:
       contents: read
-    uses: ./.github/workflows/build-binaries.yml
+    uses: ./.github/workflows/build-binaries-linux.yml
+    with:
+      cargo-version: ${{ needs.version.outputs.cargo }}
+    secrets:
+      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
+  build-binaries-macos:
+    needs: version
+    permissions:
+      contents: read
+    uses: ./.github/workflows/build-binaries-macos.yml
     with:
       cargo-version: ${{ needs.version.outputs.cargo }}
     secrets:
@@ -146,7 +156,7 @@ jobs:
 
   # The conformance program, built once per architecture for the host lanes.
   # It lives in its own workspace and is not released, so it is not part of
-  # build-binaries.yml.
+  # build-binaries-linux.yml.
   build-conformance:
     name: openshell-conformance (${{ matrix.triple }})
     needs: [pr_metadata]
@@ -237,19 +247,30 @@ jobs:
           triple: ${{ matrix.triple }}
           cargo-version: ${{ needs.version.outputs.cargo }}
 
-  build-vm-driver:
-    needs: [pr_metadata, version, build-binaries]
+  build-vm-driver-linux:
+    needs: [pr_metadata, version, build-binaries-linux]
     if: needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       contents: read
-    uses: ./.github/workflows/build-vm-driver.yml
+    uses: ./.github/workflows/build-vm-driver-linux.yml
+    with:
+      cargo-version: ${{ needs.version.outputs.cargo }}
+    secrets:
+      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
+  build-vm-driver-macos:
+    needs: [pr_metadata, version, build-binaries-linux, build-binaries-macos]
+    if: needs.pr_metadata.outputs.run_core_e2e == 'true'
+    permissions:
+      contents: read
+    uses: ./.github/workflows/build-vm-driver-macos.yml
     with:
       cargo-version: ${{ needs.version.outputs.cargo }}
     secrets:
       CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
   build-images:
-    needs: [pr_metadata, build-binaries]
+    needs: [pr_metadata, build-binaries-linux]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_any_e2e == 'true'
     permissions:
       contents: read
@@ -258,7 +279,7 @@ jobs:
 
   build-deb:
     name: Build Debian packages
-    needs: [pr_metadata, version, build-binaries, build-vm-driver]
+    needs: [pr_metadata, version, build-binaries-linux, build-vm-driver-linux]
     if: needs.pr_metadata.outputs.run_integration == 'true'
     permissions:
       contents: read
@@ -270,7 +291,7 @@ jobs:
 
   build-rpm:
     name: Build RPM packages
-    needs: [pr_metadata, version, build-binaries]
+    needs: [pr_metadata, version, build-binaries-linux]
     if: needs.pr_metadata.outputs.run_integration == 'true'
     permissions:
       actions: read
@@ -282,8 +303,48 @@ jobs:
       rpm-release: ${{ needs.version.outputs.rpm_release }}
       cargo-version: ${{ needs.version.outputs.cargo }}
 
+  # Test inputs don't depend on the packages, so build them while the packages
+  # build instead of in prepare-integration.
+  build-tmachine-test-inputs:
+    name: Build tmachine test inputs
+    needs: [pr_metadata]
+    if: needs.pr_metadata.outputs.run_integration == 'true'
+    permissions:
+      contents: read
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          ref: ${{ github.sha }}
+      - uses: ./.github/actions/setup-nix
+      - name: Build test archives
+        run: |
+          # Retry dependency preparation, then generate artifacts once.
+          nix build --no-link .#build-artifacts-test-archives || nix build --no-link .#build-artifacts-test-archives
+          nix run .#build-artifacts-test-archives
+      - name: Build test workload images
+        run: |
+          # Retry dependency preparation, then generate artifacts once.
+          nix build --no-link .#build-artifacts-test-images || nix build --no-link .#build-artifacts-test-images
+          nix run .#build-artifacts-test-images
+      - name: Package Helm chart
+        run: |
+          # Retry dependency preparation, then generate artifacts once.
+          nix build --no-link .#build-artifacts-helm || nix build --no-link .#build-artifacts-helm
+          nix run .#build-artifacts-helm
+      - name: Upload tmachine test inputs
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: openshell-tmachine-test-inputs
+          path: artifacts
+          compression-level: 0
+          retention-days: 5
+          if-no-files-found: error
+
   prepare-integration:
-    needs: [pr_metadata, build-binaries, build-images, build-deb, build-rpm]
+    needs: [pr_metadata, build-binaries-linux, build-images, build-deb, build-rpm, build-tmachine-test-inputs]
     if: needs.pr_metadata.outputs.run_integration == 'true'
     permissions:
       actions: read
@@ -293,6 +354,7 @@ jobs:
     with:
       deb-artifact-name: deb-linux-amd64
       rpm-artifact-name: rpm-linux-x86_64
+      test-inputs-artifact-name: openshell-tmachine-test-inputs
 
   # Run driver-independent conformance tests.
   conformance-integration:
@@ -360,7 +422,7 @@ jobs:
         ]
 
   docker-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -373,7 +435,7 @@ jobs:
       runner: linux-arm64-cpu8
 
   podman-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -387,7 +449,7 @@ jobs:
         [{"suite":"ci","runner":"ubuntu-26.04","podman_major":"5","podman_package_version":"5.7.0+ds2-3build1","conmon_package_version":"2.1.13+ds1-2","cmd":"mise run --no-deps --skip-deps e2e:podman:ci"}]
 
   podman-additional-ca-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -401,7 +463,7 @@ jobs:
         [{"suite":"additional-ca","runner":"ubuntu-26.04","podman_major":"5","podman_package_version":"5.7.0+ds2-3build1","conmon_package_version":"2.1.13+ds1-2","cmd":"OPENSHELL_E2E_PODMAN_TEST=additional_ca mise run --no-deps --skip-deps e2e:podman"}]
 
   vm-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-vm-driver]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-vm-driver-linux]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -412,7 +474,7 @@ jobs:
       prebuilt-conformance: true
 
   vm-additional-ca-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-vm-driver]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-vm-driver-linux]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -425,7 +487,7 @@ jobs:
       test-name: additional_ca
 
   docker-external-driver-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-gateway-plain, build-external-drivers, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-gateway-plain, build-external-drivers, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -442,7 +504,7 @@ jobs:
         [{"suite":"external-driver","cmd":"mise run --no-deps --skip-deps e2e:docker:external-driver","apt_packages":"openssh-client","python_proto":false,"mcp":false}]
 
   podman-external-driver-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-gateway-plain, build-external-drivers, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-gateway-plain, build-external-drivers, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -458,7 +520,7 @@ jobs:
         [{"suite":"external-driver","runner":"ubuntu-26.04","podman_major":"5","podman_package_version":"5.7.0+ds2-3build1","conmon_package_version":"2.1.13+ds1-2","cmd":"mise run --no-deps --skip-deps e2e:podman:external-driver"}]
 
   vm-external-driver-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-gateway-plain, build-vm-driver]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-gateway-plain, build-vm-driver-linux]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -472,7 +534,7 @@ jobs:
       e2e-task: e2e:vm:external-driver
 
   gpu-e2e:
-    needs: [pr_metadata, build-binaries, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_gpu_e2e == 'true'
     permissions:
       actions: read
@@ -483,7 +545,7 @@ jobs:
       image-tag: ${{ github.sha }}
 
   kubernetes-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     strategy:
       fail-fast: false
@@ -514,7 +576,7 @@ jobs:
       test-name: ${{ matrix.test_name }}
 
   kubernetes-app-listener-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     strategy:
       fail-fast: false
@@ -552,7 +614,7 @@ jobs:
       listener-takeover: ${{ matrix.takeover }}
 
   kubernetes-workspace-managed-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -566,7 +628,7 @@ jobs:
       e2e-task: e2e:kubernetes:workspace-managed
 
   kubernetes-external-driver-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-gateway-plain, build-external-drivers, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-gateway-plain, build-external-drivers, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -583,7 +645,7 @@ jobs:
       cluster-images: sandbox supervisor
 
   kubernetes-workspace-operator-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -597,7 +659,7 @@ jobs:
       e2e-task: e2e:kubernetes:workspace-operator
 
   kubernetes-ha-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_kubernetes_ha_e2e == 'true'
     permissions:
       actions: read
@@ -615,7 +677,7 @@ jobs:
       use-envoy-gateway: true
 
   kubernetes-credential-drivers-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_kubernetes_credential_drivers_e2e == 'true'
     permissions:
       actions: read
@@ -632,6 +694,8 @@ jobs:
     name: Core E2E result
     needs:
       - pr_metadata
+      - build-binaries-macos
+      - build-vm-driver-macos
       - conformance-integration
       - feature-specific-integration
       - driver-specific-integration
@@ -661,7 +725,7 @@ jobs:
 
   gpu-e2e-result:
     name: GPU E2E result
-    needs: [pr_metadata, gpu-e2e]
+    needs: [pr_metadata, build-binaries-macos, gpu-e2e]
     if: always() && needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_gpu_e2e == 'true'
     runs-on: ubuntu-latest
     steps:
@@ -674,7 +738,7 @@ jobs:
 
   kubernetes-ha-e2e-result:
     name: Kubernetes HA E2E result
-    needs: [pr_metadata, kubernetes-ha-e2e]
+    needs: [pr_metadata, build-binaries-macos, kubernetes-ha-e2e]
     if: always() && needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_kubernetes_ha_e2e == 'true'
     runs-on: ubuntu-latest
     steps:
@@ -687,7 +751,7 @@ jobs:
 
   kubernetes-credential-drivers-e2e-result:
     name: Kubernetes Credential Drivers E2E result
-    needs: [pr_metadata, kubernetes-credential-drivers-e2e]
+    needs: [pr_metadata, build-binaries-macos, kubernetes-credential-drivers-e2e]
     if: always() && needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_kubernetes_credential_drivers_e2e == 'true'
     runs-on: ubuntu-latest
     steps:

.github/workflows/build-binaries.yml → .github/workflows/build-binaries-linux.yml

@@ -1,7 +1,7 @@
 # SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 
-name: Build Binaries
+name: Build Linux Binaries
 
 on:
   workflow_call:
@@ -40,8 +40,6 @@ jobs:
             runner: linux-amd64-cpu8
           - triple: aarch64-unknown-linux-musl
             runner: linux-arm64-cpu8
-          - triple: aarch64-apple-darwin
-            runner: macos-15-xlarge
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
     steps: &build_steps
@@ -74,8 +72,6 @@ jobs:
             runner: linux-amd64-cpu8
           - triple: aarch64-unknown-linux-musl
             runner: linux-arm64-cpu8
-          - triple: aarch64-apple-darwin
-            runner: macos-15-xlarge
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
     steps: *build_steps
@@ -92,8 +88,6 @@ jobs:
             runner: linux-amd64-cpu8
           - triple: aarch64-unknown-linux-gnu
             runner: linux-arm64-cpu8
-          - triple: aarch64-apple-darwin
-            runner: macos-15-xlarge
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
     steps: *build_steps
@@ -122,10 +116,6 @@ jobs:
             binary: openshell-supervisor
             triple: aarch64-unknown-linux-gnu
             runner: linux-arm64-cpu8
-          - package: openshell-supervisor
-            binary: openshell-supervisor
-            triple: aarch64-apple-darwin
-            runner: macos-15-xlarge
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
     steps: *build_steps