From 48b2996a1d7494dd98b9bf37cbbce53191aaeb3e Mon Sep 17 00:00:00 2001
From: Matthew Grossman <mgrossman@nvidia.com>
Date: Mon, 9 Nov 2026 14:00:40 -0800
Subject: [PATCH] ci(e2e): trim the host Podman lane to tests tmachine can't
 run yet

The rust-podman-ci lane ran conformance and 23 e2e/rust binaries. The
tmachine e2e-podman row already runs 17 of those binaries, and the
tmachine Podman conformance rows run the same conformance tests.

Keep only the six binaries no other lane covers: the five wrapper-lane
entries in podmanE2eFollowUpBinaries, plus otlp_relay, whose collector
cases need the OTLP endpoint the wrapper configures. Skip conformance
for the ci set and drop the lane's build-conformance dependency.

Closes #5423

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
---
 .github/workflows/branch-e2e.yml |  5 +++--
 e2e/rust/e2e-podman.sh           | 31 ++++++++++---------------------
 tasks/test.toml                  |  2 +-
 tests/tmachine/artifacts.nix     |  5 +++--
 4 files changed, 17 insertions(+), 26 deletions(-)

diff --git a/.github/workflows/branch-e2e.yml b/.github/workflows/branch-e2e.yml
index fa23b89dac..38b4432f7c 100644
--- a/.github/workflows/branch-e2e.yml
+++ b/.github/workflows/branch-e2e.yml
@@ -373,8 +373,10 @@ jobs:
       image-tag: ${{ github.sha }}
       runner: linux-arm64-cpu8
 
+  # Runs only the Podman e2e/rust targets that podman-e2e-integration can't run
+  # yet; see PODMAN_CI_TESTS in e2e/rust/e2e-podman.sh.
   podman-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-images]
+    needs: [pr_metadata, build-binaries, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -382,7 +384,6 @@ jobs:
       packages: read
     uses: ./.github/workflows/e2e-podman-test.yml
     with:
-      prebuilt-conformance: true
       image-tag: ${{ github.sha }}
       suite-matrix: >-
         [{"suite":"ci","runner":"ubuntu-26.04","podman_major":"5","podman_package_version":"5.7.0+ds2-3build1","conmon_package_version":"2.1.13+ds1-2","cmd":"mise run --no-deps --skip-deps e2e:podman:ci"}]
diff --git a/e2e/rust/e2e-podman.sh b/e2e/rust/e2e-podman.sh
index 0d6cd5008c..41439a50b6 100755
--- a/e2e/rust/e2e-podman.sh
+++ b/e2e/rust/e2e-podman.sh
@@ -18,33 +18,19 @@ RUN_WITH_GATEWAY_COMMAND="__openshell_run_podman_e2e"
 # shellcheck source=e2e/support/conformance.sh
 source "${ROOT}/e2e/support/conformance.sh"
 
-# Keep required branch CI on the Podman targets that are known to pass. The
-# unfiltered e2e:podman task remains available while the omitted targets are
-# stabilized and can be added here.
+# Required branch CI runs only the Podman targets that the tmachine e2e-podman
+# testsuite can't run yet (see podmanE2eFollowUpBinaries in
+# tests/tmachine/artifacts.nix), plus otlp_relay, whose collector cases need the
+# OTLP endpoint this script configures. tmachine runs the rest of the Podman
+# targets and the conformance suite. Remove each target here once it moves to
+# testkit (#5297).
 PODMAN_CI_TESTS=(
-  bypass_detection
-  ephemeral_cleanup
-  core_dump_hardening
-  credential_gating
-  default_image
   driver_config_volume
-  edge_tunnel_e2e
-  forward_proxy_graphql_l7
-  forward_proxy_jsonrpc_l7
-  forward_proxy_l7_bypass
-  host_gateway_alias
-  landlock
-  live_policy_update
   local_driver_token_restart
-  no_proxy
-  ocsf_jsonl_conformance
   otlp_relay
   podman_corporate_proxy
   podman_gateway_start
-  podman_host_gateway
-  podman_oci_identity
   provider_token_exchange
-  upload_backpressure
 )
 
 if [ -n "${E2E_TEST}" ] && [ -n "${E2E_TEST_SET}" ]; then
@@ -79,7 +65,10 @@ if [ "${E2E_TEST}" = "gpu" ] && [ -z "${OPENSHELL_E2E_WORKLOAD_MANIFEST:-}" ] &&
 fi
 
 if [ "${1:-}" = "${RUN_WITH_GATEWAY_COMMAND}" ]; then
-  e2e_run_openshell_conformance "Podman"
+  # The tmachine Podman rows already run conformance for the ci set.
+  if [ "${E2E_TEST_SET}" != "ci" ]; then
+    e2e_run_openshell_conformance "Podman"
+  fi
   if [ "${E2E_FEATURES}" = "e2e-conformance-only" ]; then
     echo "::notice::Skipping Rust e2e tests (e2e-conformance-only)"
     exit 0
diff --git a/tasks/test.toml b/tasks/test.toml
index 2839c1cf0c..afa21a2043 100644
--- a/tasks/test.toml
+++ b/tasks/test.toml
@@ -217,7 +217,7 @@ description = "Run Rust CLI e2e tests against a Podman-backed gateway"
 run = "e2e/rust/e2e-podman.sh"
 
 ["e2e:podman:ci"]
-description = "Run the Podman Rust e2e targets enabled in required branch CI"
+description = "Run the Podman Rust e2e targets that only the host Podman lane runs in required branch CI"
 run = "OPENSHELL_E2E_PODMAN_TEST_SET=ci e2e/rust/e2e-podman.sh"
 
 ["e2e:oidc-pkce"]
diff --git a/tests/tmachine/artifacts.nix b/tests/tmachine/artifacts.nix
index ef1be7ed98..9e6c53eb98 100644
--- a/tests/tmachine/artifacts.nix
+++ b/tests/tmachine/artifacts.nix
@@ -84,8 +84,9 @@ let
 
   # Follow-up: binaries that do not yet run in the rootless tmachine guest. Each
   # entry says what it needs. Entries marked "wrapper lane" still run in the
-  # wrapper-based Podman lane (`mise run e2e:podman:ci`), so they are covered
-  # there until tmachine provides what they need.
+  # wrapper-based Podman lane (`mise run e2e:podman:ci`), whose PODMAN_CI_TESTS
+  # list in e2e/rust/e2e-podman.sh keeps only those binaries plus otlp_relay.
+  # Update both lists together.
   podmanE2eFollowUpBinaries = [
     # Needs the caller driver-config settings (`allow_driver_config`,
     # `enable_bind_mounts`), which the tmachine gateway does not enable. Wrapper