Skip to content

ci(e2e): build the tmachine suite bundles once per run - #5432

Merged
elezar merged 2 commits into
mainfrom
ci/5429-e2e-row-timings/matthewgrossman
Nov 10, 2026
Merged

elezar merged 2 commits into
mainfrom
ci/5429-e2e-row-timings/matthewgrossman

Conversation

@matthewgrossman

@matthewgrossman matthewgrossman commented Nov 9, 2026 •

Copy link
Copy Markdown
Member

Summary

Every features and drivers row of the tmachine E2E suites built testkit-ready and its family's tests before it booted the VM. That took about 167s per row. Branch E2E now builds those test bundles once per run, and the rows download them and run them.

Related Issue

Closes #5429

Changes

  • openshell-test-runner now has two subcommands:
    • build --family F --out DIR writes a family's bundle to a directory. The bundle holds the nextest archive, testkit-ready, the workspace manifests and a bundle.json.
    • run ... [--bundle DIR | --program PATH] runs it. With --bundle, --package becomes a nextest filter on the prebuilt bundle.
  • New build-e2e-bundles job in branch-e2e.yml. It runs off the critical path, after pr_metadata only. It builds the features and drivers/podman bundles for x86_64-unknown-linux-musl with line-table debuginfo: about 108 MB per bundle instead of 348 MB, and backtraces keep their line numbers.
  • build-e2e-bundles restores a Rust target cache. A new e2e-bundles job in rust-cache.yml saves it on main, because Branch E2E never runs there.
  • In e2e-suites.yml, prebuilt-conformance is renamed to prebuilt. Conformance rows still run openshell-conformance, and the other rows run their family's bundle. Release workflows don't pass prebuilt, so they still build inline.
  • Docs now use run, and describe build and --bundle.

Timings

Before: run 42707934133. After: run 42720815711. Each cell shows the job time and the "Run the suites" step time.

Row Before After
features/host-gateway, fedora-podman-rootful 6m24s / 342s 3m52s / 185s
features/host-gateway, fedora-podman-rootless 7m14s / 346s 4m03s / 203s
features/host-gateway, ubuntu-docker-rootful 5m26s / 248s 4m23s / 203s
features/host-gateway, ubuntu-k3s 11m01s / 525s 5m01s / 269s
features/host-gateway, ubuntu-k3s-ha 11m10s / 524s 5m47s / 315s
features/oci-image, fedora-podman-rootful 7m06s / 385s 4m34s / 222s
features/oci-image, fedora-podman-rootless 5m43s / 289s 4m57s / 222s
features/oci-image, ubuntu-docker-rootful 6m17s / 281s 3m58s / 189s
features/keycloak-provider-refresh, fedora-podman-rootful 9m41s / 345s 5m04s / 263s
features/keycloak-provider-refresh, fedora-podman-rootless 8m40s / 319s 5m07s / 263s
features/keycloak-provider-refresh, ubuntu-docker-rootful 6m35s / 347s 6m46s / 190s
drivers/podman (8 rows) 6m11s–8m44s / 292–397s 3m37s–4m15s / 169–213s

Phases of the features/host-gateway, fedora-podman-rootful step:

Phase Before After
Nix download ~65s ~49s
Build testkit-ready and the tests 167s 0s (bundle download: 2s)
VM layers and install 93s 120s, of which ~44s rebuilt the cached base layers (see below)
Tests 11s 9s

This PR edits a comment in tests/tmachine/config.nix, which the tmachine disk cache key hashes. So every row in the after run missed that cache once and rebuilt its base layers (~40s). That miss also makes the conformance rows slightly slower in this run, although this PR doesn't change them. Later runs restore the cache, so a Podman features row should take about 3m10s.

build-e2e-bundles took 2m40s with no Rust cache and finished 12 minutes before the rows started. It isn't on the critical path.

The Nix download (~50s per row) is handled in #5433.

Testing

  • tests/runner: cargo test (17 pass), clippy -D warnings, fmt --check
  • Local openshell-test-runner build --family features (aarch64 musl)
  • actionlint on the changed workflows. zizmor reports one existing finding in e2e-suites.yml from main.
  • Branch E2E passes, every features and drivers row included, with the prebuilt bundles (run 42720815711)

Checklist

  • Follows Conventional Commits
  • Commits are signed off (DCO)

The features and drivers rows each built testkit-ready and their family's
tests before booting the VM, about three minutes per row. Branch E2E now
builds the bundles once, and the rows run the downloaded bundle.

openshell-test-runner gains build and run subcommands. build writes a
family's bundle to a directory; run --bundle runs it, and --package
selects the tests to run from it.

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
@matthewgrossman matthewgrossman added the test:e2e Requires end-to-end coverage label Nov 9, 2026
@matthewgrossman

Copy link
Copy Markdown
Member Author

/ok to test c0263e4

@github-actions

github-actions Bot commented Nov 9, 2026

Copy link
Copy Markdown

Label test:e2e applied for c0263e4. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

@github-actions

github-actions Bot commented Nov 9, 2026

Copy link
Copy Markdown

Compatibility review (advisory)

New or updated breaking changes; see the full report for all findings.

1. cli — No explicit risk acceptance found

nix run .#openshell-test-runner -- --environment ubuntu-docker-rootful --installer deb --family conformance now requires nix run .#openshell-test-runner -- run --environment ubuntu-docker-rootful --installer deb --family conformance.

  • Impact: Existing contributor scripts and saved commands using the documented flag-only invocation exit with a usage error (status 2) before starting a VM or producing test results.
  • Action: Preserve the flag-only invocation as an alias for run on v0.1.8; the documented migration alone cannot satisfy this patch train's prohibition on Stable interface breaks.
  • PR: ci(e2e): build the tmachine suite bundles once per run #5432
Review details
  • Execution: complete
  • Candidate: PR #5432 (550b7344a0c0617de61a6f532316c0288ea2720f)
  • Baseline: 9cf85f9f344e269434daad78bfe52e71ed4a5394 (9cf85f9f344e269434daad78bfe52e71ed4a5394)
  • Reviewed: rust-sdk, python-sdk, go-sdk, typescript-sdk, api-behavior, cli, configuration, policy, helm, state

Advisory review; publication gates are unchanged.

Branch check run

build-e2e-bundles restores a Rust target cache, and Rust Cache saves it
on main, where Branch E2E never runs.

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
@matthewgrossman

Copy link
Copy Markdown
Member Author

/ok to test 1cecef4

Comment thread TESTING.md Resolved

@elezar elezar left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

@elezar
elezar enabled auto-merge November 10, 2026 07:28
@elezar
elezar added this pull request to the merge queue Nov 10, 2026
Merged via the queue into main with commit 9524011 Nov 10, 2026
153 of 154 checks passed
@elezar
elezar deleted the ci/5429-e2e-row-timings/matthewgrossman branch November 10, 2026 07:48
@elezar

elezar commented Nov 10, 2026

Copy link
Copy Markdown
Member

Note that the compatibility concern is non-blocking since this tooling is internal only and there are no external consumers.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

test:e2e Requires end-to-end coverage

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ci(e2e): cut tmachine E2E suite row setup time

2 participants