[pimlock]

Summary

Adds the E2E lane: the SDK's tests from core's e2e/python now run here against the published gateway of the pinned core version (v0.1.7). The workflow and gateway scripts are ported from sdk-go, so a core bump PR (#5) can run the same check with its proposed version.

Stacked on #3; review that first. This PR retargets to main when #3 merges.

Related Issue

Closes #6. Part of NVIDIA/OpenShell#5287.

Changes

• Suite (tests/e2e/): sandbox_api, workspace_api, sandbox_exec_python and exec_admission from core at v0.1.7, renamed to this repository's *_test.py pattern. The only change is one ruff reformat.

  • conftest.py keeps only the fixtures these tests use. It skips every test when OPENSHELL_GATEWAY isn't set.
  • The tests still call client._stub where the curated API has no wrapper: interactive exec, start and stop, UpdateConfig, and request IDs on create, delete and exec.

• Sandbox image: tests/e2e/Dockerfile.workload is a copy of core's. mise run e2e:image builds it with the Python version from .python-version and adds cloudpickle, which exec_python needs. conformance:check also fails when this copy drifts from core at the pin.

• Tasks:

  • mise run e2e runs the suite against OPENSHELL_GATEWAY.
  • mise run test ignores tests/e2e.

• Gateway scripts (scripts/e2e/start-gateway.sh, stop-gateway.sh): copied from sdk-go's hack/automation/ with these changes:

  • start-gateway.sh adds --default-image, which sets the gateway's default sandbox image to the E2E image.
  • stop-gateway.sh removes sandbox containers by core's openshell.ai/managed-by and openshell.ai/sandbox-namespace labels. sdk-go filters on openshell.sandbox_namespace, which core doesn't set, so it misses them.
  • stop-gateway.sh exits nonzero with diagnostics when a cleanup step fails, instead of always reporting success.

  ci: shared CI checks across the SDK repositories #11 tracks sharing them and one script layout across the SDK repositories.

• Workflows:

  • e2e.yml is reusable and can also be started by hand, as in sdk-go. Its core-version input defaults to OPENSHELL_CORE_REF.
  • ci.yml runs it on every PR and push to main. Unlike sdk-go, there's no path filter: almost every PR here touches the SDK, its pins or its tests, so we can add one later if E2E turns out slow or flaky. As in sdk-go, it isn't part of the required ci check.

• README: explains how to run the suite locally.

Not in this PR:

• OIDC tests (oidc/oidc_auth_test.py): they need Keycloak and get their own follow-up issue.
• Switching core's e2e/python to the remaining enforcement suites: chore(python): migrate the Python SDK to ai-openshell/sdk-python NVIDIA/OpenShell#5287 tracks that.

Testing

• mise run e2e against start-gateway.sh v0.1.7 --default-image openshell/e2e-python:dev on a local Docker host: 20 passed.
• stop-gateway.sh removed the gateway and the sandboxes it created.
• stop-gateway.sh against a stubbed docker: exits 1 with a message when saving the log, listing or removing containers, or compose down fails, and 0 when all succeed.
• Without OPENSHELL_GATEWAY, pytest tests/e2e skips all 20.
• mise run test (240 passed, E2E not collected) and mise run check pass.
• actionlint and zizmor on the workflows. zizmor's only finding is the low-severity self-repository note, which sdk-go's ci.yml also has.
• e2e.yml on GitHub: 20 passed against v0.1.7 in this PR's CI run.

[SDAChess]

Two teardown issues need fixing. The existing GitHub E2E run passed all 20 tests; review validation also covered shell syntax, E2E lint, imported-file parity, unit-test collection, skip behavior, and stubbed Docker failure paths. Live E2E was unavailable locally because Docker socket access was denied.

[pimlock]

@SDAChess Thanks! FYI these scripts were copied from the sdk-go for now. I also started tracking these shared pieces in #11

I will fix your comments here, but the same fix should be applied to sdk-go (I will do that), until we can share these.

The merge-base changed after approval.