ci: use package installers consistently in integration tests (#4056)

* test(tmachine): add Fedora RPM package installer

Signed-off-by: Evan Lezar <elezar@nvidia.com>

* ci: qualify Ubuntu branch installs with DEB packages

Signed-off-by: Evan Lezar <elezar@nvidia.com>

* ci: align package installers across integration matrices

Signed-off-by: Evan Lezar <elezar@nvidia.com>

---------

Signed-off-by: Evan Lezar <elezar@nvidia.com>

.github/workflows/branch-e2e.yml

@@ -89,6 +89,7 @@ jobs:
     timeout-minutes: 5
     outputs:
       cargo: ${{ steps.version.outputs.cargo }}
+      deb_version: ${{ steps.version.outputs.deb_version }}
       rpm_version: ${{ steps.version.outputs.rpm_version }}
       rpm_release: ${{ steps.version.outputs.rpm_release }}
     steps:
@@ -101,10 +102,12 @@ jobs:
         id: version
         run: |
           cargo="$(python3 tasks/scripts/release.py get-version --cargo)"
+          deb_version="$(python3 tasks/scripts/release.py get-version --dev --deb)"
           rpm_version="$(python3 tasks/scripts/release.py get-version --dev --rpm-version)"
           rpm_release="$(python3 tasks/scripts/release.py get-version --dev --rpm-release)"
           {
             echo "cargo=$cargo"
+            echo "deb_version=$deb_version"
             echo "rpm_version=$rpm_version"
             echo "rpm_release=$rpm_release"
           } >> "$GITHUB_OUTPUT"
@@ -208,6 +211,18 @@ jobs:
       packages: write
     uses: ./.github/workflows/build-images.yml
 
+  build-deb:
+    name: Build Debian packages
+    needs: [pr_metadata, version, build-binaries, build-vm-driver]
+    if: needs.pr_metadata.outputs.run_integration == 'true'
+    permissions:
+      contents: read
+      packages: read
+    uses: ./.github/workflows/deb-package.yml
+    with:
+      checkout-ref: ${{ github.sha }}
+      deb-version: ${{ needs.version.outputs.deb_version }}
+
   build-rpm:
     name: Build RPM packages
     needs: [pr_metadata, version, build-binaries]
@@ -223,7 +238,7 @@ jobs:
       cargo-version: ${{ needs.version.outputs.cargo }}
 
   prepare-integration:
-    needs: [pr_metadata, build-binaries, build-images, build-rpm]
+    needs: [pr_metadata, build-binaries, build-images, build-deb, build-rpm]
     if: needs.pr_metadata.outputs.run_integration == 'true'
     permissions:
       actions: read
@@ -231,6 +246,7 @@ jobs:
       packages: read
     uses: ./.github/workflows/prepare-integration-inputs.yml
     with:
+      deb-artifact-name: deb-linux-amd64
       rpm-artifact-name: rpm-linux-x86_64
 
   # Run driver-independent conformance tests.
@@ -247,7 +263,7 @@ jobs:
       integration-inputs-artifact-id: ${{ needs.prepare-integration.outputs.integration_inputs_artifact_id }}
       test-matrix: >-
         [
-          {"environment":"ubuntu-docker-rootful","installer":"binaries","testsuite":"conformance"},
+          {"environment":"ubuntu-docker-rootful","installer":"deb","testsuite":"conformance"},
           {"environment":"ubuntu-k3s","installer":"k3s","testsuite":"conformance"},
           {"environment":"fedora-podman-rootful","installer":"rpm","testsuite":"conformance"},
           {"environment":"fedora-podman-rootless","installer":"rpm","testsuite":"conformance"}
@@ -267,11 +283,13 @@ jobs:
       integration-inputs-artifact-id: ${{ needs.prepare-integration.outputs.integration_inputs_artifact_id }}
       test-matrix: >-
         [
-          {"environment":"fedora-podman-rootful","installer":"binaries","testsuite":"provider-refresh"},
+          {"environment":"fedora-podman-rootful","installer":"rpm","testsuite":"provider-refresh"},
-          {"environment":"fedora-podman-rootless","installer":"binaries","testsuite":"provider-refresh"}
+          {"environment":"fedora-podman-rootless","installer":"rpm","testsuite":"provider-refresh"}
         ]
 
   # Run driver-specific integration tests:
+  # These suites require the binary installer's CLI path, local HTTP gateway,
+  # and system service configuration for their Podman user-namespace fixtures.
   driver-specific-integration:
     needs: prepare-integration
     permissions:

.github/workflows/integration-runner.yml

@@ -26,8 +26,8 @@ on:
           [
             {"environment":"ubuntu-docker-rootful","installer":"deb","testsuite":"conformance"},
             {"environment":"ubuntu-k3s","installer":"k3s","testsuite":"conformance"},
-            {"environment":"fedora-podman-rootful","installer":"binaries","testsuite":"conformance"},
+            {"environment":"fedora-podman-rootful","installer":"rpm","testsuite":"conformance"},
-            {"environment":"fedora-podman-rootless","installer":"binaries","testsuite":"conformance"}
+            {"environment":"fedora-podman-rootless","installer":"rpm","testsuite":"conformance"}
           ]
 
 permissions:

.github/workflows/integration-test.yml

@@ -27,10 +27,10 @@ on:
         type: string
         default: >-
           [
-            {"environment":"ubuntu-docker-rootful","installer":"binaries","testsuite":"conformance"},
+            {"environment":"ubuntu-docker-rootful","installer":"deb","testsuite":"conformance"},
             {"environment":"ubuntu-k3s","installer":"k3s","testsuite":"conformance"},
-            {"environment":"fedora-podman-rootful","installer":"binaries","testsuite":"conformance"},
+            {"environment":"fedora-podman-rootful","installer":"rpm","testsuite":"conformance"},
-            {"environment":"fedora-podman-rootless","installer":"binaries","testsuite":"conformance"}
+            {"environment":"fedora-podman-rootless","installer":"rpm","testsuite":"conformance"}
           ]
 
 permissions:
@@ -44,6 +44,8 @@ jobs:
     with:
       artifact-run-id: ${{ inputs['artifact-run-id'] }}
       source-sha: ${{ inputs['source-sha'] }}
+      deb-artifact-name: ${{ contains(inputs.test-matrix, '"deb"') && 'deb-linux-amd64' || '' }}
+      rpm-artifact-name: ${{ contains(inputs.test-matrix, '"rpm"') && 'rpm-linux-x86_64' || '' }}
 
   integration:
     needs: prepare

.github/workflows/release-dev.yml

@@ -144,8 +144,8 @@ jobs:
       integration-inputs-artifact-id: ${{ needs.prepare-integration.outputs.integration_inputs_artifact_id }}
       test-matrix: >-
         [
-          {"environment":"fedora-podman-rootful","installer":"binaries","testsuite":"provider-refresh"},
+          {"environment":"fedora-podman-rootful","installer":"rpm","testsuite":"provider-refresh"},
-          {"environment":"fedora-podman-rootless","installer":"binaries","testsuite":"provider-refresh"}
+          {"environment":"fedora-podman-rootless","installer":"rpm","testsuite":"provider-refresh"}
         ]
 
   docker-e2e:

.github/workflows/release-tag.yml

@@ -195,8 +195,8 @@ jobs:
       integration-inputs-artifact-id: ${{ needs.prepare-integration.outputs.integration_inputs_artifact_id }}
       test-matrix: >-
         [
-          {"environment":"fedora-podman-rootful","installer":"binaries","testsuite":"provider-refresh"},
+          {"environment":"fedora-podman-rootful","installer":"rpm","testsuite":"provider-refresh"},
-          {"environment":"fedora-podman-rootless","installer":"binaries","testsuite":"provider-refresh"}
+          {"environment":"fedora-podman-rootless","installer":"rpm","testsuite":"provider-refresh"}
         ]
 
   docker-e2e:

CI.md

@@ -73,9 +73,14 @@ Main and manual runs also build release binaries, with `continue-on-error: true`
 so Windows failures do not fail the workflow.
 
 Every approved `Branch E2E Checks` run builds the RPM packages, including
-runs without optional E2E labels. Core integration qualification installs the
+runs without optional E2E labels. Core integration qualification builds and installs
-CLI and gateway RPMs on Fedora with rootful and rootless Podman and runs conformance using
+the DEB on Ubuntu with Docker and installs the CLI and gateway RPMs on Fedora with
-the matching runtime images. Release Dev and Release Tag run the same RPM lane.
+rootful and rootless Podman. These lanes run conformance using the matching runtime
+images. Release Dev and Release Tag use the same package installers.
+Fedora provider-refresh tests also use RPMs. The Podman driver-specific suites
+retain the binary installer because their fixtures configure its system service,
+local HTTP gateway, and CLI path. The manual Integration Tests workflow defaults
+to the package installers and downloads the packages selected by its matrix.
 
 Three opt-in labels enable the long-running E2E suites:
 

tests/ansible/playbooks/conformance/cli.yaml

@@ -90,11 +90,12 @@
       ansible.builtin.command:
         argv:
           - journalctl
-          - --unit
-          - openshell-gateway.service
           - --no-pager
           - --lines
           - "500"
+          - _SYSTEMD_UNIT=openshell-gateway.service
+          - "+"
+          - _SYSTEMD_USER_UNIT=openshell-gateway.service
       register: openshell_gateway_logs
       changed_when: false
       failed_when: false

tests/ansible/playbooks/features/provider-refresh/keycloak.yaml

@@ -88,11 +88,12 @@
       ansible.builtin.command:
         argv:
           - journalctl
-          - --unit
-          - openshell-gateway.service
           - --no-pager
           - --lines
           - "500"
+          - _SYSTEMD_UNIT=openshell-gateway.service
+          - "+"
+          - _SYSTEMD_USER_UNIT=openshell-gateway.service
       register: openshell_gateway_logs
       changed_when: false
       failed_when: false