OpenShell/.github/workflows/e2e-test.yml

name: E2E Test

on:
  workflow_call:
    inputs:
      image-tag:
        description: "Image tag to test (typically the commit SHA)"
        required: true
        type: string
      runner:
        description: "GitHub Actions runner label"
        required: false
        type: string
        default: "linux-amd64-cpu8"
      checkout-ref:
        description: "Git ref to check out for test inputs (defaults to the workflow SHA)"
        required: false
        type: string
        default: ""

permissions:
  contents: read
  packages: read

jobs:
  e2e:
    name: "E2E (${{ matrix.suite }})"
    runs-on: ${{ inputs.runner }}
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        include:
          - suite: python
            cmd: "mise run --no-deps --skip-deps e2e:python"
            apt_packages: ""
          - suite: rust-docker
            cmd: "mise run --no-deps --skip-deps e2e:rust"
            apt_packages: "openssh-client"
          - suite: rust-podman
            cmd: "mise run --no-deps --skip-deps e2e:podman"
            apt_packages: "openssh-client podman"
          - suite: rust-podman-rootless
            cmd: "mise run --no-deps --skip-deps e2e:podman:rootless"
            apt_packages: "openssh-client podman uidmap"
            rootless: true
    container:
      image: ghcr.io/nvidia/openshell/ci:latest
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
      options: --privileged
      volumes:
        - /var/run/docker.sock:/var/run/docker.sock
        - /home/runner/_work:/home/runner/_work
    env:
      MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      IMAGE_TAG: ${{ inputs.image-tag }}
      OPENSHELL_REGISTRY: ghcr.io/nvidia/openshell
      OPENSHELL_REGISTRY_HOST: ghcr.io
      OPENSHELL_REGISTRY_NAMESPACE: nvidia/openshell
      OPENSHELL_REGISTRY_USERNAME: ${{ github.actor }}
      OPENSHELL_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ inputs['checkout-ref'] || github.sha }}

      - name: Install OS test dependencies
        if: matrix.apt_packages != ''
        env:
          APT_PACKAGES: ${{ matrix.apt_packages }}
        run: apt-get update && apt-get install -y ${APT_PACKAGES} && rm -rf /var/lib/apt/lists/*

      - name: Log in to GHCR with Docker
        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin

      - name: Log in to GHCR with Podman
        if: startsWith(matrix.suite, 'rust-podman')
        run: echo "${{ secrets.GITHUB_TOKEN }}" | podman login ghcr.io -u "${{ github.actor }}" --password-stdin

      - name: Set up rootless Podman user
        if: matrix.rootless
        run: |
          useradd -m openshell-test
          echo "openshell-test:100000:65536" >> /etc/subuid
          echo "openshell-test:100000:65536" >> /etc/subgid
          mkdir -p "/run/user/$(id -u openshell-test)"
          chown openshell-test: "/run/user/$(id -u openshell-test)"
          chmod 700 "/run/user/$(id -u openshell-test)"
          chown -R openshell-test: .
          mkdir -p /home/openshell-test/.cache/mise /home/openshell-test/.cargo /home/openshell-test/.local/state/mise
          chown -R openshell-test: /home/openshell-test/.cache /home/openshell-test/.cargo /home/openshell-test/.local
          install -m 0755 "$(command -v mise)" /usr/local/bin/mise
          chmod a+x /root /root/.local /root/.local/bin
          for dir in /root/.cargo /root/.rustup /root/.local/share/mise /opt/mise; do
            [ -d "$dir" ] && chmod -R a+rX "$dir"
          done

      - name: Install Python dependencies and generate protobuf stubs
        if: matrix.suite == 'python'
        run: uv sync --frozen && mise run --no-deps python:proto

      - name: Run tests
        env:
          OPENSHELL_SUPERVISOR_IMAGE: ${{ format('ghcr.io/nvidia/openshell/supervisor:{0}', inputs.image-tag) }}
          E2E_CMD: ${{ matrix.cmd }}
        run: |
          if [ "${{ matrix.rootless }}" = "true" ]; then
            TESTUID="$(id -u openshell-test)"
            runuser -u openshell-test -- env \
              XDG_RUNTIME_DIR="/run/user/${TESTUID}" \
              HOME="/home/openshell-test" \
              PATH="/usr/local/bin:/root/.cargo/bin:/opt/mise/shims:/root/.local/bin:${PATH}" \
              CARGO_HOME="/home/openshell-test/.cargo" \
              RUSTUP_HOME="/root/.rustup" \
              MISE_DATA_DIR="/opt/mise" \
              MISE_CACHE_DIR="/home/openshell-test/.cache/mise" \
              MISE_STATE_DIR="/home/openshell-test/.local/state/mise" \
              OPENSHELL_SUPERVISOR_IMAGE="${OPENSHELL_SUPERVISOR_IMAGE}" \
              OPENSHELL_REGISTRY="${OPENSHELL_REGISTRY}" \
              OPENSHELL_REGISTRY_HOST="${OPENSHELL_REGISTRY_HOST}" \
              OPENSHELL_REGISTRY_USERNAME="${OPENSHELL_REGISTRY_USERNAME}" \
              OPENSHELL_REGISTRY_PASSWORD="${OPENSHELL_REGISTRY_PASSWORD}" \
              IMAGE_TAG="${IMAGE_TAG}" \
              MISE_GITHUB_TOKEN="${MISE_GITHUB_TOKEN}" \
              bash -c "${E2E_CMD}"
          else
            ${E2E_CMD}
          fi