ci(integration): split input preparation from runners

Signed-off-by: Evan Lezar <elezar@nvidia.com>

Author: elezar

.github/workflows/branch-e2e.yml

@@ -23,6 +23,7 @@ jobs:
       pull-requests: read
     outputs:
       should_run: ${{ steps.gate.outputs.should_run }}
+      run_integration: ${{ steps.labels.outputs.run_core_e2e }}
       run_core_e2e: ${{ steps.labels.outputs.run_core_e2e }}
       run_gpu_e2e: ${{ steps.labels.outputs.run_gpu_e2e }}
       run_kubernetes_ha_e2e: ${{ steps.labels.outputs.run_kubernetes_ha_e2e }}
@@ -199,40 +200,82 @@ jobs:
       packages: write
     uses: ./.github/workflows/build-images.yml
 
-  docker-e2e:
+  prepare-integration:
     needs: [pr_metadata, build-binaries, build-images]
-    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
+    if: needs.pr_metadata.outputs.run_integration == 'true'
     permissions:
       actions: read
       contents: read
       packages: read
-    uses: ./.github/workflows/e2e-docker-test.yml
+    uses: ./.github/workflows/prepare-integration-inputs.yml
+
+  # Run driver-independent conformance tests.
+  conformance-integration:
+    needs: prepare-integration
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+    uses: ./.github/workflows/integration-runner.yml
     with:
-      image-tag: ${{ github.sha }}
-      runner: linux-arm64-cpu8
-      conformance-artifact-prefix: openshell-conformance
+      category: conformance
+      source-sha: ${{ needs.prepare-integration.outputs.source_sha }}
+      integration-inputs-artifact-id: ${{ needs.prepare-integration.outputs.integration_inputs_artifact_id }}
+      test-matrix: >-
+        [
+          {"scenario":"ubuntu-docker-rootful","testsuite":"conformance"},
+          {"scenario":"fedora-podman-rootful","testsuite":"conformance"},
+          {"scenario":"fedora-podman-rootless","testsuite":"conformance"}
+        ]
 
-  podman-e2e:
-    needs: [pr_metadata, build-binaries, build-images]
-    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
+  # Run feature-specific integration tests:
+  feature-specific-integration:
+    needs: prepare-integration
     permissions:
       actions: read
       contents: read
       packages: read
-    uses: ./.github/workflows/tmachine-test.yml
+    uses: ./.github/workflows/integration-runner.yml
     with:
+      category: feature-specific
+      source-sha: ${{ needs.prepare-integration.outputs.source_sha }}
+      integration-inputs-artifact-id: ${{ needs.prepare-integration.outputs.integration_inputs_artifact_id }}
       test-matrix: >-
         [
-          {
-            "scenario":"fedora-podman-rootful",
-            "testsuite":"conformance"
-          },
-          {
-            "scenario":"fedora-podman-rootful",
-            "testsuite":"provider-refresh"
-          }
+          {"scenario":"fedora-podman-rootful","testsuite":"provider-refresh"},
+          {"scenario":"fedora-podman-rootless","testsuite":"provider-refresh"}
         ]
 
+  # Run driver-specific integration tests:
+  # TODO: This should be added as soon as we have driver-specific tests enabled in tmachine.
+  # driver-specific:
+  #   needs: prepare-integration
+  #   permissions:
+  #     actions: read
+  #     contents: read
+  #     packages: read
+  #   uses: ./.github/workflows/integration-runner.yml
+  #   with:
+  #     category: driver-specific
+  #     source-sha: ${{ needs.prepare-integration.outputs.source_sha }}
+  #     integration-inputs-artifact-id: ${{ needs.prepare-integration.outputs.integration_inputs_artifact_id }}
+  #     test-matrix: >-
+  #       [
+  #       ]
+
+  docker-e2e:
+    needs: [pr_metadata, build-binaries, build-images]
+    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+    uses: ./.github/workflows/e2e-docker-test.yml
+    with:
+      image-tag: ${{ github.sha }}
+      runner: linux-arm64-cpu8
+      conformance-artifact-prefix: openshell-conformance
+
   vm-e2e:
     needs: [pr_metadata, build-binaries, build-vm-driver]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
@@ -401,7 +444,19 @@ jobs:
 
   core-e2e-result:
     name: Core E2E result
-    needs: [pr_metadata, docker-e2e, podman-e2e, vm-e2e, docker-external-driver-e2e, podman-external-driver-e2e, vm-external-driver-e2e, kubernetes-e2e, kubernetes-external-driver-e2e, kubernetes-workspace-managed-e2e, kubernetes-workspace-operator-e2e]
+    needs:
+      - pr_metadata
+      - conformance-integration
+      - feature-specific-integration
+      - docker-e2e
+      - vm-e2e
+      - docker-external-driver-e2e
+      - podman-external-driver-e2e
+      - vm-external-driver-e2e
+      - kubernetes-e2e
+      - kubernetes-external-driver-e2e
+      - kubernetes-workspace-managed-e2e
+      - kubernetes-workspace-operator-e2e
     if: always() && needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     runs-on: ubuntu-latest
     steps:

.github/workflows/integration-runner.yml

@@ -0,0 +1,85 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Integration Test Runner
+
+on:
+  workflow_call:
+    inputs:
+      source-sha:
+        description: Source revision of the prepared candidate artifacts
+        required: true
+        type: string
+      integration-inputs-artifact-id:
+        description: Immutable ID of the prepared integration inputs artifact
+        required: true
+        type: string
+      category:
+        description: Integration-test category, used for the job name and concurrency key
+        required: false
+        type: string
+      test-matrix:
+        description: JSON array of scenario and testsuite combinations
+        required: false
+        type: string
+        default: >-
+          [
+            {"scenario":"ubuntu-docker-rootful","testsuite":"conformance"},
+            {"scenario":"fedora-podman-rootful","testsuite":"conformance"},
+            {"scenario":"fedora-podman-rootless","testsuite":"conformance"}
+          ]
+
+permissions:
+  actions: read
+  contents: read
+  packages: read
+
+concurrency:
+  group: ${{ github.workflow }}-integration-${{ inputs.category }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  integration:
+    name: Integration test (${{ inputs.category }}, ${{ matrix.scenario }}, ${{ matrix.testsuite }})
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJSON(inputs['test-matrix']) }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs['source-sha'] }}
+          persist-credentials: false
+
+      - name: Enable KVM access
+        run: |
+          set -euo pipefail
+          if [[ ! -c /dev/kvm ]]; then
+            echo "::error::The runner did not expose /dev/kvm"
+            exit 1
+          fi
+          sudo chmod 0666 /dev/kvm
+          exec 3<>/dev/kvm
+          exec 3>&-
+
+      - uses: ./.github/actions/setup-nix
+
+      - name: Cache tmachine disks
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        with:
+          path: ~/.cache/tmachine
+          key: tmachine-${{ runner.os }}-${{ runner.arch }}
+
+      - name: Download integration inputs
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          artifact-ids: ${{ inputs['integration-inputs-artifact-id'] }}
+          path: artifacts
+
+      - name: Run test suite
+        env:
+          SCENARIO: ${{ matrix.scenario }}
+          TESTSUITE: ${{ matrix.testsuite }}
+        run: nix run .#tmachine -- test "${SCENARIO}" "${TESTSUITE}"

.github/workflows/integration-test.yml

@@ -0,0 +1,48 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Integration Tests
+
+on:
+  workflow_dispatch:
+    inputs:
+      artifact-run-id:
+        description: Workflow run containing the candidate artifacts
+        required: false
+        type: string
+        default: ""
+      category:
+        description: Integration-test category, used for the job name and concurrency key
+        required: true
+        type: string
+        default: conformance
+      test-matrix:
+        description: JSON array of scenario and testsuite combinations
+        required: true
+        type: string
+        default: >-
+          [
+            {"scenario":"ubuntu-docker-rootful","testsuite":"conformance"},
+            {"scenario":"fedora-podman-rootful","testsuite":"conformance"},
+            {"scenario":"fedora-podman-rootless","testsuite":"conformance"}
+          ]
+
+permissions:
+  actions: read
+  contents: read
+  packages: read
+
+jobs:
+  prepare:
+    uses: ./.github/workflows/prepare-integration-inputs.yml
+    with:
+      artifact-run-id: ${{ inputs['artifact-run-id'] }}
+
+  integration:
+    needs: prepare
+    uses: ./.github/workflows/integration-runner.yml
+    with:
+      category: ${{ inputs.category }}
+      source-sha: ${{ needs.prepare.outputs.source_sha }}
+      integration-inputs-artifact-id: ${{ needs.prepare.outputs.integration_inputs_artifact_id }}
+      test-matrix: ${{ inputs.test-matrix }}

.github/workflows/tmachine-test.yml …workflows/prepare-integration-inputs.yml.github/workflows/tmachine-test.yml renamed to .github/workflows/prepare-integration-inputs.yml .github/workflows/tmachine-test.yml renamed to .github/workflows/prepare-integration-inputs.yml

@@ -1,7 +1,7 @@
 # SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 
-name: Tmachine Tests
+name: Prepare Integration Inputs
 
 on:
   workflow_call:
@@ -11,50 +11,27 @@ on:
         required: false
         type: string
         default: ""
-      test-matrix:
-        description: JSON array of scenario and testsuite combinations
-        required: false
-        type: string
-        default: >-
-          [
-            {"scenario":"ubuntu-docker-rootful","testsuite":"conformance"},
-            {"scenario":"fedora-podman-rootful","testsuite":"conformance"},
-            {"scenario":"fedora-podman-rootless","testsuite":"conformance"}
-          ]
-  workflow_dispatch:
-    inputs:
-      artifact-run-id:
-        description: Workflow run containing the candidate artifacts
-        required: false
-        type: string
-        default: ""
-      test-matrix:
-        description: JSON array of scenario and testsuite combinations
-        required: false
-        type: string
-        default: >-
-          [
-            {"scenario":"ubuntu-docker-rootful","testsuite":"conformance"},
-            {"scenario":"fedora-podman-rootful","testsuite":"conformance"},
-            {"scenario":"fedora-podman-rootless","testsuite":"conformance"}
-          ]
+    outputs:
+      source_sha:
+        description: Source revision of the candidate artifacts
+        value: ${{ jobs.prepare.outputs.source_sha }}
+      integration_inputs_artifact_id:
+        description: Immutable ID of the prepared integration inputs artifact
+        value: ${{ jobs.prepare.outputs.integration_inputs_artifact_id }}
 
 permissions:
   actions: read
   contents: read
   packages: read
 
-concurrency:
-  group: ${{ github.workflow }}-conformance-${{ github.ref }}
-  cancel-in-progress: true
-
 jobs:
   prepare:
     name: Prepare tmachine inputs
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     outputs:
       source_sha: ${{ steps.artifact-run.outputs.source_sha }}
+      integration_inputs_artifact_id: ${{ steps.upload-integration-inputs.outputs.artifact-id }}
     steps:
       - name: Resolve artifact run
         id: artifact-run
@@ -108,57 +85,12 @@ jobs:
       - name: Build test archives
         run: nix run .#build-artifacts-test-archives
 
-      - name: Upload tmachine inputs
+      - name: Upload integration inputs
+        id: upload-integration-inputs
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: openshell-tmachine-inputs
           path: artifacts
           compression-level: 0
           retention-days: 5
           if-no-files-found: error
-
-  tmachine:
-    name: Tmachine (${{ matrix.scenario }}, ${{ matrix.testsuite }})
-    needs: prepare
-    strategy:
-      fail-fast: false
-      matrix:
-        include: ${{ fromJSON(inputs['test-matrix']) }}
-    runs-on: ubuntu-24.04
-    timeout-minutes: 90
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ needs.prepare.outputs.source_sha }}
-          persist-credentials: false
-
-      - name: Enable KVM access
-        run: |
-          set -euo pipefail
-          if [[ ! -c /dev/kvm ]]; then
-            echo "::error::The runner did not expose /dev/kvm"
-            exit 1
-          fi
-          sudo chmod 0666 /dev/kvm
-          exec 3<>/dev/kvm
-          exec 3>&-
-
-      - uses: ./.github/actions/setup-nix
-
-      - name: Cache tmachine disks
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
-        with:
-          path: ~/.cache/tmachine
-          key: tmachine-${{ runner.os }}-${{ runner.arch }}
-
-      - name: Download tmachine inputs
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: openshell-tmachine-inputs
-          path: artifacts
-
-      - name: Run tmachine suite
-        env:
-          SCENARIO: ${{ matrix.scenario }}
-          TESTSUITE: ${{ matrix.testsuite }}
-        run: nix run .#tmachine -- test "${SCENARIO}" "${TESTSUITE}"