From 808aebb51356715e58fbc635361fd3531f4cdf3e Mon Sep 17 00:00:00 2001 From: Samuel K Date: Wed, 13 May 2026 13:23:37 -0500 Subject: [PATCH 1/2] ci: split test matrix into privileged and non-privileged groups Move tests with zero Docker dependency (context, ide, readconfiguration, extends, outdated, machine, machineprovider) into a new integration-tests-unprivileged job that runs without sudo. This reduces the sudo surface to only tests that actually require root for Docker operations. The job name pattern is preserved so branch protection status checks remain compatible. --- .github/workflows/pr-ci.yml | 96 ++++++++++++++++++++++++------------- 1 file changed, 63 insertions(+), 33 deletions(-) diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml index 2d9391091..409aefeae 100644 --- a/.github/workflows/pr-ci.yml +++ b/.github/workflows/pr-ci.yml @@ -119,39 +119,87 @@ jobs: name: devsy-${{ steps.os.outputs.runner_os }} path: dist/devsy-${{ steps.os.outputs.runner_os }}_*/devsy-${{ steps.os.outputs.runner_os }}-* - integration-tests: + integration-tests-unprivileged: name: Test ${{ matrix.label }} on ${{ matrix.runner }} - needs: [can-read-secret, build-cli] + needs: [build-cli] strategy: fail-fast: false matrix: include: - label: context runner: ubuntu-latest - free-disk-space: false - install-kind: false - requires-secret: false - label: ide runner: ubuntu-latest - free-disk-space: false - install-kind: false - requires-secret: false - - label: integration + - label: readconfiguration + runner: ubuntu-latest + + - label: extends + runner: ubuntu-latest + + - label: outdated runner: ubuntu-latest - free-disk-space: false - install-kind: false - requires-secret: false - label: machine runner: ubuntu-latest - free-disk-space: false - install-kind: false - requires-secret: false - label: machineprovider runner: ubuntu-latest + + runs-on: ${{ matrix.runner }} + steps: + - uses: actions/checkout@v6 + + - name: setup Go + uses: actions/setup-go@v6 + with: + go-version-file: go.mod + + - name: get operating system lowercase + id: os + shell: bash + run: | + OS=$(echo "${{ runner.os }}" | tr '[:upper:]' '[:lower:]') + echo "runner_os=$OS" >> "$GITHUB_OUTPUT" + + - name: download CLI artifacts + uses: actions/download-artifact@v8 + with: + pattern: devsy-${{ steps.os.outputs.runner_os }} + path: ${{ runner.temp }}/devsy-bin/ + merge-multiple: true + + - name: setup executable + shell: bash + working-directory: ./e2e + run: | + TEMP_DIR="${{ runner.temp }}" + ls -R "$TEMP_DIR/devsy-bin/" + mkdir -p ./bin/ + find "$TEMP_DIR/devsy-bin/" -type f -name "devsy-*" -exec cp {} ./bin \; + find ./bin -name "devsy-*" -exec chmod +x {} \; + ls -R ./bin/ + + - name: run test + shell: bash + working-directory: ./e2e + env: + GH_USERNAME: ${{ github.repository_owner }} + GH_ACCESS_TOKEN: ${{ github.token }} + GH_CREDENTIAL_USERNAME: x-access-token + run: | + go test -v -ginkgo.v -timeout 1500s --ginkgo.label-filter="${{ matrix.label }}" + + integration-tests: + name: Test ${{ matrix.label }} on ${{ matrix.runner }} + needs: [can-read-secret, build-cli] + strategy: + fail-fast: false + matrix: + include: + - label: integration + runner: ubuntu-latest free-disk-space: false install-kind: false requires-secret: false @@ -186,30 +234,12 @@ jobs: install-kind: false requires-secret: false - - label: readconfiguration - runner: ubuntu-latest - free-disk-space: false - install-kind: false - requires-secret: false - - - label: extends - runner: ubuntu-latest - free-disk-space: false - install-kind: false - requires-secret: false - - label: extends-up runner: ubuntu-latest free-disk-space: false install-kind: false requires-secret: false - - label: outdated - runner: ubuntu-latest - free-disk-space: false - install-kind: false - requires-secret: false - - label: down runner: ubuntu-latest free-disk-space: false From 1660ec6ee9f91d12aa980d308652a9448495ef0e Mon Sep 17 00:00:00 2001 From: Samuel K Date: Wed, 13 May 2026 13:48:51 -0500 Subject: [PATCH 2/2] ci: move ide and machineprovider back to privileged group These tests require root access despite having no Docker dependency. Both failed when running without sudo in CI. Move them back to the privileged integration-tests job. --- .github/workflows/pr-ci.yml | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml index 409aefeae..8d762334a 100644 --- a/.github/workflows/pr-ci.yml +++ b/.github/workflows/pr-ci.yml @@ -129,9 +129,6 @@ jobs: - label: context runner: ubuntu-latest - - label: ide - runner: ubuntu-latest - - label: readconfiguration runner: ubuntu-latest @@ -144,9 +141,6 @@ jobs: - label: machine runner: ubuntu-latest - - label: machineprovider - runner: ubuntu-latest - runs-on: ${{ matrix.runner }} steps: - uses: actions/checkout@v6 @@ -198,6 +192,18 @@ jobs: fail-fast: false matrix: include: + - label: ide + runner: ubuntu-latest + free-disk-space: false + install-kind: false + requires-secret: false + + - label: machineprovider + runner: ubuntu-latest + free-disk-space: false + install-kind: false + requires-secret: false + - label: integration runner: ubuntu-latest free-disk-space: false