From 6d8fabfe18bba8a42da287d1f6477aebb9e78936 Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Wed, 13 May 2026 15:22:33 -0500
Subject: [PATCH 1/2] ci: add Linux Podman (rootless and rootful) to e2e test
 matrix

The CI matrix only tested Podman on Windows. Add two new Linux entries
for rootless and rootful Podman so the up-provider-podman tests run
against both privilege modes on ubuntu-latest. DOCKER_HOST is set via
GITHUB_ENV and forwarded through the sudo test invocation.
---
 .github/workflows/pr-ci.yml | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml
index 39f8bbadf..c2deffc3d 100644
--- a/.github/workflows/pr-ci.yml
+++ b/.github/workflows/pr-ci.yml
@@ -308,6 +308,22 @@ jobs:
             install-kind: true
             requires-secret: false
 
+          - label: up-provider-podman
+            runner: ubuntu-latest
+            free-disk-space: false
+            install-kind: false
+            install-podman-linux: true
+            podman-rootless: true
+            requires-secret: false
+
+          - label: up-provider-podman
+            runner: ubuntu-latest
+            free-disk-space: false
+            install-kind: false
+            install-podman-linux: true
+            podman-rootless: false
+            requires-secret: false
+
           - label: up-provider-docker
             runner: ubuntu-latest
             free-disk-space: false
@@ -481,6 +497,22 @@ jobs:
           & "$installDir\podman.exe" machine set --rootful
           & "$installDir\podman.exe" machine start
 
+      - name: install and start podman (Linux rootless)
+        if: matrix.install-podman-linux == true && matrix.podman-rootless == true && (matrix.requires-secret == false || needs.can-read-secret.outputs.secret-set == 'true')
+        run: |
+          sudo apt-get update && sudo apt-get install -y podman
+          systemctl --user start podman.socket
+          podman info
+          echo "DOCKER_HOST=unix:///run/user/$(id -u)/podman/podman.sock" >> "$GITHUB_ENV"
+
+      - name: install and start podman (Linux rootful)
+        if: matrix.install-podman-linux == true && matrix.podman-rootless == false && (matrix.requires-secret == false || needs.can-read-secret.outputs.secret-set == 'true')
+        run: |
+          sudo apt-get update && sudo apt-get install -y podman
+          sudo systemctl start podman.socket
+          podman info
+          echo "DOCKER_HOST=unix:///run/podman/podman.sock" >> "$GITHUB_ENV"
+
       - name: setup kind (Windows)
         if: matrix.install-kind == true && runner.os == 'Windows' && (matrix.requires-secret == false || needs.can-read-secret.outputs.secret-set == 'true')
         shell: bash
@@ -547,6 +579,7 @@ jobs:
               KUBECONFIG="${KUBECONFIG:-$HOME/.kube/config}" \
               PATH="${PATH}" \
               GOROOT="${GOROOT}" \
+              ${DOCKER_HOST:+DOCKER_HOST="${DOCKER_HOST}"} \
               go test -v -ginkgo.v -timeout 1500s --ginkgo.label-filter="${{ matrix.label }}"
           else
             GH_USERNAME="${GH_USERNAME}" \

From 39d30b6c647a02e402e81b9a7bb35f0b99ff7619 Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Wed, 13 May 2026 15:25:46 -0500
Subject: [PATCH 2/2] fix(ci): address review findings for Linux Podman matrix
 entries

Always forward DOCKER_HOST through sudo (empty string is harmless for
Docker entries). Add variant field to matrix entries so rootless and
rootful jobs get distinct display names. Replace podman info with
socket-exists polls for deterministic readiness checks.
---
 .github/workflows/pr-ci.yml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml
index c2deffc3d..f009f73dc 100644
--- a/.github/workflows/pr-ci.yml
+++ b/.github/workflows/pr-ci.yml
@@ -186,7 +186,7 @@ jobs:
           go test -v -ginkgo.v -timeout 1500s --ginkgo.label-filter="${{ matrix.label }}"
 
   integration-tests:
-    name: Test ${{ matrix.label }} on ${{ matrix.runner }}
+    name: Test ${{ matrix.label }}${{ matrix.variant && format(' ({0})', matrix.variant) || '' }} on ${{ matrix.runner }}
     needs: [can-read-secret, build-cli]
     strategy:
       fail-fast: false
@@ -309,6 +309,7 @@ jobs:
             requires-secret: false
 
           - label: up-provider-podman
+            variant: rootless
             runner: ubuntu-latest
             free-disk-space: false
             install-kind: false
@@ -317,6 +318,7 @@ jobs:
             requires-secret: false
 
           - label: up-provider-podman
+            variant: rootful
             runner: ubuntu-latest
             free-disk-space: false
             install-kind: false
@@ -502,7 +504,7 @@ jobs:
         run: |
           sudo apt-get update && sudo apt-get install -y podman
           systemctl --user start podman.socket
-          podman info
+          timeout 10 bash -c "until [ -S /run/user/$(id -u)/podman/podman.sock ]; do sleep 0.5; done"
           echo "DOCKER_HOST=unix:///run/user/$(id -u)/podman/podman.sock" >> "$GITHUB_ENV"
 
       - name: install and start podman (Linux rootful)
@@ -510,7 +512,7 @@ jobs:
         run: |
           sudo apt-get update && sudo apt-get install -y podman
           sudo systemctl start podman.socket
-          podman info
+          timeout 10 bash -c 'until [ -S /run/podman/podman.sock ]; do sleep 0.5; done'
           echo "DOCKER_HOST=unix:///run/podman/podman.sock" >> "$GITHUB_ENV"
 
       - name: setup kind (Windows)
@@ -579,7 +581,7 @@ jobs:
               KUBECONFIG="${KUBECONFIG:-$HOME/.kube/config}" \
               PATH="${PATH}" \
               GOROOT="${GOROOT}" \
-              ${DOCKER_HOST:+DOCKER_HOST="${DOCKER_HOST}"} \
+              DOCKER_HOST="${DOCKER_HOST:-}" \
               go test -v -ginkgo.v -timeout 1500s --ginkgo.label-filter="${{ matrix.label }}"
           else
             GH_USERNAME="${GH_USERNAME}" \