Skip to content

test(e2e): run the testkit conformance suite in the host lanes - #5078

Draft
matthewgrossman wants to merge 2 commits into
test/3954-migrate-suites-to-testkit/matthewgrossmanfrom
test/3954-host-lanes-to-testkit/matthewgrossman
Draft

matthewgrossman wants to merge 2 commits into
test/3954-migrate-suites-to-testkit/matthewgrossmanfrom
test/3954-host-lanes-to-testkit/matthewgrossman

Conversation

@matthewgrossman

Copy link
Copy Markdown
Member

Summary

Run the testkit conformance tests (tests/suites/conformance/sandbox) in the host E2E lanes, and delete the old CLI conformance suite they replace. This is a parity change: every lane keeps its current gateway and driver setup.

Based on #4774. The base branch is #4774's branch until it merges, then this PR retargets main.

Related Issue

Part of #3954

Changes

  • e2e/support/conformance.sh runs cargo nextest run --package sandbox in tests/suites/conformance with --no-tests fail, so a lane that selects zero tests fails. All host lanes (Docker, Docker external-driver, Podman, Kubernetes and its variants, VM, VM external-driver, and e2e:rust:push) go through this script, so none of the lane wrappers changed.
  • Deleted tests/suites/conformance/cli, its workspace member, and its lockfile entries. crates/openshell-conformance stays for the suites that still use it.
  • tasks/test.toml: e2e:testkit no longer excludes the deleted suite. e2e:rust:push drops a dependency on e2e:conformance:build, a task that no longer exists.
  • TESTING.md: updated the suite and lane descriptions and the manual-run command.

Gateway selection per lane:

  • Docker and Podman export OPENSHELL_GATEWAY for an mTLS gateway registered in a temporary config folder.
  • Kubernetes exports OPENSHELL_GATEWAY. The gateway is registered without TLS, or with mTLS for the TLS and OpenShift variants. Operator workspace mode still skips conformance.
  • VM exports only OPENSHELL_GATEWAY_ENDPOINT. testkit matches it to the active registered gateway and uses that gateway's mTLS certificates.

Testing

  • Checks appropriate to the affected code and behavior pass: cargo fmt, cargo clippy -D warnings (sandbox package), lockfile alignment, markdownlint-cli2 TESTING.md, mise run license:check, shellcheck (no new warnings)
  • Unit tests added/updated (if applicable)
  • E2E tests added/updated (if applicable)

Local runs, 15/15 conformance tests passing in each:

Lane Time
Docker 64s
Docker external-driver 67s
Podman (macOS podman machine) 79s
Kubernetes (k3d, plaintext) 329s
Docker, push config delivery 54s

VM gateway selection was checked by recreating the VM lane's environment on Docker (only OPENSHELL_GATEWAY_ENDPOINT set). Running with a filter that matches no tests exits non-zero.

Not verified locally: the real VM and VM external-driver lanes, Kubernetes external-driver, and the Kubernetes TLS and OpenShift variants. The Docker E2E CI image does not include cargo-nextest. mise installs the pinned version in that image (checked locally), at the cost of one download per job.

Checklist

  • Follows Conventional Commits
  • Commits are signed off (DCO)
  • Architecture docs updated (if applicable)

The Docker, Podman, Kubernetes and VM host lanes, including external-driver
mode and e2e:rust:push, now run the testkit `sandbox` package with nextest
instead of the old CLI conformance package. The tests find the lane's
gateway the same way the CLI does, through the OPENSHELL_GATEWAY_ENDPOINT
and OPENSHELL_GATEWAY values the gateway wrappers export, and `--no-tests
fail` makes a lane that selects no tests fail.

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
Nothing runs tests/suites/conformance/cli now that the host lanes run the
testkit suite. Remove it from the conformance workspace and its lockfile,
drop the e2e:testkit exclusion for it, and point the TESTING.md manual run
at the `sandbox` package.

e2e:rust:push also loses its dependency on e2e:conformance:build, which no
longer exists, and the unused OPENSHELL_CONFORMANCE_BIN it set.
crates/openshell-conformance stays for the features and drivers suites.

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
@copy-pr-bot

copy-pr-bot Bot commented Oct 30, 2026

Copy link
Copy Markdown

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

@matthewgrossman matthewgrossman added the test:e2e Requires end-to-end coverage label Oct 30, 2026
@matthewgrossman

Copy link
Copy Markdown
Member Author

/ok to test e0d2385

@github-actions

Copy link
Copy Markdown

@github-actions

Copy link
Copy Markdown

Label test:e2e applied for e0d2385. Open Branch E2E Checks, find the run for commit e0d2385, and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

test:e2e Requires end-to-end coverage

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant