From 353eeeb9eff6b754de475f8833eadf39a855f486 Mon Sep 17 00:00:00 2001 From: Simon Scatton Date: Fri, 18 Sep 2026 15:04:49 +0200 Subject: [PATCH 1/5] test(tmachine): add Debian installer profile Signed-off-by: Simon Scatton --- .../workflows/prepare-integration-inputs.yml | 21 ++++++++++++++++++ .github/workflows/release-dev.yml | 11 +++++++++- .github/workflows/release-tag.yml | 11 +++++++++- architecture/build.md | 7 ++++-- tests/ansible/playbooks/conformance/cli.yaml | 11 +++++++++- .../features/provider-refresh/keycloak.yaml | 11 +++++++++- tests/ansible/playbooks/openshell-deb.yaml | 22 +++++++++++++++++++ .../roles/openshell_client/tasks/main.yaml | 2 +- .../roles/openshell_gateway/tasks/main.yaml | 2 +- .../templates/gateway.service.j2 | 2 +- tests/config.nix | 13 +++++++++++ 11 files changed, 104 insertions(+), 9 deletions(-) create mode 100644 tests/ansible/playbooks/openshell-deb.yaml diff --git a/.github/workflows/prepare-integration-inputs.yml b/.github/workflows/prepare-integration-inputs.yml index af6d61d293..1fb14e5835 100644 --- a/.github/workflows/prepare-integration-inputs.yml +++ b/.github/workflows/prepare-integration-inputs.yml @@ -11,6 +11,11 @@ on: required: false type: string default: "" + deb-artifact-name: + description: Debian package artifact to include in the tmachine inputs + required: false + type: string + default: "" outputs: source_sha: description: Source revision of the candidate artifacts @@ -65,6 +70,22 @@ jobs: github-token: ${{ github.token }} run-id: ${{ inputs['artifact-run-id'] || github.run_id }} + - name: Download Debian package artifact + if: inputs['deb-artifact-name'] != '' + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: ${{ inputs['deb-artifact-name'] }} + path: artifacts/packages/download + github-token: ${{ github.token }} + run-id: ${{ inputs['artifact-run-id'] || github.run_id }} + + - name: Stage Debian package input + if: inputs['deb-artifact-name'] != '' + run: | + set -euo pipefail + mv artifacts/packages/download/*.deb artifacts/packages/openshell.deb + rmdir artifacts/packages/download + - name: Log in to GHCR run: echo "${{ github.token }}" | docker login ghcr.io -u "${GITHUB_ACTOR}" --password-stdin diff --git a/.github/workflows/release-dev.yml b/.github/workflows/release-dev.yml index 23dd415d2f..71adb3eedd 100644 --- a/.github/workflows/release-dev.yml +++ b/.github/workflows/release-dev.yml @@ -102,12 +102,14 @@ jobs: checkout-ref: ${{ github.sha }} prepare-integration: - needs: [build-binaries, build-images] + needs: [build-binaries, build-deb, build-images] permissions: actions: read contents: read packages: read uses: ./.github/workflows/prepare-integration-inputs.yml + with: + deb-artifact-name: deb-linux-amd64 conformance-integration: needs: prepare-integration @@ -120,6 +122,13 @@ jobs: category: conformance source-sha: ${{ needs.prepare-integration.outputs.source_sha }} integration-inputs-artifact-id: ${{ needs.prepare-integration.outputs.integration_inputs_artifact_id }} + test-matrix: >- + [ + {"environment":"ubuntu-docker-rootful","installer":"binaries","testsuite":"conformance"}, + {"environment":"ubuntu-docker-rootful","installer":"deb","testsuite":"conformance"}, + {"environment":"fedora-podman-rootful","installer":"binaries","testsuite":"conformance"}, + {"environment":"fedora-podman-rootless","installer":"binaries","testsuite":"conformance"} + ] feature-specific-integration: needs: prepare-integration diff --git a/.github/workflows/release-tag.yml b/.github/workflows/release-tag.yml index e7e4795437..4c340cfd3d 100644 --- a/.github/workflows/release-tag.yml +++ b/.github/workflows/release-tag.yml @@ -130,12 +130,14 @@ jobs: checkout-ref: ${{ needs.compute-versions.outputs.source_sha }} prepare-integration: - needs: [compute-versions, build-binaries, build-images] + needs: [compute-versions, build-binaries, build-deb, build-images] permissions: actions: read contents: read packages: read uses: ./.github/workflows/prepare-integration-inputs.yml + with: + deb-artifact-name: deb-linux-amd64 conformance-integration: needs: prepare-integration @@ -148,6 +150,13 @@ jobs: category: conformance source-sha: ${{ needs.prepare-integration.outputs.source_sha }} integration-inputs-artifact-id: ${{ needs.prepare-integration.outputs.integration_inputs_artifact_id }} + test-matrix: >- + [ + {"environment":"ubuntu-docker-rootful","installer":"binaries","testsuite":"conformance"}, + {"environment":"ubuntu-docker-rootful","installer":"deb","testsuite":"conformance"}, + {"environment":"fedora-podman-rootful","installer":"binaries","testsuite":"conformance"}, + {"environment":"fedora-podman-rootless","installer":"binaries","testsuite":"conformance"} + ] feature-specific-integration: needs: prepare-integration diff --git a/architecture/build.md b/architecture/build.md index 5ac5ff5f18..8a4cf6c81b 100644 --- a/architecture/build.md +++ b/architecture/build.md @@ -275,7 +275,7 @@ includes, templates, inventory, and requirements. The digest uses sorted relative paths, file contents, and executable permissions; source symlinks are unsupported. Both keys also retain the ordered playbook paths and contents, their base disk contents, and whether Galaxy is enabled; install keys -include named binary inputs. The top-level `.roles` directory is excluded: +include named artifact inputs. The top-level `.roles` directory is excluded: Galaxy release pins in `requirements.yaml` are treated as immutable, including any transitive dependency pins. Cache misses with Galaxy enabled reinstall the required roles and their dependencies before running playbooks. @@ -286,7 +286,10 @@ the gateway, sandbox, and supervisor as separate binaries for their respective Dockerfiles. The helpers stage binaries under `artifacts/binaries` so local and CI builds expose the same inputs to tmachine and image assembly. The Ubuntu Docker and Fedora Podman environments import both local runtime images and -configure the gateway to use them. +configure the gateway to use them. The Ubuntu `deb` installer consumes +`artifacts/packages/openshell.deb`; the `binaries` installer remains available +for direct executable installation on every environment. Release Dev and +Release Tag run Ubuntu conformance through both installers. ## Python Wheel Packaging diff --git a/tests/ansible/playbooks/conformance/cli.yaml b/tests/ansible/playbooks/conformance/cli.yaml index 4adf9aa954..759cc53fca 100644 --- a/tests/ansible/playbooks/conformance/cli.yaml +++ b/tests/ansible/playbooks/conformance/cli.yaml @@ -39,6 +39,15 @@ - conformance_archive.stat.isreg | default(false) fail_msg: OpenShell conformance test bundle did not contain tests.tar.zst + - name: Resolve installed OpenShell CLI + ansible.builtin.command: + argv: + - /bin/sh + - -c + - command -v openshell + register: openshell_cli + changed_when: false + - name: Run OpenShell conformance archive ansible.builtin.command: argv: @@ -51,7 +60,7 @@ - /var/lib/openshell-conformance/tests - --no-capture environment: - OPENSHELL_BIN: /usr/local/bin/openshell + OPENSHELL_BIN: "{{ openshell_cli.stdout }}" register: conformance_result changed_when: false failed_when: false diff --git a/tests/ansible/playbooks/features/provider-refresh/keycloak.yaml b/tests/ansible/playbooks/features/provider-refresh/keycloak.yaml index 81bcba5ed1..72ee9ba0fb 100644 --- a/tests/ansible/playbooks/features/provider-refresh/keycloak.yaml +++ b/tests/ansible/playbooks/features/provider-refresh/keycloak.yaml @@ -49,6 +49,15 @@ - provider_refresh_keycloak_test_archive.stat.isreg | default(false) fail_msg: Keycloak provider refresh test bundle did not contain tests.tar.zst + - name: Resolve installed OpenShell CLI + ansible.builtin.command: + argv: + - /bin/sh + - -c + - command -v openshell + register: openshell_cli + changed_when: false + - name: Run Keycloak provider refresh archive ansible.builtin.command: argv: @@ -61,7 +70,7 @@ - /var/lib/openshell-provider-refresh/tests - --no-capture environment: - OPENSHELL_BIN: /usr/local/bin/openshell + OPENSHELL_BIN: "{{ openshell_cli.stdout }}" OPENSHELL_E2E_OIDC_ISSUER: http://127.0.0.1:8180/realms/openshell OPENSHELL_E2E_OIDC_USERNAME: admin@test OPENSHELL_E2E_OIDC_PASSWORD: admin diff --git a/tests/ansible/playbooks/openshell-deb.yaml b/tests/ansible/playbooks/openshell-deb.yaml new file mode 100644 index 0000000000..04b753c172 --- /dev/null +++ b/tests/ansible/playbooks/openshell-deb.yaml @@ -0,0 +1,22 @@ +# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 + +--- +- name: Install OpenShell Debian package + hosts: all + gather_facts: false + tasks: + - name: Wait for SSH + ansible.builtin.wait_for_connection: + + - name: Copy OpenShell Debian package + become: true + ansible.builtin.copy: + src: "{{ openshell_deb }}" + dest: /var/tmp/openshell.deb + mode: "0644" + + - name: Install OpenShell Debian package + become: true + ansible.builtin.apt: + deb: /var/tmp/openshell.deb diff --git a/tests/ansible/roles/openshell_client/tasks/main.yaml b/tests/ansible/roles/openshell_client/tasks/main.yaml index 25f41fb861..268be3a483 100644 --- a/tests/ansible/roles/openshell_client/tasks/main.yaml +++ b/tests/ansible/roles/openshell_client/tasks/main.yaml @@ -5,7 +5,7 @@ - name: Register OpenShell gateway for tmachine test client ansible.builtin.command: argv: - - /usr/local/bin/openshell + - openshell - gateway - add - http://127.0.0.1:17670 diff --git a/tests/ansible/roles/openshell_gateway/tasks/main.yaml b/tests/ansible/roles/openshell_gateway/tasks/main.yaml index c065354b4b..c8089f5ae0 100644 --- a/tests/ansible/roles/openshell_gateway/tasks/main.yaml +++ b/tests/ansible/roles/openshell_gateway/tasks/main.yaml @@ -43,7 +43,7 @@ become_user: "{{ openshell_gateway_user }}" ansible.builtin.command: argv: - - /usr/local/bin/openshell-gateway + - openshell-gateway - generate-certs - --output-dir - /var/lib/openshell/pki diff --git a/tests/ansible/roles/openshell_gateway/templates/gateway.service.j2 b/tests/ansible/roles/openshell_gateway/templates/gateway.service.j2 index 9e589803cd..6966e4b075 100644 --- a/tests/ansible/roles/openshell_gateway/templates/gateway.service.j2 +++ b/tests/ansible/roles/openshell_gateway/templates/gateway.service.j2 @@ -11,7 +11,7 @@ User={{ openshell_gateway_user }} Group={{ openshell_gateway_user }} Environment=HOME={{ openshell_gateway_home }} {% block service %}{% endblock %} -ExecStart=/usr/local/bin/openshell-gateway --config /etc/openshell/gateway.toml +ExecStart=openshell-gateway --config /etc/openshell/gateway.toml Restart=on-failure [Install] diff --git a/tests/config.nix b/tests/config.nix index 461d3ddfbf..b44f853330 100644 --- a/tests/config.nix +++ b/tests/config.nix @@ -84,6 +84,19 @@ let openshell_sandbox_image = "../artifacts/images/openshell-sandbox-tmachine.tar"; }; } + { + name = "deb"; + use_galaxy = false; + playbooks = [ + "ansible/playbooks/openshell-deb.yaml" + "ansible/playbooks/gateway.yaml" + ]; + inputs = { + openshell_deb = "../artifacts/packages/openshell.deb"; + openshell_supervisor_image = "../artifacts/images/openshell-supervisor-tmachine.tar"; + openshell_sandbox_image = "../artifacts/images/openshell-sandbox-tmachine.tar"; + }; + } ]; testsuites = [ From b15a3ec4226fa024478c28ba4e99894934717981 Mon Sep 17 00:00:00 2001 From: Simon Scatton Date: Fri, 18 Sep 2026 16:40:11 +0200 Subject: [PATCH 2/5] refactor(ci): centralize conformance matrix Signed-off-by: Simon Scatton --- .github/workflows/integration-runner.yml | 1 + .github/workflows/release-dev.yml | 7 ------- .github/workflows/release-tag.yml | 7 ------- 3 files changed, 1 insertion(+), 14 deletions(-) diff --git a/.github/workflows/integration-runner.yml b/.github/workflows/integration-runner.yml index 69e366dc55..6e9f06a798 100644 --- a/.github/workflows/integration-runner.yml +++ b/.github/workflows/integration-runner.yml @@ -25,6 +25,7 @@ on: default: >- [ {"environment":"ubuntu-docker-rootful","installer":"binaries","testsuite":"conformance"}, + {"environment":"ubuntu-docker-rootful","installer":"deb","testsuite":"conformance"}, {"environment":"fedora-podman-rootful","installer":"binaries","testsuite":"conformance"}, {"environment":"fedora-podman-rootless","installer":"binaries","testsuite":"conformance"} ] diff --git a/.github/workflows/release-dev.yml b/.github/workflows/release-dev.yml index 71adb3eedd..c188ba3dc6 100644 --- a/.github/workflows/release-dev.yml +++ b/.github/workflows/release-dev.yml @@ -122,13 +122,6 @@ jobs: category: conformance source-sha: ${{ needs.prepare-integration.outputs.source_sha }} integration-inputs-artifact-id: ${{ needs.prepare-integration.outputs.integration_inputs_artifact_id }} - test-matrix: >- - [ - {"environment":"ubuntu-docker-rootful","installer":"binaries","testsuite":"conformance"}, - {"environment":"ubuntu-docker-rootful","installer":"deb","testsuite":"conformance"}, - {"environment":"fedora-podman-rootful","installer":"binaries","testsuite":"conformance"}, - {"environment":"fedora-podman-rootless","installer":"binaries","testsuite":"conformance"} - ] feature-specific-integration: needs: prepare-integration diff --git a/.github/workflows/release-tag.yml b/.github/workflows/release-tag.yml index 4c340cfd3d..41107e5c63 100644 --- a/.github/workflows/release-tag.yml +++ b/.github/workflows/release-tag.yml @@ -150,13 +150,6 @@ jobs: category: conformance source-sha: ${{ needs.prepare-integration.outputs.source_sha }} integration-inputs-artifact-id: ${{ needs.prepare-integration.outputs.integration_inputs_artifact_id }} - test-matrix: >- - [ - {"environment":"ubuntu-docker-rootful","installer":"binaries","testsuite":"conformance"}, - {"environment":"ubuntu-docker-rootful","installer":"deb","testsuite":"conformance"}, - {"environment":"fedora-podman-rootful","installer":"binaries","testsuite":"conformance"}, - {"environment":"fedora-podman-rootless","installer":"binaries","testsuite":"conformance"} - ] feature-specific-integration: needs: prepare-integration From 0370af6ee9ea6c8d12cbc458ab11c7614fb737c3 Mon Sep 17 00:00:00 2001 From: Simon Scatton Date: Fri, 18 Sep 2026 16:57:44 +0200 Subject: [PATCH 3/5] test(ci): prefer packaged conformance artifacts Signed-off-by: Simon Scatton --- .github/workflows/integration-runner.yml | 1 - architecture/build.md | 3 ++- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/integration-runner.yml b/.github/workflows/integration-runner.yml index 6e9f06a798..1048e5abd3 100644 --- a/.github/workflows/integration-runner.yml +++ b/.github/workflows/integration-runner.yml @@ -24,7 +24,6 @@ on: type: string default: >- [ - {"environment":"ubuntu-docker-rootful","installer":"binaries","testsuite":"conformance"}, {"environment":"ubuntu-docker-rootful","installer":"deb","testsuite":"conformance"}, {"environment":"fedora-podman-rootful","installer":"binaries","testsuite":"conformance"}, {"environment":"fedora-podman-rootless","installer":"binaries","testsuite":"conformance"} diff --git a/architecture/build.md b/architecture/build.md index 8a4cf6c81b..45315e9a5e 100644 --- a/architecture/build.md +++ b/architecture/build.md @@ -289,7 +289,8 @@ Docker and Fedora Podman environments import both local runtime images and configure the gateway to use them. The Ubuntu `deb` installer consumes `artifacts/packages/openshell.deb`; the `binaries` installer remains available for direct executable installation on every environment. Release Dev and -Release Tag run Ubuntu conformance through both installers. +Release Tag run Ubuntu conformance through the Debian package, while Fedora +continues using direct executable installation until RPM coverage is available. ## Python Wheel Packaging From 691ea14737b6598b2eb9791c3cf59504146dfcdf Mon Sep 17 00:00:00 2001 From: Simon Scatton Date: Fri, 18 Sep 2026 17:21:15 +0200 Subject: [PATCH 4/5] test(tmachine): use packaged Debian gateway service Signed-off-by: Simon Scatton --- tests/ansible/playbooks/openshell-deb.yaml | 70 +++++++++++++++++++ tests/ansible/playbooks/podman-rootless.yaml | 28 ++------ .../roles/openshell_client/tasks/main.yaml | 6 +- .../tmachine_user_manager/tasks/main.yaml | 18 +++++ tests/config.nix | 1 - 5 files changed, 95 insertions(+), 28 deletions(-) create mode 100644 tests/ansible/roles/tmachine_user_manager/tasks/main.yaml diff --git a/tests/ansible/playbooks/openshell-deb.yaml b/tests/ansible/playbooks/openshell-deb.yaml index 04b753c172..09cee8e0d5 100644 --- a/tests/ansible/playbooks/openshell-deb.yaml +++ b/tests/ansible/playbooks/openshell-deb.yaml @@ -20,3 +20,73 @@ become: true ansible.builtin.apt: deb: /var/tmp/openshell.deb + + - name: Copy OpenShell runtime images + become: true + ansible.builtin.copy: + src: "{{ item.src }}" + dest: "/var/tmp/{{ item.name }}.tar" + mode: "0644" + loop: + - name: openshell-sandbox + src: "{{ openshell_sandbox_image }}" + - name: openshell-supervisor + src: "{{ openshell_supervisor_image }}" + + - name: Load OpenShell runtime images + become: true + ansible.builtin.command: + argv: + - docker + - load + - --input + - "/var/tmp/{{ item }}.tar" + loop: + - openshell-sandbox + - openshell-supervisor + + - name: Create OpenShell configuration directory + ansible.builtin.file: + path: /home/tmachine/.config/openshell + state: directory + mode: "0700" + + - name: Configure candidate OpenShell runtime images + ansible.builtin.copy: + dest: /home/tmachine/.config/openshell/gateway.toml + mode: "0600" + content: | + [openshell] + version = 2 + + [openshell.drivers.docker] + sandbox_runtime_image = "docker.io/openshell/sandbox:tmachine" + supervisor_image = "docker.io/openshell/supervisor:tmachine" + + - name: Start tmachine user manager + ansible.builtin.include_role: + name: tmachine_user_manager + + - name: Start packaged OpenShell gateway service + ansible.builtin.systemd_service: + name: openshell-gateway.service + scope: user + daemon_reload: true + enabled: true + state: started + environment: + XDG_RUNTIME_DIR: /run/user/1000 + DBUS_SESSION_BUS_ADDRESS: unix:path=/run/user/1000/bus + + - name: Wait for OpenShell gateway + ansible.builtin.wait_for: + host: 127.0.0.1 + port: 17670 + timeout: 60 + + - name: Register packaged OpenShell gateway + ansible.builtin.include_role: + name: openshell_client + vars: + openshell_client_gateway_endpoint: https://127.0.0.1:17670 + openshell_client_gateway_name: openshell diff --git a/tests/ansible/playbooks/podman-rootless.yaml b/tests/ansible/playbooks/podman-rootless.yaml index 15d30ebc6a..816def359b 100644 --- a/tests/ansible/playbooks/podman-rootless.yaml +++ b/tests/ansible/playbooks/podman-rootless.yaml @@ -9,29 +9,9 @@ - name: Wait for SSH ansible.builtin.wait_for_connection: - - name: Enable lingering for tmachine - become: true - ansible.builtin.command: - argv: - - loginctl - - enable-linger - - tmachine - changed_when: false - - - name: Resolve tmachine UID - ansible.builtin.command: - argv: - - id - - -u - - tmachine - changed_when: false - register: tmachine_uid - - name: Start tmachine user manager - become: true - ansible.builtin.systemd_service: - name: "user@{{ tmachine_uid.stdout }}.service" - state: started + ansible.builtin.include_role: + name: tmachine_user_manager - name: Enable rootless Podman socket become: true @@ -43,5 +23,5 @@ state: started environment: HOME: /home/tmachine - XDG_RUNTIME_DIR: "/run/user/{{ tmachine_uid.stdout }}" - DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ tmachine_uid.stdout }}/bus" + XDG_RUNTIME_DIR: /run/user/1000 + DBUS_SESSION_BUS_ADDRESS: unix:path=/run/user/1000/bus diff --git a/tests/ansible/roles/openshell_client/tasks/main.yaml b/tests/ansible/roles/openshell_client/tasks/main.yaml index 268be3a483..6586f23ac2 100644 --- a/tests/ansible/roles/openshell_client/tasks/main.yaml +++ b/tests/ansible/roles/openshell_client/tasks/main.yaml @@ -2,13 +2,13 @@ # SPDX-License-Identifier: Apache-2.0 --- -- name: Register OpenShell gateway for tmachine test client +- name: Register OpenShell gateway for test client ansible.builtin.command: argv: - openshell - gateway - add - - http://127.0.0.1:17670 + - "{{ openshell_client_gateway_endpoint | default('http://127.0.0.1:17670') }}" - --local - --name - - tmachine + - "{{ openshell_client_gateway_name | default('tmachine') }}" diff --git a/tests/ansible/roles/tmachine_user_manager/tasks/main.yaml b/tests/ansible/roles/tmachine_user_manager/tasks/main.yaml new file mode 100644 index 0000000000..1b2f2232af --- /dev/null +++ b/tests/ansible/roles/tmachine_user_manager/tasks/main.yaml @@ -0,0 +1,18 @@ +# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 + +--- +- name: Enable lingering for tmachine + become: true + ansible.builtin.command: + argv: + - loginctl + - enable-linger + - tmachine + changed_when: false + +- name: Start tmachine user manager + become: true + ansible.builtin.systemd_service: + name: user@1000.service + state: started diff --git a/tests/config.nix b/tests/config.nix index b44f853330..b542af6614 100644 --- a/tests/config.nix +++ b/tests/config.nix @@ -89,7 +89,6 @@ let use_galaxy = false; playbooks = [ "ansible/playbooks/openshell-deb.yaml" - "ansible/playbooks/gateway.yaml" ]; inputs = { openshell_deb = "../artifacts/packages/openshell.deb"; From d70dba961ccfcc4fbd095c0eddf55533a5394b0b Mon Sep 17 00:00:00 2001 From: Evan Lezar Date: Mon, 21 Sep 2026 11:31:55 +0200 Subject: [PATCH 5/5] test(tmachine): isolate Debian qualification config Signed-off-by: Evan Lezar --- architecture/build.md | 6 ++++ tests/ansible/playbooks/openshell-deb.yaml | 34 ++++++++++++++++++---- 2 files changed, 34 insertions(+), 6 deletions(-) diff --git a/architecture/build.md b/architecture/build.md index 45315e9a5e..b6c464bbe5 100644 --- a/architecture/build.md +++ b/architecture/build.md @@ -291,6 +291,12 @@ configure the gateway to use them. The Ubuntu `deb` installer consumes for direct executable installation on every environment. Release Dev and Release Tag run Ubuntu conformance through the Debian package, while Fedora continues using direct executable installation until RPM coverage is available. +The Debian qualification profile keeps candidate-image overrides outside the +operator-owned gateway configuration: it writes a harness-owned file under +`/var/lib/openshell-qualification` and selects it through the packaged systemd +unit's `gateway.env` hook. Ordinary package installations continue to use the +gateway's built-in runtime-image defaults unless the operator configures an +override. ## Python Wheel Packaging diff --git a/tests/ansible/playbooks/openshell-deb.yaml b/tests/ansible/playbooks/openshell-deb.yaml index 09cee8e0d5..f1589374d2 100644 --- a/tests/ansible/playbooks/openshell-deb.yaml +++ b/tests/ansible/playbooks/openshell-deb.yaml @@ -45,16 +45,25 @@ - openshell-sandbox - openshell-supervisor - - name: Create OpenShell configuration directory + # The package normally starts from its built-in runtime-image defaults. + # Qualification instead pins the candidate images staged by tmachine, so + # keep that override separate from the operator-owned gateway.toml. + - name: Create OpenShell qualification configuration directory + become: true ansible.builtin.file: - path: /home/tmachine/.config/openshell + path: /var/lib/openshell-qualification state: directory - mode: "0700" + owner: root + group: root + mode: "0755" - - name: Configure candidate OpenShell runtime images + - name: Configure candidate OpenShell runtime images for qualification + become: true ansible.builtin.copy: - dest: /home/tmachine/.config/openshell/gateway.toml - mode: "0600" + dest: /var/lib/openshell-qualification/gateway.toml + owner: root + group: root + mode: "0644" content: | [openshell] version = 2 @@ -63,6 +72,19 @@ sandbox_runtime_image = "docker.io/openshell/sandbox:tmachine" supervisor_image = "docker.io/openshell/supervisor:tmachine" + - name: Create OpenShell environment directory + ansible.builtin.file: + path: /home/tmachine/.config/openshell + state: directory + mode: "0700" + + - name: Select qualification gateway configuration + ansible.builtin.copy: + dest: /home/tmachine/.config/openshell/gateway.env + mode: "0600" + content: | + OPENSHELL_GATEWAY_CONFIG=/var/lib/openshell-qualification/gateway.toml + - name: Start tmachine user manager ansible.builtin.include_role: name: tmachine_user_manager