ci(e2e): trim the host Podman lane to tests tmachine can't run yet

The rust-podman-ci lane ran conformance and 23 e2e/rust binaries. The
tmachine e2e-podman row already runs 17 of those binaries, and the
tmachine Podman conformance rows run the same conformance tests.

Keep only the six binaries no other lane covers: the five wrapper-lane
entries in podmanE2eFollowUpBinaries, plus otlp_relay, whose collector
cases need the OTLP endpoint the wrapper configures. Skip conformance
for the ci set and drop the lane's build-conformance dependency.

Closes #5423

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

Author: matthewgrossman

.github/workflows/branch-e2e.yml

@@ -373,16 +373,17 @@ jobs:
       image-tag: ${{ github.sha }}
       runner: linux-arm64-cpu8
 
+  # Runs only the Podman e2e/rust targets that podman-e2e-integration can't run
+  # yet; see PODMAN_CI_TESTS in e2e/rust/e2e-podman.sh.
   podman-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-images]
+    needs: [pr_metadata, build-binaries, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
       contents: read
       packages: read
     uses: ./.github/workflows/e2e-podman-test.yml
     with:
-      prebuilt-conformance: true
       image-tag: ${{ github.sha }}
       suite-matrix: >-
         [{"suite":"ci","runner":"ubuntu-26.04","podman_major":"5","podman_package_version":"5.7.0+ds2-3build1","conmon_package_version":"2.1.13+ds1-2","cmd":"mise run --no-deps --skip-deps e2e:podman:ci"}]

e2e/rust/e2e-podman.sh

@@ -18,33 +18,19 @@ RUN_WITH_GATEWAY_COMMAND="__openshell_run_podman_e2e"
 # shellcheck source=e2e/support/conformance.sh
 source "${ROOT}/e2e/support/conformance.sh"
 
-# Keep required branch CI on the Podman targets that are known to pass. The
-# unfiltered e2e:podman task remains available while the omitted targets are
-# stabilized and can be added here.
+# Required branch CI runs only the Podman targets that the tmachine e2e-podman
+# testsuite can't run yet (see podmanE2eFollowUpBinaries in
+# tests/tmachine/artifacts.nix), plus otlp_relay, whose collector cases need the
+# OTLP endpoint this script configures. tmachine runs the rest of the Podman
+# targets and the conformance suite. Remove each target here once it moves to
+# testkit (#5297).
 PODMAN_CI_TESTS=(
-  bypass_detection
-  ephemeral_cleanup
-  core_dump_hardening
-  credential_gating
-  default_image
   driver_config_volume
-  edge_tunnel_e2e
-  forward_proxy_graphql_l7
-  forward_proxy_jsonrpc_l7
-  forward_proxy_l7_bypass
-  host_gateway_alias
-  landlock
-  live_policy_update
   local_driver_token_restart
-  no_proxy
-  ocsf_jsonl_conformance
   otlp_relay
   podman_corporate_proxy
   podman_gateway_start
-  podman_host_gateway
-  podman_oci_identity
   provider_token_exchange
-  upload_backpressure
 )
 
 if [ -n "${E2E_TEST}" ] && [ -n "${E2E_TEST_SET}" ]; then
@@ -79,7 +65,10 @@ if [ "${E2E_TEST}" = "gpu" ] && [ -z "${OPENSHELL_E2E_WORKLOAD_MANIFEST:-}" ] &&
 fi
 
 if [ "${1:-}" = "${RUN_WITH_GATEWAY_COMMAND}" ]; then
-  e2e_run_openshell_conformance "Podman"
+  # The tmachine Podman rows already run conformance for the ci set.
+  if [ "${E2E_TEST_SET}" != "ci" ]; then
+    e2e_run_openshell_conformance "Podman"
+  fi
   if [ "${E2E_FEATURES}" = "e2e-conformance-only" ]; then
     echo "::notice::Skipping Rust e2e tests (e2e-conformance-only)"
     exit 0

tasks/test.toml

@@ -217,7 +217,7 @@ description = "Run Rust CLI e2e tests against a Podman-backed gateway"
 run = "e2e/rust/e2e-podman.sh"
 
 ["e2e:podman:ci"]
-description = "Run the Podman Rust e2e targets enabled in required branch CI"
+description = "Run the Podman Rust e2e targets that only the host Podman lane runs in required branch CI"
 run = "OPENSHELL_E2E_PODMAN_TEST_SET=ci e2e/rust/e2e-podman.sh"
 
 ["e2e:oidc-pkce"]

tests/tmachine/artifacts.nix

@@ -84,8 +84,9 @@ let
 
   # Follow-up: binaries that do not yet run in the rootless tmachine guest. Each
   # entry says what it needs. Entries marked "wrapper lane" still run in the
-  # wrapper-based Podman lane (`mise run e2e:podman:ci`), so they are covered
-  # there until tmachine provides what they need.
+  # wrapper-based Podman lane (`mise run e2e:podman:ci`), whose PODMAN_CI_TESTS
+  # list in e2e/rust/e2e-podman.sh keeps only those binaries plus otlp_relay.
+  # Update both lists together.
   podmanE2eFollowUpBinaries = [
     # Needs the caller driver-config settings (`allow_driver_config`,
     # `enable_bind_mounts`), which the tmachine gateway does not enable. Wrapper