ci(e2e): start Linux and tmachine jobs without waiting on macOS or package builds (#5270)

* ci(e2e): build macOS binaries without blocking Linux jobs

Branch E2E built the macOS binaries in the same reusable workflow call
as the Linux binaries, so every Linux consumer waited for the macOS
runners. Add linux and macos inputs to build-binaries and
build-vm-driver, and call them separately in Branch E2E. The result
jobs still depend on the macOS builds, so a macOS build failure still
fails them. Release workflows keep both inputs at their defaults.

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

* ci(e2e): build tmachine test inputs before packages finish

Prepare tmachine inputs built the test archives, test workload images,
and Helm chart after the DEB and RPM builds finished, which added about
three minutes before any tmachine suite could start. None of them use
the packages. Build them in a Branch E2E job that needs only PR
metadata, and let prepare download the result through a new
test-inputs-artifact-name input. Other callers of
prepare-integration-inputs leave the input empty and still build in
place with the same steps.

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

* ci(e2e): split binary builds into per-platform workflows

Branch E2E used flags on the shared build workflows to keep Linux and
macOS apart. Make each platform its own reusable workflow instead, with
a plain matrix, so a consumer depends only on the platforms it needs and
adding a platform means adding a workflow rather than another flag.

Move the VM driver build steps shared by both platforms into a
composite action. Release workflows call both platforms and keep their
existing gating.

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

* ci(release): inline VM driver build steps in the platform workflows

Release builds check out the release tag, so a local action used by
the VM driver workflows must exist in that tag. A tag cut before the
shared build-vm-driver action landed would not have it, which breaks
promoting or re-qualifying that tag. Keep the steps inline in each
platform workflow instead.

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

---------

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

Author: matthewgrossman

.github/workflows/branch-e2e.yml

@@ -101,11 +101,21 @@ jobs:
             echo "rpm_release=$rpm_release"
           } >> "$GITHUB_OUTPUT"
 
-  build-binaries:
+  build-binaries-linux:
     needs: version
     permissions:
       contents: read
-    uses: ./.github/workflows/build-binaries.yml
+    uses: ./.github/workflows/build-binaries-linux.yml
+    with:
+      cargo-version: ${{ needs.version.outputs.cargo }}
+    secrets:
+      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
+  build-binaries-macos:
+    needs: version
+    permissions:
+      contents: read
+    uses: ./.github/workflows/build-binaries-macos.yml
     with:
       cargo-version: ${{ needs.version.outputs.cargo }}
     secrets:
@@ -146,7 +156,7 @@ jobs:
 
   # The conformance program, built once per architecture for the host lanes.
   # It lives in its own workspace and is not released, so it is not part of
-  # build-binaries.yml.
+  # build-binaries-linux.yml.
   build-conformance:
     name: openshell-conformance (${{ matrix.triple }})
     needs: [pr_metadata]
@@ -237,19 +247,30 @@ jobs:
           triple: ${{ matrix.triple }}
           cargo-version: ${{ needs.version.outputs.cargo }}
 
-  build-vm-driver:
-    needs: [pr_metadata, version, build-binaries]
+  build-vm-driver-linux:
+    needs: [pr_metadata, version, build-binaries-linux]
     if: needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       contents: read
-    uses: ./.github/workflows/build-vm-driver.yml
+    uses: ./.github/workflows/build-vm-driver-linux.yml
+    with:
+      cargo-version: ${{ needs.version.outputs.cargo }}
+    secrets:
+      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
+  build-vm-driver-macos:
+    needs: [pr_metadata, version, build-binaries-linux, build-binaries-macos]
+    if: needs.pr_metadata.outputs.run_core_e2e == 'true'
+    permissions:
+      contents: read
+    uses: ./.github/workflows/build-vm-driver-macos.yml
     with:
       cargo-version: ${{ needs.version.outputs.cargo }}
     secrets:
       CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
   build-images:
-    needs: [pr_metadata, build-binaries]
+    needs: [pr_metadata, build-binaries-linux]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_any_e2e == 'true'
     permissions:
       contents: read
@@ -258,7 +279,7 @@ jobs:
 
   build-deb:
     name: Build Debian packages
-    needs: [pr_metadata, version, build-binaries, build-vm-driver]
+    needs: [pr_metadata, version, build-binaries-linux, build-vm-driver-linux]
     if: needs.pr_metadata.outputs.run_integration == 'true'
     permissions:
       contents: read
@@ -270,7 +291,7 @@ jobs:
 
   build-rpm:
     name: Build RPM packages
-    needs: [pr_metadata, version, build-binaries]
+    needs: [pr_metadata, version, build-binaries-linux]
     if: needs.pr_metadata.outputs.run_integration == 'true'
     permissions:
       actions: read
@@ -282,8 +303,48 @@ jobs:
       rpm-release: ${{ needs.version.outputs.rpm_release }}
       cargo-version: ${{ needs.version.outputs.cargo }}
 
+  # Test inputs don't depend on the packages, so build them while the packages
+  # build instead of in prepare-integration.
+  build-tmachine-test-inputs:
+    name: Build tmachine test inputs
+    needs: [pr_metadata]
+    if: needs.pr_metadata.outputs.run_integration == 'true'
+    permissions:
+      contents: read
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          ref: ${{ github.sha }}
+      - uses: ./.github/actions/setup-nix
+      - name: Build test archives
+        run: |
+          # Retry dependency preparation, then generate artifacts once.
+          nix build --no-link .#build-artifacts-test-archives || nix build --no-link .#build-artifacts-test-archives
+          nix run .#build-artifacts-test-archives
+      - name: Build test workload images
+        run: |
+          # Retry dependency preparation, then generate artifacts once.
+          nix build --no-link .#build-artifacts-test-images || nix build --no-link .#build-artifacts-test-images
+          nix run .#build-artifacts-test-images
+      - name: Package Helm chart
+        run: |
+          # Retry dependency preparation, then generate artifacts once.
+          nix build --no-link .#build-artifacts-helm || nix build --no-link .#build-artifacts-helm
+          nix run .#build-artifacts-helm
+      - name: Upload tmachine test inputs
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: openshell-tmachine-test-inputs
+          path: artifacts
+          compression-level: 0
+          retention-days: 5
+          if-no-files-found: error
+
   prepare-integration:
-    needs: [pr_metadata, build-binaries, build-images, build-deb, build-rpm]
+    needs: [pr_metadata, build-binaries-linux, build-images, build-deb, build-rpm, build-tmachine-test-inputs]
     if: needs.pr_metadata.outputs.run_integration == 'true'
     permissions:
       actions: read
@@ -293,6 +354,7 @@ jobs:
     with:
       deb-artifact-name: deb-linux-amd64
       rpm-artifact-name: rpm-linux-x86_64
+      test-inputs-artifact-name: openshell-tmachine-test-inputs
 
   # Run driver-independent conformance tests.
   conformance-integration:
@@ -361,7 +423,7 @@ jobs:
         ]
 
   docker-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -374,7 +436,7 @@ jobs:
       runner: linux-arm64-cpu8
 
   podman-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -388,7 +450,7 @@ jobs:
         [{"suite":"ci","runner":"ubuntu-26.04","podman_major":"5","podman_package_version":"5.7.0+ds2-3build1","conmon_package_version":"2.1.13+ds1-2","cmd":"mise run --no-deps --skip-deps e2e:podman:ci"}]
 
   podman-additional-ca-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -402,7 +464,7 @@ jobs:
         [{"suite":"additional-ca","runner":"ubuntu-26.04","podman_major":"5","podman_package_version":"5.7.0+ds2-3build1","conmon_package_version":"2.1.13+ds1-2","cmd":"OPENSHELL_E2E_PODMAN_TEST=additional_ca mise run --no-deps --skip-deps e2e:podman"}]
 
   vm-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-vm-driver]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-vm-driver-linux]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -413,7 +475,7 @@ jobs:
       prebuilt-conformance: true
 
   vm-additional-ca-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-vm-driver]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-vm-driver-linux]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -426,7 +488,7 @@ jobs:
       test-name: additional_ca
 
   docker-external-driver-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-gateway-plain, build-external-drivers, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-gateway-plain, build-external-drivers, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -443,7 +505,7 @@ jobs:
         [{"suite":"external-driver","cmd":"mise run --no-deps --skip-deps e2e:docker:external-driver","apt_packages":"openssh-client","python_proto":false,"mcp":false}]
 
   podman-external-driver-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-gateway-plain, build-external-drivers, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-gateway-plain, build-external-drivers, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -459,7 +521,7 @@ jobs:
         [{"suite":"external-driver","runner":"ubuntu-26.04","podman_major":"5","podman_package_version":"5.7.0+ds2-3build1","conmon_package_version":"2.1.13+ds1-2","cmd":"mise run --no-deps --skip-deps e2e:podman:external-driver"}]
 
   vm-external-driver-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-gateway-plain, build-vm-driver]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-gateway-plain, build-vm-driver-linux]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -473,7 +535,7 @@ jobs:
       e2e-task: e2e:vm:external-driver
 
   gpu-e2e:
-    needs: [pr_metadata, build-binaries, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_gpu_e2e == 'true'
     permissions:
       actions: read
@@ -484,7 +546,7 @@ jobs:
       image-tag: ${{ github.sha }}
 
   kubernetes-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     strategy:
       fail-fast: false
@@ -515,7 +577,7 @@ jobs:
       test-name: ${{ matrix.test_name }}
 
   kubernetes-app-listener-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     strategy:
       fail-fast: false
@@ -553,7 +615,7 @@ jobs:
       listener-takeover: ${{ matrix.takeover }}
 
   kubernetes-workspace-managed-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -567,7 +629,7 @@ jobs:
       e2e-task: e2e:kubernetes:workspace-managed
 
   kubernetes-external-driver-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-gateway-plain, build-external-drivers, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-gateway-plain, build-external-drivers, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -584,7 +646,7 @@ jobs:
       cluster-images: sandbox supervisor
 
   kubernetes-workspace-operator-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -598,7 +660,7 @@ jobs:
       e2e-task: e2e:kubernetes:workspace-operator
 
   kubernetes-ha-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_kubernetes_ha_e2e == 'true'
     permissions:
       actions: read
@@ -616,7 +678,7 @@ jobs:
       use-envoy-gateway: true
 
   kubernetes-credential-drivers-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_kubernetes_credential_drivers_e2e == 'true'
     permissions:
       actions: read
@@ -633,6 +695,8 @@ jobs:
     name: Core E2E result
     needs:
       - pr_metadata
+      - build-binaries-macos
+      - build-vm-driver-macos
       - conformance-integration
       - feature-specific-integration
       - driver-specific-integration
@@ -662,7 +726,7 @@ jobs:
 
   gpu-e2e-result:
     name: GPU E2E result
-    needs: [pr_metadata, gpu-e2e]
+    needs: [pr_metadata, build-binaries-macos, gpu-e2e]
     if: always() && needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_gpu_e2e == 'true'
     runs-on: ubuntu-latest
     steps:
@@ -675,7 +739,7 @@ jobs:
 
   kubernetes-ha-e2e-result:
     name: Kubernetes HA E2E result
-    needs: [pr_metadata, kubernetes-ha-e2e]
+    needs: [pr_metadata, build-binaries-macos, kubernetes-ha-e2e]
     if: always() && needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_kubernetes_ha_e2e == 'true'
     runs-on: ubuntu-latest
     steps:
@@ -688,7 +752,7 @@ jobs:
 
   kubernetes-credential-drivers-e2e-result:
     name: Kubernetes Credential Drivers E2E result
-    needs: [pr_metadata, kubernetes-credential-drivers-e2e]
+    needs: [pr_metadata, build-binaries-macos, kubernetes-credential-drivers-e2e]
     if: always() && needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_kubernetes_credential_drivers_e2e == 'true'
     runs-on: ubuntu-latest
     steps:

.github/workflows/build-binaries.yml …ithub/workflows/build-binaries-linux.yml.github/workflows/build-binaries.yml renamed to .github/workflows/build-binaries-linux.yml .github/workflows/build-binaries.yml renamed to .github/workflows/build-binaries-linux.yml

@@ -1,7 +1,7 @@
 # SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 
-name: Build Binaries
+name: Build Linux Binaries
 
 on:
   workflow_call:
@@ -40,8 +40,6 @@ jobs:
             runner: linux-amd64-cpu8
           - triple: aarch64-unknown-linux-musl
             runner: linux-arm64-cpu8
-          - triple: aarch64-apple-darwin
-            runner: macos-15-xlarge
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
     steps: &build_steps
@@ -74,8 +72,6 @@ jobs:
             runner: linux-amd64-cpu8
           - triple: aarch64-unknown-linux-musl
             runner: linux-arm64-cpu8
-          - triple: aarch64-apple-darwin
-            runner: macos-15-xlarge
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
     steps: *build_steps
@@ -92,8 +88,6 @@ jobs:
             runner: linux-amd64-cpu8
           - triple: aarch64-unknown-linux-gnu
             runner: linux-arm64-cpu8
-          - triple: aarch64-apple-darwin
-            runner: macos-15-xlarge
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
     steps: *build_steps
@@ -122,10 +116,6 @@ jobs:
             binary: openshell-supervisor
             triple: aarch64-unknown-linux-gnu
             runner: linux-arm64-cpu8
-          - package: openshell-supervisor
-            binary: openshell-supervisor
-            triple: aarch64-apple-darwin
-            runner: macos-15-xlarge
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
     steps: *build_steps