ci(e2e): split binary builds into per-platform workflows

Branch E2E used flags on the shared build workflows to keep Linux and
macOS apart. Make each platform its own reusable workflow instead, with
a plain matrix, so a consumer depends only on the platforms it needs and
adding a platform means adding a workflow rather than another flag.

Move the VM driver build steps shared by both platforms into a
composite action. Release workflows call both platforms and keep their
existing gating.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

Author: matthewgrossman

.github/actions/build-vm-driver/action.yml

@@ -0,0 +1,75 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Build VM Driver
+description: Assemble the compressed VM runtime and build openshell-driver-vm
+
+inputs:
+  arch:
+    description: Guest architecture used to select the Linux sandbox and VM init artifacts
+    required: true
+  triple:
+    description: Rust target triple of the driver
+    required: true
+  supervisor-artifact:
+    description: Artifact containing the openshell-supervisor binary embedded in the runtime
+    required: true
+  cargo-version:
+    description: Cargo package version embedded in the binary
+    required: true
+  supervisor-image-tag:
+    description: Default supervisor image tag embedded in the binary
+    required: false
+    default: ""
+  entitlements-file:
+    description: Path to an entitlements plist for macOS ad-hoc codesigning
+    required: false
+    default: ""
+runs:
+  using: composite
+  steps:
+    - name: Download openshell-sandbox
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        name: openshell-sandbox-${{ inputs.arch }}-unknown-linux-musl
+        path: sandbox
+
+    - name: Download openshell-supervisor
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        name: ${{ inputs.supervisor-artifact }}
+        path: supervisor
+
+    - name: Download VM guest init
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        name: openshell-vm-init-${{ inputs.arch }}-unknown-linux-musl
+        path: vm-init
+
+    - name: Build VM runtime
+      shell: nix develop -c bash -euo pipefail {0}
+      run: |
+        # HTTP 416 is not retried by Nix; restart the build once on failure.
+        nix build .#vm-runtime || nix build .#vm-runtime
+
+    - name: Assemble compressed VM runtime
+      shell: nix develop -c bash -euo pipefail {0}
+      run: |
+        compressed_dir="${RUNNER_TEMP}/vm-runtime-compressed"
+        install -d "$compressed_dir"
+        cp result/compressed/*.zst "$compressed_dir/"
+        zstd -19 -T1 sandbox/openshell-sandbox -o "$compressed_dir/openshell-sandbox.zst"
+        zstd -19 -T1 supervisor/openshell-supervisor -o "$compressed_dir/openshell-supervisor.zst"
+        zstd -19 -T1 vm-init/openshell-vm-init -o "$compressed_dir/openshell-vm-init.zst"
+
+    - name: Build openshell-driver-vm
+      uses: ./.github/actions/build-rust-binary
+      env:
+        OPENSHELL_VM_RUNTIME_COMPRESSED_DIR: ${{ runner.temp }}/vm-runtime-compressed
+      with:
+        package: openshell-driver-vm
+        binary: openshell-driver-vm
+        triple: ${{ inputs.triple }}
+        cargo-version: ${{ inputs.cargo-version }}
+        supervisor-image-tag: ${{ inputs.supervisor-image-tag }}
+        entitlements-file: ${{ inputs.entitlements-file }}

.github/workflows/branch-e2e.yml

@@ -101,27 +101,23 @@ jobs:
             echo "rpm_release=$rpm_release"
           } >> "$GITHUB_OUTPUT"
 
-  build-binaries:
+  build-binaries-linux:
     needs: version
     permissions:
       contents: read
-    uses: ./.github/workflows/build-binaries.yml
+    uses: ./.github/workflows/build-binaries-linux.yml
     with:
       cargo-version: ${{ needs.version.outputs.cargo }}
-      macos: false
     secrets:
       CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
-  # macOS runners can queue for a long time. A separate call lets Linux
-  # consumers start as soon as the Linux binaries are ready.
   build-binaries-macos:
     needs: version
     permissions:
       contents: read
-    uses: ./.github/workflows/build-binaries.yml
+    uses: ./.github/workflows/build-binaries-macos.yml
     with:
       cargo-version: ${{ needs.version.outputs.cargo }}
-      linux: false
     secrets:
       CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
@@ -160,7 +156,7 @@ jobs:
 
   # The conformance program, built once per architecture for the host lanes.
   # It lives in its own workspace and is not released, so it is not part of
-  # build-binaries.yml.
+  # build-binaries-linux.yml.
   build-conformance:
     name: openshell-conformance (${{ matrix.triple }})
     needs: [pr_metadata]
@@ -251,32 +247,30 @@ jobs:
           triple: ${{ matrix.triple }}
           cargo-version: ${{ needs.version.outputs.cargo }}
 
-  build-vm-driver:
-    needs: [pr_metadata, version, build-binaries]
+  build-vm-driver-linux:
+    needs: [pr_metadata, version, build-binaries-linux]
     if: needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       contents: read
-    uses: ./.github/workflows/build-vm-driver.yml
+    uses: ./.github/workflows/build-vm-driver-linux.yml
     with:
       cargo-version: ${{ needs.version.outputs.cargo }}
-      macos: false
     secrets:
       CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
   build-vm-driver-macos:
-    needs: [pr_metadata, version, build-binaries, build-binaries-macos]
+    needs: [pr_metadata, version, build-binaries-linux, build-binaries-macos]
     if: needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       contents: read
-    uses: ./.github/workflows/build-vm-driver.yml
+    uses: ./.github/workflows/build-vm-driver-macos.yml
     with:
       cargo-version: ${{ needs.version.outputs.cargo }}
-      linux: false
     secrets:
       CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
   build-images:
-    needs: [pr_metadata, build-binaries]
+    needs: [pr_metadata, build-binaries-linux]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_any_e2e == 'true'
     permissions:
       contents: read
@@ -285,7 +279,7 @@ jobs:
 
   build-deb:
     name: Build Debian packages
-    needs: [pr_metadata, version, build-binaries, build-vm-driver]
+    needs: [pr_metadata, version, build-binaries-linux, build-vm-driver-linux]
     if: needs.pr_metadata.outputs.run_integration == 'true'
     permissions:
       contents: read
@@ -297,7 +291,7 @@ jobs:
 
   build-rpm:
     name: Build RPM packages
-    needs: [pr_metadata, version, build-binaries]
+    needs: [pr_metadata, version, build-binaries-linux]
     if: needs.pr_metadata.outputs.run_integration == 'true'
     permissions:
       actions: read
@@ -350,7 +344,7 @@ jobs:
           if-no-files-found: error
 
   prepare-integration:
-    needs: [pr_metadata, build-binaries, build-images, build-deb, build-rpm, build-tmachine-test-inputs]
+    needs: [pr_metadata, build-binaries-linux, build-images, build-deb, build-rpm, build-tmachine-test-inputs]
     if: needs.pr_metadata.outputs.run_integration == 'true'
     permissions:
       actions: read
@@ -428,7 +422,7 @@ jobs:
         ]
 
   docker-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -441,7 +435,7 @@ jobs:
       runner: linux-arm64-cpu8
 
   podman-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -455,7 +449,7 @@ jobs:
         [{"suite":"ci","runner":"ubuntu-26.04","podman_major":"5","podman_package_version":"5.7.0+ds2-3build1","conmon_package_version":"2.1.13+ds1-2","cmd":"mise run --no-deps --skip-deps e2e:podman:ci"}]
 
   podman-additional-ca-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -469,7 +463,7 @@ jobs:
         [{"suite":"additional-ca","runner":"ubuntu-26.04","podman_major":"5","podman_package_version":"5.7.0+ds2-3build1","conmon_package_version":"2.1.13+ds1-2","cmd":"OPENSHELL_E2E_PODMAN_TEST=additional_ca mise run --no-deps --skip-deps e2e:podman"}]
 
   vm-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-vm-driver]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-vm-driver-linux]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -480,7 +474,7 @@ jobs:
       prebuilt-conformance: true
 
   vm-additional-ca-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-vm-driver]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-vm-driver-linux]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -493,7 +487,7 @@ jobs:
       test-name: additional_ca
 
   docker-external-driver-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-gateway-plain, build-external-drivers, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-gateway-plain, build-external-drivers, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -510,7 +504,7 @@ jobs:
         [{"suite":"external-driver","cmd":"mise run --no-deps --skip-deps e2e:docker:external-driver","apt_packages":"openssh-client","python_proto":false,"mcp":false}]
 
   podman-external-driver-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-gateway-plain, build-external-drivers, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-gateway-plain, build-external-drivers, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -526,7 +520,7 @@ jobs:
         [{"suite":"external-driver","runner":"ubuntu-26.04","podman_major":"5","podman_package_version":"5.7.0+ds2-3build1","conmon_package_version":"2.1.13+ds1-2","cmd":"mise run --no-deps --skip-deps e2e:podman:external-driver"}]
 
   vm-external-driver-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-gateway-plain, build-vm-driver]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-gateway-plain, build-vm-driver-linux]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -540,7 +534,7 @@ jobs:
       e2e-task: e2e:vm:external-driver
 
   gpu-e2e:
-    needs: [pr_metadata, build-binaries, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_gpu_e2e == 'true'
     permissions:
       actions: read
@@ -551,7 +545,7 @@ jobs:
       image-tag: ${{ github.sha }}
 
   kubernetes-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     strategy:
       fail-fast: false
@@ -582,7 +576,7 @@ jobs:
       test-name: ${{ matrix.test_name }}
 
   kubernetes-app-listener-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     strategy:
       fail-fast: false
@@ -620,7 +614,7 @@ jobs:
       listener-takeover: ${{ matrix.takeover }}
 
   kubernetes-workspace-managed-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -634,7 +628,7 @@ jobs:
       e2e-task: e2e:kubernetes:workspace-managed
 
   kubernetes-external-driver-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-gateway-plain, build-external-drivers, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-gateway-plain, build-external-drivers, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -651,7 +645,7 @@ jobs:
       cluster-images: sandbox supervisor
 
   kubernetes-workspace-operator-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
@@ -665,7 +659,7 @@ jobs:
       e2e-task: e2e:kubernetes:workspace-operator
 
   kubernetes-ha-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_kubernetes_ha_e2e == 'true'
     permissions:
       actions: read
@@ -683,7 +677,7 @@ jobs:
       use-envoy-gateway: true
 
   kubernetes-credential-drivers-e2e:
-    needs: [pr_metadata, build-binaries, build-conformance, build-images]
+    needs: [pr_metadata, build-binaries-linux, build-conformance, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_kubernetes_credential_drivers_e2e == 'true'
     permissions:
       actions: read