test(upgrade): split RPM coverage from Debian qualification

Signed-off-by: Evan Lezar <elezar@nvidia.com>

Author: elezar

.agents/skills/test-release-canary/SKILL.md

@@ -40,10 +40,10 @@ gateway RPMs and matching runtime images. Branch RPM package builds run on
 every approved branch run, independently of optional E2E labels.
 
 The host-package jobs exercise fresh installs, not upgrades from persisted
-gateway state. Release Dev and Release Tag additionally run tmachine Ubuntu DEB
-and Fedora RPM upgrade lanes: they install the latest published release
-packages and matching runtime images, upgrade to the candidate packages, verify
-an existing sandbox survives, and create a new sandbox. Those lanes are part of
+gateway state. Release Dev and Release Tag additionally run a tmachine Ubuntu DEB
+upgrade lane: it installs the latest published release
+package and matching runtime images, upgrades to the candidate package, verifies
+an existing sandbox survives, and creates a new sandbox. That lane is part of
 the release conformance matrix, not this canary. Validate Homebrew exact-default
 migration with the release-tooling and package lifecycle tests before relying
 on the canary.

.github/workflows/branch-e2e.yml

@@ -261,7 +261,7 @@ jobs:
 
   prepare-integration-upgrades:
     name: Prepare upgrade qualification inputs
-    needs: [pr_metadata, build-binaries, build-images, build-deb, build-rpm]
+    needs: [pr_metadata, build-binaries, build-images, build-deb]
     if: needs.pr_metadata.outputs.run_integration_upgrades == 'true'
     permissions:
       actions: read
@@ -270,9 +270,7 @@ jobs:
     uses: ./.github/workflows/prepare-integration-inputs.yml
     with:
       deb-artifact-name: deb-linux-amd64
-      rpm-artifact-name: rpm-linux-x86_64
       include-deb-upgrade-source: true
-      include-rpm-upgrade-source: true
 
   integration-upgrades:
     name: Integration upgrades
@@ -288,8 +286,7 @@ jobs:
       integration-inputs-artifact-id: ${{ needs.prepare-integration-upgrades.outputs.integration_inputs_artifact_id }}
       test-matrix: >-
         [
-          {"environment":"ubuntu-docker-rootful","installer":"deb-upgrade-source","testsuite":"deb-upgrade"},
-          {"environment":"fedora-podman-rootless","installer":"rpm-upgrade-source","testsuite":"rpm-upgrade"}
+          {"environment":"ubuntu-docker-rootful","installer":"deb-upgrade-source","testsuite":"deb-upgrade"}
         ]
 
   # Run driver-independent conformance tests.

.github/workflows/e2e-label-help.yml

@@ -51,8 +51,8 @@ jobs:
               status_summary="The matching required CI gate status on this PR will flip green automatically once the run finishes."
               ;;
             test:upgrade)
-              suite_summary="the Debian and RPM upgrade qualification"
-              build_summary="DEB and RPM packages, VM driver, sandbox image, and supervisor image"
+              suite_summary="the Debian upgrade qualification"
+              build_summary="DEB package, VM driver, sandbox image, and supervisor image"
               status_summary="This is an optional proof-of-life suite; failures are visible in the workflow run but do not publish a required CI gate status."
               ;;
             test:e2e-kubernetes)

.github/workflows/prepare-integration-inputs.yml

@@ -31,11 +31,6 @@ on:
         required: false
         type: boolean
         default: false
-      include-rpm-upgrade-source:
-        description: Include the latest published release RPMs and runtime images as upgrade inputs
-        required: false
-        type: boolean
-        default: false
     outputs:
       source_sha:
         description: Source revision of the candidate artifacts
@@ -141,7 +136,7 @@ jobs:
           rm -rf "$download_dir"
 
       - name: Resolve released upgrade source
-        if: inputs['include-deb-upgrade-source'] || inputs['include-rpm-upgrade-source']
+        if: inputs['include-deb-upgrade-source']
         id: upgrade-source
         env:
           GH_TOKEN: ${{ github.token }}
@@ -186,7 +181,7 @@ jobs:
       # this release tag, while tmachine consumes tarballs to keep guest setup
       # independent of registry access.
       - name: Export released runtime images for upgrade sources
-        if: inputs['include-deb-upgrade-source'] || inputs['include-rpm-upgrade-source']
+        if: inputs['include-deb-upgrade-source']
         env:
           IMAGE_TAG: ${{ steps.upgrade-source.outputs.tag }}
         run: |
@@ -200,41 +195,6 @@ jobs:
           docker pull "ghcr.io/nvidia/openshell/supervisor:${image_tag}"
           docker save --output artifacts/upgrade/source-images/openshell-supervisor-tmachine.tar "ghcr.io/nvidia/openshell/supervisor:${image_tag}"
 
-      - name: Download released RPM upgrade source
-        if: inputs['include-rpm-upgrade-source']
-        env:
-          GH_TOKEN: ${{ github.token }}
-          SOURCE_TAG: ${{ steps.upgrade-source.outputs.tag }}
-        run: |
-          set -euo pipefail
-          gh release download "$SOURCE_TAG" --repo "$GITHUB_REPOSITORY" \
-            --pattern 'openshell-[0-9]*.x86_64.rpm' \
-            --pattern 'openshell-gateway-[0-9]*.x86_64.rpm' \
-            --pattern openshell-checksums-sha256.txt \
-            --dir artifacts/upgrade/rpm/source/download
-
-      - name: Stage released RPM upgrade source
-        if: inputs['include-rpm-upgrade-source']
-        run: |
-          set -euo pipefail
-          source_dir=artifacts/upgrade/rpm/source
-          download_dir="${source_dir}/download"
-          cli_rpm=$(find "$download_dir" -maxdepth 1 -type f -name 'openshell-[0-9]*.x86_64.rpm' -print -quit)
-          gateway_rpm=$(find "$download_dir" -maxdepth 1 -type f -name 'openshell-gateway-[0-9]*.x86_64.rpm' -print -quit)
-          if [[ -z "$cli_rpm" || -z "$gateway_rpm" || ! -f "${download_dir}/openshell-checksums-sha256.txt" ]]; then
-            echo "released source artifact did not contain the expected RPMs and checksums" >&2
-            exit 1
-          fi
-          (
-            cd "$download_dir"
-            grep -F " $(basename "$cli_rpm")" openshell-checksums-sha256.txt | sha256sum --check --status
-            grep -F " $(basename "$gateway_rpm")" openshell-checksums-sha256.txt | sha256sum --check --status
-          )
-          mv "$cli_rpm" "${source_dir}/openshell.rpm"
-          mv "$gateway_rpm" "${source_dir}/openshell-gateway.rpm"
-          mv "${download_dir}/openshell-checksums-sha256.txt" "${source_dir}/openshell-checksums-sha256.txt"
-          rm -rf "$download_dir"
-
       - name: Log in to GHCR
         run: echo "${{ github.token }}" | docker login ghcr.io -u "${GITHUB_ACTOR}" --password-stdin
 

.github/workflows/release-dev.yml

@@ -112,7 +112,6 @@ jobs:
       deb-artifact-name: deb-linux-amd64
       rpm-artifact-name: rpm-linux-x86_64
       include-deb-upgrade-source: true
-      include-rpm-upgrade-source: true
 
   conformance-integration:
     needs: prepare-integration
@@ -129,7 +128,6 @@ jobs:
         [
           {"environment":"ubuntu-docker-rootful","installer":"deb","testsuite":"conformance"},
           {"environment":"ubuntu-docker-rootful","installer":"deb-upgrade-source","testsuite":"deb-upgrade"},
-          {"environment":"fedora-podman-rootless","installer":"rpm-upgrade-source","testsuite":"rpm-upgrade"},
           {"environment":"ubuntu-k3s","installer":"k3s","testsuite":"conformance"},
           {"environment":"fedora-podman-rootful","installer":"rpm","testsuite":"conformance"},
           {"environment":"fedora-podman-rootless","installer":"rpm","testsuite":"conformance"}

.github/workflows/release-tag.yml

@@ -163,7 +163,6 @@ jobs:
       deb-artifact-name: deb-linux-amd64
       rpm-artifact-name: rpm-linux-x86_64
       include-deb-upgrade-source: true
-      include-rpm-upgrade-source: true
 
   conformance-integration:
     needs: prepare-integration
@@ -180,7 +179,6 @@ jobs:
         [
           {"environment":"ubuntu-docker-rootful","installer":"deb","testsuite":"conformance"},
           {"environment":"ubuntu-docker-rootful","installer":"deb-upgrade-source","testsuite":"deb-upgrade"},
-          {"environment":"fedora-podman-rootless","installer":"rpm-upgrade-source","testsuite":"rpm-upgrade"},
           {"environment":"ubuntu-k3s","installer":"k3s","testsuite":"conformance"},
           {"environment":"fedora-podman-rootful","installer":"rpm","testsuite":"conformance"},
           {"environment":"fedora-podman-rootless","installer":"rpm","testsuite":"conformance"}

CI.md

@@ -92,7 +92,7 @@ the tmachine upgrade execution and its runtime-image preparation.
 - `test:e2e` runs the Docker, rootless Podman, Kubernetes, and VM E2E suites
   with both managed and standalone compute drivers in `Branch E2E Checks`
 - `test:e2e-gpu` runs GPU E2E in `Branch E2E Checks`
-- `test:upgrade` runs tmachine Debian and RPM upgrade qualification in
+- `test:upgrade` runs tmachine Debian upgrade qualification in
   `Branch E2E Checks`: the latest published release packages and matching
   runtime images are installed first, then the PR's packages are installed and
   both existing and new sandboxes are verified
@@ -454,7 +454,7 @@ its own stable result status.
 Merge-group runs use the `merge_group` event. The event is distinct from `pull_request` and `push`, and GitHub will not report required checks for queued PRs unless the workflows include it. In this repository:
 
 - `Branch Checks` runs the standard non-E2E gates on the merge-group SHA.
-- `Branch E2E Checks` runs core E2E and GPU E2E for merge groups. Debian and RPM upgrade qualification and Kubernetes HA E2E remain optional and label-driven on PRs.
+- `Branch E2E Checks` runs core E2E and GPU E2E for merge groups. Debian upgrade qualification and Kubernetes HA E2E remain optional and label-driven on PRs.
 - `Helm Lint` runs for merge groups without the PR diff optimization, because the merge-group branch is the final integration state.
 - `Trivy Changes` compares the merge-group configuration with its base and rejects new High or Critical findings.
 - `Required CI Gates` posts the same `OpenShell / ...` statuses to the merge-group SHA and does not require a `pull-request/<N>` mirror for merge-group events.
@@ -480,7 +480,7 @@ The bot's full administrator documentation is internal to NVIDIA. The only comma
 | File | Role |
 |---|---|
 | `.github/workflows/branch-checks.yml` | Required non-E2E checks. Triggers on `push: pull-request/[0-9]+` for PR mirrors and `merge_group` for queued merges. |
-| `.github/workflows/branch-e2e.yml` | Standard, GPU, Debian and RPM upgrade, Kubernetes HA, and Kubernetes credential-driver E2E. PR mirror pushes use `test:e2e`, `test:e2e-gpu`, `test:upgrade`, and `test:e2e-kubernetes` labels; merge groups run core and GPU E2E. |
+| `.github/workflows/branch-e2e.yml` | Standard, GPU, Debian upgrade, Kubernetes HA, and Kubernetes credential-driver E2E. PR mirror pushes use `test:e2e`, `test:e2e-gpu`, `test:upgrade`, and `test:e2e-kubernetes` labels; merge groups run core and GPU E2E. |
 | `.github/workflows/build-binaries.yml`, `build-vm-driver.yml` | Shared binary matrices used by branch and release workflows. The VM driver remains separate because its build consumes the runtime binaries. |
 | `.github/workflows/build-images.yml` | Builds and pushes multi-platform images, then uploads the same OCI images as workflow artifacts. |
 | `.github/workflows/package-release-binaries.yml` | Packages raw build artifacts into release tarballs without rebuilding them. |