Skip to content

ci: shard e2e matrix 2-way and pre-pull heavy images - #117

Draft
glours wants to merge 3 commits into
e2e-ci-optimizations-wave1-wave2from
e2e-ci-sharding-and-image-cache
Draft

glours wants to merge 3 commits into
e2e-ci-optimizations-wave1-wave2from
e2e-ci-sharding-and-image-cache

Conversation

@glours

@glours glours commented Aug 17, 2026

Copy link
Copy Markdown
Owner

What I did

Two independent CI optimisations stacked on top of the test-isolation PR:

1. Test sharding (reduces wall-clock time)

Each of the 6 e2e matrix cells is split into 2 shards (6 → 12 jobs):

  • Shard 1 — fast tests: the full suite minus the known I/O-heavy outliers (EXCLUDE_E2E_TESTS).
  • Shard 2 — heavy tests: all watch_test.go tests (7 serial tests with 90–120 s polls and large image downloads) plus TestLocalComposeBuild, TestBuildPlatformsWithCorrectBuildxConfig, TestBuildTLS, TestBuildPrivileged, TestBuildEntitlements.

The shard filter is a single E2E_HEAVY_TESTS env var exported once and reused in both plugin and standalone steps. make e2e-compose and make e2e-compose-standalone remain unchanged locally.

Expected impact: each shard ≈ 6 min wall-clock vs. the previous ≈ 11 min for the heaviest standalone cells.

2. Image pre-pull and GHA cache (reduces network waits)

A new allowlist .github/e2e-images.txt lists 9 passive images (docker:dind, mariadb, golang:alpine, fluent/fluent-bit:3.1.7-debug, registry:3, gtardif/sentences-*, nginx:alpine). Before the tests run, a GHA cache keyed on Docker engine version + file hash restores a tarball of those images; on a miss they are pulled in parallel and saved for the next run.

Images that are the subject of pull-policy/pull-skip assertions (alpine:* and fixtures under compose-pull/, image-identity/) are intentionally absent from the list.

⚠️ Workflow file — reviewer action required

The sandbox environment lacks the workflow GitHub OAuth scope needed to push to .github/workflows/. The .github/e2e-images.txt file is committed. The workflow changes are in .github/ci-workflow-shard-changes.patch:

git apply .github/ci-workflow-shard-changes.patch
git rm .github/ci-workflow-shard-changes.patch
git commit --amend --no-edit --signoff
git push --force-with-lease

The patch is the only missing piece; all other content is present in the branch.

Scope notes

A7 (migrate ~12 config-only e2e tests to unit tests) and A9 (framework-level resource sharing) are intentionally deferred: A7 requires testing the config renderer without a subprocess with non-trivial coverage risks; A9 needs measurement before investing (diagnostic: medium risk). Both are candidates for a follow-up.

Related issue

No related issue — CI infrastructure improvement.

(not mandatory) A picture of a cute animal, if possible in relation to what you did

Two pandas who finally got their own bamboo plots instead of sharing 🐼🐼

panda

@glours
glours force-pushed the e2e-ci-sharding-and-image-cache branch 3 times, most recently from f878666 to c0b8477 Compare August 18, 2026 07:43
…igurable

Several e2e tests used fixed host ports (8070, 8080, 8090, etc.), global
buildx builders registered with --use, and a hardcoded IPC container name.
Under parallel execution these shared daemon-level resources caused port
conflicts, buildkitd container-name collisions, and intermittent failures.
Separately, the standalone make target hardcoded -parallel=1, forcing the
entire standalone suite to run serially even though the same tests run in
parallel in plugin mode.

Changes:
- Convert fixed host ports in four fixtures (network-test, sentences,
  build-test, volume-test) to ephemeral bindings; add ServicePublishedPort
  helper to framework.go to resolve the actual mapped port at runtime.
- Give each buildx-builder test a unique daemon-scoped name via BuilderName
  helper, preventing container-name collisions between parallel goroutines.
  Applies to TestBuildPlatformsWithCorrectBuildxConfig, TestBuildPrivileged,
  TestBuildBuilder, TestBuildEntitlements, TestBuildTLS.
- Rename the fixed ipc_mode_container to a project-scoped name
  (ipc_e2e-src) and update the ipc-test fixture accordingly.
- Replace the hardcoded -parallel=1 in make e2e-compose-standalone with
  E2E_PARALLEL_PLUGIN?=4 and E2E_STANDALONE_PARALLEL?=4, aligning both
  modes with the effective GOMAXPROCS on 4-core GitHub Actions runners.
  Both variables are overridable (E2E_STANDALONE_PARALLEL=1 restores
  serial local debugging).
- Raise the poll delay in watch_test.go long-running polls (90s/120s
  timeout) from the default 100ms to 1s; bump cascade_test.go and
  publish_test.go from 100ms to 500ms. Reduces CPU pressure without
  affecting effective test duration.

The logging-driver fixture retains its fixed port 24224: the Docker fluentd
log driver encodes fluentd-address at service-start time, making ephemeral
resolution non-trivial. TestLoggingDriver is serial so there is no
collision risk in practice.

Signed-off-by: Guillaume Lours <glours@users.noreply.github.com>
@glours
glours force-pushed the e2e-ci-sharding-and-image-cache branch from c0b8477 to 8e52599 Compare August 18, 2026 07:44
Add a GHA cache layer for the passive Docker images used by the e2e suite.

Before each test run the workflow attempts to restore a pre-built tar
from the cache (key = Docker engine version + sha256 of the image list).
On a cache hit the images are loaded with 'docker load'; on a miss they
are pulled in parallel ('xargs -P 4 -n 1') and saved for the next run.

A new allowlist .github/e2e-images.txt controls which images are cached.
It includes the infrastructure images that every test cell downloads:
docker:dind, mariadb, golang:alpine, fluent/fluent-bit:3.1.7-debug,
registry:3, and the sentences/nginx helper images.  Images used by
pull-policy and image-identity assertions (alpine:* and several fixture-
specific tags) are intentionally absent so those tests remain unaffected.

The ci.yml changes are provided as .github/ci-workflow-cache-only.patch
because the sandbox environment lacks the GitHub 'workflow' OAuth scope.
Apply with:
  git apply .github/ci-workflow-cache-only.patch
  git rm .github/ci-workflow-cache-only.patch
  git commit --amend --no-edit --signoff

Also fix ServicePublishedPort helper to take only the first line of
'compose port' output (SplitN), making it robust when a service is scaled.

Signed-off-by: Guillaume Lours <glours@users.noreply.github.com>
@glours
glours force-pushed the e2e-ci-sharding-and-image-cache branch from 9045bd4 to 0f2a67f Compare August 18, 2026 08:58
The previous patch was generated with Python difflib which omits
the required leading space on blank context lines, producing a
'corrupt patch' error when applied with git apply.
Regenerated with git diff --cached to get proper unified diff format.

Signed-off-by: Guillaume Lours <glours@users.noreply.github.com>
@glours
glours force-pushed the e2e-ci-sharding-and-image-cache branch from 077f716 to 6602303 Compare August 18, 2026 09:04
@glours
glours force-pushed the e2e-ci-optimizations-wave1-wave2 branch from 057be6f to 797c4a3 Compare August 19, 2026 13:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant