ci: add the package-currency workflow (lane 2)

.github/workflows/package-currency.yml

@@ -0,0 +1,225 @@
+name: PVE Package Currency
+
+# Lane 2 of the two-lane CI split (see docs/lane2-change-plan.md).
+#
+# Lane 1 (integration-tests.yml) pins the nested nodes to what the ISO ships
+# and never upgrades — that pin is what makes it a stable merge gate.
+# This lane does the opposite: it dist-upgrades the nested nodes to current
+# PVE, reboots onto the new kernel, records the package set, and runs the full
+# suite against it.
+#
+# REPORT-ONLY. Test failures here do NOT fail the job — this lane never gates
+# a merge, and a red weekly cron nobody can action becomes noise. The signal is
+# the recorded package set and (from commit 3) the rolling issue, not the check
+# colour. A failure of the lane's own machinery — provisioning, upgrade, reboot
+# — still fails the job, because that means the lane learned nothing.
+#
+# Shares the `integration-tests` concurrency group: both lanes drive the same
+# nested VMIDs on the same parent node, so they must never run at once.
+
+concurrency:
+  group: integration-tests
+  cancel-in-progress: false
+
+on:
+  schedule:
+    # Mondays 06:00 UTC. Weekly is deliberate: this lane exists to notice
+    # upstream drift, and PVE's no-subscription repo does not move hourly.
+    - cron: '0 6 * * 1'
+  workflow_dispatch:
+    inputs:
+      keep_vms:
+        description: 'Skip cleanup so the nested PVE VMs survive for inspection'
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+  packages: write
+
+env:
+  SCRIPTS_DIR: tests/infrastructure/scripts
+  TEST_IMAGE: ghcr.io/goodolclint/psproxmoxve-integration
+  CACHE_DIR: /opt/pve-integration
+  PVE_VERSIONS: '9'
+  PVE9_ISO: proxmox-ve_9.2-1.iso
+
+jobs:
+  # ── Build module artifact (GitHub-hosted) ────────────────────────
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v6
+        with:
+          dotnet-version: '10.0.x'
+
+      - name: Build module
+        run: dotnet publish src/PSProxmoxVE/PSProxmoxVE.csproj --configuration Release --framework netstandard2.0 --output ./publish/netstandard2.0
+
+      - name: Clean publish output
+        run: rm -f ./publish/netstandard2.0/*.deps.json
+
+      - name: Upload module artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: module-currency
+          path: ./publish/netstandard2.0/
+
+  # ── Build test container image (GitHub-hosted) ───────────────────────
+  container-image:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: tests/Dockerfile.test
+          target: dev-infra
+          push: true
+          tags: ${{ env.TEST_IMAGE }}:${{ github.sha }}
+
+  # ── Provision, dist-upgrade, reboot (self-hosted) ────────────────────
+  provision:
+    needs: [build, container-image]
+    runs-on: psproxmoxve
+    timeout-minutes: 60
+    container:
+      image: ghcr.io/goodolclint/psproxmoxve-integration:${{ github.sha }}
+      credentials:
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+      volumes:
+        - /opt/pve-integration:/opt/pve-integration
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Provision PVE instances and dist-upgrade
+        shell: bash
+        env:
+          PVE_ENDPOINT: ${{ secrets.PVE_ENDPOINT }}
+          PVE_API_TOKEN: ${{ secrets.PVE_API_TOKEN }}
+          PVE_TARGET_NODE: ${{ vars.PVE_TARGET_NODE }}
+          PVE_PASSWORD: ${{ secrets.PVE_TEST_PASSWORD }}
+          STORAGE_VM_FQDN: ${{ vars.STORAGE_VM_FQDN }}
+          TF_VAR_disk_storage: ${{ vars.DISK_STORAGE }}
+          TF_VAR_iso_storage: ${{ vars.ISO_STORAGE }}
+          TF_VAR_network_bridge: ${{ vars.NETWORK_BRIDGE }}
+          TF_VAR_pool_id: ${{ vars.POOL_ID }}
+          # The one line that separates this lane from lane 1.
+          PVE_DIST_UPGRADE: '1'
+        run: bash ${SCRIPTS_DIR}/run-integration.sh provision
+
+      # success() not always(): when provisioning succeeded the package file
+      # must exist, and if-no-files-found: error enforces that invariant. When
+      # provisioning failed the job is already red, and a missing-artifact
+      # error would only bury the real cause.
+      - name: Upload recorded package set
+        if: success()
+        uses: actions/upload-artifact@v7
+        with:
+          name: pve-package-set
+          path: ${{ env.CACHE_DIR }}/work/*-packages.txt
+          if-no-files-found: error
+
+  # ── Integration tests against the upgraded nodes ─────────────────────
+  test:
+    needs: [build, provision]
+    runs-on: psproxmoxve
+    timeout-minutes: 20
+    container:
+      image: ghcr.io/goodolclint/psproxmoxve-integration:${{ github.sha }}
+      credentials:
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+      volumes:
+        - /opt/pve-integration:/opt/pve-integration
+    strategy:
+      fail-fast: false
+      matrix:
+        pve_version: ['9']
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Download module artifact
+        uses: actions/download-artifact@v8
+        with:
+          name: module-currency
+          path: ./publish/netstandard2.0/
+
+      # continue-on-error is the report-only decision made concrete: a module
+      # broken against current PVE must not turn this cron red.
+      - name: Run integration tests (PVE ${{ matrix.pve_version }})
+        id: suite
+        continue-on-error: true
+        shell: bash
+        env:
+          PVE_PASSWORD: ${{ secrets.PVE_TEST_PASSWORD }}
+          MODULE_ARTIFACT: ./publish/netstandard2.0
+        run: bash ${SCRIPTS_DIR}/run-integration.sh test ${{ matrix.pve_version }}
+
+      - name: Record suite outcome
+        shell: bash
+        run: |
+          echo "Suite outcome against current PVE: ${{ steps.suite.outcome }}"
+
+      - name: Diagnose cluster state
+        if: steps.suite.outcome == 'failure'
+        shell: bash
+        env:
+          PVE_PASSWORD: ${{ secrets.PVE_TEST_PASSWORD }}
+        run: bash ${SCRIPTS_DIR}/diagnose-cluster.sh ${{ matrix.pve_version }}
+
+      - name: Upload test results
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: currency-test-results-pve${{ matrix.pve_version }}
+          path: TestResults/
+
+  # ── Cleanup: destroy all VMs (always runs) ──────────────────────
+  cleanup:
+    needs: [provision, test]
+    if: always() && needs.provision.result != 'skipped' && !inputs.keep_vms
+    runs-on: psproxmoxve
+    timeout-minutes: 15
+    container:
+      image: ghcr.io/goodolclint/psproxmoxve-integration:${{ github.sha }}
+      credentials:
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+      volumes:
+        - /opt/pve-integration:/opt/pve-integration
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Cleanup PVE instances
+        shell: bash
+        env:
+          PVE_ENDPOINT: ${{ secrets.PVE_ENDPOINT }}
+          PVE_API_TOKEN: ${{ secrets.PVE_API_TOKEN }}
+          PVE_TARGET_NODE: ${{ vars.PVE_TARGET_NODE }}
+          PVE_PASSWORD: ${{ secrets.PVE_TEST_PASSWORD }}
+          STORAGE_VM_FQDN: ${{ vars.STORAGE_VM_FQDN }}
+          TF_VAR_disk_storage: ${{ vars.DISK_STORAGE }}
+          TF_VAR_iso_storage: ${{ vars.ISO_STORAGE }}
+          TF_VAR_network_bridge: ${{ vars.NETWORK_BRIDGE }}
+          TF_VAR_pool_id: ${{ vars.POOL_ID }}
+        run: bash ${SCRIPTS_DIR}/run-integration.sh force-cleanup

tests/infrastructure/scripts/prepare-test-environment.sh

@@ -49,6 +49,12 @@ if [[ "${DIST_UPGRADE}" == "1" ]]; then
     # immediately would match the pre-reboot node and return at once.
     sleep 30
     bash "${SCRIPT_DIR}/wait-for-api.sh" "${NESTED_IP}" 8006 600
+
+    # The running kernel is the point of the reboot: the package set alone
+    # cannot show whether the node actually booted what it installed.
+    if [[ -n "${PKG_OUT}" ]]; then
+        ${SSH_CMD} "echo \"# running-kernel\t\$(uname -r)\"" >> "${PKG_OUT}"
+    fi
 fi
 
 # Enable snippets and import content types on local storage