refactor(tests): move tmachine support files under tests/tmachine

.gitignore

@@ -190,7 +190,7 @@ temp/
 e2e/gpu/images/.build/
 
 # Ansible Galaxy roles
-/tests/ansible/.roles/
+/tests/tmachine/ansible/.roles/
 
 # Secrets/credentials (should never be committed)
 *.pem

TESTING.md

@@ -371,7 +371,7 @@ Podman user-namespace mappings for the default, `auto`, `keep-id`, and private
 profiles. The E2E archive excludes binaries that still depend on wrapper-owned
 gateway controls, SPIFFE fixtures, the caller driver-config setting, or other
 guest setup. The `driver-podman` suite replaces the removed `podman_userns` E2E
-binary. `tests/artifacts.nix` keeps the follow-up exclusions explicit and uses
+binary. `tests/tmachine/artifacts.nix` keeps the follow-up exclusions explicit and uses
 the same filter for the generated inventory, so excluded binaries cannot appear
 as false passes or silently re-enter the archive.
 

flake.nix

@@ -126,12 +126,12 @@
           qemuPkgs = testGuestPkgs;
           firmwarePkgs = testGuestPkgs;
         };
-        testMachines = import ./tests/config.nix {
+        testMachines = import ./tests/tmachine/config.nix {
           inherit pkgs toolchains;
           qemuPkgs = tmachineRuntimePkgs;
           firmwarePkgs = tmachineRuntimePkgs;
         };
-        artifacts = pkgs.callPackage ./tests/artifacts.nix { inherit rustToolchain toolchains; };
+        artifacts = pkgs.callPackage ./tests/tmachine/artifacts.nix { inherit rustToolchain toolchains; };
         checkProtobufCompatibility = pkgs.writeShellApplication {
           name = "check-protobuf-compatibility";
           runtimeInputs = [
@@ -219,7 +219,7 @@
               ];
 
               shellHook = ''
-                export ANSIBLE_CONFIG="$(git rev-parse --show-toplevel)/tests/ansible/ansible.cfg"
+                export ANSIBLE_CONFIG="$(git rev-parse --show-toplevel)/tests/tmachine/ansible/ansible.cfg"
               '';
             }
           );

tasks/scripts/test-packaging-assets.sh

@@ -40,10 +40,10 @@ assert_file_exists() {
 service="${ROOT}/deploy/deb/openshell-gateway.service"
 control="${ROOT}/deploy/deb/control.in"
 spec="${ROOT}/openshell.spec"
-package_qualification="${ROOT}/tests/ansible/roles/openshell_packaged_gateway/tasks/main.yaml"
-tmachine_gateway_service="${ROOT}/tests/ansible/roles/openshell_gateway/templates/gateway.service.j2"
-tmachine_docker_config="${ROOT}/tests/ansible/roles/openshell_gateway/templates/gateway-docker.toml.j2"
-tmachine_podman_config="${ROOT}/tests/ansible/roles/openshell_gateway/templates/gateway-podman.toml.j2"
+package_qualification="${ROOT}/tests/tmachine/ansible/roles/openshell_packaged_gateway/tasks/main.yaml"
+tmachine_gateway_service="${ROOT}/tests/tmachine/ansible/roles/openshell_gateway/templates/gateway.service.j2"
+tmachine_docker_config="${ROOT}/tests/tmachine/ansible/roles/openshell_gateway/templates/gateway-docker.toml.j2"
+tmachine_podman_config="${ROOT}/tests/tmachine/ansible/roles/openshell_gateway/templates/gateway-podman.toml.j2"
 development_gateway="${ROOT}/nix/test-guest/provisioners/roles/gateway-podman/tasks/development-gateway.yml"
 
 assert_file_exists "$service"

tests/ansible/roles/openshell_diagnostics/tasks/main.yaml → tests/tmachine/ansible/roles/openshell_diagnostics/tasks/main.yaml

@@ -46,6 +46,6 @@
     - name: Fetch K3s diagnostics
       ansible.builtin.fetch:
         src: /var/lib/openshell/diagnostics/k3s.txt
-        dest: "{{ role_path }}/../../../../artifacts/tmachine-diagnostics/{{ inventory_hostname }}/k3s.txt"
+        dest: "{{ role_path }}/../../../../../artifacts/tmachine-diagnostics/{{ inventory_hostname }}/k3s.txt"
         flat: true
       failed_when: false

tests/artifacts.nix → tests/tmachine/artifacts.nix

@@ -12,7 +12,7 @@ let
   gnuToolchain = toolchains.${if isAarch64 then "aarch64-gnu" else "x86_64-gnu"};
   muslToolchain = toolchains.${if isAarch64 then "aarch64-musl" else "x86_64-musl"};
   dockerArch = if isAarch64 then "arm64" else "amd64";
-  linuxVmRuntime = pkgs.callPackage ../nix/pkgs/vm-runtime.nix {
+  linuxVmRuntime = pkgs.callPackage ../../nix/pkgs/vm-runtime.nix {
     stdenv = gnuToolchain.stdenv;
   };
   toolchainEnv = pkgs.lib.foldl' (env: toolchain: env // toolchain.env) { } (

tests/config.nix → tests/tmachine/config.nix

@@ -15,17 +15,17 @@ let
   images = import ./images.nix {
     inherit pkgs qemuPkgs firmwarePkgs;
   };
-  tmachine = pkgs.callPackage ./tmachine {
+  tmachine = pkgs.callPackage ./. {
     OVMF = firmwarePkgs.OVMF;
   };
   qemu = qemuPkgs.qemu.override { hostCpuOnly = true; };
   k3sInputs = {
     agent_sandbox_version = "0.5.0";
-    openshell_cli_binary = "../artifacts/binaries/${muslTarget}/openshell";
-    openshell_gateway_image = "../artifacts/images/openshell-gateway-tmachine.tar";
-    openshell_helm_chart = "../artifacts/helm/helm-chart-0.0.0.tgz";
-    openshell_sandbox_image = "../artifacts/images/openshell-sandbox-tmachine.tar";
-    openshell_supervisor_image = "../artifacts/images/openshell-supervisor-tmachine.tar";
+    openshell_cli_binary = "../../artifacts/binaries/${muslTarget}/openshell";
+    openshell_gateway_image = "../../artifacts/images/openshell-gateway-tmachine.tar";
+    openshell_helm_chart = "../../artifacts/helm/helm-chart-0.0.0.tgz";
+    openshell_sandbox_image = "../../artifacts/images/openshell-sandbox-tmachine.tar";
+    openshell_supervisor_image = "../../artifacts/images/openshell-supervisor-tmachine.tar";
   };
   config = (pkgs.formats.yaml { }).generate "tmachine-config.yaml" {
     machines = [
@@ -100,7 +100,7 @@ let
         use_galaxy = false;
         playbooks = [ "ansible/playbooks/openshell-k3s-ha.yaml" ];
         inputs = k3sInputs // {
-          openshell_postgres_fixture = "../e2e/kubernetes/postgres-fixture.yaml";
+          openshell_postgres_fixture = "../../e2e/kubernetes/postgres-fixture.yaml";
         };
       }
       {
@@ -117,10 +117,10 @@ let
           "ansible/playbooks/gateway.yaml"
         ];
         inputs = {
-          openshell_cli_binary = "../artifacts/binaries/${muslTarget}/openshell";
-          openshell_gateway_binary = "../artifacts/binaries/${gnuTarget}/openshell-gateway";
-          openshell_supervisor_image = "../artifacts/images/openshell-supervisor-tmachine.tar";
-          openshell_sandbox_image = "../artifacts/images/openshell-sandbox-tmachine.tar";
+          openshell_cli_binary = "../../artifacts/binaries/${muslTarget}/openshell";
+          openshell_gateway_binary = "../../artifacts/binaries/${gnuTarget}/openshell-gateway";
+          openshell_supervisor_image = "../../artifacts/images/openshell-supervisor-tmachine.tar";
+          openshell_sandbox_image = "../../artifacts/images/openshell-sandbox-tmachine.tar";
         };
       }
       {
@@ -130,20 +130,20 @@ let
           "ansible/playbooks/openshell-deb.yaml"
         ];
         inputs = {
-          openshell_deb = "../artifacts/packages/openshell.deb";
-          openshell_supervisor_image = "../artifacts/images/openshell-supervisor-tmachine.tar";
-          openshell_sandbox_image = "../artifacts/images/openshell-sandbox-tmachine.tar";
+          openshell_deb = "../../artifacts/packages/openshell.deb";
+          openshell_supervisor_image = "../../artifacts/images/openshell-supervisor-tmachine.tar";
+          openshell_sandbox_image = "../../artifacts/images/openshell-sandbox-tmachine.tar";
         };
       }
       {
         name = "rpm";
         use_galaxy = false;
         playbooks = [ "ansible/playbooks/openshell-rpm.yaml" ];
         inputs = {
-          openshell_rpm = "../artifacts/packages/rpm/openshell.rpm";
-          openshell_gateway_rpm = "../artifacts/packages/rpm/openshell-gateway.rpm";
-          openshell_supervisor_image = "../artifacts/images/openshell-supervisor-tmachine.tar";
-          openshell_sandbox_image = "../artifacts/images/openshell-sandbox-tmachine.tar";
+          openshell_rpm = "../../artifacts/packages/rpm/openshell.rpm";
+          openshell_gateway_rpm = "../../artifacts/packages/rpm/openshell-gateway.rpm";
+          openshell_supervisor_image = "../../artifacts/images/openshell-supervisor-tmachine.tar";
+          openshell_sandbox_image = "../../artifacts/images/openshell-sandbox-tmachine.tar";
         };
       }
     ];
@@ -159,37 +159,37 @@ let
         name = "conformance";
         playbooks = [ "ansible/playbooks/conformance/cli.yaml" ];
         inputs = {
-          openshell_conformance_test_bundle = "../artifacts/test-archives/${muslTarget}/openshell-conformance-tests.tar";
+          openshell_conformance_test_bundle = "../../artifacts/test-archives/${muslTarget}/openshell-conformance-tests.tar";
         };
       }
       {
         name = "policy-advisor";
         playbooks = [ "ansible/playbooks/conformance/policy-advisor.yaml" ];
         inputs = {
-          openshell_conformance_test_bundle = "../artifacts/test-archives/${muslTarget}/openshell-conformance-tests.tar";
+          openshell_conformance_test_bundle = "../../artifacts/test-archives/${muslTarget}/openshell-conformance-tests.tar";
         };
       }
       {
         name = "provider-refresh";
         playbooks = [ "ansible/playbooks/features/provider-refresh/keycloak.yaml" ];
         inputs = {
-          keycloak_realm_file = "../scripts/keycloak-realm.json";
-          provider_refresh_keycloak_test_bundle = "../artifacts/test-archives/${muslTarget}/provider-refresh-keycloak-tests.tar";
+          keycloak_realm_file = "../../scripts/keycloak-realm.json";
+          provider_refresh_keycloak_test_bundle = "../../artifacts/test-archives/${muslTarget}/provider-refresh-keycloak-tests.tar";
         };
       }
       {
         name = "oci-image";
         playbooks = [ "ansible/playbooks/features/oci-image.yaml" ];
         inputs = {
-          oci_image_test_bundle = "../artifacts/test-archives/${muslTarget}/oci-image-tests.tar";
+          oci_image_test_bundle = "../../artifacts/test-archives/${muslTarget}/oci-image-tests.tar";
         };
       }
       {
         name = "e2e-podman";
         playbooks = [ "ansible/playbooks/drivers/podman/e2e.yaml" ];
         inputs = {
-          openshell_podman_e2e_test_bundle = "../artifacts/test-archives/${muslTarget}/openshell-podman-e2e-tests.tar";
-          openshell_podman_e2e_workload_image = "../artifacts/images/openshell-e2e-python-dev.tar";
+          openshell_podman_e2e_test_bundle = "../../artifacts/test-archives/${muslTarget}/openshell-podman-e2e-tests.tar";
+          openshell_podman_e2e_workload_image = "../../artifacts/images/openshell-e2e-python-dev.tar";
         };
       }
       {
@@ -205,13 +205,13 @@ let
           "ansible/playbooks/drivers/podman/tests.yaml"
         ];
         inputs = {
-          openshell_podman_test_bundle = "../artifacts/test-archives/${muslTarget}/openshell-podman-tests.tar";
+          openshell_podman_test_bundle = "../../artifacts/test-archives/${muslTarget}/openshell-podman-tests.tar";
           # Match OpenShell's compiled-in default so direct Podman and
           # OpenShell containers resolve the same workload image metadata.
           openshell_podman_reference_image = "nvcr.io/nvidia/base/ubuntu:24.04";
-          openshell_podman_userns_auto_config = "suites/drivers/podman/fixtures/userns-auto.toml";
-          openshell_podman_userns_keep_id_config = "suites/drivers/podman/fixtures/userns-keep-id.toml";
-          openshell_podman_userns_private_config = "suites/drivers/podman/fixtures/userns-private.toml";
+          openshell_podman_userns_auto_config = "../suites/drivers/podman/fixtures/userns-auto.toml";
+          openshell_podman_userns_keep_id_config = "../suites/drivers/podman/fixtures/userns-keep-id.toml";
+          openshell_podman_userns_private_config = "../suites/drivers/podman/fixtures/userns-private.toml";
         };
       }
     ];
@@ -227,7 +227,7 @@ let
     ];
     text = ''
       root=$(git rev-parse --show-toplevel)
-      cd "$root/tests"
+      cd "$root/tests/tmachine"
       export ANSIBLE_CONFIG="$PWD/ansible/ansible.cfg"
       exec ${tmachine}/bin/tmachine --config ${config} "$@"
     '';

tests/tmachine/default.nix

@@ -12,7 +12,16 @@ rustPlatform.buildRustPackage {
   pname = "tmachine";
   version = "0.1.0";
 
-  src = lib.cleanSource ./.;
+  # Only the crate files, so edits to the Ansible and Nix config beside it
+  # do not rebuild tmachine.
+  src = lib.fileset.toSource {
+    root = ./.;
+    fileset = lib.fileset.unions [
+      ./Cargo.toml
+      ./Cargo.lock
+      ./src
+    ];
+  };
   cargoLock.lockFile = ./Cargo.lock;
 
   env = lib.optionalAttrs stdenv.hostPlatform.isAarch64 {