test(tmachine): qualify DEB and RPM package upgrades

.agents/skills/test-release-canary/SKILL.md

@@ -28,9 +28,14 @@ The workflow sets `OPENSHELL_VERSION=dev`, so every `install.sh` job consumes th
 rolling dev release produced by the triggering workflow. Kubernetes pins the
 matching `0.0.0-dev` chart and `:dev` images.
 
-The host-package jobs exercise fresh installs, not upgrades from a persisted
-schema-v1 gateway config. Validate Homebrew and RPM exact-default migration with
-the release-tooling and package lifecycle tests before relying on the canary.
+The host-package jobs exercise fresh installs, not upgrades from persisted
+gateway state. Release Dev and Release Tag additionally run tmachine Ubuntu DEB
+and Fedora RPM upgrade lanes: they install the latest retained prerelease
+packages and matching runtime images, upgrade to the candidate packages, verify
+an existing sandbox survives, and create a new sandbox. Those lanes are part of
+the release conformance matrix, not this canary. Validate Homebrew exact-default
+migration with the release-tooling and package lifecycle tests before relying
+on the canary.
 
 The canary does not install or import `@nvidia/openshell-sdk`. TypeScript SDK
 validation lives in the `TypeScript SDK` branch check, including a publish

.github/workflows/branch-e2e.yml

@@ -26,6 +26,7 @@ jobs:
       run_integration: ${{ steps.labels.outputs.run_core_e2e }}
       run_core_e2e: ${{ steps.labels.outputs.run_core_e2e }}
       run_gpu_e2e: ${{ steps.labels.outputs.run_gpu_e2e }}
+      run_integration_upgrades: ${{ steps.labels.outputs.run_integration_upgrades }}
       run_kubernetes_ha_e2e: ${{ steps.labels.outputs.run_kubernetes_ha_e2e }}
       run_kubernetes_credential_drivers_e2e: ${{ steps.labels.outputs.run_kubernetes_credential_drivers_e2e }}
       run_any_e2e: ${{ steps.labels.outputs.run_any_e2e }}
@@ -47,6 +48,7 @@ jobs:
             push)
               run_core_e2e="$(jq -r 'index("test:e2e") != null' <<< "$LABELS_JSON")"
               run_gpu_e2e="$(jq -r 'index("test:e2e-gpu") != null' <<< "$LABELS_JSON")"
+              run_integration_upgrades="$(jq -r 'index("test:upgrade") != null' <<< "$LABELS_JSON")"
               run_kubernetes_ha_e2e=false
               run_kubernetes_credential_drivers_e2e=false
               ;;
@@ -56,17 +58,19 @@ jobs:
               # and ejects the PR. HA stays off until stable.
               run_core_e2e=true
               run_gpu_e2e=true
+              run_integration_upgrades=false
               run_kubernetes_ha_e2e=false
               run_kubernetes_credential_drivers_e2e=false
               ;;
             *)
               run_core_e2e=true
               run_gpu_e2e=true
+              run_integration_upgrades=false
               run_kubernetes_ha_e2e=false
               run_kubernetes_credential_drivers_e2e=false
               ;;
           esac
-          if [ "$run_core_e2e" = "true" ] || [ "$run_gpu_e2e" = "true" ] || [ "$run_kubernetes_ha_e2e" = "true" ] || [ "$run_kubernetes_credential_drivers_e2e" = "true" ]; then
+          if [ "$run_core_e2e" = "true" ] || [ "$run_gpu_e2e" = "true" ] || [ "$run_integration_upgrades" = "true" ] || [ "$run_kubernetes_ha_e2e" = "true" ] || [ "$run_kubernetes_credential_drivers_e2e" = "true" ]; then
             run_any_e2e=true
           else
             run_any_e2e=false
@@ -75,20 +79,24 @@ jobs:
           {
             echo "run_core_e2e=$run_core_e2e"
             echo "run_gpu_e2e=$run_gpu_e2e"
+            echo "run_integration_upgrades=$run_integration_upgrades"
             echo "run_kubernetes_ha_e2e=$run_kubernetes_ha_e2e"
             echo "run_kubernetes_credential_drivers_e2e=$run_kubernetes_credential_drivers_e2e"
             echo "run_any_e2e=$run_any_e2e"
           } >> "$GITHUB_OUTPUT"
 
   version:
     needs: [pr_metadata]
-    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_any_e2e == 'true'
+    if: needs.pr_metadata.outputs.should_run == 'true'
     permissions:
       contents: read
     runs-on: ubuntu-latest
     timeout-minutes: 5
     outputs:
       cargo: ${{ steps.version.outputs.cargo }}
+      deb: ${{ steps.version.outputs.deb }}
+      rpm_version: ${{ steps.version.outputs.rpm_version }}
+      rpm_release: ${{ steps.version.outputs.rpm_release }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -99,7 +107,15 @@ jobs:
         id: version
         run: |
           cargo="$(python3 tasks/scripts/release.py get-version --cargo)"
-          echo "cargo=$cargo" >> "$GITHUB_OUTPUT"
+          deb="$(python3 tasks/scripts/release.py get-version --dev --deb)"
+          rpm_version="$(python3 tasks/scripts/release.py get-version --dev --rpm-version)"
+          rpm_release="$(python3 tasks/scripts/release.py get-version --dev --rpm-release)"
+          {
+            echo "cargo=$cargo"
+            echo "deb=$deb"
+            echo "rpm_version=$rpm_version"
+            echo "rpm_release=$rpm_release"
+          } >> "$GITHUB_OUTPUT"
 
   build-binaries:
     needs: version
@@ -182,8 +198,10 @@ jobs:
           cargo-version: ${{ needs.version.outputs.cargo }}
 
   build-vm-driver:
+    # The Debian package embeds this binary, so unconditional package builds
+    # require the VM driver artifact even when no E2E suite is selected.
     needs: [pr_metadata, version, build-binaries]
-    if: needs.pr_metadata.outputs.run_core_e2e == 'true'
+    if: needs.pr_metadata.outputs.should_run == 'true'
     permissions:
       contents: read
     uses: ./.github/workflows/build-vm-driver.yml
@@ -209,6 +227,66 @@ jobs:
       packages: read
     uses: ./.github/workflows/prepare-integration-inputs.yml
 
+  build-deb:
+    name: Build Debian packages
+    needs: [pr_metadata, version, build-binaries, build-vm-driver]
+    if: needs.pr_metadata.outputs.should_run == 'true'
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+    uses: ./.github/workflows/deb-package.yml
+    with:
+      deb-version: ${{ needs.version.outputs.deb }}
+      checkout-ref: ${{ github.sha }}
+
+  build-rpm:
+    name: Build RPM packages
+    needs: [pr_metadata, version, build-binaries]
+    if: needs.pr_metadata.outputs.should_run == 'true'
+    permissions:
+      actions: read
+      contents: read
+    uses: ./.github/workflows/rpm-package.yml
+    with:
+      checkout-ref: ${{ github.sha }}
+      rpm-version: ${{ needs.version.outputs.rpm_version }}
+      rpm-release: ${{ needs.version.outputs.rpm_release }}
+      cargo-version: ${{ needs.version.outputs.cargo }}
+
+  prepare-integration-upgrades:
+    name: Prepare upgrade qualification inputs
+    needs: [pr_metadata, build-binaries, build-images, build-deb, build-rpm]
+    if: needs.pr_metadata.outputs.run_integration_upgrades == 'true'
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+    uses: ./.github/workflows/prepare-integration-inputs.yml
+    with:
+      deb-artifact-name: deb-linux-amd64
+      rpm-artifact-name: rpm-linux-x86_64
+      include-deb-upgrade-source: true
+      include-rpm-upgrade-source: true
+
+  integration-upgrades:
+    name: Integration upgrades
+    needs: prepare-integration-upgrades
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+    uses: ./.github/workflows/integration-runner.yml
+    with:
+      category: upgrades
+      source-sha: ${{ needs.prepare-integration-upgrades.outputs.source_sha }}
+      integration-inputs-artifact-id: ${{ needs.prepare-integration-upgrades.outputs.integration_inputs_artifact_id }}
+      test-matrix: >-
+        [
+          {"environment":"ubuntu-docker-rootful","installer":"deb-upgrade-source","testsuite":"deb-upgrade"},
+          {"environment":"fedora-podman-rootless","installer":"rpm-upgrade-source","testsuite":"rpm-upgrade"}
+        ]
+
   # Run driver-independent conformance tests.
   conformance-integration:
     needs: prepare-integration

.github/workflows/e2e-label-help.yml

@@ -19,7 +19,7 @@ permissions: {}
 jobs:
   hint:
     name: Post next-step hint for E2E label
-    if: github.event.label.name == 'test:e2e' || github.event.label.name == 'test:e2e-gpu' || github.event.label.name == 'test:e2e-kubernetes'
+    if: github.event.label.name == 'test:e2e' || github.event.label.name == 'test:e2e-gpu' || github.event.label.name == 'test:e2e-kubernetes' || github.event.label.name == 'test:upgrade'
     runs-on: ubuntu-latest
     permissions:
       pull-requests: write
@@ -50,6 +50,11 @@ jobs:
               build_summary="supervisor image"
               status_summary="The matching required CI gate status on this PR will flip green automatically once the run finishes."
               ;;
+            test:upgrade)
+              suite_summary="the Debian and RPM upgrade qualification"
+              build_summary="DEB and RPM packages, VM driver, sandbox image, and supervisor image"
+              status_summary="This is an optional proof-of-life suite; failures are visible in the workflow run but do not publish a required CI gate status."
+              ;;
             test:e2e-kubernetes)
               suite_summary="Kubernetes HA and credential-driver E2E"
               build_summary="gateway, sandbox, and supervisor images"