test(snap): smoke PR artifacts before release

.agents/skills/test-release-canary/SKILL.md

@@ -29,6 +29,10 @@ validation lives in the `TypeScript SDK` branch check, including a publish
 dry-run. The tagged release workflow publishes the package to GitHub Packages;
 verify that job directly when diagnosing SDK publication failures.
 
+The PR-only `test:snap` label runs the same gateway lifecycle smoke test in
+`Branch E2E Checks`, but packages a Snap from that workflow's amd64 prebuilt
+binary artifacts. It does not require or publish a Release Dev artifact.
+
 ## Trigger paths
 
 The workflow has two triggers:

.github/actions/snap-gateway-smoke/action.yml

@@ -0,0 +1,73 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Snap gateway smoke test
+description: Install a local OpenShell Snap with Docker and verify gateway readiness.
+
+inputs:
+  snap-path:
+    description: Path to the locally built Snap artifact.
+    required: true
+  telemetry-enabled:
+    description: Value supplied to the gateway service environment.
+    required: false
+    default: "false"
+
+runs:
+  using: composite
+  steps:
+    - name: Install snapd
+      shell: bash
+      run: |
+        set -euo pipefail
+        sudo apt-get update
+        sudo apt-get install -y snapd
+        sudo systemctl enable --now snapd.socket
+        sudo systemctl start snapd
+        sudo snap wait system seed.loaded
+
+    - name: Install Docker snap
+      shell: bash
+      run: sudo snap install docker
+
+    - name: Install, connect, and verify gateway
+      shell: bash
+      env:
+        SNAP_PATH: ${{ inputs.snap-path }}
+        TELEMETRY_ENABLED: ${{ inputs.telemetry-enabled }}
+      run: |
+        set -Eeuo pipefail
+
+        collect_diagnostics() {
+          set +e
+          sudo snap services openshell
+          sudo snap connections openshell
+          sudo snap changes
+          sudo systemctl status snap.openshell.gateway.service --no-pager
+          sudo journalctl -b -u snap.openshell.gateway.service --no-pager -n 300
+          sudo journalctl -b -u snapd.service --no-pager -n 300
+          sudo snap logs openshell.gateway -n=300
+          sudo ss -ltnp '( sport = :17670 )'
+        }
+        trap collect_diagnostics ERR
+
+        snap_path=$(compgen -G "$SNAP_PATH" | head -n 1 || true)
+        test -n "$snap_path"
+        sudo systemctl set-environment "OPENSHELL_TELEMETRY_ENABLED=${TELEMETRY_ENABLED}"
+        sudo snap install "$snap_path" --dangerous
+        sudo snap connect openshell:docker docker:docker-daemon
+        sudo snap connect openshell:log-observe
+        sudo snap connect openshell:system-observe
+
+        openshell --version
+        sudo snap services openshell
+        openshell gateway add http://127.0.0.1:17670 --local --name snap-docker
+        openshell gateway select snap-docker
+        for _ in $(seq 1 30); do
+          if openshell status; then
+            exit 0
+          fi
+          sleep 1
+        done
+        echo "Gateway did not become ready within 30 seconds" >&2
+        exit 1

.github/workflows/branch-e2e.yml

@@ -27,6 +27,7 @@ jobs:
       run_gpu_e2e: ${{ steps.labels.outputs.run_gpu_e2e }}
       run_kubernetes_ha_e2e: ${{ steps.labels.outputs.run_kubernetes_ha_e2e }}
       run_kubernetes_credential_drivers_e2e: ${{ steps.labels.outputs.run_kubernetes_credential_drivers_e2e }}
+      run_snap_smoke: ${{ steps.labels.outputs.run_snap_smoke }}
       run_any_e2e: ${{ steps.labels.outputs.run_any_e2e }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -46,6 +47,7 @@ jobs:
               run_gpu_e2e="$(jq -r 'index("test:e2e-gpu") != null' <<< "$LABELS_JSON")"
               run_kubernetes_ha_e2e="$(jq -r 'index("test:e2e-kubernetes") != null' <<< "$LABELS_JSON")"
               run_kubernetes_credential_drivers_e2e="$(jq -r 'index("test:e2e-kubernetes") != null' <<< "$LABELS_JSON")"
+              run_snap_smoke="$(jq -r 'index("test:snap") != null' <<< "$LABELS_JSON")"
               ;;
             merge_group)
               # Merge groups have no PR labels. When GPU E2E is required as documented
@@ -55,15 +57,17 @@ jobs:
               run_gpu_e2e=true
               run_kubernetes_ha_e2e=false
               run_kubernetes_credential_drivers_e2e=false
+              run_snap_smoke=true
               ;;
             *)
               run_core_e2e=true
               run_gpu_e2e=true
               run_kubernetes_ha_e2e=true
               run_kubernetes_credential_drivers_e2e=true
+              run_snap_smoke=true
               ;;
           esac
-          if [ "$run_core_e2e" = "true" ] || [ "$run_gpu_e2e" = "true" ] || [ "$run_kubernetes_ha_e2e" = "true" ] || [ "$run_kubernetes_credential_drivers_e2e" = "true" ]; then
+          if [ "$run_core_e2e" = "true" ] || [ "$run_gpu_e2e" = "true" ] || [ "$run_kubernetes_ha_e2e" = "true" ] || [ "$run_kubernetes_credential_drivers_e2e" = "true" ] || [ "$run_snap_smoke" = "true" ]; then
             run_any_e2e=true
           else
             run_any_e2e=false
@@ -73,6 +77,7 @@ jobs:
             echo "run_gpu_e2e=$run_gpu_e2e"
             echo "run_kubernetes_ha_e2e=$run_kubernetes_ha_e2e"
             echo "run_kubernetes_credential_drivers_e2e=$run_kubernetes_credential_drivers_e2e"
+            echo "run_snap_smoke=$run_snap_smoke"
             echo "run_any_e2e=$run_any_e2e"
           } >> "$GITHUB_OUTPUT"
 
@@ -86,6 +91,7 @@ jobs:
     with:
       component: gateway
       image-tag: ${{ github.sha }}
+      platform: ${{ (needs.pr_metadata.outputs.run_core_e2e == 'true' || needs.pr_metadata.outputs.run_gpu_e2e == 'true' || needs.pr_metadata.outputs.run_kubernetes_ha_e2e == 'true' || needs.pr_metadata.outputs.run_kubernetes_credential_drivers_e2e == 'true') && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
 
   build-supervisor:
     needs: [pr_metadata]
@@ -97,6 +103,7 @@ jobs:
     with:
       component: supervisor
       image-tag: ${{ github.sha }}
+      platform: ${{ (needs.pr_metadata.outputs.run_core_e2e == 'true' || needs.pr_metadata.outputs.run_gpu_e2e == 'true' || needs.pr_metadata.outputs.run_kubernetes_ha_e2e == 'true' || needs.pr_metadata.outputs.run_kubernetes_credential_drivers_e2e == 'true') && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
 
   build-cli:
     needs: [pr_metadata]
@@ -107,7 +114,45 @@ jobs:
     uses: ./.github/workflows/docker-build.yml
     with:
       component: cli
-      platform: linux/amd64,linux/arm64
+      platform: ${{ (needs.pr_metadata.outputs.run_core_e2e == 'true' || needs.pr_metadata.outputs.run_gpu_e2e == 'true' || needs.pr_metadata.outputs.run_kubernetes_ha_e2e == 'true' || needs.pr_metadata.outputs.run_kubernetes_credential_drivers_e2e == 'true') && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
+
+  build-snap:
+    name: Build Snap
+    needs: [pr_metadata, build-gateway, build-supervisor, build-cli]
+    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_snap_smoke == 'true'
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+    uses: ./.github/workflows/snap-build.yml
+    with:
+      checkout-ref: ${{ github.sha }}
+      artifact-layout: raw
+      build-matrix: '{"include":[{"arch":"amd64","runner":"linux-amd64-cpu8"}]}'
+      cli-artifact-prefix: rust-binary-cli
+      gateway-artifact-prefix: rust-binary-gateway
+      supervisor-artifact-prefix: rust-binary-supervisor
+
+  snap-smoke:
+    name: Snap Smoke
+    needs: [pr_metadata, build-snap]
+    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_snap_smoke == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      actions: read
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Download locally built Snap
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: snap-linux-amd64
+          path: release/
+      - name: Install and verify local Snap
+        uses: ./.github/actions/snap-gateway-smoke
+        with:
+          snap-path: ./release/*.snap
 
   build-driver-vm-linux:
     needs: [pr_metadata]

.github/workflows/e2e-label-help.yml

@@ -19,7 +19,7 @@ permissions: {}
 jobs:
   hint:
     name: Post next-step hint for E2E label
-    if: github.event.label.name == 'test:e2e' || github.event.label.name == 'test:e2e-gpu' || github.event.label.name == 'test:e2e-kubernetes'
+    if: github.event.label.name == 'test:e2e' || github.event.label.name == 'test:e2e-gpu' || github.event.label.name == 'test:e2e-kubernetes' || github.event.label.name == 'test:snap'
     runs-on: ubuntu-latest
     permissions:
       pull-requests: write
@@ -55,6 +55,11 @@ jobs:
               build_summary="gateway and supervisor images"
               status_summary="This is an optional proof-of-life suite; failures are visible in the workflow run but do not publish a required CI gate status."
               ;;
+            test:snap)
+              suite_summary="Snap packaging and gateway lifecycle smoke test"
+              build_summary="amd64 CLI, gateway, and supervisor binaries"
+              status_summary="This is an optional proof-of-life suite; failures are visible in the workflow run but do not publish a required CI gate status."
+              ;;
             *) echo "Unrecognized label $LABEL_NAME"; exit 1 ;;
           esac
 

.github/workflows/release-canary.yml

@@ -163,19 +163,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - name: Install snapd
-        run: |
-          set -euo pipefail
-          sudo apt-get update
-          sudo apt-get install -y snapd
-          sudo systemctl enable --now snapd.socket
-          sudo systemctl start snapd
-          sudo snap wait system seed.loaded
-
-      - name: Install Docker snap
-        run: |
-          set -euo pipefail
-          sudo snap install docker
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
+          fetch-depth: 1
 
       - name: Download snap from release-dev artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -186,48 +177,11 @@ jobs:
           path: release/
           merge-multiple: true
 
-      - name: Install snap (dangerous — from release, not store)
-        run: |
-          set -euo pipefail
-          sudo systemctl set-environment \
-            "OPENSHELL_TELEMETRY_ENABLED=${OPENSHELL_TELEMETRY_ENABLED}"
-          sudo snap install ./release/*.snap --dangerous
-
-      - name: Connect interfaces
-        run: |
-          set -euo pipefail
-          sudo snap connect openshell:docker docker:docker-daemon
-          sudo snap connect openshell:log-observe
-          sudo snap connect openshell:system-observe
-
-      - name: Register snap gateway and check status
-        run: |
-          set -euo pipefail
-          openshell --version
-          sudo snap services openshell
-          openshell gateway add http://127.0.0.1:17670 --local --name snap-docker
-          openshell gateway select snap-docker
-          for _ in $(seq 1 30); do
-            if openshell status; then
-              exit 0
-            fi
-            sleep 1
-          done
-          echo "Gateway did not become ready within 30 seconds" >&2
-          exit 1
-
-      - name: Collect Snap diagnostics
-        if: failure()
-        run: |
-          set +e
-          sudo snap services openshell
-          sudo snap connections openshell
-          sudo snap changes
-          sudo systemctl status snap.openshell.gateway.service --no-pager
-          sudo journalctl -b -u snap.openshell.gateway.service --no-pager -n 300
-          sudo journalctl -b -u snapd.service --no-pager -n 300
-          sudo snap logs openshell.gateway -n=300
-          sudo ss -ltnp '( sport = :17670 )'
+      - name: Install and verify local Snap
+        uses: ./.github/actions/snap-gateway-smoke
+        with:
+          snap-path: ./release/*.snap
+          telemetry-enabled: ${{ env.OPENSHELL_TELEMETRY_ENABLED }}
 
   kubernetes:
     name: Kubernetes Helm (kind)