Support integration tests for external pull request contributors

[coderabbitai]

Objective

Allow external contributors to run the integration-test validation required for pull requests.

Background

Pull requests from forks do not receive the repository credentials that current integration-test workflows require. The workflows also run on GitHub Actions hosted runners. These runners do not support attaching the BPF LSM hooks required by the integration tests.

As a result, simply exposing the current credentialed test-container build to fork pull requests will not make the integration tests usable for external contributors.

Required work

• Define a safe workflow for integration tests from fork pull requests.
• Run the tests in an environment that supports the required BPF LSM hooks.
• Evaluate nested virtual machines on GitHub Actions as the execution environment.
• Avoid exposing repository credentials, registry credentials, or other secrets to untrusted pull request code.
• Identify an image and artifact strategy that supports fast, repeatable validation.

Technical challenges

• GitHub Actions hosted runners cannot attach the BPF LSM hooks that these integration tests require.
• The workflow must therefore run the tests inside a nested VM, or use another isolated environment with equivalent kernel support.
• Nested VM setup can increase runtime, resource use, image-management complexity, and failure modes.
• The solution must preserve the security boundary for code from external contributors.
• The solution should minimize container-image builds and downloads to keep pull-request validation fast.

Candidate approaches

Evaluate cilium/little-vm-helper for creating and running lightweight VMs in GitHub Actions.

Also evaluate similar alternatives that can provide faster validation, such as:

• Azure/azure-linux-vm-utils, where compatible with the test requirements.
• A purpose-built QEMU/KVM workflow with cached VM and container artifacts.
• A self-hosted, isolated runner design, if hosted-runner nested virtualization cannot meet the security and performance requirements.

Affected areas

• .github/workflows/ci.yml
• .github/workflows/integration-tests.yml
• .github/workflows/test-containers-build.yml
• Ansible integration-test provisioning and execution
• Test-container image build, pull, and cache behavior

Acceptance criteria

• A pull request from a fork can run the relevant integration-test validation without access to repository secrets.
• The test environment supports the BPF LSM hooks required by the integration tests.
• The workflow documents its trust boundary and secret-handling model.
• The workflow uses versioned and reusable artifacts or images where practical.
• The validation time is measured and is suitable for pull-request feedback.

References

• Pull request: ROX-36983: version containers used in tests #1789
• Review discussion: ROX-36983: version containers used in tests #1789 (comment)
• Requested by: @Molter73