ci: split the conformance leg and build the e2e images once

[onedr0p]

The conformance leg ran miroir's Go specs and the upstream external-storage suite back to back, which made it the longest lane by about fourteen minutes. Neither suite needs the other's state, so they get a leg each.

Every leg also rebuilt all three images itself, so a shared e2e-images job now builds them once and hands them to the matrix.

Why

Timings from a green run on #364 (30453357794):

leg	job total	test step
conformance	38m02	33m48
zfs	28m02	23m50
replicated	22m51	18m08
rwx	8m59	5m05
serial	8m06	3m54

The conformance leg's 33m48 was 1m39 install + 13m47 Go specs + 18m09 upstream suite. Splitting those gives roughly a 20m leg and a 24m leg, so the critical path drops to about 28m and zfs becomes the new ceiling.

There is no slack left inside a leg. Sum-of-spec-time against wall clock at procs=4, from the JUnit artifacts:

leg	Σ spec time	wall	speedup
conformance	68.7m (109 specs)	18m09	3.78× / 95%
zfs	79.4m (120 specs)	23m50	3.33× / 83%
replicated	57.6m (119 specs)	18m08	3.18× / 79%

procs cannot go higher either — the runner is 4 CPU / 15.61 GiB already hosting three VMs. More clusters is the only lever, which is what this change spends.

Changes

Split — conformance becomes specs (Go specs, conformance: "0") and local (upstream suite), both on testdriver-local.yaml with capacity on. This reuses the RUN_CONFORMANCE knob and conformance: "0" convention already in test.sh for the autodiskful leg, so test.sh is unchanged.

Shared images — a new e2e-images job builds controller/agent/gateway with load: true, exports all three in one docker save | gzip (~135MB, since gateway shares every agent layer) and uploads it as an artifact. Each leg downloads and loads it into its own runner-local registry while its VMs boot, so nodes still pull over loopback and patches/registry.yaml is untouched.

Fallout that cleaned up on its own:

• The gateway image was built by every leg and installed by one. Building once removes that without a special case.
• The cache-to: ${{ matrix.suite == 'replicated' && … }} ordering hack is gone. One job owns each scope, so each cache-to is unconditional and the cache cannot go unwritten if that leg is renamed or fails early.
• setup-buildx and its network=host are gone from the legs entirely.
• The Go module cache is now gated on matrix.specs == '1', and the e2e.test download on matrix.conformance != '0'.

Verified

The image path was run locally end to end rather than assumed: built all three, docker save of the set is 135MB, docker load restores all three localhost:5000/…:e2e tags, and pushing into a real registry:3 gives a catalog with all three.

actionlint (with the shared workflow-lint action's own ignore flags), zizmor, shellcheck, go vet -tags e2e and golangci-lint are clean.

One bug caught while writing it: GitHub's implicit run shell is bash -e {0} with no pipefail, so a failed docker save would have exited 0 via gzip and handed every leg a truncated tarball. That step sets shell: bash.

Tradeoff

The shared build job adds its own duration to the front of every leg, since the per-leg builds were previously hidden behind the cluster boot. The wall-clock win here comes from the split; the build job buys identical bytes across legs and the cache-scope cleanup. It also scales — the more the matrix shards, the more a single build amortises.

Next

Sharding the heavy upstream legs by [Testpattern: …] should take the critical path to roughly 14-16m. run.sh already reads FOCUS/SKIP from env, so it is matrix-only work — but setting SKIP in a matrix row overrides run.sh's default \[Disruptive\]|\[Serial\]|…, which would re-admit Serial specs into a parallel shard. That wants append semantics first.