talos/.kres.yaml

---
kind: auto.CI
spec:
  compileGHWorkflowsOnly: true
---
kind: common.SOPS
spec:
  enabled: true
  config: |-
    creation_rules:
      - age: age1xrpa9ujxxcj2u2gzfrzv8mxak4rts94a6y60ypurv6rs5cpr4e4sg95f0k
        # order: Andrey, Noel, Artem, Utku, Dmitriy
        pgp: >-
          15D5721F5F5BAF121495363EFE042E3D4085A811,
          CC51116A94490FA6FB3C18EB2401FCAE863A06CA,
          4919F560F0D35F80CF382D76E084A2DF1143C14D,
          966BC282A680D8BB3E8363E865933E76F0549B0D,
          AA5213AF261C1977AF38B03A94B473337258BFD5
---
kind: common.Repository
spec:
  conformScopes:
    - apid
    - machined
    - networkd
    - talosctl
    - trustd
    - talosctl
    - kernel
    - security
    - ci
    - ^v1.8
  licenseChecks:
    - skipPaths:
        - .git/
        - testdata/
      includeSuffixes:
        - .go
      excludeSuffixes:
        - .pb.go
        - .pb.gw.go
        - _string.go
        - _enumer.go
        - _string_linux.go
        - zz_generated.deepcopy.go
      header: |
        // This Source Code Form is subject to the terms of the Mozilla Public
        // License, v. 2.0. If a copy of the MPL was not distributed with this
        // file, You can obtain one at http://mozilla.org/MPL/2.0/.
  enforceContexts:
    - default
    - e2e-iso
    - e2e-qemu-short
    - e2e-docker-short
    - integration-qemu
    - integration-trusted-boot
    - integration-provision-0
    - integration-provision-1
    - integration-provision-2
    - integration-misc-0
    - integration-misc-1
    - integration-misc-2
    - integration-misc-3
    - integration-misc-4
    - integration-extensions
    - integration-cilium
    - integration-conformance
    - integration-qemu-encrypted-vip
    - integration-qemu-race
    - integration-qemu-csi-rook-ceph
    - integration-qemu-csi-longhorn
    - integration-images
    - integration-reproducibility-test
    - integration-cloud-images
    - integration-image-factory
    - integration-aws
    - integration-aws-nvidia-oss
    - integration-aws-nvidia-nonfree
    - integration-azure
    - integration-gcp
    - integration-equinix-metal
---
kind: common.GHWorkflow
spec:
  jobs:
    - name: default
      buildxOptions:
        enabled: true
      runners:
        - self-hosted
        - talos
      conditions:
        - on-pull-request
      steps:
        - name: ci-temp-release-tag
        - name: external-artifacts
        - name: generate
          command: generate docs
        - name: uki-certs
          environment:
            PLATFORM: linux/amd64
        - name: check-dirty
        - name: build
          command: talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
          environment:
            PLATFORM: linux/amd64,linux/arm64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
            PUSH: true
        - name: lint
        - name: talosctl-cni-bundle
        - name: iso
          command: iso secureboot-iso
          environment:
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: images-essential
          environment:
            PLATFORM: linux/amd64,linux/arm64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: unit-tests
        - name: unit-tests-race
        - name: coverage
          coverageStep:
            files:
              - _out/coverage.txt
          timeoutMinutes: 3
        - name: save-artifacts
          artifactStep:
            type: upload
            artifactName: talos-artifacts
            artifactPath: _out
            additionalArtifacts:
              - "!_out/coverage.txt"
    - name: push
      buildxOptions:
        enabled: true
      runners:
        - self-hosted
        - talos
      conditions:
        - except-pull-request
        - not-on-tag
      steps:
        - name: build
          command: talosctl-all kernel sd-boot sd-stub initramfs installer imager talos
          environment:
            PLATFORM: linux/amd64,linux/arm64
        - name: release-notes
        - name: login-to-registry
          registryLoginStep:
            registry: ghcr.io
        - name: push
          environment:
            PLATFORM: linux/amd64,linux/arm64
        - name: push-latest
          environment:
            PLATFORM: linux/amd64,linux/arm64
          conditions:
            - not-on-tag
    - name: tag
      sops: true
      buildxOptions:
        enabled: true
      runners:
        - self-hosted
        - talos
      conditions:
        - only-on-tag
      steps:
        - name: build
          command: talosctl-all kernel sd-boot sd-stub initramfs installer imager talos talosctl-cni-bundle
          environment:
            PLATFORM: linux/amd64,linux/arm64
        - name: release-notes
        - name: login-to-registry
          registryLoginStep:
            registry: ghcr.io
        - name: push
          environment:
            PLATFORM: linux/amd64,linux/arm64
        - name: images
          environment:
            PLATFORM: linux/amd64,linux/arm64
        - name: cloud-images
          environment:
            PLATFORM: linux/amd64,linux/arm64
        - name: release
          releaseStep:
            baseDirectory: _out
            artifacts:
              - cloud-images.json
              - initramfs-amd64.xz
              - initramfs-arm64.xz
              - metal-amd64.iso
              - metal-arm64.iso
              - metal-amd64.raw.zst
              - metal-arm64.raw.zst
              - talosctl-cni-bundle-amd64.tar.gz
              - talosctl-cni-bundle-arm64.tar.gz
              - talosctl-darwin-amd64
              - talosctl-darwin-arm64
              - talosctl-freebsd-amd64
              - talosctl-freebsd-arm64
              - talosctl-linux-amd64
              - talosctl-linux-arm64
              - talosctl-linux-armv7
              - talosctl-windows-amd64.exe
              - vmlinuz-amd64
              - vmlinuz-arm64
            generateChecksums: true
            releaseNotes: RELEASE_NOTES.md
    - name: e2e-iso
      depends:
        - default
      runners:
        - self-hosted
        - talos
      steps:
        - name: download-artifacts
          artifactStep:
            type: download
            artifactName: talos-artifacts
            artifactPath: _out
        - name: ci-temp-release-tag
        - name: e2e-iso
          withSudo: true
          environment:
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: save-talos-logs
          conditions:
            - always
          artifactStep:
            type: upload
            artifactName: talos-logs-e2e-iso
            disableExecutableListGeneration: true
            artifactPath: ~/.talos/clusters/**/*.log
            additionalArtifacts:
              - "!~/.talos/clusters/**/swtpm.log"
    - name: e2e-qemu-short
      depends:
        - default
      runners:
        - self-hosted
        - talos
      steps:
        - name: download-artifacts
          artifactStep:
            type: download
            artifactName: talos-artifacts
            artifactPath: _out
        - name: ci-temp-release-tag
        - name: e2e-qemu
          withSudo: true
          environment:
            IMAGE_REGISTRY: registry.dev.siderolabs.io
            SHORT_INTEGRATION_TEST: yes
        - name: save-talos-logs
          conditions:
            - always
          artifactStep:
            type: upload
            artifactName: talos-logs-e2e-qemu-short
            disableExecutableListGeneration: true
            artifactPath: ~/.talos/clusters/**/*.log
            additionalArtifacts:
              - "!~/.talos/clusters/**/swtpm.log"
    - name: e2e-docker-short
      depends:
        - default
      runners:
        - self-hosted
        - talos
      steps:
        - name: download-artifacts
          artifactStep:
            type: download
            artifactName: talos-artifacts
            artifactPath: _out
        - name: ci-temp-release-tag
        - name: e2e-docker
          withSudo: false
          environment:
            IMAGE_REGISTRY: registry.dev.siderolabs.io
            SHORT_INTEGRATION_TEST: yes
        - name: save-talos-logs
          conditions:
            - always
          artifactStep:
            type: upload
            artifactName: talos-logs-e2e-docker-short
            disableExecutableListGeneration: true
            artifactPath: ~/.talos/clusters/**/*.log
            additionalArtifacts:
              - "!~/.talos/clusters/**/swtpm.log"
    - name: integration-qemu
      buildxOptions:
        enabled: true
      depends:
        - default
      runners:
        - self-hosted
        - talos
      crons:
        - '30 3 * * *'
      triggerLabels:
        - integration/qemu
      steps:
        - name: download-artifacts
          conditions:
            - not-on-schedule
          artifactStep:
            type: download
            artifactName: talos-artifacts
            artifactPath: _out
        - name: ci-temp-release-tag
          conditions:
            - not-on-schedule
        - name: build
          conditions:
            - only-on-schedule
          command: talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
          environment:
            PLATFORM: linux/amd64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
            PUSH: true
        - name: talosctl-cni-bundle
          conditions:
            - only-on-schedule
        - name: e2e-qemu
          withSudo: true
          environment:
            IMAGE_REGISTRY: registry.dev.siderolabs.io
            QEMU_EXTRA_DISKS: "3"
            QEMU_EXTRA_DISKS_SIZE: "10240"
            QEMU_EXTRA_DISKS_DRIVERS: "ide,nvme"
            WITH_CONFIG_PATCH_WORKER: "@hack/test/patches/ephemeral-nvme.yaml:@hack/test/patches/dm-raid-module.yaml"
        - name: save-talos-logs
          conditions:
            - always
          artifactStep:
            type: upload
            artifactName: talos-logs-integration-qemu
            disableExecutableListGeneration: true
            artifactPath: ~/.talos/clusters/**/*.log
            additionalArtifacts:
              - "!~/.talos/clusters/**/swtpm.log"
    - name: integration-conformance
      buildxOptions:
        enabled: true
      depends:
        - default
      runners:
        - self-hosted
        - talos
      crons:
        - '30 4 * * *'
      triggerLabels:
        - integration/conformance
      steps:
        - name: download-artifacts
          conditions:
            - not-on-schedule
          artifactStep:
            type: download
            artifactName: talos-artifacts
            artifactPath: _out
        - name: ci-temp-release-tag
          conditions:
            - not-on-schedule
        - name: build
          conditions:
            - only-on-schedule
          command: talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
          environment:
            PLATFORM: linux/amd64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
            PUSH: true
        - name: talosctl-cni-bundle
          conditions:
            - only-on-schedule
        - name: conformance-qemu
          command: e2e-qemu
          withSudo: true
          environment:
            QEMU_WORKERS: 2
            QEMU_CPUS: 4
            TEST_MODE: fast-conformance
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: save-talos-logs
          conditions:
            - always
          artifactStep:
            type: upload
            artifactName: talos-logs-integration-qemu
            disableExecutableListGeneration: true
            artifactPath: ~/.talos/clusters/**/*.log
            additionalArtifacts:
              - "!~/.talos/clusters/**/swtpm.log"
    - name: integration-trusted-boot
      buildxOptions:
        enabled: true
      depends:
        - default
      runners:
        - self-hosted
        - talos
      crons:
        - '30 3 * * *'
      triggerLabels:
        - integration/trusted-boot
      steps:
        - name: download-artifacts
          conditions:
            - not-on-schedule
          artifactStep:
            type: download
            artifactName: talos-artifacts
            artifactPath: _out
        - name: ci-temp-release-tag
          conditions:
            - not-on-schedule
        - name: uki-certs
          conditions:
            - only-on-schedule
          environment:
            PLATFORM: linux/amd64
        - name: build
          conditions:
            - only-on-schedule
          command: talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
          environment:
            PLATFORM: linux/amd64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
            PUSH: true
        - name: talosctl-cni-bundle
          conditions:
            - only-on-schedule
        - name: images-essential
          conditions:
            - only-on-schedule
          environment:
            PLATFORM: linux/amd64
            IMAGER_ARGS: "--extra-kernel-arg=console=ttyS0"
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: secureboot-iso
          conditions:
            - only-on-schedule
          environment:
            PLATFORM: linux/amd64
            IMAGER_ARGS: "--extra-kernel-arg=console=ttyS0"
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: integration-trusted-boot
          command: e2e-qemu
          withSudo: true
          environment:
            VIA_MAINTENANCE_MODE: true
            WITH_TRUSTED_BOOT_ISO: true
            EXTRA_TEST_ARGS: -talos.trustedboot
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: save-talos-logs
          conditions:
            - always
          artifactStep:
            type: upload
            artifactName: talos-logs-integration-trusted-boot
            disableExecutableListGeneration: true
            artifactPath: ~/.talos/clusters/**/*.log
            additionalArtifacts:
              - "!~/.talos/clusters/**/swtpm.log"
    - name: integration-provision-0
      buildxOptions:
        enabled: true
      depends:
        - default
      runners:
        - self-hosted
        - talos
      crons:
        - '30 4 * * *'
      triggerLabels:
        - integration/provision
        - integration/provision-0
      steps:
        - name: download-artifacts
          conditions:
            - not-on-schedule
          artifactStep:
            type: download
            artifactName: talos-artifacts
            artifactPath: _out
        - name: ci-temp-release-tag
          conditions:
            - not-on-schedule
        - name: build
          conditions:
            - only-on-schedule
          command: talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
          environment:
            PLATFORM: linux/amd64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
            PUSH: true
        - name: talosctl-cni-bundle
          conditions:
            - only-on-schedule
        - name: provision-tests-prepare
        - name: provision-tests-track-0
          withSudo: true
          environment:
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: save-talos-logs
          conditions:
            - always
          artifactStep:
            type: upload
            artifactName: talos-logs-integration-provision-0
            disableExecutableListGeneration: true
            artifactPath: ~/.talos/clusters/**/*.log
            additionalArtifacts:
              - "!~/.talos/clusters/**/swtpm.log"
    - name: integration-provision-1
      buildxOptions:
        enabled: true
      depends:
        - default
      runners:
        - self-hosted
        - talos
      crons:
        - '30 4 * * *'
      triggerLabels:
        - integration/provision
        - integration/provision-1
      steps:
        - name: download-artifacts
          conditions:
            - not-on-schedule
          artifactStep:
            type: download
            artifactName: talos-artifacts
            artifactPath: _out
        - name: ci-temp-release-tag
          conditions:
            - not-on-schedule
        - name: build
          conditions:
            - only-on-schedule
          command: talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
          environment:
            PLATFORM: linux/amd64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
            PUSH: true
        - name: talosctl-cni-bundle
          conditions:
            - only-on-schedule
        - name: provision-tests-prepare
        - name: provision-tests-track-1
          withSudo: true
          environment:
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: save-talos-logs
          conditions:
            - always
          artifactStep:
            type: upload
            artifactName: talos-logs-integration-provision-1
            disableExecutableListGeneration: true
            artifactPath: ~/.talos/clusters/**/*.log
            additionalArtifacts:
              - "!~/.talos/clusters/**/swtpm.log"
    - name: integration-provision-2
      buildxOptions:
        enabled: true
      depends:
        - default
      runners:
        - self-hosted
        - talos
      crons:
        - '30 4 * * *'
      triggerLabels:
        - integration/provision
        - integration/provision-2
      steps:
        - name: download-artifacts
          conditions:
            - not-on-schedule
          artifactStep:
            type: download
            artifactName: talos-artifacts
            artifactPath: _out
        - name: ci-temp-release-tag
          conditions:
            - not-on-schedule
        - name: build
          conditions:
            - only-on-schedule
          command: talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
          environment:
            PLATFORM: linux/amd64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
            PUSH: true
        - name: talosctl-cni-bundle
          conditions:
            - only-on-schedule
        - name: provision-tests-prepare
        - name: provision-tests-track-2
          withSudo: true
          environment:
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: save-talos-logs
          conditions:
            - always
          artifactStep:
            type: upload
            artifactName: talos-logs-integration-provision-2
            disableExecutableListGeneration: true
            artifactPath: ~/.talos/clusters/**/*.log
            additionalArtifacts:
              - "!~/.talos/clusters/**/swtpm.log"
    - name: integration-misc-0
      buildxOptions:
        enabled: true
      depends:
        - default
      runners:
        - self-hosted
        - talos
      crons:
        - '30 5 * * *'
      triggerLabels:
        - integration/misc
        - integration/misc-0
      steps:
        - name: download-artifacts
          conditions:
            - not-on-schedule
          artifactStep:
            type: download
            artifactName: talos-artifacts
            artifactPath: _out
        - name: ci-temp-release-tag
          conditions:
            - not-on-schedule
        - name: build
          conditions:
            - only-on-schedule
          command: talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
          environment:
            PLATFORM: linux/amd64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
            PUSH: true
        - name: talosctl-cni-bundle
          conditions:
            - only-on-schedule
        - name: e2e-firewall
          command: e2e-qemu
          withSudo: true
          environment:
            SHORT_INTEGRATION_TEST: yes
            WITH_FIREWALL: block
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: e2e-canal-reset
          command: e2e-qemu
          withSudo: true
          environment:
            INTEGRATION_TEST_RUN: TestIntegration/api.ResetSuite/TestResetWithSpec
            CUSTOM_CNI_URL: https://raw.githubusercontent.com/projectcalico/calico/v3.25.0/manifests/canal.yaml
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: e2e-controlplane-port
          command: e2e-qemu
          withSudo: true
          environment:
            SHORT_INTEGRATION_TEST: yes
            WITH_CONTROL_PLANE_PORT: 443
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: save-talos-logs
          conditions:
            - always
          artifactStep:
            type: upload
            artifactName: talos-logs-integration-misc-0
            disableExecutableListGeneration: true
            artifactPath: ~/.talos/clusters/**/*.log
            additionalArtifacts:
              - "!~/.talos/clusters/**/swtpm.log"
    - name: integration-misc-1
      buildxOptions:
        enabled: true
      depends:
        - default
      runners:
        - self-hosted
        - talos
      crons:
        - '30 5 * * *'
      triggerLabels:
        - integration/misc
        - integration/misc-1
      steps:
        - name: download-artifacts
          conditions:
            - not-on-schedule
          artifactStep:
            type: download
            artifactName: talos-artifacts
            artifactPath: _out
        - name: ci-temp-release-tag
          conditions:
            - not-on-schedule
        - name: build
          conditions:
            - only-on-schedule
          command: talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
          environment:
            PLATFORM: linux/amd64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
            PUSH: true
        - name: talosctl-cni-bundle
          conditions:
            - only-on-schedule
        - name: e2e-no-cluster-discovery
          command: e2e-qemu
          withSudo: true
          environment:
            SHORT_INTEGRATION_TEST: yes
            WITH_CLUSTER_DISCOVERY: false
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: e2e-kubespan
          command: e2e-qemu
          withSudo: true
          environment:
            SHORT_INTEGRATION_TEST: yes
            WITH_CLUSTER_DISCOVERY: true
            WITH_KUBESPAN: true
            IMAGE_REGISTRY: registry.dev.siderolabs.io\
        - name: e2e-default-hostname
          command: e2e-qemu
          withSudo: true
          environment:
            SHORT_INTEGRATION_TEST: yes
            VIA_MAINTENANCE_MODE: true
            DISABLE_DHCP_HOSTNAME: true
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: save-talos-logs
          conditions:
            - always
          artifactStep:
            type: upload
            artifactName: talos-logs-integration-misc-1
            disableExecutableListGeneration: true
            artifactPath: ~/.talos/clusters/**/*.log
            additionalArtifacts:
              - "!~/.talos/clusters/**/swtpm.log"
    - name: integration-misc-2
      buildxOptions:
        enabled: true
      depends:
        - default
      runners:
        - self-hosted
        - talos
      crons:
        - '30 5 * * *'
      triggerLabels:
        - integration/misc
        - integration/misc-2
      steps:
        - name: download-artifacts
          conditions:
            - not-on-schedule
          artifactStep:
            type: download
            artifactName: talos-artifacts
            artifactPath: _out
        - name: ci-temp-release-tag
          conditions:
            - not-on-schedule
        - name: uki-certs
          conditions:
            - only-on-schedule
          environment:
            PLATFORM: linux/amd64
        - name: build
          conditions:
            - only-on-schedule
          command: talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
          environment:
            PLATFORM: linux/amd64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
            PUSH: true
        - name: talosctl-cni-bundle
          conditions:
            - only-on-schedule
        - name: images-essential
          conditions:
            - only-on-schedule
          environment:
            PLATFORM: linux/amd64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: e2e-bios-cgroupsv1
          command: e2e-qemu
          withSudo: true
          environment:
            SHORT_INTEGRATION_TEST: yes
            WITH_UEFI: false
            WITH_CONFIG_PATCH: "@hack/test/patches/cgroupsv1.yaml" #use cgroupsv1
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: e2e-disk-image
          command: e2e-qemu
          withSudo: true
          environment:
            SHORT_INTEGRATION_TEST: yes
            USE_DISK_IMAGE: true
            VIA_MAINTENANCE_MODE: true
            WITH_DISK_ENCRYPTION: true
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: save-talos-logs
          conditions:
            - always
          artifactStep:
            type: upload
            artifactName: talos-logs-integration-misc-2
            disableExecutableListGeneration: true
            artifactPath: ~/.talos/clusters/**/*.log
            additionalArtifacts:
              - "!~/.talos/clusters/**/swtpm.log"
    - name: integration-misc-3
      buildxOptions:
        enabled: true
      depends:
        - default
      runners:
        - self-hosted
        - talos
      crons:
        - '30 5 * * *'
      triggerLabels:
        - integration/misc
        - integration/misc-3
      steps:
        - name: download-artifacts
          conditions:
            - not-on-schedule
          artifactStep:
            type: download
            artifactName: talos-artifacts
            artifactPath: _out
        - name: ci-temp-release-tag
          conditions:
            - not-on-schedule
        - name: build
          conditions:
            - only-on-schedule
          command: talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
          environment:
            PLATFORM: linux/amd64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
            PUSH: true
        - name: talosctl-cni-bundle
          conditions:
            - only-on-schedule
        - name: e2e-network-chaos
          command: e2e-qemu
          withSudo: true
          environment:
            SHORT_INTEGRATION_TEST: yes
            WITH_NETWORK_CHAOS: yes
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: e2e-metal-iso
          command: e2e-qemu
          withSudo: true
          environment:
            SHORT_INTEGRATION_TEST: yes
            WITH_CONFIG_INJECTION_METHOD: "metal-iso"
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: save-talos-logs
          conditions:
            - always
          artifactStep:
            type: upload
            artifactName: talos-logs-integration-misc-3
            disableExecutableListGeneration: true
            artifactPath: ~/.talos/clusters/**/*.log
            additionalArtifacts:
              - "!~/.talos/clusters/**/swtpm.log"
    - name: integration-misc-4
      buildxOptions:
        enabled: true
      depends:
        - default
      runners:
        - self-hosted
        - talos
      crons:
        - '30 5 * * *'
      triggerLabels:
        - integration/misc
        - integration/misc-4
      steps:
        - name: download-artifacts
          conditions:
            - not-on-schedule
          artifactStep:
            type: download
            artifactName: talos-artifacts
            artifactPath: _out
        - name: ci-temp-release-tag
          conditions:
            - not-on-schedule
        - name: build
          conditions:
            - only-on-schedule
          command: talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
          environment:
            PLATFORM: linux/amd64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
            PUSH: true
        - name: talosctl-cni-bundle
          conditions:
            - only-on-schedule
        - name: e2e-siderolink
          command: e2e-qemu
          withSudo: true
          environment:
            SHORT_INTEGRATION_TEST: yes
            WITH_SIDEROLINK_AGENT: true
            VIA_MAINTENANCE_MODE: true
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: e2e-siderolink-tunnel
          command: e2e-qemu
          withSudo: true
          environment:
            SHORT_INTEGRATION_TEST: yes
            WITH_SIDEROLINK_AGENT: tunnel
            VIA_MAINTENANCE_MODE: true
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: e2e-siderolink-tls
          command: e2e-qemu
          withSudo: true
          environment:
            SHORT_INTEGRATION_TEST: yes
            WITH_SIDEROLINK_AGENT: wireguard+tls
            VIA_MAINTENANCE_MODE: true
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: e2e-apparmor
          command: e2e-qemu
          withSudo: true
          environment:
            SHORT_INTEGRATION_TEST: yes
            WITH_APPARMOR_LSM_ENABLED: yes
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: save-talos-logs
          conditions:
            - always
          artifactStep:
            type: upload
            artifactName: talos-logs-integration-misc-4
            disableExecutableListGeneration: true
            artifactPath: ~/.talos/clusters/**/*.log
            additionalArtifacts:
              - "!~/.talos/clusters/**/swtpm.log"
    - name: integration-extensions
      buildxOptions:
        enabled: true
      depends:
        - default
      runners:
        - self-hosted
        - talos
      crons:
        - '30 6 * * *'
      triggerLabels:
        - integration/extensions
      steps:
        - name: download-artifacts
          conditions:
            - not-on-schedule
          artifactStep:
            type: download
            artifactName: talos-artifacts
            artifactPath: _out
        - name: ci-temp-release-tag
          conditions:
            - not-on-schedule
        - name: generate
          conditions:
            - only-on-schedule
        - name: build
          conditions:
            - only-on-schedule
          command: talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
          environment:
            PLATFORM: linux/amd64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
            PUSH: true
        - name: talosctl-cni-bundle
          conditions:
            - only-on-schedule
        - name: checkout extensions
          checkoutStep:
            repository: siderolabs/extensions
            ref: release-1.8
            path: _out/extensions
        - name: unshallow-extensions
          nonMakeStep: true
          command: git -C _out/extensions fetch --prune --unshallow
        - name: set variables
          nonMakeStep: true
          command: cat _out/talos-metadata >> "$GITHUB_ENV"
        - name: build extensions
          command: all extensions-metadata
          arguments:
            - -C
            - _out/extensions
          environment:
            PLATFORM: linux/amd64
            PUSH: true
            REGISTRY: registry.dev.siderolabs.io
        - name: installer extensions
          command: installer-with-extensions
          environment:
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: e2e-extensions
          command: e2e-qemu
          withSudo: true
          environment:
            QEMU_MEMORY_WORKERS: 4096
            WITH_CONFIG_PATCH_WORKER: "@_out/installer-extensions-patch.yaml:@hack/test/patches/extensions.yaml:@hack/test/patches/dm-raid-module.yaml"
            QEMU_EXTRA_DISKS: 3
            SHORT_INTEGRATION_TEST: yes
            EXTRA_TEST_ARGS: -talos.extensions.qemu
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: save-talos-logs
          conditions:
            - always
          artifactStep:
            type: upload
            artifactName: talos-logs-integration-extensions
            disableExecutableListGeneration: true
            artifactPath: ~/.talos/clusters/**/*.log
            additionalArtifacts:
              - "!~/.talos/clusters/**/swtpm.log"
    - name: integration-cilium
      buildxOptions:
        enabled: true
      depends:
        - default
      runners:
        - self-hosted
        - talos
      crons:
        - '30 3 * * *'
      triggerLabels:
        - integration/cilium
      steps:
        - name: download-artifacts
          conditions:
            - not-on-schedule
          artifactStep:
            type: download
            artifactName: talos-artifacts
            artifactPath: _out
        - name: ci-temp-release-tag
          conditions:
            - not-on-schedule
        - name: build
          conditions:
            - only-on-schedule
          command: talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
          environment:
            PLATFORM: linux/amd64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
            PUSH: true
        - name: talosctl-cni-bundle
          conditions:
            - only-on-schedule
        - name: e2e-cilium
          command: e2e-qemu
          withSudo: true
          environment:
            SHORT_INTEGRATION_TEST: yes
            WITH_SKIP_K8S_NODE_READINESS_CHECK: yes
            WITH_CUSTOM_CNI: cilium
            WITH_FIREWALL: accept
            QEMU_WORKERS: 2
            WITH_CONFIG_PATCH: "@hack/test/patches/cilium-no-kubeproxy.yaml"
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: e2e-cilium-strict
          command: e2e-qemu
          withSudo: true
          environment:
            SHORT_INTEGRATION_TEST: yes
            WITH_SKIP_K8S_NODE_READINESS_CHECK: yes
            WITH_CUSTOM_CNI: cilium
            WITH_FIREWALL: accept
            QEMU_WORKERS: 2
            CILIUM_INSTALL_TYPE: strict
            WITH_CONFIG_PATCH: "@hack/test/patches/cilium-kubeproxy.yaml"
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: e2e-cilium-strict-kubespan
          command: e2e-qemu
          withSudo: true
          environment:
            SHORT_INTEGRATION_TEST: yes
            WITH_SKIP_K8S_NODE_READINESS_CHECK: yes
            WITH_CUSTOM_CNI: cilium
            WITH_FIREWALL: accept
            WITH_KUBESPAN: true
            QEMU_WORKERS: 2
            CILIUM_INSTALL_TYPE: strict
            WITH_CONFIG_PATCH: "@hack/test/patches/cilium-kubeproxy.yaml"
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: save-talos-logs
          conditions:
            - always
          artifactStep:
            type: upload
            artifactName: talos-logs-integration-cilium
            disableExecutableListGeneration: true
            artifactPath: ~/.talos/clusters/**/*.log
            additionalArtifacts:
              - "!~/.talos/clusters/**/swtpm.log"
    - name: integration-qemu-encrypted-vip
      buildxOptions:
        enabled: true
      depends:
        - default
      runners:
        - self-hosted
        - talos
      crons:
        - '30 3 * * *'
      triggerLabels:
        - integration/qemu-encrypted-vip
      steps:
        - name: download-artifacts
          conditions:
            - not-on-schedule
          artifactStep:
            type: download
            artifactName: talos-artifacts
            artifactPath: _out
        - name: ci-temp-release-tag
          conditions:
            - not-on-schedule
        - name: build
          conditions:
            - only-on-schedule
          command: talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
          environment:
            PLATFORM: linux/amd64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
            PUSH: true
        - name: talosctl-cni-bundle
          conditions:
            - only-on-schedule
        - name: e2e-qemu
          withSudo: true
          environment:
            WITH_DISK_ENCRYPTION: true
            WITH_VIRTUAL_IP: true
            WITH_KUBESPAN: true
            IMAGE_REGISTRY: registry.dev.siderolabs.io
            QEMU_EXTRA_DISKS: "3"
            QEMU_EXTRA_DISKS_SIZE: "10240"
            QEMU_EXTRA_DISKS_DRIVERS: "ide,nvme"
            WITH_CONFIG_PATCH_WORKER: "@hack/test/patches/ephemeral-nvme.yaml:@hack/test/patches/dm-raid-module.yaml"
        - name: save-talos-logs
          conditions:
            - always
          artifactStep:
            type: upload
            artifactName: talos-logs-integration-qemu-encrypted-vip
            disableExecutableListGeneration: true
            artifactPath: ~/.talos/clusters/**/*.log
            additionalArtifacts:
              - "!~/.talos/clusters/**/swtpm.log"
    - name: integration-qemu-race
      buildxOptions:
        enabled: true
      depends:
        - default
      runners:
        - self-hosted
        - talos
      crons:
        - '30 3 * * *'
      triggerLabels:
        - integration/qemu-race
      steps:
        - name: download-artifacts
          conditions:
            - not-on-schedule
          artifactStep:
            type: download
            artifactName: talos-artifacts
            artifactPath: _out
        - name: ci-temp-release-tag
          conditions:
            - not-on-schedule
        - name: build
          conditions:
            - only-on-schedule
          command: talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
          environment:
            PLATFORM: linux/amd64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
            PUSH: true
        - name: talosctl-cni-bundle
          conditions:
            - only-on-schedule
        - name: build-race
          command: initramfs installer
          environment:
            PUSH: true
            TAG_SUFFIX: -race
            WITH_RACE: 1
            PLATFORM: linux/amd64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: e2e-qemu-race
          command: e2e-qemu
          withSudo: true
          environment:
            QEMU_EXTRA_DISKS: "3"
            QEMU_EXTRA_DISKS_SIZE: "10240"
            QEMU_EXTRA_DISKS_DRIVERS: "ide,nvme"
            WITH_CONFIG_PATCH_WORKER: "@hack/test/patches/ephemeral-nvme.yaml:@hack/test/patches/dm-raid-module.yaml"
            TAG_SUFFIX: -race
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: save-talos-logs
          conditions:
            - always
          artifactStep:
            type: upload
            artifactName: talos-logs-integration-qemu-race
            disableExecutableListGeneration: true
            artifactPath: ~/.talos/clusters/**/*.log
            additionalArtifacts:
              - "!~/.talos/clusters/**/swtpm.log"
    - name: integration-qemu-csi-rook-ceph
      buildxOptions:
        enabled: true
      depends:
        - default
      runners:
        - self-hosted
        - talos
      crons:
        - '30 3 * * *'
      triggerLabels:
        - integration/qemu-csi
        - integration/qemu-csi-rook-ceph
      steps:
        - name: download-artifacts
          conditions:
            - not-on-schedule
          artifactStep:
            type: download
            artifactName: talos-artifacts
            artifactPath: _out
        - name: ci-temp-release-tag
          conditions:
            - not-on-schedule
        - name: build
          conditions:
            - only-on-schedule
          command: talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
          environment:
            PLATFORM: linux/amd64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
            PUSH: true
        - name: talosctl-cni-bundle
          conditions:
            - only-on-schedule
        - name: e2e-qemu-csi-rook-ceph
          command: e2e-qemu
          withSudo: true
          environment:
            SHORT_INTEGRATION_TEST: yes
            QEMU_WORKERS: 3
            QEMU_CPUS_WORKERS: 6
            QEMU_MEMORY_WORKERS: 8192
            QEMU_EXTRA_DISKS: 1
            QEMU_EXTRA_DISKS_SIZE: 12288
            WITH_CONFIG_PATCH: "@hack/test/patches/rook-ceph.yaml"
            EXTRA_TEST_ARGS: -talos.csi=rook-ceph
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: save-talos-logs
          conditions:
            - always
          artifactStep:
            type: upload
            artifactName: talos-logs-integration-qemu-csi-rook-ceph
            disableExecutableListGeneration: true
            artifactPath: ~/.talos/clusters/**/*.log
            additionalArtifacts:
              - "!~/.talos/clusters/**/swtpm.log"
    - name: integration-qemu-csi-longhorn
      buildxOptions:
        enabled: true
      depends:
        - default
      runners:
        - self-hosted
        - talos
      crons:
        - '30 3 * * *'
      triggerLabels:
        - integration/qemu-csi
        - integration/qemu-csi-longhorn
      steps:
        - name: download-artifacts
          conditions:
            - not-on-schedule
          artifactStep:
            type: download
            artifactName: talos-artifacts
            artifactPath: _out
        - name: ci-temp-release-tag
          conditions:
            - not-on-schedule
        - name: generate
          conditions:
            - only-on-schedule
        - name: build
          conditions:
            - only-on-schedule
          command: talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
          environment:
            PLATFORM: linux/amd64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
            PUSH: true
        - name: talosctl-cni-bundle
          conditions:
            - only-on-schedule
        - name: checkout extensions
          checkoutStep:
            repository: siderolabs/extensions
            ref: release-1.8
            path: _out/extensions
        - name: set variables
          nonMakeStep: true
          command: cat _out/talos-metadata >> "$GITHUB_ENV"
        - name: build extensions
          command: iscsi-tools util-linux-tools extensions-metadata
          arguments:
            - -C
            - _out/extensions
          environment:
            PLATFORM: linux/amd64
            PUSH: true
            REGISTRY: registry.dev.siderolabs.io
        - name: installer extensions
          command: installer-with-extensions
          environment:
            EXTENSIONS_FILTER_COMMAND: "grep -E 'iscsi-tools|util-linux-tools'"
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: e2e-qemu-csi-longhorn
          command: e2e-qemu
          withSudo: true
          environment:
            SHORT_INTEGRATION_TEST: yes
            QEMU_WORKERS: 3
            WITH_CONFIG_PATCH: "@_out/installer-extensions-patch.yaml:@hack/test/patches/longhorn.yaml"
            EXTRA_TEST_ARGS: -talos.csi=longhorn
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: save-talos-logs
          conditions:
            - always
          artifactStep:
            type: upload
            artifactName: talos-logs-integration-qemu-csi-longhorn
            disableExecutableListGeneration: true
            artifactPath: ~/.talos/clusters/**/*.log
            additionalArtifacts:
              - "!~/.talos/clusters/**/swtpm.log"
    - name: integration-images
      buildxOptions:
        enabled: true
      depends:
        - default
      runners:
        - self-hosted
        - generic # this is pretty fast, so we can use generic
      crons:
        - '30 2 * * *'
      triggerLabels:
        - integration/images
      steps:
        - name: download-artifacts
          conditions:
            - not-on-schedule
          artifactStep:
            type: download
            artifactName: talos-artifacts
            artifactPath: _out
        - name: ci-temp-release-tag
          conditions:
            - not-on-schedule
        - name: build
          conditions:
            - only-on-schedule
          command: talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
          environment:
            PLATFORM: linux/amd64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
            PUSH: true
        - name: talosctl-cni-bundle
          conditions:
            - only-on-schedule
        - name: images
          environment:
            PLATFORM: linux/amd64,linux/arm64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
    - name: integration-reproducibility-test
      buildxOptions:
        enabled: true
      depends:
        - default
      runners:
        - self-hosted
        - talos
      crons:
        - '30 2 * * *'
      triggerLabels:
        - integration/reproducibility-test
      steps:
        - name: download-artifacts
          conditions:
            - not-on-schedule
          artifactStep:
            type: download
            artifactName: talos-artifacts
            artifactPath: _out
        - name: ci-temp-release-tag
          conditions:
            - not-on-schedule
        - name: reproducibility-test
          environment:
            IMAGE_REGISTRY: registry.dev.siderolabs.io
    - name: integration-cloud-images
      buildxOptions:
        enabled: true
      sops: true
      depends:
        - default
      runners:
        - self-hosted
        - generic # this is not compute intensive, so we can use generic
      crons:
        - '30 2 * * *'
      triggerLabels:
        - integration/cloud-images
      steps:
        - name: download-artifacts
          conditions:
            - not-on-schedule
          artifactStep:
            type: download
            artifactName: talos-artifacts
            artifactPath: _out
        - name: ci-temp-release-tag
          conditions:
            - not-on-schedule
        - name: build
          conditions:
            - only-on-schedule
          command: talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
          environment:
            PLATFORM: linux/amd64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
            PUSH: true
        - name: images
          environment:
            PLATFORM: linux/amd64,linux/arm64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: cloud-images
    - name: integration-image-factory
      buildxOptions:
        enabled: true
      depends:
        - default
      runners:
        - self-hosted
        - talos
      crons:
        - '30 6 * * *'
      triggerLabels:
        - integration/image-factory
      steps:
        - name: download-artifacts
          conditions:
            - not-on-schedule
          artifactStep:
            type: download
            artifactName: talos-artifacts
            artifactPath: _out
        - name: ci-temp-release-tag
          conditions:
            - not-on-schedule
        - name: uki-certs
          conditions:
            - only-on-schedule
          environment:
            PLATFORM: linux/amd64
        - name: build
          conditions:
            - only-on-schedule
          command: talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
          environment:
            PLATFORM: linux/amd64,linux/arm64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
            PUSH: true
        - name: talosctl-cni-bundle
          conditions:
            - only-on-schedule
        - name: iso
          conditions:
            - only-on-schedule
          command: iso secureboot-iso
          environment:
            IMAGER_ARGS: "--extra-kernel-arg=console=ttyS0"
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: images-essential
          conditions:
            - only-on-schedule
          environment:
            PLATFORM: linux/amd64
            IMAGER_ARGS: "--extra-kernel-arg=console=ttyS0"
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: factory-1.7-iso
          command: e2e-image-factory
          withSudo: true
          environment:
            FACTORY_BOOT_METHOD: iso
            FACTORY_VERSION: v1.7.5
            FACTORY_SCHEMATIC: 376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba
            KUBERNETES_VERSION: 1.30.1
            FACTORY_UPGRADE: true
            FACTORY_UPGRADE_SCHEMATIC: cf9b7aab9ed7c365d5384509b4d31c02fdaa06d2b3ac6cc0bc806f28130eff1f
            FACTORY_UPGRADE_VERSION: v1.7.6
        - name: factory-1.7-image
          command: e2e-image-factory
          withSudo: true
          environment:
            FACTORY_BOOT_METHOD: disk-image
            FACTORY_VERSION: v1.7.5
            FACTORY_SCHEMATIC: 376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba
            KUBERNETES_VERSION: 1.30.1
            FACTORY_UPGRADE: true
            FACTORY_UPGRADE_SCHEMATIC: cf9b7aab9ed7c365d5384509b4d31c02fdaa06d2b3ac6cc0bc806f28130eff1f
            FACTORY_UPGRADE_VERSION: v1.7.6
        - name: factory-1.7-pxe
          command: e2e-image-factory
          withSudo: true
          environment:
            FACTORY_BOOT_METHOD: pxe
            FACTORY_VERSION: v1.7.6
            FACTORY_SCHEMATIC: 376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba
            KUBERNETES_VERSION: 1.30.1
        - name: factory-1.7-secureboot
          command: e2e-image-factory
          withSudo: true
          environment:
            FACTORY_BOOT_METHOD: secureboot-iso
            FACTORY_VERSION: v1.7.5
            FACTORY_SCHEMATIC: cf9b7aab9ed7c365d5384509b4d31c02fdaa06d2b3ac6cc0bc806f28130eff1f
            KUBERNETES_VERSION: 1.30.1
            FACTORY_UPGRADE: true
            FACTORY_UPGRADE_SCHEMATIC: 376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba
            FACTORY_UPGRADE_VERSION: v1.7.6
        - name: factory-1.6-secureboot
          command: e2e-image-factory
          withSudo: true
          environment:
            FACTORY_BOOT_METHOD: secureboot-iso
            FACTORY_VERSION: v1.6.0
            FACTORY_SCHEMATIC: cf9b7aab9ed7c365d5384509b4d31c02fdaa06d2b3ac6cc0bc806f28130eff1f
            KUBERNETES_VERSION: 1.29.0
            FACTORY_UPGRADE: true
            FACTORY_UPGRADE_SCHEMATIC: 376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba
            FACTORY_UPGRADE_VERSION: v1.6.1
        - name: factory-1.6-iso
          command: e2e-image-factory
          withSudo: true
          environment:
            FACTORY_BOOT_METHOD: iso
            FACTORY_VERSION: v1.6.0
            FACTORY_SCHEMATIC: 376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba
            KUBERNETES_VERSION: 1.29.0
            FACTORY_UPGRADE: true
            FACTORY_UPGRADE_SCHEMATIC: cf9b7aab9ed7c365d5384509b4d31c02fdaa06d2b3ac6cc0bc806f28130eff1f
            FACTORY_UPGRADE_VERSION: v1.6.1
        - name: factory-1.5-iso
          command: e2e-image-factory
          withSudo: true
          environment:
            FACTORY_BOOT_METHOD: iso
            FACTORY_VERSION: v1.5.5
            FACTORY_SCHEMATIC: 376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba
            KUBERNETES_VERSION: 1.28.5
            FACTORY_UPGRADE: true
            FACTORY_UPGRADE_SCHEMATIC: cf9b7aab9ed7c365d5384509b4d31c02fdaa06d2b3ac6cc0bc806f28130eff1f
            FACTORY_UPGRADE_VERSION: v1.5.5
        - name: save-talos-logs
          conditions:
            - always
          artifactStep:
            type: upload
            artifactName: talos-logs-integration-image-factory
            disableExecutableListGeneration: true
            artifactPath: ~/.talos/clusters/**/*.log
            additionalArtifacts:
              - "!~/.talos/clusters/**/swtpm.log"
    - name: integration-aws
      buildxOptions:
        enabled: true
      sops: true
      depends:
        - default
      runners:
        - self-hosted
        - generic # we can use generic here since the tests run against a remote talos cluster
      crons:
        - '30 7 * * *'
      triggerLabels:
        - integration/aws
      steps:
        - name: download-artifacts
          conditions:
            - not-on-schedule
          artifactStep:
            type: download
            artifactName: talos-artifacts
            artifactPath: _out
        - name: ci-temp-release-tag
          conditions:
            - not-on-schedule
        - name: uki-certs
          conditions:
            - only-on-schedule
          environment:
            PLATFORM: linux/amd64
        - name: build
          conditions:
            - only-on-schedule
          command: talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
          environment:
            PLATFORM: linux/amd64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
            PUSH: true
        - name: talosctl-cni-bundle
          conditions:
            - only-on-schedule
        - name: images-essential
          conditions:
            - only-on-schedule
          environment:
            PLATFORM: linux/amd64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: e2e-aws-prepare
          environment:
            E2E_AWS_TARGET: default
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: checkout contrib
          checkoutStep:
            repository: siderolabs/contrib
            ref: main
            path: _out/contrib
        - name: setup tf
          terraformStep: true
        - name: tf apply
          command: e2e-cloud-tf
          environment:
            TF_SCRIPT_DIR: _out/contrib
            TF_E2E_TEST_TYPE: aws
            TF_E2E_ACTION: apply
        - name: e2e-aws
        - name: tf destroy
          command: e2e-cloud-tf
          conditions:
            - always
          environment:
            TF_SCRIPT_DIR: _out/contrib
            TF_E2E_TEST_TYPE: aws
            TF_E2E_ACTION: destroy
    - name: integration-aws-nvidia-oss
      buildxOptions:
        enabled: true
      sops: true
      depends:
        - default
      runners:
        - self-hosted
        - generic # we can use generic here since the tests run against a remote talos cluster
      crons:
        - '30 7 * * *'
      triggerLabels:
        - integration/aws-nvidia-oss
      steps:
        - name: download-artifacts
          conditions:
            - not-on-schedule
          artifactStep:
            type: download
            artifactName: talos-artifacts
            artifactPath: _out
        - name: ci-temp-release-tag
          conditions:
            - not-on-schedule
        - name: generate
          conditions:
            - only-on-schedule
        - name: uki-certs
          conditions:
            - only-on-schedule
          environment:
            PLATFORM: linux/amd64
        - name: build
          conditions:
            - only-on-schedule
          command: talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
          environment:
            PLATFORM: linux/amd64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
            PUSH: true
        - name: talosctl-cni-bundle
          conditions:
            - only-on-schedule
        - name: images-essential
          conditions:
            - only-on-schedule
          environment:
            PLATFORM: linux/amd64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: checkout extensions
          checkoutStep:
            repository: siderolabs/extensions
            ref: release-1.8
            path: _out/extensions
        - name: set variables
          nonMakeStep: true
          command: cat _out/talos-metadata >> "$GITHUB_ENV"
        - name: build extensions
          command: nvidia-container-toolkit-production nvidia-open-gpu-kernel-modules-production zfs extensions-metadata
          arguments:
            - -C
            - _out/extensions
          environment:
            PLATFORM: linux/amd64
            PUSH: true
            REGISTRY: registry.dev.siderolabs.io
        - name: e2e-aws-prepare
          environment:
            EXTENSIONS_METADATA_FILE: _out/extensions/_out/extensions-metadata
            E2E_AWS_TARGET: nvidia-oss
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: checkout contrib
          checkoutStep:
            repository: siderolabs/contrib
            ref: main
            path: _out/contrib
        - name: setup tf
          terraformStep: true
        - name: tf apply
          command: e2e-cloud-tf
          environment:
            TF_SCRIPT_DIR: _out/contrib
            TF_E2E_TEST_TYPE: aws
            TF_E2E_ACTION: apply
        - name: e2e-aws-nvidia-oss
          command: e2e-aws
          environment:
            TEST_NUM_NODES: 4
            EXTRA_TEST_ARGS: -talos.extensions.nvidia
        - name: tf destroy
          command: e2e-cloud-tf
          conditions:
            - always
          environment:
            TF_SCRIPT_DIR: _out/contrib
            TF_E2E_TEST_TYPE: aws
            TF_E2E_ACTION: destroy
    - name: integration-aws-nvidia-nonfree
      buildxOptions:
        enabled: true
      sops: true
      depends:
        - default
      runners:
        - self-hosted
        - generic # we can use generic here since the tests run against a remote talos cluster
      crons:
        - '30 7 * * *'
      triggerLabels:
        - integration/aws-nvidia-nonfree
      steps:
        - name: download-artifacts
          conditions:
            - not-on-schedule
          artifactStep:
            type: download
            artifactName: talos-artifacts
            artifactPath: _out
        - name: ci-temp-release-tag
          conditions:
            - not-on-schedule
        - name: generate
          conditions:
            - only-on-schedule
        - name: uki-certs
          conditions:
            - only-on-schedule
          environment:
            PLATFORM: linux/amd64
        - name: build
          conditions:
            - only-on-schedule
          command: talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
          environment:
            PLATFORM: linux/amd64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
            PUSH: true
        - name: talosctl-cni-bundle
          conditions:
            - only-on-schedule
        - name: images-essential
          conditions:
            - only-on-schedule
          environment:
            PLATFORM: linux/amd64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: checkout extensions
          checkoutStep:
            repository: siderolabs/extensions
            ref: release-1.8
            path: _out/extensions
        - name: set variables
          nonMakeStep: true
          command: cat _out/talos-metadata >> "$GITHUB_ENV"
        - name: build extensions
          command: nvidia-container-toolkit-lts nonfree-kmod-nvidia-lts extensions-metadata
          arguments:
            - -C
            - _out/extensions
          environment:
            PLATFORM: linux/amd64
            PUSH: true
            REGISTRY: registry.dev.siderolabs.io
        - name: e2e-aws-prepare
          environment:
            EXTENSIONS_METADATA_FILE: _out/extensions/_out/extensions-metadata
            E2E_AWS_TARGET: nvidia-nonfree
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: checkout contrib
          checkoutStep:
            repository: siderolabs/contrib
            ref: main
            path: _out/contrib
        - name: setup tf
          terraformStep: true
        - name: tf apply
          command: e2e-cloud-tf
          environment:
            TF_SCRIPT_DIR: _out/contrib
            TF_E2E_TEST_TYPE: aws
            TF_E2E_ACTION: apply
        - name: e2e-aws-nvidia-nonfree
          command: e2e-aws
          environment:
            TEST_NUM_NODES: 4
            EXTRA_TEST_ARGS: -talos.extensions.nvidia
        - name: tf destroy
          command: e2e-cloud-tf
          conditions:
            - always
          environment:
            TF_SCRIPT_DIR: _out/contrib
            TF_E2E_TEST_TYPE: aws
            TF_E2E_ACTION: destroy
    - name: integration-azure
      buildxOptions:
        enabled: true
      sops: true
      depends:
        - default
      runners:
        - self-hosted
        - generic # we can use generic here since the tests run against a remote talos cluster
      crons:
        - '30 7 * * *'
      triggerLabels:
        - integration/azure
      steps:
        - name: download-artifacts
          conditions:
            - not-on-schedule
          artifactStep:
            type: download
            artifactName: talos-artifacts
            artifactPath: _out
        - name: ci-temp-release-tag
          conditions:
            - not-on-schedule
        - name: uki-certs
          conditions:
            - only-on-schedule
          environment:
            PLATFORM: linux/amd64
        - name: build
          conditions:
            - only-on-schedule
          command: talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
          environment:
            PLATFORM: linux/amd64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
            PUSH: true
        - name: talosctl-cni-bundle
          conditions:
            - only-on-schedule
        - name: images-essential
          conditions:
            - only-on-schedule
          environment:
            PLATFORM: linux/amd64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: e2e-azure-prepare
          environment:
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: checkout contrib
          checkoutStep:
            repository: siderolabs/contrib
            ref: main
            path: _out/contrib
        - name: setup tf
          terraformStep: true
        - name: tf apply
          command: e2e-cloud-tf
          environment:
            TF_SCRIPT_DIR: _out/contrib
            TF_E2E_TEST_TYPE: azure
            TF_E2E_ACTION: apply
            ARM_SUBSCRIPTION_ID: ${{ env.AZURE_SUBSCRIPTION_ID }}
            ARM_CLIENT_ID: ${{ env.AZURE_CLIENT_ID }}
            ARM_CLIENT_SECRET: ${{ env.AZURE_CLIENT_SECRET }}
            ARM_TENANT_ID: ${{ env.AZURE_TENANT_ID }}
        - name: e2e-azure
        - name: tf destroy
          command: e2e-cloud-tf
          conditions:
            - always
          environment:
            TF_SCRIPT_DIR: _out/contrib
            TF_E2E_TEST_TYPE: azure
            TF_E2E_ACTION: destroy
            ARM_SUBSCRIPTION_ID: ${{ env.AZURE_SUBSCRIPTION_ID }}
            ARM_CLIENT_ID: ${{ env.AZURE_CLIENT_ID }}
            ARM_CLIENT_SECRET: ${{ env.AZURE_CLIENT_SECRET }}
            ARM_TENANT_ID: ${{ env.AZURE_TENANT_ID }}
    - name: integration-gcp
      buildxOptions:
        enabled: true
      sops: true
      depends:
        - default
      runners:
        - self-hosted
        - generic # we can use generic here since the tests run against a remote talos cluster
      crons:
        - '30 7 * * *'
      triggerLabels:
        - integration/gcp
      steps:
        - name: download-artifacts
          conditions:
            - not-on-schedule
          artifactStep:
            type: download
            artifactName: talos-artifacts
            artifactPath: _out
        - name: ci-temp-release-tag
          conditions:
            - not-on-schedule
        - name: uki-certs
          conditions:
            - only-on-schedule
          environment:
            PLATFORM: linux/amd64
        - name: build
          conditions:
            - only-on-schedule
          command: talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
          environment:
            PLATFORM: linux/amd64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
            PUSH: true
        - name: talosctl-cni-bundle
          conditions:
            - only-on-schedule
        - name: images-essential
          conditions:
            - only-on-schedule
          environment:
            PLATFORM: linux/amd64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: e2e-gcp-prepare
        - name: checkout contrib
          checkoutStep:
            repository: siderolabs/contrib
            ref: main
            path: _out/contrib
        - name: setup tf
          terraformStep: true
        - name: tf apply
          command: e2e-cloud-tf
          environment:
            TF_SCRIPT_DIR: _out/contrib
            TF_E2E_TEST_TYPE: gcp
            TF_E2E_ACTION: apply
        - name: e2e-gcp
        - name: tf destroy
          command: e2e-cloud-tf
          conditions:
            - always
          environment:
            TF_SCRIPT_DIR: _out/contrib
            TF_E2E_TEST_TYPE: gcp
            TF_E2E_ACTION: destroy
    - name: integration-equinix-metal
      buildxOptions:
        enabled: true
      sops: true
      depends:
        - default
      runners:
        - self-hosted
        - generic # we can use generic here since the tests run against a remote talos cluster
      crons:
        - '30 7 * * *'
      triggerLabels:
        - integration/equinix-metal
      steps:
        - name: download-artifacts
          conditions:
            - not-on-schedule
          artifactStep:
            type: download
            artifactName: talos-artifacts
            artifactPath: _out
        - name: ci-temp-release-tag
          conditions:
            - not-on-schedule
        - name: build
          conditions:
            - only-on-schedule
          command: talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer imager talos _out/integration-test-linux-amd64
          environment:
            PLATFORM: linux/amd64,linux/arm64
            IMAGE_REGISTRY: registry.dev.siderolabs.io
            PUSH: true
        - name: talosctl-cni-bundle
          conditions:
            - only-on-schedule
        - name: e2e-equinix-metal-prepare
          environment:
            IMAGE_REGISTRY: registry.dev.siderolabs.io
        - name: checkout contrib
          checkoutStep:
            repository: siderolabs/contrib
            ref: main
            path: _out/contrib
        - name: setup tf
          terraformStep: true
        - name: tf apply
          command: e2e-cloud-tf
          environment:
            TF_SCRIPT_DIR: _out/contrib
            TF_E2E_TEST_TYPE: equinix-metal
            TF_E2E_ACTION: apply
        - name: e2e-equinix-metal
        - name: tf destroy
          command: e2e-cloud-tf
          conditions:
            - always
          environment:
            TF_SCRIPT_DIR: _out/contrib
            TF_E2E_TEST_TYPE: equinix-metal
            TF_E2E_ACTION: destroy
---
kind: common.Repository
spec:
  conformMaximumOfOneCommit: false