test(tmachine): migrate Keycloak provider refresh coverage

.github/workflows/branch-e2e.yml

@@ -23,6 +23,7 @@ jobs:
       pull-requests: read
     outputs:
       should_run: ${{ steps.gate.outputs.should_run }}
+      run_integration: ${{ steps.labels.outputs.run_core_e2e }}
       run_core_e2e: ${{ steps.labels.outputs.run_core_e2e }}
       run_gpu_e2e: ${{ steps.labels.outputs.run_gpu_e2e }}
       run_kubernetes_ha_e2e: ${{ steps.labels.outputs.run_kubernetes_ha_e2e }}
@@ -199,29 +200,80 @@ jobs:
       packages: write
     uses: ./.github/workflows/build-images.yml
 
-  docker-e2e:
+  prepare-integration:
     needs: [pr_metadata, build-binaries, build-images]
-    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
+    if: needs.pr_metadata.outputs.run_integration == 'true'
     permissions:
       actions: read
       contents: read
       packages: read
-    uses: ./.github/workflows/e2e-docker-test.yml
+    uses: ./.github/workflows/prepare-integration-inputs.yml
+
+  # Run driver-independent conformance tests.
+  conformance-integration:
+    needs: prepare-integration
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+    uses: ./.github/workflows/integration-runner.yml
     with:
-      image-tag: ${{ github.sha }}
-      runner: linux-arm64-cpu8
-      conformance-artifact-prefix: openshell-conformance
+      category: conformance
+      source-sha: ${{ needs.prepare-integration.outputs.source_sha }}
+      integration-inputs-artifact-id: ${{ needs.prepare-integration.outputs.integration_inputs_artifact_id }}
+      test-matrix: >-
+        [
+          {"scenario":"ubuntu-docker-rootful","testsuite":"conformance"},
+          {"scenario":"fedora-podman-rootful","testsuite":"conformance"},
+          {"scenario":"fedora-podman-rootless","testsuite":"conformance"}
+        ]
 
-  podman-e2e:
+  # Run feature-specific integration tests:
+  feature-specific-integration:
+    needs: prepare-integration
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+    uses: ./.github/workflows/integration-runner.yml
+    with:
+      category: feature-specific
+      source-sha: ${{ needs.prepare-integration.outputs.source_sha }}
+      integration-inputs-artifact-id: ${{ needs.prepare-integration.outputs.integration_inputs_artifact_id }}
+      test-matrix: >-
+        [
+          {"scenario":"fedora-podman-rootful","testsuite":"provider-refresh"},
+          {"scenario":"fedora-podman-rootless","testsuite":"provider-refresh"}
+        ]
+
+  # Run driver-specific integration tests:
+  # TODO: This should be added as soon as we have driver-specific tests enabled in tmachine.
+  # driver-specific:
+  #   needs: prepare-integration
+  #   permissions:
+  #     actions: read
+  #     contents: read
+  #     packages: read
+  #   uses: ./.github/workflows/integration-runner.yml
+  #   with:
+  #     category: driver-specific
+  #     source-sha: ${{ needs.prepare-integration.outputs.source_sha }}
+  #     integration-inputs-artifact-id: ${{ needs.prepare-integration.outputs.integration_inputs_artifact_id }}
+  #     test-matrix: >-
+  #       [
+  #       ]
+
+  docker-e2e:
     needs: [pr_metadata, build-binaries, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     permissions:
       actions: read
       contents: read
       packages: read
-    uses: ./.github/workflows/e2e-podman-test.yml
+    uses: ./.github/workflows/e2e-docker-test.yml
     with:
       image-tag: ${{ github.sha }}
+      runner: linux-arm64-cpu8
       conformance-artifact-prefix: openshell-conformance
 
   vm-e2e:
@@ -392,7 +444,19 @@ jobs:
 
   core-e2e-result:
     name: Core E2E result
-    needs: [pr_metadata, docker-e2e, podman-e2e, vm-e2e, docker-external-driver-e2e, podman-external-driver-e2e, vm-external-driver-e2e, kubernetes-e2e, kubernetes-external-driver-e2e, kubernetes-workspace-managed-e2e, kubernetes-workspace-operator-e2e]
+    needs:
+      - pr_metadata
+      - conformance-integration
+      - feature-specific-integration
+      - docker-e2e
+      - vm-e2e
+      - docker-external-driver-e2e
+      - podman-external-driver-e2e
+      - vm-external-driver-e2e
+      - kubernetes-e2e
+      - kubernetes-external-driver-e2e
+      - kubernetes-workspace-managed-e2e
+      - kubernetes-workspace-operator-e2e
     if: always() && needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
     runs-on: ubuntu-latest
     steps:

.github/workflows/e2e-podman-test.yml

@@ -26,10 +26,8 @@ on:
         type: string
         default: ""
       suite-matrix:
-        required: false
+        required: true
         type: string
-        default: >-
-          [{"suite":"provider-refresh-keycloak","runner":"ubuntu-26.04","podman_major":"5","podman_package_version":"5.7.0+ds2-3build1","conmon_package_version":"2.1.13+ds1-2","cmd":"mise run --no-deps --skip-deps e2e:provider-refresh-keycloak"}]
 
 permissions:
   actions: read

.github/workflows/integration-runner.yml

@@ -0,0 +1,85 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Integration Test Runner
+
+on:
+  workflow_call:
+    inputs:
+      source-sha:
+        description: Source revision of the prepared candidate artifacts
+        required: true
+        type: string
+      integration-inputs-artifact-id:
+        description: Immutable ID of the prepared integration inputs artifact
+        required: true
+        type: string
+      category:
+        description: Integration-test category, used for the job name and concurrency key
+        required: false
+        type: string
+      test-matrix:
+        description: JSON array of scenario and testsuite combinations
+        required: false
+        type: string
+        default: >-
+          [
+            {"scenario":"ubuntu-docker-rootful","testsuite":"conformance"},
+            {"scenario":"fedora-podman-rootful","testsuite":"conformance"},
+            {"scenario":"fedora-podman-rootless","testsuite":"conformance"}
+          ]
+
+permissions:
+  actions: read
+  contents: read
+  packages: read
+
+concurrency:
+  group: ${{ github.workflow }}-integration-${{ inputs.category }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  integration:
+    name: Integration test (${{ inputs.category }}, ${{ matrix.scenario }}, ${{ matrix.testsuite }})
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJSON(inputs['test-matrix']) }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs['source-sha'] }}
+          persist-credentials: false
+
+      - name: Enable KVM access
+        run: |
+          set -euo pipefail
+          if [[ ! -c /dev/kvm ]]; then
+            echo "::error::The runner did not expose /dev/kvm"
+            exit 1
+          fi
+          sudo chmod 0666 /dev/kvm
+          exec 3<>/dev/kvm
+          exec 3>&-
+
+      - uses: ./.github/actions/setup-nix
+
+      - name: Cache tmachine disks
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        with:
+          path: ~/.cache/tmachine
+          key: tmachine-${{ runner.os }}-${{ runner.arch }}
+
+      - name: Download integration inputs
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          artifact-ids: ${{ inputs['integration-inputs-artifact-id'] }}
+          path: artifacts
+
+      - name: Run test suite
+        env:
+          SCENARIO: ${{ matrix.scenario }}
+          TESTSUITE: ${{ matrix.testsuite }}
+        run: nix run .#tmachine -- test "${SCENARIO}" "${TESTSUITE}"