ci: shard integration tests and matrix darwin on go 1.25/1.26

.github/workflows/ci.yml

@@ -28,7 +28,7 @@ jobs:
           # GOLANGCI_LINT_VERSION.
           version: v2.5.0
 
-  test:
+  test-linux:
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -43,22 +43,6 @@ jobs:
       - run: go vet ./...
       - run: go test -race -count=1 ./...
 
-  test-integration:
-    runs-on: ubuntu-latest
-    needs: [lint, test]
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version: "1.25"
-          cache: true
-      - name: Verify Docker available
-        run: |
-          docker version
-          docker compose version
-      - name: Run integration tests
-        run: make test-integration
-
   # Apple-container backend lives in runtime/applecontainer and is
   # darwin/arm64-only (see build tags). This job builds the Swift
   # bridge and runs the Go test suite on macOS so we get coverage of
@@ -67,11 +51,15 @@ jobs:
   # runtimeOrSkip when Apple's `container` apiserver isn't running.
   test-darwin:
     runs-on: macos-26
+    strategy:
+      fail-fast: false
+      matrix:
+        go: ["1.25", "1.26"]
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-go@v6
         with:
-          go-version: "1.25"
+          go-version: ${{ matrix.go }}
           cache: true
       - name: Select Xcode with Swift 6.2
         # apple/container 0.12.3 declares swift-tools-version 6.2;
@@ -95,6 +83,48 @@ jobs:
       - run: go vet ./...
       - run: go test -race -count=1 ./...
 
+  test-integration-linux:
+    runs-on: ubuntu-latest
+    needs: [lint, test-linux]
+    strategy:
+      fail-fast: false
+      matrix:
+        go: ["1.25", "1.26"]
+        shard: [1, 2, 3]
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
+        with:
+          go-version: ${{ matrix.go }}
+          cache: true
+      - name: Verify Docker available
+        run: |
+          docker version
+          docker compose version
+      - name: Run integration tests (shard ${{ matrix.shard }}/3)
+        env:
+          SHARD_INDEX: ${{ matrix.shard }}
+          SHARD_TOTAL: 3
+        run: |
+          # Enumerate tests under the integration tag, partition them
+          # deterministically by sorted-index modulo SHARD_TOTAL, and
+          # run only this shard's subset. Apple-container tests are
+          # build-tagged darwin/arm64, so they don't appear here.
+          set -euo pipefail
+          tests=$(go test -tags=integration -list '.*' ./test/integration/... \
+            | grep -E '^Test' | sort -u)
+          if [ -z "$tests" ]; then
+            echo "no integration tests discovered" >&2
+            exit 1
+          fi
+          selected=$(echo "$tests" | awk -v s="$SHARD_INDEX" -v t="$SHARD_TOTAL" \
+            '{ if ((NR - 1) % t == (s - 1)) print }')
+          echo "Shard ${SHARD_INDEX}/${SHARD_TOTAL} will run:"
+          echo "$selected"
+          pattern="^($(echo "$selected" | paste -sd '|' -))$"
+          go test -race -count=1 -tags=integration -timeout=15m \
+            -run "$pattern" ./test/integration/...
+
   # Integration tests against a live Apple `container` daemon.
   #
   # Verified-on-CI status:
@@ -118,11 +148,16 @@ jobs:
   test-integration-darwin:
     runs-on: macos-26
     needs: [test-darwin]
+    strategy:
+      fail-fast: false
+      matrix:
+        go: ["1.25", "1.26"]
+        shard: [1, 2, 3]
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-go@v6
         with:
-          go-version: "1.25"
+          go-version: ${{ matrix.go }}
           cache: true
       - name: Install apple/container
         env:
@@ -174,12 +209,34 @@ jobs:
         # integration tests against a missing daemon.
         continue-on-error: true
         run: container builder start
-      - name: Run apple-container integration tests
+      - name: Run apple-container integration tests (shard ${{ matrix.shard }}/3)
         if: steps.builder.outcome == 'success'
-        # Filter to TestAppleContainer_* — the docker-backed tests
-        # share the `integration` build tag and would fail without a
-        # Docker daemon on this runner.
-        run: go test -race -count=1 -tags=integration -timeout=15m -run '^TestAppleContainer_' ./test/integration/...
+        env:
+          SHARD_INDEX: ${{ matrix.shard }}
+          SHARD_TOTAL: 3
+        run: |
+          # Filter to TestAppleContainer_* — the docker-backed tests
+          # share the `integration` build tag and would fail without a
+          # Docker daemon on this runner. Then partition that subset
+          # across shards.
+          set -euo pipefail
+          tests=$(go test -tags=integration -list '^TestAppleContainer_' ./test/integration/... \
+            | grep -E '^TestAppleContainer_' | sort -u)
+          if [ -z "$tests" ]; then
+            echo "no apple-container integration tests discovered" >&2
+            exit 1
+          fi
+          selected=$(echo "$tests" | awk -v s="$SHARD_INDEX" -v t="$SHARD_TOTAL" \
+            '{ if ((NR - 1) % t == (s - 1)) print }')
+          echo "Shard ${SHARD_INDEX}/${SHARD_TOTAL} will run:"
+          echo "$selected"
+          if [ -z "$selected" ]; then
+            echo "shard is empty; nothing to run"
+            exit 0
+          fi
+          pattern="^($(echo "$selected" | paste -sd '|' -))$"
+          go test -race -count=1 -tags=integration -timeout=15m \
+            -run "$pattern" ./test/integration/...
       - name: Stop container services
         if: always()
         run: |