ci(e2e): reuse prebuilt gateway artifacts

Signed-off-by: Evan Lezar <elezar@nvidia.com>

Author: elezar

.github/actions/setup-e2e-gateway/action.yml

@@ -0,0 +1,29 @@
+name: Setup E2E Gateway
+description: Download an architecture-matched prebuilt OpenShell gateway for E2E tests
+
+inputs:
+  artifact-prefix:
+    description: Artifact name prefix; linux-<arch> is appended automatically
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Download prebuilt gateway
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        name: ${{ format('{0}-linux-{1}', inputs.artifact-prefix, runner.arch == 'X64' && 'amd64' || 'arm64') }}
+        path: .e2e/prebuilt-gateway
+
+    - name: Configure prebuilt gateway
+      shell: bash
+      run: |
+        set -euo pipefail
+        gateway="$GITHUB_WORKSPACE/.e2e/prebuilt-gateway/openshell-gateway"
+        if [[ ! -f "$gateway" ]]; then
+          echo "downloaded artifact is missing $gateway" >&2
+          exit 1
+        fi
+        chmod +x "$gateway"
+        "$gateway" --version
+        echo "OPENSHELL_GATEWAY_BIN=$gateway" >> "$GITHUB_ENV"

.github/workflows/branch-e2e.yml

@@ -73,7 +73,7 @@ jobs:
 
   build-gateway:
     needs: [pr_metadata]
-    if: needs.pr_metadata.outputs.should_run == 'true' && (needs.pr_metadata.outputs.run_core_e2e == 'true' || needs.pr_metadata.outputs.run_kubernetes_ha_e2e == 'true')
+    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_any_e2e == 'true'
     permissions:
       contents: read
       packages: write
@@ -116,9 +116,10 @@ jobs:
       image-tag: ${{ github.sha }}
       runner: linux-arm64-cpu8
       cli-artifact-prefix: rust-binary-cli
+      gateway-artifact-prefix: rust-binary-gateway
 
   gpu-e2e:
-    needs: [pr_metadata, build-supervisor, build-cli]
+    needs: [pr_metadata, build-gateway, build-supervisor, build-cli]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_gpu_e2e == 'true'
     permissions:
       actions: read
@@ -128,6 +129,7 @@ jobs:
     with:
       image-tag: ${{ github.sha }}
       cli-artifact-prefix: rust-binary-cli
+      gateway-artifact-prefix: rust-binary-gateway
 
   kubernetes-e2e:
     needs: [pr_metadata, build-gateway, build-supervisor, build-cli]
@@ -208,19 +210,21 @@ jobs:
 
   gpu-e2e-result:
     name: GPU E2E result
-    needs: [pr_metadata, build-supervisor, build-cli, gpu-e2e]
+    needs: [pr_metadata, build-gateway, build-supervisor, build-cli, gpu-e2e]
     if: always() && needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_gpu_e2e == 'true'
     runs-on: ubuntu-latest
     steps:
       - name: Verify GPU E2E jobs
         env:
+          BUILD_GATEWAY_RESULT: ${{ needs.build-gateway.result }}
           BUILD_SUPERVISOR_RESULT: ${{ needs.build-supervisor.result }}
           BUILD_CLI_RESULT: ${{ needs.build-cli.result }}
           GPU_E2E_RESULT: ${{ needs.gpu-e2e.result }}
         run: |
           set -euo pipefail
           failed=0
           for item in \
+            "build-gateway:$BUILD_GATEWAY_RESULT" \
             "build-supervisor:$BUILD_SUPERVISOR_RESULT" \
             "build-cli:$BUILD_CLI_RESULT" \
             "gpu-e2e:$GPU_E2E_RESULT"; do

.github/workflows/e2e-gpu-test.yaml

@@ -12,6 +12,11 @@ on:
         required: false
         type: string
         default: ""
+      gateway-artifact-prefix:
+        description: "Optional prebuilt gateway artifact prefix (artifact suffix is linux-<arch>)"
+        required: false
+        type: string
+        default: ""
 
 permissions:
   actions: read
@@ -70,6 +75,12 @@ jobs:
         with:
           artifact-prefix: ${{ inputs.cli-artifact-prefix }}
 
+      - name: Use prebuilt OpenShell gateway
+        if: inputs.gateway-artifact-prefix != ''
+        uses: ./.github/actions/setup-e2e-gateway
+        with:
+          artifact-prefix: ${{ inputs.gateway-artifact-prefix }}
+
       - name: Log in to GHCR
         run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
 

.github/workflows/e2e-test.yml

@@ -22,6 +22,11 @@ on:
         required: false
         type: string
         default: ""
+      gateway-artifact-prefix:
+        description: "Optional prebuilt gateway artifact prefix (artifact suffix is linux-<arch>)"
+        required: false
+        type: string
+        default: ""
 
 permissions:
   actions: read
@@ -75,6 +80,12 @@ jobs:
         with:
           artifact-prefix: ${{ inputs.cli-artifact-prefix }}
 
+      - name: Use prebuilt OpenShell gateway
+        if: inputs.gateway-artifact-prefix != ''
+        uses: ./.github/actions/setup-e2e-gateway
+        with:
+          artifact-prefix: ${{ inputs.gateway-artifact-prefix }}
+
       - name: Check out MCP conformance tests
         if: matrix.suite == 'mcp'
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -144,6 +155,12 @@ jobs:
         with:
           artifact-prefix: ${{ inputs.cli-artifact-prefix }}
 
+      - name: Use prebuilt OpenShell gateway
+        if: inputs.gateway-artifact-prefix != ''
+        uses: ./.github/actions/setup-e2e-gateway
+        with:
+          artifact-prefix: ${{ inputs.gateway-artifact-prefix }}
+
       - name: Install mise
         run: |
           curl https://mise.run | MISE_VERSION=v2026.4.25 sh

CI.md

@@ -20,7 +20,7 @@ Three opt-in labels enable the long-running E2E suites:
 - `test:e2e-kubernetes` runs Kubernetes E2E with the HA Helm overlay
   (`replicaCount: 2` and bundled PostgreSQL) in `Branch E2E Checks`
 
-When multiple labels are present, `Branch E2E Checks` builds the shared gateway and supervisor images once, builds one CLI artifact per runner architecture, and fans out all enabled suites in parallel. Rust and MCP E2E jobs reuse the matching prebuilt CLI instead of compiling another debug CLI in each job.
+When multiple labels are present, `Branch E2E Checks` builds the shared gateway and supervisor images once, builds one CLI artifact per runner architecture, and fans out all enabled suites in parallel. Docker, Podman, GPU, Rust, Python, and MCP E2E jobs reuse the matching prebuilt gateway and CLI binaries instead of compiling additional debug binaries in each job; Kubernetes E2E consumes the gateway image directly and reuses the prebuilt CLI.
 The `OpenShell / E2E` and `OpenShell / GPU E2E` required statuses are evaluated from separate suite result jobs inside that workflow. `test:e2e-kubernetes` is optional while HA behavior is under active iteration: failures are visible in the workflow run but do not publish a required CI gate status.
 
 The GitHub ruleset should require the `OpenShell / ...` statuses published by `Required CI Gates`, not the push-triggered workflow jobs directly.

e2e/support/gateway-common.sh

@@ -181,12 +181,16 @@ e2e_build_gateway_binaries() {
 
   target_dir="$(e2e_cargo_target_dir "${root}")"
   printf -v "${target_var}" '%s' "${target_dir}"
-  printf -v "${gateway_var}" '%s' "${target_dir}/debug/openshell-gateway"
+  printf -v "${gateway_var}" '%s' "${OPENSHELL_GATEWAY_BIN:-${target_dir}/debug/openshell-gateway}"
   printf -v "${cli_var}" '%s' "${OPENSHELL_BIN:-${target_dir}/debug/openshell}"
 
-  echo "Building openshell-gateway..."
-  cargo build "${jobs[@]}" \
-    -p openshell-server --bin openshell-gateway
+  if [ -z "${OPENSHELL_GATEWAY_BIN:-}" ]; then
+    echo "Building openshell-gateway..."
+    cargo build "${jobs[@]}" \
+      -p openshell-server --bin openshell-gateway
+  else
+    echo "Using prebuilt openshell gateway at ${OPENSHELL_GATEWAY_BIN}"
+  fi
 
   if [ -z "${OPENSHELL_BIN:-}" ]; then
     echo "Building openshell-cli..."
@@ -196,8 +200,8 @@ e2e_build_gateway_binaries() {
     echo "Using prebuilt openshell CLI at ${OPENSHELL_BIN}"
   fi
 
-  if [ ! -x "${target_dir}/debug/openshell-gateway" ]; then
-    echo "ERROR: expected openshell-gateway binary at ${target_dir}/debug/openshell-gateway" >&2
+  if [ ! -x "${!gateway_var}" ]; then
+    echo "ERROR: expected openshell-gateway binary at ${!gateway_var}" >&2
     exit 1
   fi
   if [ ! -x "${!cli_var}" ]; then