.github/workflows/test-action.yml - master - githubmirror/salt

.github/workflows/test-action.yml
1 481 строка63 KB
Daniel A. Wozniak
Merge branch '3007.x' into merge/3007.x/3008.x-26-06-23
24 июн 2026, 01:19
24 июн 2026, 01:19611b4be
---
name: Test Artifact

on:
  workflow_call:
    inputs:
      nox-session:
        required: true
        type: string
        description: The nox session to run
      testrun:
        required: true
        type: string
        description: JSON string containing information about what and how to run the test suite
      ci-python-version:
        required: true
        type: string
        description: The python version to run tests with
      salt-version:
        type: string
        required: true
        description: The Salt version to set prior to running tests.
      cache-prefix:
        required: true
        type: string
        description: Seed used to invalidate caches
      nox-version:
        required: true
        type: string
        description: The nox version to install
      package-name:
        required: false
        type: string
        description: The onedir package name to use
        default: salt
      skip-code-coverage:
        required: false
        type: boolean
        description: Skip code coverage
        default: false
      workflow-slug:
        required: false
        type: string
        description: Which workflow is running.
        default: ci
      default-timeout:
        required: false
        type: number
        description: Timeout, in minutes, for the test job(Default 360, 6 hours).
        default: 360
      matrix:
        required: true
        type: string
        description: Json job matrix config
      linux_arm_runner:
        required: true
        type: string
        description: Json job matrix config
      raise-deprecations-runtime-errors:
        required: true
        type: string
        description: Whether to raise RuntimeError on deprecation warnings ("1" or "0")

env:
  COLUMNS: 190
  RELENV_DATA: "${{ github.workspace }}/.relenv"
  PIP_INDEX_URL: ${{ vars.PIP_INDEX_URL }}
  PIP_TRUSTED_HOST: ${{ vars.PIP_TRUSTED_HOST }}
  PIP_EXTRA_INDEX_URL: ${{ vars.PIP_EXTRA_INDEX_URL }}
  PIP_DISABLE_PIP_VERSION_CHECK: "1"
  RAISE_DEPRECATIONS_RUNTIME_ERRORS: ${{ inputs.raise-deprecations-runtime-errors }}
  # Line-buffer Python on the runner; docker exec still passes this into the test container explicitly.
  PYTHONUNBUFFERED: "1"

jobs:

  test-linux:
    name: ${{ matrix.display_name }} ${{ matrix.tests-chunk }} ${{ matrix.transport }}${{ matrix.fips && '(fips)' || '' }}${{ matrix.test-group && ' ' || '' }}${{ matrix.test-group && matrix.test-group || '' }}
    runs-on: ${{ matrix.arch == 'x86_64' && 'ubuntu-24.04' || inputs.linux_arm_runner }}
    if: ${{ !cancelled() && toJSON(fromJSON(inputs.matrix)['linux-x86_64']) != '[]' }}
    # Full test runs. Each chunk should never take more than 2 hours.
    # Partial test runs(no chunk parallelization), 6 Hours
    timeout-minutes: ${{ fromJSON(inputs.testrun)['type'] == 'full' && inputs.default-timeout || 360 }}
    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJSON(inputs.matrix)['linux-x86_64'] }}
    steps:

      - name: "Throttle Builds"
        shell: bash
        run: |
          t=$(python3 -c 'import random, sys; sys.stdout.write(str(random.randint(1, 15)))'); echo "Sleeping $t seconds"; sleep "$t"

      - name: "Set `TIMESTAMP` environment variable"
        shell: bash
        run: |
          echo "TIMESTAMP=$(date +%s)" | tee -a "$GITHUB_ENV"

      - name: Checkout Source Code
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Setup Python ${{ inputs.ci-python-version }}
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "${{ inputs.ci-python-version }}"

      - name: Setup Python Tools Scripts
        uses: ./.github/actions/setup-python-tools-scripts
        with:
          cache-prefix: ${{ inputs.cache-prefix }}

      - name: Free Disk Space Before Build
        run: |
          echo "Disk space before cleanup:"
          df -h
          sudo rm -rf /usr/local/.ghcup
          sudo rm -rf /opt/hostedtoolcache/CodeQL
          sudo rm -rf /usr/local/lib/android/sdk/ndk
          sudo rm -rf /usr/share/dotnet
          sudo rm -rf /opt/ghc
          sudo rm -rf /usr/local/share/boost
          sudo apt-get clean
          echo "Disk space after cleanup:"
          df -h

      - name: Setup Salt Version
        run: |
          echo "${{ inputs.salt-version }}" > salt/_version.txt

      - name: Download Onedir Tarball as an Artifact
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: ${{ inputs.package-name }}-${{ inputs.salt-version }}-onedir-${{ matrix.platform }}-${{ matrix.arch }}.tar.xz
          path: artifacts/

      - name: Decompress Onedir Tarball
        shell: bash
        run: |
          python3 -c "import os; os.makedirs('artifacts', exist_ok=True)"
          cd artifacts
          tar xvf ${{ inputs.package-name }}-${{ inputs.salt-version }}-onedir-${{ matrix.platform }}-${{ matrix.arch }}.tar.xz

      - name: "Configure docker"
        run: |
          sudo sed -i '/LimitNOFILE=infinity/c\LimitNOFILE=1048576' /lib/systemd/system/containerd.service
          sudo systemctl daemon-reload
          sudo systemctl restart containerd
          cat /lib/systemd/system/containerd.service

      - name: "Pull container ${{ matrix.container }}"
        run: |
          docker pull ${{ matrix.container }}

      - name: "Create docker network"
        run: |
           # Use ULA prefix (fd00::/8) for proper IPv6 support with NAT
           docker network create --ipv6 \
             --subnet="fd00:db8::/64" \
             -o "com.docker.network.driver.mtu=1500" \
             ip6net

           # Enable IPv6 forwarding and NAT for internet connectivity
           sudo sysctl -w net.ipv6.conf.all.forwarding=1
           sudo sysctl -w net.ipv6.conf.default.forwarding=1

           # Accept router advertisements even with forwarding enabled
           sudo sysctl -w net.ipv6.conf.all.accept_ra=2
           sudo sysctl -w net.ipv6.conf.default.accept_ra=2

           # Add masquerading for ULA to reach internet (fixes Python 3.11+ IPv6 timeouts)
           sudo ip6tables -t nat -A POSTROUTING -s fd00:db8::/64 ! -d fd00:db8::/64 -j MASQUERADE

      - name: "Host network config"
        run: |
          ip a

      - name: Free Memory Before Container
        shell: bash
        run: |
          free -h

      - name: "Create container ${{ matrix.container }}"
        env:
          GITHUB_ACTIONS: true
          CI: true
          SKIP_REQUIREMENTS_INSTALL: 1
          PRINT_TEST_SELECTION: 0
          PRINT_TEST_PLAN_ONLY: 0
          PRINT_SYSTEM_INFO: 0
          RERUN_FAILURES: 1
          GITHUB_ACTIONS_PIPELINE: 1
          SKIP_INITIAL_ONEDIR_FAILURES: 1
          SKIP_INITIAL_GH_ACTIONS_FAILURES: 1
          SKIP_CODE_COVERAGE: ${{ inputs.skip-code-coverage && '1' || '0' }}
          CONVERAGE_CONTEXT: ${{ matrix.slug }}
          COLUMNS: 190
          PIP_INDEX_URL: "${{ vars.PIP_INDEX_URL }}"
          PIP_TRUSTED_HOST: "${{ vars.PIP_TRUSTED_HOST }}"
          PIP_EXTRA_INDEX_URL: "${{ vars.PIP_EXTRA_INDEX_URL }}"
          PIP_DISABLE_PIP_VERSION_CHECK: 1
          RAISE_DEPRECATIONS_RUNTIME_ERRORS: ${{ inputs.raise-deprecations-runtime-errors }}
          SALT_TRANSPORT: ${{ matrix.transport }}
          FIPS_TESTRUN: ${{ matrix.fips && '1' || '0' }}
        run: |
          tools container create ${{ matrix.container }} --name ${{ github.run_id }}_salt-test

      - name: "Start container ${{ matrix.container }}"
        run: |
          /usr/bin/docker start ${{ github.run_id }}_salt-test

      - name: Fix PhotonOS password expiration
        if: startsWith(matrix.slug, 'photonos-')
        run: |
          docker exec ${{ github.run_id }}_salt-test chage -I -1 -m 0 -M 99999 -E -1 root

      - name: Fix PhotonOS repository URLs
        if: startsWith(matrix.slug, 'photonos-')
        run: |
          docker exec ${{ github.run_id }}_salt-test \
            sh -c "for f in /etc/yum.repos.d/photon*.repo; do [ -e \"\$f\" ] && sed -i -E 's/packages(-prod)?\.(vmware|broadcom)\.com\/photon/packages.broadcom.com\/photon/g' \"\$f\"; done && tdnf makecache"

      - name: Install FIPS provider
        if: ${{ matrix.fips && startsWith(matrix.slug, 'photonos-') }}
        run: |
          docker exec ${{ github.run_id }}_salt-test \
            tdnf install -y openssl-fips-provider
          # openssl-fips-provider <= 3.1.2-3.ph5 disables the OpenSSL default
          # provider in /etc/ssl/distro.cnf, breaking TLS in curl/git/tdnf.
          # Re-enable it to mirror the upstream fix in vmware/photon@4610f36756
          # (openssl-fips-provider 3.1.2-4.ph5). Idempotent on fixed builds.
          docker exec ${{ github.run_id }}_salt-test \
            sed -i '/^#\.include \/etc\/ssl\/provider_default.cnf/s/^#//g' /etc/ssl/distro.cnf

      - name: "Show container inspect ${{ matrix.container }}"
        run: |
          /usr/bin/docker inspect ${{ github.run_id }}_salt-test

      - name: Download nox.linux.${{ matrix.arch }}.tar.* artifact for session ${{ inputs.nox-session }}
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: nox-linux-${{ matrix.arch }}-${{ inputs.nox-session }}

      - name: Install Nox
        run: |
          python3 -m pip install 'nox==${{ inputs.nox-version }}'
        env:
          PIP_INDEX_URL: https://pypi.org/simple

      - name: Decompress .nox Directory
        run: |
          docker exec -e PYTHONUNBUFFERED=1 ${{ github.run_id}}_salt-test python3 -m nox --force-color -e decompress-dependencies -- linux ${{ matrix.arch }}

      - name: Create relenv toolchain symlink
        run: |
          # Python's sysconfig expects toolchain at ~/.local/relenv/toolchain but
          # relenv extracts to ~/.cache/relenv/toolchains - create symlink
          docker exec ${{ github.run_id}}_salt-test bash -c \
            'mkdir -p ~/.local/relenv && ln -sf ~/.cache/relenv/toolchains ~/.local/relenv/toolchain'

      - name: Download testrun-changed-files.txt
        if: ${{ fromJSON(inputs.testrun)['type'] != 'full' }}
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: testrun-changed-files.txt

      - name: Current Directory
        run: |
          pwd

      - name: Show System Info
        run: |
          docker exec -e SKIP_REQUIREMENTS_INSTALL=1 -e PRINT_SYSTEM_INFO_ONLY=1 ${{ github.run_id}}_salt-test \
          python3 -m nox --force-color -e ${{ inputs.nox-session }} -- ${{ matrix.tests-chunk }}

      - name: Free Space on Host
        shell: bash
        run: |
          df -h

      - name: Show container network info
        shell: bash
        run: |
          docker exec ${{ github.run_id}}_salt-test ip addr

      - name: Show container processes
        shell: bash
        run: |
          docker exec ${{ github.run_id}}_salt-test ps auxf

      - name: Free Space on Container
        shell: bash
        run: |
          docker exec ${{ github.run_id}}_salt-test df -h

      - name: Free Memory
        shell: bash
        run: |
          free -h

      - name: Configure apparmor
        run: |
          # Apparmor's unix-chkpwd profile gets in the way of tests needing to
          # authenticate from inside a container.
          cat <<'EOF' | sudo tee /etc/apparmor.d/unix-chkpwd
          abi <abi/4.0>,
          include <tunables/global>
          profile unix-chkpwd /{,usr/}{,s}bin/unix_chkpwd flags=(unconfined) {
            include <abstractions/base>
            include <abstractions/nameservice>
            # To write records to the kernel auditing log.
            capability audit_write,
            network netlink raw,
            /{,usr/}{,s}bin/unix_chkpwd mr,
            /etc/shadow r,
            # systemd userdb, used in nspawn
            /run/host/userdb/*.user r,
            /run/host/userdb/*.user-privileged r,
            # file_inherit
            owner /dev/tty[0-9]* rw,
            include if exists <local/unix-chkpwd>
          }
          EOF
          sudo systemctl restart apparmor
          sudo aa-status

      - name: Run Changed Tests
        id: run-fast-changed-tests
        if: ${{ !cancelled() && fromJSON(inputs.testrun)['type'] != 'full' }}
        run: |
          docker exec -e PYTHONUNBUFFERED=1 ${{ github.run_id}}_salt-test python3 -m nox --force-color -e ${{ inputs.nox-session }} -- ${{ matrix.tests-chunk }} -- \
            --core-tests --slow-tests --suppress-no-test-exit-code --from-filenames=testrun-changed-files.txt

      - name: Run Fast Tests
        id: run-fast-tests
        if: ${{ !cancelled() && fromJSON(inputs.testrun)['type'] != 'full' && fromJSON(inputs.testrun)['selected_tests']['fast'] }}
        run: |
          docker exec -e PYTHONUNBUFFERED=1 ${{ github.run_id}}_salt-test \
            python3 -m nox --force-color -e ${{ inputs.nox-session }} -- ${{ matrix.tests-chunk }} -- \
            --suppress-no-test-exit-code

      - name: Run Slow Tests
        id: run-slow-tests
        if: ${{ !cancelled() && fromJSON(inputs.testrun)['type'] != 'full' && fromJSON(inputs.testrun)['selected_tests']['slow'] }}
        run: |
          docker exec -e PYTHONUNBUFFERED=1 ${{ github.run_id}}_salt-test \
            python3 -m nox --force-color -e ${{ inputs.nox-session }} -- ${{ matrix.tests-chunk }} -- \
            --suppress-no-test-exit-code --no-fast-tests --slow-tests

      - name: Run Core Tests
        id: run-core-tests
        if: ${{ !cancelled() && fromJSON(inputs.testrun)['type'] != 'full' && fromJSON(inputs.testrun)['selected_tests']['core'] }}
        run: |
          docker exec -e PYTHONUNBUFFERED=1 ${{ github.run_id}}_salt-test \
            python3 -m nox --force-color -e ${{ inputs.nox-session }} -- ${{ matrix.tests-chunk }} -- \
            --suppress-no-test-exit-code --no-fast-tests --core-tests

      - name: Run Flaky Tests
        id: run-flaky-tests
        if: ${{ !cancelled() && fromJSON(inputs.testrun)['selected_tests']['flaky'] }}
        run: |
          docker exec -e PYTHONUNBUFFERED=1 ${{ github.run_id}}_salt-test \
            python3 -m nox --force-color -e ${{ inputs.nox-session }} -- ${{ matrix.tests-chunk }} -- \
            --suppress-no-test-exit-code --no-fast-tests --flaky-jail

      - name: Run Full Tests
        id: run-full-tests
        if: ${{ !cancelled() && fromJSON(inputs.testrun)['type'] == 'full' }}
        run: |
          docker exec -e PYTHONUNBUFFERED=1 ${{ github.run_id}}_salt-test \
            python3 -m nox --force-color -e ${{ inputs.nox-session }} -- ${{ matrix.tests-chunk }} -- \
            --slow-tests --core-tests --test-group-count=${{ matrix.test-group-count || 1 }} --test-group=${{ matrix.test-group || 1 }}

      - name: Sync filesystem in test container
        if: always()
        run: |
          docker exec ${{ github.run_id}}_salt-test sync 2>/dev/null || true

      - name: Stop Container
        if: always()
        run: |
          docker container stop ${{ github.run_id}}_salt-test || true

      - name: Remove Container
        if: always()
        run: |
          docker container rm ${{ github.run_id}}_salt-test || true

      - name: Remove Container Image
        if: always()
        run: |
          docker image rm ${{ matrix.container }} || true

      - name: Fix file ownership
        if: always()
        run: |
          sudo chown -R "$(id -un)" .

      - name: Prepare Test Run Artifacts
        id: download-artifacts-from-vm
        if: always()
        run: |
          # Delete the salt onedir, we won't need it anymore and it will prevent
          # from it showing in the tree command below
          sudo rm -rf artifacts/salt*
          sync || true
          tree -a artifacts

      - name: Combine Code Coverage
        if: ${{ !cancelled() && !inputs.skip-code-coverage }}
        run: |
          nox --force-color -e combine-coverage

      - name: Rename Coverage Artifact
        if: ${{ !cancelled() && !inputs.skip-code-coverage }}
        run: |
          mv artifacts/coverage/.coverage artifacts/coverage/.coverage.${{ matrix.slug }}-${{ inputs.nox-session }}-${{ matrix.transport }}-${{ matrix.tests-chunk }}-${{ env.TIMESTAMP }}-${{ matrix.fips && 'fips' || 'std' }}-${{ matrix.test-group || 1 }}-${{ github.run_attempt }}

      - name: Upload Code Coverage Test Run Artifacts
        if: ${{ !cancelled() && !inputs.skip-code-coverage }}
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: coverage-artifacts-${{ matrix.slug }}-${{ inputs.nox-session }}-${{ matrix.transport }}-${{ matrix.tests-chunk }}-${{ env.TIMESTAMP }}-${{ matrix.fips && 'fips' || 'std' }}-${{ matrix.test-group || 1 }}-${{ github.run_attempt }}
          path: |
            artifacts/coverage/.coverage.${{ matrix.slug }}-${{ inputs.nox-session }}-${{ matrix.transport }}-${{ matrix.tests-chunk }}-${{ env.TIMESTAMP }}-${{ matrix.fips && 'fips' || 'std' }}-${{ matrix.test-group || 1 }}-${{ github.run_attempt }}
          include-hidden-files: true

      - name: Upload JUnit XML Test Run Artifacts
        if: always() && steps.download-artifacts-from-vm.outcome == 'success'
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: testrun-junit-artifacts-${{ matrix.slug }}-${{ inputs.nox-session }}-${{ matrix.transport }}${{ matrix.fips && '(fips)' || '' }}-${{ matrix.tests-chunk }}-${{ matrix.test-group || 1 }}-${{ env.TIMESTAMP }}
          path: |
            artifacts/xml-unittests-output/
          include-hidden-files: true

      - name: Upload Test Run Log Artifacts
        if: always() && steps.download-artifacts-from-vm.outcome == 'success'
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: testrun-log-artifacts-${{ matrix.slug }}-${{ inputs.nox-session }}-${{ matrix.transport }}${{ matrix.fips && '(fips)' || '' }}-${{ matrix.tests-chunk }}-${{ matrix.test-group || 1 }}-${{ env.TIMESTAMP }}
          path: |
            artifacts/logs
          include-hidden-files: true

  test-linux-arm64:
    name: ${{ matrix.display_name }} ${{ matrix.tests-chunk }} ${{ matrix.transport }}${{ matrix.fips && '(fips)' || '' }}${{ matrix.test-group && ' ' || '' }}${{ matrix.test-group && matrix.test-group || '' }}
    runs-on: ${{ matrix.arch == 'x86_64' && 'ubuntu-22.04' || inputs.linux_arm_runner }}
    if: ${{ !cancelled() && toJSON(fromJSON(inputs.matrix)['linux-arm64']) != '[]' }}
    # Full test runs. Each chunk should never take more than 2 hours.
    # Partial test runs(no chunk parallelization), 6 Hours
    timeout-minutes: ${{ fromJSON(inputs.testrun)['type'] == 'full' && inputs.default-timeout || 360 }}
    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJSON(inputs.matrix)['linux-arm64'] }}
    steps:

      - name: "Throttle Builds"
        shell: bash
        run: |
          t=$(python3 -c 'import random, sys; sys.stdout.write(str(random.randint(1, 15)))'); echo "Sleeping $t seconds"; sleep "$t"

      - name: "Set `TIMESTAMP` environment variable"
        shell: bash
        run: |
          echo "TIMESTAMP=$(date +%s)" | tee -a "$GITHUB_ENV"


      - name: Checkout Source Code
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Setup Python ${{ inputs.ci-python-version }}
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "${{ inputs.ci-python-version }}"

      - name: Setup Python Tools Scripts
        uses: ./.github/actions/setup-python-tools-scripts
        with:
          cache-prefix: ${{ inputs.cache-prefix }}

      - name: "Set `TIMESTAMP` environment variable"
        shell: bash
        run: |
          echo "TIMESTAMP=$(date +%s)" | tee -a "$GITHUB_ENV"

      - name: Free Disk Space Before Build
        run: |
          echo "Disk space before cleanup:"
          df -h
          sudo rm -rf /usr/local/.ghcup
          sudo rm -rf /opt/hostedtoolcache/CodeQL
          sudo rm -rf /usr/local/lib/android/sdk/ndk
          sudo rm -rf /usr/share/dotnet
          sudo rm -rf /opt/ghc
          sudo rm -rf /usr/local/share/boost
          sudo apt-get clean
          echo "Disk space after cleanup:"
          df -h

      - name: Setup Salt Version
        run: |
          echo "${{ inputs.salt-version }}" > salt/_version.txt

      - name: Download Onedir Tarball as an Artifact
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: ${{ inputs.package-name }}-${{ inputs.salt-version }}-onedir-${{ matrix.platform }}-${{ matrix.arch }}.tar.xz
          path: artifacts/

      - name: Decompress Onedir Tarball
        shell: bash
        run: |
          python3 -c "import os; os.makedirs('artifacts', exist_ok=True)"
          cd artifacts
          tar xvf ${{ inputs.package-name }}-${{ inputs.salt-version }}-onedir-${{ matrix.platform }}-${{ matrix.arch }}.tar.xz

      - name: "Configure docker"
        run: |
          sudo sed -i '/LimitNOFILE=infinity/c\LimitNOFILE=1048576' /lib/systemd/system/containerd.service
          sudo systemctl daemon-reload
          sudo systemctl restart containerd
          cat /lib/systemd/system/containerd.service

      - name: "Pull container ${{ matrix.container }}"
        run: |
          docker pull ${{ matrix.container }}

      - name: "Create docker network"
        run: |
           # Use ULA prefix (fd00::/8) for proper IPv6 support with NAT
           docker network create --ipv6 \
             --subnet="fd00:db8::/64" \
             -o "com.docker.network.driver.mtu=1500" \
             ip6net

           # Enable IPv6 forwarding and NAT for internet connectivity
           sudo sysctl -w net.ipv6.conf.all.forwarding=1
           sudo sysctl -w net.ipv6.conf.default.forwarding=1

           # Accept router advertisements even with forwarding enabled
           sudo sysctl -w net.ipv6.conf.all.accept_ra=2
           sudo sysctl -w net.ipv6.conf.default.accept_ra=2

           # Add masquerading for ULA to reach internet (fixes Python 3.11+ IPv6 timeouts)
           sudo ip6tables -t nat -A POSTROUTING -s fd00:db8::/64 ! -d fd00:db8::/64 -j MASQUERADE

      - name: "Host network config"
        run: |
          ip a

      - name: Free Memory Before Container
        shell: bash
        run: |
          free -h

      - name: "Create container ${{ matrix.container }}"
        env:
          GITHUB_ACTIONS: true
          CI: true
          SKIP_REQUIREMENTS_INSTALL: 1
          PRINT_TEST_SELECTION: 0
          PRINT_TEST_PLAN_ONLY: 0
          PRINT_SYSTEM_INFO: 0
          RERUN_FAILURES: 1
          GITHUB_ACTIONS_PIPELINE: 1
          SKIP_INITIAL_ONEDIR_FAILURES: 1
          SKIP_INITIAL_GH_ACTIONS_FAILURES: 1
          SKIP_CODE_COVERAGE: ${{ inputs.skip-code-coverage && '1' || '0' }}
          CONVERAGE_CONTEXT: ${{ matrix.slug }}
          COLUMNS: 190
          PIP_INDEX_URL: "${{ vars.PIP_INDEX_URL }}"
          PIP_TRUSTED_HOST: "${{ vars.PIP_TRUSTED_HOST }}"
          PIP_EXTRA_INDEX_URL: "${{ vars.PIP_EXTRA_INDEX_URL }}"
          PIP_DISABLE_PIP_VERSION_CHECK: 1
          RAISE_DEPRECATIONS_RUNTIME_ERRORS: ${{ inputs.raise-deprecations-runtime-errors }}
          SALT_TRANSPORT: ${{ matrix.transport }}
          FIPS_TESTRUN: ${{ matrix.fips && '1' || '0' }}
        run: |
          tools container create ${{ matrix.container }} --name ${{ github.run_id }}_salt-test

      - name: "Start container ${{ matrix.container }}"
        run: |
          /usr/bin/docker start ${{ github.run_id }}_salt-test

      - name: Fix PhotonOS password expiration
        if: startsWith(matrix.slug, 'photonos-')
        run: |
          docker exec ${{ github.run_id }}_salt-test chage -I -1 -m 0 -M 99999 -E -1 root

      - name: Fix PhotonOS repository URLs
        if: startsWith(matrix.slug, 'photonos-')
        run: |
          docker exec ${{ github.run_id }}_salt-test \
            sh -c "for f in /etc/yum.repos.d/photon*.repo; do [ -e \"\$f\" ] && sed -i -E 's/packages(-prod)?\.(vmware|broadcom)\.com\/photon/packages.broadcom.com\/photon/g' \"\$f\"; done && tdnf makecache"

      - name: Install FIPS provider
        if: ${{ matrix.fips && startsWith(matrix.slug, 'photonos-') }}
        run: |
          docker exec ${{ github.run_id }}_salt-test \
            tdnf install -y openssl-fips-provider
          # openssl-fips-provider <= 3.1.2-3.ph5 disables the OpenSSL default
          # provider in /etc/ssl/distro.cnf, breaking TLS in curl/git/tdnf.
          # Re-enable it to mirror the upstream fix in vmware/photon@4610f36756
          # (openssl-fips-provider 3.1.2-4.ph5). Idempotent on fixed builds.
          docker exec ${{ github.run_id }}_salt-test \
            sed -i '/^#\.include \/etc\/ssl\/provider_default.cnf/s/^#//g' /etc/ssl/distro.cnf

      - name: "Show container inspect ${{ matrix.container }}"
        run: |
          /usr/bin/docker inspect ${{ github.run_id }}_salt-test

      - name: Download nox.linux.${{ matrix.arch }}.tar.* artifact for session ${{ inputs.nox-session }}
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: nox-linux-${{ matrix.arch }}-${{ inputs.nox-session }}

      - name: Install Nox
        run: |
          python3 -m pip install 'nox==${{ inputs.nox-version }}'
        env:
          PIP_INDEX_URL: https://pypi.org/simple

      - name: Decompress .nox Directory
        run: |
          docker exec -e PYTHONUNBUFFERED=1 ${{ github.run_id}}_salt-test python3 -m nox --force-color -e decompress-dependencies -- linux ${{ matrix.arch }}

      - name: Create relenv toolchain symlink
        run: |
          # Python's sysconfig expects toolchain at ~/.local/relenv/toolchain but
          # relenv extracts to ~/.cache/relenv/toolchains - create symlink
          docker exec ${{ github.run_id}}_salt-test bash -c \
            'mkdir -p ~/.local/relenv && ln -sf ~/.cache/relenv/toolchains ~/.local/relenv/toolchain'

      - name: Download testrun-changed-files.txt
        if: ${{ fromJSON(inputs.testrun)['type'] != 'full' }}
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: testrun-changed-files.txt

      - name: Current Directory
        run: |
          pwd

      - name: Show System Info
        run: |
          docker exec -e SKIP_REQUIREMENTS_INSTALL=1 -e PRINT_SYSTEM_INFO_ONLY=1 ${{ github.run_id}}_salt-test \
          python3 -m nox --force-color -e ${{ inputs.nox-session }} -- ${{ matrix.tests-chunk }}

      - name: Free Space on Host
        shell: bash
        run: |
          df -h

      - name: Show container network info
        shell: bash
        run: |
          docker exec ${{ github.run_id}}_salt-test ip addr

      - name: Show container processes
        shell: bash
        run: |
          docker exec ${{ github.run_id}}_salt-test ps auxf

      - name: Free Space on Container
        shell: bash
        run: |
          docker exec ${{ github.run_id}}_salt-test df -h

      - name: Free Memory
        shell: bash
        run: |
          free -h

      - name: Configure apparmor
        run: |
          # Apparmor's unix-chkpwd profile gets in the way of tests needing to
          # authenticate from inside a container.
          cat <<'EOF' | sudo tee /etc/apparmor.d/unix-chkpwd
          abi <abi/4.0>,
          include <tunables/global>
          profile unix-chkpwd /{,usr/}{,s}bin/unix_chkpwd flags=(unconfined) {
            include <abstractions/base>
            include <abstractions/nameservice>
            # To write records to the kernel auditing log.
            capability audit_write,
            network netlink raw,
            /{,usr/}{,s}bin/unix_chkpwd mr,
            /etc/shadow r,
            # systemd userdb, used in nspawn
            /run/host/userdb/*.user r,
            /run/host/userdb/*.user-privileged r,
            # file_inherit
            owner /dev/tty[0-9]* rw,
            include if exists <local/unix-chkpwd>
          }
          EOF
          sudo systemctl restart apparmor
          sudo aa-status

      - name: Run Changed Tests
        id: run-fast-changed-tests
        if: ${{ !cancelled() && fromJSON(inputs.testrun)['type'] != 'full' }}
        run: |
          docker exec -e PYTHONUNBUFFERED=1 ${{ github.run_id}}_salt-test python3 -m nox --force-color -e ${{ inputs.nox-session }} -- ${{ matrix.tests-chunk }} -- \
            --core-tests --slow-tests --suppress-no-test-exit-code --from-filenames=testrun-changed-files.txt

      - name: Run Fast Tests
        id: run-fast-tests
        if: ${{ !cancelled() && fromJSON(inputs.testrun)['type'] != 'full' && fromJSON(inputs.testrun)['selected_tests']['fast'] }}
        run: |
          docker exec -e PYTHONUNBUFFERED=1 ${{ github.run_id}}_salt-test \
            python3 -m nox --force-color -e ${{ inputs.nox-session }} -- ${{ matrix.tests-chunk }} -- \
            --suppress-no-test-exit-code

      - name: Run Slow Tests
        id: run-slow-tests
        if: ${{ !cancelled() && fromJSON(inputs.testrun)['type'] != 'full' && fromJSON(inputs.testrun)['selected_tests']['slow'] }}
        run: |
          docker exec -e PYTHONUNBUFFERED=1 ${{ github.run_id}}_salt-test \
            python3 -m nox --force-color -e ${{ inputs.nox-session }} -- ${{ matrix.tests-chunk }} -- \
            --suppress-no-test-exit-code --no-fast-tests --slow-tests

      - name: Run Core Tests
        id: run-core-tests
        if: ${{ !cancelled() && fromJSON(inputs.testrun)['type'] != 'full' && fromJSON(inputs.testrun)['selected_tests']['core'] }}
        run: |
          docker exec -e PYTHONUNBUFFERED=1 ${{ github.run_id}}_salt-test \
            python3 -m nox --force-color -e ${{ inputs.nox-session }} -- ${{ matrix.tests-chunk }} -- \
            --suppress-no-test-exit-code --no-fast-tests --core-tests

      - name: Run Flaky Tests
        id: run-flaky-tests
        if: ${{ !cancelled() && fromJSON(inputs.testrun)['selected_tests']['flaky'] }}
        run: |
          docker exec -e PYTHONUNBUFFERED=1 ${{ github.run_id}}_salt-test \
            python3 -m nox --force-color -e ${{ inputs.nox-session }} -- ${{ matrix.tests-chunk }} -- \
            --suppress-no-test-exit-code --no-fast-tests --flaky-jail

      - name: Run Full Tests
        id: run-full-tests
        if: ${{ !cancelled() && fromJSON(inputs.testrun)['type'] == 'full' }}
        run: |
          docker exec -e PYTHONUNBUFFERED=1 ${{ github.run_id}}_salt-test \
            python3 -m nox --force-color -e ${{ inputs.nox-session }} -- ${{ matrix.tests-chunk }} -- \
            --slow-tests --core-tests --test-group-count=${{ matrix.test-group-count || 1 }} --test-group=${{ matrix.test-group || 1 }}

      - name: Sync filesystem in test container
        if: always()
        run: |
          docker exec ${{ github.run_id}}_salt-test sync 2>/dev/null || true

      - name: Stop Container
        if: always()
        run: |
          docker container stop ${{ github.run_id}}_salt-test || true

      - name: Remove Container
        if: always()
        run: |
          docker container rm ${{ github.run_id}}_salt-test || true

      - name: Remove Container Image
        if: always()
        run: |
          docker image rm ${{ matrix.container }} || true

      - name: Fix file ownership
        if: always()
        run: |
          sudo chown -R "$(id -un)" .

      - name: Prepare Test Run Artifacts
        id: download-artifacts-from-vm
        if: always()
        run: |
          # Delete the salt onedir, we won't need it anymore and it will prevent
          # from it showing in the tree command below
          sudo rm -rf artifacts/salt*
          sync || true
          tree -a artifacts

      - name: Combine Code Coverage
        if: ${{ !cancelled() && !inputs.skip-code-coverage }}
        run: |
          nox --force-color -e combine-coverage

      - name: Rename Coverage Artifact
        if: ${{ !cancelled() && !inputs.skip-code-coverage }}
        run: |
          mv artifacts/coverage/.coverage artifacts/coverage/.coverage.${{ matrix.slug }}-${{ inputs.nox-session }}-${{ matrix.transport }}-${{ matrix.tests-chunk }}-${{ env.TIMESTAMP }}-${{ matrix.fips && 'fips' || 'std' }}-${{ matrix.test-group || 1 }}-${{ github.run_attempt }}

      - name: Upload Code Coverage Test Run Artifacts
        if: ${{ !cancelled() && !inputs.skip-code-coverage }}
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: coverage-artifacts-${{ matrix.slug }}-${{ inputs.nox-session }}-${{ matrix.transport }}-${{ matrix.tests-chunk }}-${{ env.TIMESTAMP }}-${{ matrix.fips && 'fips' || 'std' }}-${{ matrix.test-group || 1 }}-${{ github.run_attempt }}
          path: |
            artifacts/coverage/.coverage.${{ matrix.slug }}-${{ inputs.nox-session }}-${{ matrix.transport }}-${{ matrix.tests-chunk }}-${{ env.TIMESTAMP }}-${{ matrix.fips && 'fips' || 'std' }}-${{ matrix.test-group || 1 }}-${{ github.run_attempt }}
          include-hidden-files: true

      - name: Upload JUnit XML Test Run Artifacts
        if: always() && steps.download-artifacts-from-vm.outcome == 'success'
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: testrun-junit-artifacts-${{ matrix.slug }}-${{ inputs.nox-session }}-${{ matrix.transport }}${{ matrix.fips && '(fips)' || '' }}-${{ matrix.tests-chunk }}-${{ matrix.test-group || 1 }}-${{ env.TIMESTAMP }}
          path: |
            artifacts/xml-unittests-output/
          include-hidden-files: true

      - name: Upload Test Run Log Artifacts
        if: always() && steps.download-artifacts-from-vm.outcome == 'success'
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: testrun-log-artifacts-${{ matrix.slug }}-${{ inputs.nox-session }}-${{ matrix.transport }}${{ matrix.fips && '(fips)' || '' }}-${{ matrix.tests-chunk }}-${{ matrix.test-group || 1 }}-${{ env.TIMESTAMP }}
          path: |
            artifacts/logs
          include-hidden-files: true

  test-macos:
    name: ${{ matrix.display_name }} ${{ matrix.tests-chunk }} ${{ matrix.transport }}${{ matrix.test-group && ' ' || '' }}${{ matrix.test-group && matrix.test-group || '' }}
    runs-on: ${{ matrix.runner }}
    # Full test runs. Each chunk should never take more than 2 hours.
    # Partial test runs(no chunk parallelization), 6 Hours
    if: ${{ !cancelled() && toJSON(fromJSON(inputs.matrix)['macos']) != '[]' }}
    timeout-minutes: ${{ fromJSON(inputs.testrun)['type'] == 'full' && inputs.default-timeout || 360 }}
    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJSON(inputs.matrix)['macos'] }}
    steps:

      - name: "Throttle Builds"
        shell: bash
        run: |
          t=$(python3 -c 'import random, sys; sys.stdout.write(str(random.randint(1, 15)))'); echo "Sleeping $t seconds"; sleep "$t"

      - name: "Set `TIMESTAMP` environment variable"
        shell: bash
        run: |
          echo "TIMESTAMP=$(date +%s)" | tee -a "$GITHUB_ENV"

      - name: Checkout Source Code
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Setup Python ${{ inputs.ci-python-version }}
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "${{ inputs.ci-python-version }}"

      - name: Setup Salt Version
        run: |
          echo "${{ inputs.salt-version }}" > salt/_version.txt

      - name: Download Onedir Tarball as an Artifact
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: ${{ inputs.package-name }}-${{ inputs.salt-version }}-onedir-${{ matrix.platform }}-${{ matrix.arch }}.tar.xz
          path: artifacts/

      - name: Decompress Onedir Tarball
        shell: bash
        run: |
          python3 -c "import os; os.makedirs('artifacts', exist_ok=True)"
          cd artifacts
          tar xvf ${{ inputs.package-name }}-${{ inputs.salt-version }}-onedir-${{ matrix.platform }}-${{ matrix.arch }}.tar.xz

      - name: Install System Dependencies
        run: |
          brew install tree

      - name: Download nox.macos.${{ matrix.arch }}.tar.* artifact for session ${{ inputs.nox-session }}
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: nox-macos-${{ matrix.arch }}-${{ inputs.nox-session }}
      - name: Install Nox
        run: |
          python3 -m pip install 'nox==${{ inputs.nox-version }}'
        env:
          PIP_INDEX_URL: https://pypi.org/simple

      - name: Decompress .nox Directory
        run: |
          nox --force-color -e decompress-dependencies -- macos ${{ matrix.arch }}

      - name: Download testrun-changed-files.txt
        if: ${{ fromJSON(inputs.testrun)['type'] != 'full' }}
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: testrun-changed-files.txt

      - name: Show System Info
        env:
          SKIP_REQUIREMENTS_INSTALL: "1"
          PRINT_SYSTEM_INFO_ONLY: "1"
        run: |
          sudo -E nox --force-color -e ${{ inputs.nox-session }} -- ${{ matrix.tests-chunk }}

      - name: Run Changed Tests
        id: run-fast-changed-tests
        if: ${{ !cancelled() && fromJSON(inputs.testrun)['type'] != 'full' }}
        env:
          SKIP_REQUIREMENTS_INSTALL: "1"
          PRINT_TEST_SELECTION: "0"
          PRINT_TEST_PLAN_ONLY: "0"
          PRINT_SYSTEM_INFO: "0"
          RERUN_FAILURES: "1"
          GITHUB_ACTIONS_PIPELINE: "1"
          SKIP_INITIAL_ONEDIR_FAILURES: "1"
          SKIP_INITIAL_GH_ACTIONS_FAILURES: "1"
          SKIP_CODE_COVERAGE: "${{ inputs.skip-code-coverage && '1' || '0' }}"
          COVERAGE_CONTEXT: ${{ matrix.slug }}
          COLUMNS: 190
          PIP_INDEX_URL: ${{ vars.PIP_INDEX_URL }}
          PIP_TRUSTED_HOST: ${{ vars.PIP_TRUSTED_HOST }}
          PIP_EXTRA_INDEX_URL: ${{ vars.PIP_EXTRA_INDEX_URL }}
          PIP_DISABLE_PIP_VERSION_CHECK: "1"
          RAISE_DEPRECATIONS_RUNTIME_ERRORS: ${{ inputs.raise-deprecations-runtime-errors }}
          SALT_TRANSPORT: ${{ matrix.transport }}
        run: |
          sudo -E nox --force-color -e ${{ inputs.nox-session }} -- ${{ matrix.tests-chunk }} -- \
            -k "mac or darwin" --core-tests --slow-tests --suppress-no-test-exit-code \
            --from-filenames=testrun-changed-files.txt

      - name: Run Fast Tests
        id: run-fast-tests
        if: ${{ !cancelled() && fromJSON(inputs.testrun)['type'] != 'full' && fromJSON(inputs.testrun)['selected_tests']['fast'] }}
        env:
          SKIP_REQUIREMENTS_INSTALL: "1"
          PRINT_TEST_SELECTION: "0"
          PRINT_TEST_PLAN_ONLY: "0"
          PRINT_SYSTEM_INFO: "0"
          RERUN_FAILURES: "1"
          GITHUB_ACTIONS_PIPELINE: "1"
          SKIP_INITIAL_ONEDIR_FAILURES: "1"
          SKIP_INITIAL_GH_ACTIONS_FAILURES: "1"
          SKIP_CODE_COVERAGE: "${{ inputs.skip-code-coverage && '1' || '0' }}"
          COVERAGE_CONTEXT: ${{ matrix.slug }}
          COLUMNS: 190
          PIP_INDEX_URL: ${{ vars.PIP_INDEX_URL }}
          PIP_TRUSTED_HOST: ${{ vars.PIP_TRUSTED_HOST }}
          PIP_EXTRA_INDEX_URL: ${{ vars.PIP_EXTRA_INDEX_URL }}
          PIP_DISABLE_PIP_VERSION_CHECK: "1"
          RAISE_DEPRECATIONS_RUNTIME_ERRORS: ${{ inputs.raise-deprecations-runtime-errors }}
          SALT_TRANSPORT: ${{ matrix.transport }}
        run: |
          sudo -E nox --force-color -e ${{ inputs.nox-session }} -- ${{ matrix.tests-chunk }} -- \
            -k "mac or darwin" --suppress-no-test-exit-code

      - name: Run Slow Tests
        id: run-slow-tests
        if: ${{ !cancelled() && fromJSON(inputs.testrun)['type'] != 'full' && fromJSON(inputs.testrun)['selected_tests']['slow'] }}
        env:
          SKIP_REQUIREMENTS_INSTALL: "1"
          PRINT_TEST_SELECTION: "0"
          PRINT_TEST_PLAN_ONLY: "0"
          PRINT_SYSTEM_INFO: "0"
          RERUN_FAILURES: "1"
          GITHUB_ACTIONS_PIPELINE: "1"
          SKIP_INITIAL_ONEDIR_FAILURES: "1"
          SKIP_INITIAL_GH_ACTIONS_FAILURES: "1"
          SKIP_CODE_COVERAGE: "${{ inputs.skip-code-coverage && '1' || '0' }}"
          COVERAGE_CONTEXT: ${{ matrix.slug }}
          COLUMNS: 190
          PIP_INDEX_URL: ${{ vars.PIP_INDEX_URL }}
          PIP_TRUSTED_HOST: ${{ vars.PIP_TRUSTED_HOST }}
          PIP_EXTRA_INDEX_URL: ${{ vars.PIP_EXTRA_INDEX_URL }}
          PIP_DISABLE_PIP_VERSION_CHECK: "1"
          RAISE_DEPRECATIONS_RUNTIME_ERRORS: ${{ inputs.raise-deprecations-runtime-errors }}
          SALT_TRANSPORT: ${{ matrix.transport }}
        run: |
          sudo -E nox --force-color -e ${{ inputs.nox-session }} -- ${{ matrix.tests-chunk }} -- \
            -k "mac or darwin" --suppress-no-test-exit-code --no-fast-tests --slow-tests

      - name: Run Core Tests
        id: run-core-tests
        if: ${{ !cancelled() && fromJSON(inputs.testrun)['type'] != 'full' && fromJSON(inputs.testrun)['selected_tests']['core'] }}
        env:
          SKIP_REQUIREMENTS_INSTALL: "1"
          PRINT_TEST_SELECTION: "0"
          PRINT_TEST_PLAN_ONLY: "0"
          PRINT_SYSTEM_INFO: "0"
          RERUN_FAILURES: "1"
          GITHUB_ACTIONS_PIPELINE: "1"
          SKIP_INITIAL_ONEDIR_FAILURES: "1"
          SKIP_INITIAL_GH_ACTIONS_FAILURES: "1"
          SKIP_CODE_COVERAGE: "${{ inputs.skip-code-coverage && '1' || '0' }}"
          COVERAGE_CONTEXT: ${{ matrix.slug }}
          COLUMNS: 190
          PIP_INDEX_URL: ${{ vars.PIP_INDEX_URL }}
          PIP_TRUSTED_HOST: ${{ vars.PIP_TRUSTED_HOST }}
          PIP_EXTRA_INDEX_URL: ${{ vars.PIP_EXTRA_INDEX_URL }}
          PIP_DISABLE_PIP_VERSION_CHECK: "1"
          RAISE_DEPRECATIONS_RUNTIME_ERRORS: ${{ inputs.raise-deprecations-runtime-errors }}
          SALT_TRANSPORT: ${{ matrix.transport }}
        run: |
          sudo -E nox --force-color -e ${{ inputs.nox-session }} -- ${{ matrix.tests-chunk }} -- \
            -k "mac or darwin" --suppress-no-test-exit-code --no-fast-tests --core-tests

      - name: Run Flaky Tests
        id: run-flaky-tests
        if: ${{ !cancelled() && fromJSON(inputs.testrun)['selected_tests']['flaky'] }}
        env:
          SKIP_REQUIREMENTS_INSTALL: "1"
          PRINT_TEST_SELECTION: "0"
          PRINT_TEST_PLAN_ONLY: "0"
          PRINT_SYSTEM_INFO: "0"
          RERUN_FAILURES: "1"
          GITHUB_ACTIONS_PIPELINE: "1"
          SKIP_INITIAL_ONEDIR_FAILURES: "1"
          SKIP_INITIAL_GH_ACTIONS_FAILURES: "1"
          SKIP_CODE_COVERAGE: "${{ inputs.skip-code-coverage && '1' || '0' }}"
          COVERAGE_CONTEXT: ${{ matrix.slug }}
          COLUMNS: 190
          PIP_INDEX_URL: ${{ vars.PIP_INDEX_URL }}
          PIP_TRUSTED_HOST: ${{ vars.PIP_TRUSTED_HOST }}
          PIP_EXTRA_INDEX_URL: ${{ vars.PIP_EXTRA_INDEX_URL }}
          PIP_DISABLE_PIP_VERSION_CHECK: "1"
          RAISE_DEPRECATIONS_RUNTIME_ERRORS: ${{ inputs.raise-deprecations-runtime-errors }}
          SALT_TRANSPORT: ${{ matrix.transport }}
        run: |
          sudo -E nox --force-color -e ${{ inputs.nox-session }} -- ${{ matrix.tests-chunk }} -- \
            -k "mac or darwin" --suppress-no-test-exit-code --no-fast-tests --flaky-jail

      - name: Run Full Tests
        id: run-full-tests
        if: ${{ !cancelled() && fromJSON(inputs.testrun)['type'] == 'full' }}
        env:
          SKIP_REQUIREMENTS_INSTALL: "1"
          PRINT_TEST_SELECTION: "0"
          PRINT_TEST_PLAN_ONLY: "0"
          PRINT_SYSTEM_INFO: "0"
          RERUN_FAILURES: "1"
          GITHUB_ACTIONS_PIPELINE: "1"
          SKIP_INITIAL_ONEDIR_FAILURES: "1"
          SKIP_INITIAL_GH_ACTIONS_FAILURES: "1"
          SKIP_CODE_COVERAGE: "${{ inputs.skip-code-coverage && '1' || '0' }}"
          COVERAGE_CONTEXT: ${{ matrix.slug }}
          COLUMNS: 190
          PIP_INDEX_URL: ${{ vars.PIP_INDEX_URL }}
          PIP_TRUSTED_HOST: ${{ vars.PIP_TRUSTED_HOST }}
          PIP_EXTRA_INDEX_URL: ${{ vars.PIP_EXTRA_INDEX_URL }}
          PIP_DISABLE_PIP_VERSION_CHECK: "1"
          RAISE_DEPRECATIONS_RUNTIME_ERRORS: ${{ inputs.raise-deprecations-runtime-errors }}
          SALT_TRANSPORT: ${{ matrix.transport }}
        run: |
          sudo -E nox --force-color -e ${{ inputs.nox-session }} -- ${{ matrix.tests-chunk }} -- \
            --slow-tests --core-tests -k "mac or darwin" --test-group-count=${{ matrix.test-group-count || 1 }} --test-group=${{ matrix.test-group || 1 }}


      - name: Fix file ownership
        if: always()
        run: |
          sudo chown -R "$(id -un)" .

      - name: Prepare Test Run Artifacts
        id: download-artifacts-from-vm
        if: always()
        run: |
          # Delete the salt onedir, we won't need it anymore and it will prevent
          # from it showing in the tree command below
          rm -rf artifacts/salt*
          sync || true
          tree -a artifacts

      - name: Combine Code Coverage
        if: ${{ !cancelled() && !inputs.skip-code-coverage }}
        run: |
          nox --force-color -e combine-coverage

      - name: Rename Coverage Artifact
        if: ${{ !cancelled() && !inputs.skip-code-coverage }}
        run: |
          mv artifacts/coverage/.coverage artifacts/coverage/.coverage.${{ matrix.slug }}-${{ inputs.nox-session }}-${{ matrix.transport }}-${{ matrix.tests-chunk }}-${{ matrix.test-group || 1 }}-${{ env.TIMESTAMP }}-${{ matrix.fips && 'fips' || 'std' }}-${{ github.run_attempt }}

      - name: Upload Code Coverage Test Run Artifacts
        if: ${{ !cancelled() && !inputs.skip-code-coverage }}
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: coverage-artifacts-${{ matrix.slug }}-${{ inputs.nox-session }}-${{ matrix.transport }}-${{ matrix.tests-chunk }}-${{ matrix.test-group || 1 }}-${{ env.TIMESTAMP }}-${{ matrix.fips && 'fips' || 'std' }}-${{ github.run_attempt }}
          path: |
            artifacts/coverage/.coverage.${{ matrix.slug }}-${{ inputs.nox-session }}-${{ matrix.transport }}-${{ matrix.tests-chunk }}-${{ matrix.test-group || 1 }}-${{ env.TIMESTAMP }}-${{ matrix.fips && 'fips' || 'std' }}-${{ github.run_attempt }}

          include-hidden-files: true

      - name: Upload JUnit XML Test Run Artifacts
        if: always() && steps.download-artifacts-from-vm.outcome == 'success'
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: testrun-junit-artifacts-${{ matrix.slug }}-${{ inputs.nox-session }}-${{ matrix.transport }}-${{ matrix.tests-chunk }}-${{ matrix.test-group || 1 }}-${{ env.TIMESTAMP }}
          path: |
            artifacts/xml-unittests-output/
          include-hidden-files: true

      - name: Upload Test Run Log Artifacts
        if: always() && steps.download-artifacts-from-vm.outcome == 'success'
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: testrun-log-artifacts-${{ matrix.slug }}-${{ inputs.nox-session }}-${{ matrix.transport }}-${{ matrix.tests-chunk }}-${{ matrix.test-group || 1 }}-${{ env.TIMESTAMP }}
          path: |
            artifacts/logs
          include-hidden-files: true

  test-windows:
    name: ${{ matrix.display_name }} ${{ matrix.tests-chunk }} ${{ matrix.transport }}${{ matrix.test-group && ' ' || '' }}${{ matrix.test-group && matrix.test-group || '' }}

    if: ${{ !cancelled() && toJSON(fromJSON(inputs.matrix)['windows']) != '[]' }}
    runs-on: ${{ matrix.runner }}
    # Full test runs. Each chunk should never take more than 2 hours.
    # Partial test runs(no chunk parallelization), 6 Hours
    timeout-minutes: ${{ fromJSON(inputs.testrun)['type'] == 'full' && inputs.default-timeout || 360 }}
    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJSON(inputs.matrix)['windows'] }}
    steps:

      - name: Setup Python ${{ inputs.ci-python-version }}
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: ${{ inputs.ci-python-version }}

      - name: "Throttle Builds"
        shell: bash
        run: |
          t=$(python3 -c 'import random, sys; sys.stdout.write(str(random.randint(1, 15)))'); echo "Sleeping $t seconds"; sleep "$t"

      - name: "Set `TIMESTAMP` environment variable"
        shell: bash
        run: |
          echo "TIMESTAMP=$(date +%s)" | tee -a "$GITHUB_ENV"

      - name: Checkout Source Code
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Setup Salt Version
        run: |
          echo "${{ inputs.salt-version }}" > salt/_version.txt

      - name: Download Onedir Tarball as an Artifact
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: ${{ inputs.package-name }}-${{ inputs.salt-version }}-onedir-${{ matrix.platform }}-${{ matrix.arch }}.tar.xz
          path: artifacts/

      - name: Decompress Onedir Tarball
        shell: bash
        run: |
          python3 -c "import os; os.makedirs('artifacts', exist_ok=True)"
          cd artifacts
          tar xvf ${{ inputs.package-name }}-${{ inputs.salt-version }}-onedir-${{ matrix.platform }}-${{ matrix.arch }}.tar.xz

      - name: Patch cpython#104135 in onedir Lib/ssl.py
        # Test sessions and test helpers (salt.utils.virtualenv.VirtualEnv)
        # create venvs from the onedir Python and run pip in them; without
        # this patch Python 3.10's _load_windows_store_certs aborts on the
        # first ASN.1-malformed cert in the Windows root store under OpenSSL
        # 3.5.x. Needed on Python 3.10 and 3.11 (cpython#104135 was never
        # backported); self-disables on 3.12+.
        # DURABLE CLEANUP: drop this step + the matching steps in
        # build-deps-ci-action.yml and test-packages-action.yml +
        # cicd/windows-ssl-104135-patch.py + salt/__init__.py +
        # salt/ext/tornado/netutil.py once relenv ships the cpython#104135
        # patch in its cpython build. See salt/__init__.py for the cleanup
        # pointer.
        shell: bash
        run: |
          python3 cicd/windows-ssl-104135-patch.py artifacts/salt/Lib/ssl.py

      - name: Install System Dependencies
        run: |
          echo true

      - name: Install Nox
        run: |
          python3 -m pip install 'nox==${{ inputs.nox-version }}'
        env:
          PIP_INDEX_URL: https://pypi.org/simple

      - name: Download nox.windows.${{ matrix.arch }}.tar.* artifact for session ${{ inputs.nox-session }}
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: nox-windows-${{ matrix.arch }}-${{ inputs.nox-session }}

      - name: Decompress .nox Directory
        run: |
          nox --force-color -e decompress-dependencies -- windows ${{ matrix.arch }}

      - name: Download testrun-changed-files.txt
        if: ${{ fromJSON(inputs.testrun)['type'] != 'full' }}
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: testrun-changed-files.txt

      - name: Check nox python
        continue-on-error: true
        run: |
          .nox/ci-test-onedir/Scripts/python.exe --version

      - name: Show System Info
        env:
          SKIP_REQUIREMENTS_INSTALL: "1"
          PRINT_SYSTEM_INFO_ONLY: "1"
        run: |
          nox --force-color -e ${{ inputs.nox-session }} -- ${{ matrix.tests-chunk }}

      - name: Run Changed Tests
        id: run-fast-changed-tests
        if: ${{ !cancelled() && fromJSON(inputs.testrun)['type'] != 'full' }}
        env:
          SKIP_REQUIREMENTS_INSTALL: "1"
          PRINT_TEST_SELECTION: "0"
          PRINT_TEST_PLAN_ONLY: "0"
          PRINT_SYSTEM_INFO: "0"
          RERUN_FAILURES: "1"
          GITHUB_ACTIONS_PIPELINE: "1"
          SKIP_INITIAL_ONEDIR_FAILURES: "1"
          SKIP_INITIAL_GH_ACTIONS_FAILURES: "1"
          SKIP_CODE_COVERAGE: "${{ inputs.skip-code-coverage && '1' || '0' }}"
          COVERAGE_CONTEXT: ${{ matrix.slug }}
          COLUMNS: 190
          PIP_INDEX_URL: ${{ vars.PIP_INDEX_URL }}
          PIP_TRUSTED_HOST: ${{ vars.PIP_TRUSTED_HOST }}
          PIP_EXTRA_INDEX_URL: ${{ vars.PIP_EXTRA_INDEX_URL }}
          PIP_DISABLE_PIP_VERSION_CHECK: "1"
          RAISE_DEPRECATIONS_RUNTIME_ERRORS: ${{ inputs.raise-deprecations-runtime-errors }}
          SALT_TRANSPORT: ${{ matrix.transport }}
          TMPDIR: ${{ runner.temp }}
        shell: powershell
        run: >
          nox --force-color -e ${{ inputs.nox-session }} -- ${{ matrix.tests-chunk }} --
          -k "win" --core-tests --slow-tests --suppress-no-test-exit-code
          "--from-filenames=testrun-changed-files.txt"

      - name: Run Fast Tests
        id: run-fast-tests
        if: ${{ !cancelled() && fromJSON(inputs.testrun)['type'] != 'full' && fromJSON(inputs.testrun)['selected_tests']['fast'] }}
        env:
          SKIP_REQUIREMENTS_INSTALL: "1"
          PRINT_TEST_SELECTION: "0"
          PRINT_TEST_PLAN_ONLY: "0"
          PRINT_SYSTEM_INFO: "0"
          RERUN_FAILURES: "1"
          GITHUB_ACTIONS_PIPELINE: "1"
          SKIP_INITIAL_ONEDIR_FAILURES: "1"
          SKIP_INITIAL_GH_ACTIONS_FAILURES: "1"
          SKIP_CODE_COVERAGE: "${{ inputs.skip-code-coverage && '1' || '0' }}"
          COVERAGE_CONTEXT: ${{ matrix.slug }}
          COLUMNS: 190
          PIP_INDEX_URL: ${{ vars.PIP_INDEX_URL }}
          PIP_TRUSTED_HOST: ${{ vars.PIP_TRUSTED_HOST }}
          PIP_EXTRA_INDEX_URL: ${{ vars.PIP_EXTRA_INDEX_URL }}
          PIP_DISABLE_PIP_VERSION_CHECK: "1"
          RAISE_DEPRECATIONS_RUNTIME_ERRORS: ${{ inputs.raise-deprecations-runtime-errors }}
          SALT_TRANSPORT: ${{ matrix.transport }}
          TMPDIR: ${{ runner.temp }}
        shell: powershell
        run: >
          nox --force-color -e ${{ inputs.nox-session }} -- ${{ matrix.tests-chunk }} --
          -k "win" --suppress-no-test-exit-code

      - name: Run Slow Tests
        id: run-slow-tests
        if: ${{ !cancelled() && fromJSON(inputs.testrun)['type'] != 'full' && fromJSON(inputs.testrun)['selected_tests']['slow'] }}
        env:
          SKIP_REQUIREMENTS_INSTALL: "1"
          PRINT_TEST_SELECTION: "0"
          PRINT_TEST_PLAN_ONLY: "0"
          PRINT_SYSTEM_INFO: "0"
          RERUN_FAILURES: "1"
          GITHUB_ACTIONS_PIPELINE: "1"
          SKIP_INITIAL_ONEDIR_FAILURES: "1"
          SKIP_INITIAL_GH_ACTIONS_FAILURES: "1"
          SKIP_CODE_COVERAGE: "${{ inputs.skip-code-coverage && '1' || '0' }}"
          COVERAGE_CONTEXT: ${{ matrix.slug }}
          COLUMNS: 190
          PIP_INDEX_URL: ${{ vars.PIP_INDEX_URL }}
          PIP_TRUSTED_HOST: ${{ vars.PIP_TRUSTED_HOST }}
          PIP_EXTRA_INDEX_URL: ${{ vars.PIP_EXTRA_INDEX_URL }}
          PIP_DISABLE_PIP_VERSION_CHECK: "1"
          RAISE_DEPRECATIONS_RUNTIME_ERRORS: ${{ inputs.raise-deprecations-runtime-errors }}
          SALT_TRANSPORT: ${{ matrix.transport }}
          TMPDIR: ${{ runner.temp }}
        shell: powershell
        run: >
          nox --force-color -e ${{ inputs.nox-session }} -- ${{ matrix.tests-chunk }} --
          -k "win" --suppress-no-test-exit-code --no-fast-tests --slow-tests

      - name: Run Core Tests
        id: run-core-tests
        if: ${{ !cancelled() && fromJSON(inputs.testrun)['type'] != 'full' && fromJSON(inputs.testrun)['selected_tests']['core'] }}
        env:
          SKIP_REQUIREMENTS_INSTALL: "1"
          PRINT_TEST_SELECTION: "0"
          PRINT_TEST_PLAN_ONLY: "0"
          PRINT_SYSTEM_INFO: "0"
          RERUN_FAILURES: "1"
          GITHUB_ACTIONS_PIPELINE: "1"
          SKIP_INITIAL_ONEDIR_FAILURES: "1"
          SKIP_INITIAL_GH_ACTIONS_FAILURES: "1"
          SKIP_CODE_COVERAGE: "${{ inputs.skip-code-coverage && '1' || '0' }}"
          COVERAGE_CONTEXT: ${{ matrix.slug }}
          COLUMNS: 190
          PIP_INDEX_URL: ${{ vars.PIP_INDEX_URL }}
          PIP_TRUSTED_HOST: ${{ vars.PIP_TRUSTED_HOST }}
          PIP_EXTRA_INDEX_URL: ${{ vars.PIP_EXTRA_INDEX_URL }}
          PIP_DISABLE_PIP_VERSION_CHECK: "1"
          RAISE_DEPRECATIONS_RUNTIME_ERRORS: ${{ inputs.raise-deprecations-runtime-errors }}
          SALT_TRANSPORT: ${{ matrix.transport }}
          TMPDIR: ${{ runner.temp }}
        shell: powershell
        run: >
          nox --force-color -e ${{ inputs.nox-session }} -- ${{ matrix.tests-chunk }} --
          -k "win" --suppress-no-test-exit-code --no-fast-tests --core-tests

      - name: Run Flaky Tests
        id: run-flaky-tests
        if: ${{ !cancelled() && fromJSON(inputs.testrun)['selected_tests']['flaky'] }}
        env:
          SKIP_REQUIREMENTS_INSTALL: "1"
          PRINT_TEST_SELECTION: "0"
          PRINT_TEST_PLAN_ONLY: "0"
          PRINT_SYSTEM_INFO: "0"
          RERUN_FAILURES: "1"
          GITHUB_ACTIONS_PIPELINE: "1"
          SKIP_INITIAL_ONEDIR_FAILURES: "1"
          SKIP_INITIAL_GH_ACTIONS_FAILURES: "1"
          SKIP_CODE_COVERAGE: "${{ inputs.skip-code-coverage && '1' || '0' }}"
          COVERAGE_CONTEXT: ${{ matrix.slug }}
          COLUMNS: 190
          PIP_INDEX_URL: ${{ vars.PIP_INDEX_URL }}
          PIP_TRUSTED_HOST: ${{ vars.PIP_TRUSTED_HOST }}
          PIP_EXTRA_INDEX_URL: ${{ vars.PIP_EXTRA_INDEX_URL }}
          PIP_DISABLE_PIP_VERSION_CHECK: "1"
          RAISE_DEPRECATIONS_RUNTIME_ERRORS: ${{ inputs.raise-deprecations-runtime-errors }}
          SALT_TRANSPORT: ${{ matrix.transport }}
          TMPDIR: ${{ runner.temp }}
        shell: powershell
        run: >
          nox --force-color -e ${{ inputs.nox-session }} -- ${{ matrix.tests-chunk }} --
          -k "win" --suppress-no-test-exit-code --no-fast-tests --flaky-jail

      - name: Run Full Tests
        id: run-full-tests
        if: ${{ !cancelled() && fromJSON(inputs.testrun)['type'] == 'full' }}
        env:
          SKIP_REQUIREMENTS_INSTALL: "1"
          PRINT_TEST_SELECTION: "0"
          PRINT_TEST_PLAN_ONLY: "0"
          PRINT_SYSTEM_INFO: "0"
          RERUN_FAILURES: "1"
          GITHUB_ACTIONS_PIPELINE: "1"
          SKIP_INITIAL_ONEDIR_FAILURES: "1"
          SKIP_INITIAL_GH_ACTIONS_FAILURES: "1"
          SKIP_CODE_COVERAGE: "${{ inputs.skip-code-coverage && '1' || '0' }}"
          COVERAGE_CONTEXT: ${{ matrix.slug }}
          COLUMNS: 190
          PIP_INDEX_URL: ${{ vars.PIP_INDEX_URL }}
          PIP_TRUSTED_HOST: ${{ vars.PIP_TRUSTED_HOST }}
          PIP_EXTRA_INDEX_URL: ${{ vars.PIP_EXTRA_INDEX_URL }}
          PIP_DISABLE_PIP_VERSION_CHECK: "1"
          RAISE_DEPRECATIONS_RUNTIME_ERRORS: ${{ inputs.raise-deprecations-runtime-errors }}
          SALT_TRANSPORT: ${{ matrix.transport }}
          TMPDIR: ${{ runner.temp }}
        shell: powershell
        run: >
          nox --force-color -e ${{ inputs.nox-session }} -- ${{ matrix.tests-chunk }} --
          --slow-tests --core-tests -k "win" --test-group-count=${{ matrix.test-group-count || 1 }} --test-group=${{ matrix.test-group || 1 }}


      - name: Prepare Test Run Artifacts
        id: download-artifacts-from-vm
        if: always()
        shell: bash
        run: |
          # Delete the salt onedir, we won't need it anymore and it will prevent
          # from it showing in the tree command below
          rm -rf artifacts/salt*
          sync || true

      - name: Combine Code Coverage
        if: ${{ !cancelled() && !inputs.skip-code-coverage }}
        run: |
          nox --force-color -e combine-coverage

      - name: Rename Coverage Artifact
        if: ${{ !cancelled() && !inputs.skip-code-coverage }}
        run: |
          mv artifacts/coverage/.coverage artifacts/coverage/.coverage.${{ matrix.slug }}-${{ inputs.nox-session }}-${{ matrix.transport }}-${{ matrix.tests-chunk }}-${{ matrix.test-group || 1 }}-${{ env.TIMESTAMP }}-${{ matrix.fips && 'fips' || 'std' }}-${{ github.run_attempt }}


      - name: Upload Code Coverage Test Run Artifacts
        if: ${{ !cancelled() && !inputs.skip-code-coverage }}
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: coverage-artifacts-${{ matrix.slug }}-${{ inputs.nox-session }}-${{ matrix.transport }}-${{ matrix.tests-chunk }}-${{ matrix.test-group || 1 }}-${{ env.TIMESTAMP }}-${{ matrix.fips && 'fips' || 'std' }}-${{ github.run_attempt }}
          path: |
            artifacts/coverage/.coverage.${{ matrix.slug }}-${{ inputs.nox-session }}-${{ matrix.transport }}-${{ matrix.tests-chunk }}-${{ matrix.test-group || 1 }}-${{ env.TIMESTAMP }}-${{ matrix.fips && 'fips' || 'std' }}-${{ github.run_attempt }}

          include-hidden-files: true

      - name: Upload JUnit XML Test Run Artifacts
        if: always() && steps.download-artifacts-from-vm.outcome == 'success'
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: testrun-junit-artifacts-${{ matrix.slug }}-${{ inputs.nox-session }}-${{ matrix.transport }}-${{ matrix.tests-chunk }}-${{ matrix.test-group || 1 }}-${{ env.TIMESTAMP }}
          path: |
            artifacts/xml-unittests-output/
          include-hidden-files: true

      - name: Upload Test Run Log Artifacts
        if: always() && steps.download-artifacts-from-vm.outcome == 'success'
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: testrun-log-artifacts-${{ matrix.slug }}-${{ inputs.nox-session }}-${{ matrix.transport }}-${{ matrix.tests-chunk }}-${{ matrix.test-group || 1 }}-${{ env.TIMESTAMP }}
          path: |
            artifacts/logs
          include-hidden-files: true


  report:
    name: Test Reports
    runs-on: ubuntu-22.04
    if: ${{ false }}
    needs:
      - test-linux
      - test-linux-arm64
      - test-macos
      - test-windows
    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJSON(inputs.matrix)['linux'] }}
    env:
      PIP_INDEX_URL: https://pypi.org/simple

    steps:
      - name: Checkout Source Code
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "${{ inputs.ci-python-version }}"

      - name: "Throttle Builds"
        shell: bash
        run: |
          t=$(shuf -i 1-30 -n 1); echo "Sleeping $t seconds"; sleep "$t"

      - name: Merge JUnit XML Test Run Artifacts
        continue-on-error: true
        uses: actions/upload-artifact/merge@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: testrun-junit-artifacts-${{ matrix.slug }}-${{ inputs.nox-session }}
          pattern: testrun-junit-artifacts-${{ matrix.slug }}-${{ inputs.nox-session }}-*
          separate-directories: false
          delete-merged: true

      - name: Merge Log Test Run Artifacts
        continue-on-error: true
        uses: actions/upload-artifact/merge@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: testrun-log-artifacts-${{ matrix.slug }}-${{ inputs.nox-session }}
          pattern: testrun-log-artifacts-${{ matrix.slug }}-${{ inputs.nox-session }}-*
          separate-directories: false
          delete-merged: true

      - name: Show Downloaded Test Run Artifacts
        if: ${{ inputs.skip-code-coverage == false }}
        run: |
          tree -a artifacts

      - name: Setup Python ${{ inputs.ci-python-version }}
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "${{ inputs.ci-python-version }}"

      - name: Install Nox
        run: |
          python3 -m pip install 'nox==${{ inputs.nox-version }}'