test(sandbox): run a testkit suite in Branch E2E

.github/workflows/branch-checks.yml

@@ -222,6 +222,7 @@ jobs:
           cargo fmt --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml --all -- --check
           cargo fmt --manifest-path examples/isolation-backend-v8/Cargo.toml --all -- --check
           cargo fmt --manifest-path tests/testkit/Cargo.toml --all -- --check
+          cargo fmt --manifest-path tests/suites/sandbox/Cargo.toml --all -- --check
 
   cargo-lockfiles:
     name: Cargo lockfiles
@@ -279,6 +280,7 @@ jobs:
           cargo clippy --locked --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml --all-targets -- -D warnings
           cargo clippy --locked --manifest-path examples/isolation-backend-v8/Cargo.toml --all-targets -- -D warnings
           cargo clippy --locked --manifest-path tests/testkit/Cargo.toml --all-targets -- -D warnings
+          cargo clippy --locked --manifest-path tests/suites/sandbox/Cargo.toml --all-targets -- -D warnings
 
   rust-test:
     name: Rust test (${{ matrix.system }})

.github/workflows/branch-e2e.yml

@@ -315,6 +315,22 @@ jobs:
       image-tag: ${{ github.sha }}
       runner: linux-arm64-cpu8
 
+  # Run suites written on testkit (tests/testkit) against a Docker-backed
+  # gateway. Not part of the Core E2E result yet.
+  testkit-e2e:
+    needs: [pr_metadata, build-binaries, build-images]
+    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+    uses: ./.github/workflows/e2e-docker-test.yml
+    with:
+      image-tag: ${{ github.sha }}
+      runner: linux-arm64-cpu8
+      suite-matrix: >-
+        [{"suite":"testkit","cmd":"mise run --no-deps --skip-deps e2e:testkit","apt_packages":"openssh-client","python_proto":false,"mcp":false}]
+
   podman-e2e:
     needs: [pr_metadata, build-binaries, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'

TESTING.md

@@ -140,6 +140,11 @@ by `OPENSHELL_BIN`. See
 [tests/testkit/README.md](tests/testkit/README.md) for how to write and run
 tests.
 
+The `testkit-e2e` job in Branch E2E (`test:e2e` label) runs the suites under
+`tests/suites/sandbox` against a Docker-backed gateway with
+`mise run e2e:testkit`. The same task works locally. It isn't part of the Core
+E2E result yet.
+
 ### Python E2E (`e2e/python/`)
 
 `mise run e2e:python` builds `openshell/e2e-python:dev` from

tasks/rust.toml

@@ -34,6 +34,7 @@ run = [
   "cargo clippy --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml --all-targets -- -D warnings",
   "cargo clippy --manifest-path examples/isolation-backend-v8/Cargo.toml --all-targets -- -D warnings",
   "cargo clippy --manifest-path tests/testkit/Cargo.toml --all-targets -- -D warnings",
+  "cargo clippy --manifest-path tests/suites/sandbox/Cargo.toml --all-targets -- -D warnings",
 ]
 run_windows = "powershell -NoProfile -ExecutionPolicy Bypass -File tasks/scripts/windows-msvc.ps1 lint native"
 hide = true
@@ -47,6 +48,7 @@ run = [
   "cargo fmt --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml --all",
   "cargo fmt --manifest-path examples/isolation-backend-v8/Cargo.toml --all",
   "cargo fmt --manifest-path tests/testkit/Cargo.toml --all",
+  "cargo fmt --manifest-path tests/suites/sandbox/Cargo.toml --all",
 ]
 hide = true
 
@@ -59,6 +61,7 @@ run = [
   "cargo fmt --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml --all -- --check",
   "cargo fmt --manifest-path examples/isolation-backend-v8/Cargo.toml --all -- --check",
   "cargo fmt --manifest-path tests/testkit/Cargo.toml --all -- --check",
+  "cargo fmt --manifest-path tests/suites/sandbox/Cargo.toml --all -- --check",
 ]
 hide = true
 

tasks/test.toml

@@ -152,6 +152,10 @@ hide = true
 description = "Run Rust CLI e2e tests against a Docker-backed gateway"
 run = "e2e/rust/e2e-docker.sh"
 
+["e2e:testkit"]
+description = "Run the testkit suites against a Docker-backed gateway"
+run = "e2e/with-docker-gateway.sh cargo test --locked --manifest-path tests/suites/sandbox/Cargo.toml --workspace -- --test-threads 1 --nocapture"
+
 ["e2e:oci-image"]
 description = "Run the shared OCI image feature suite against a Docker-backed gateway"
 run = "OPENSHELL_TEST_CONTAINER_ENGINE=docker e2e/with-docker-gateway.sh cargo test --locked --manifest-path tests/suites/features/Cargo.toml -p openshell-test-feature-oci-image -- --test-threads 1 --nocapture"