ci: add ubuntu-26.04 to spread test matrix

.github/workflows/_tests.yaml

@@ -6,7 +6,11 @@ on:
       arch:
         required: true
         type: string
-      runner:
+      bases:
+        # JSON array of {"base": "...", "runner": "..."} entries. Each base is a spread system
+        # label declared in spread.yaml; runner is the GHA runner label whose
+        # OS matches that base (the github-ci backend is adhoc-on-localhost,
+        # so the runner's OS must match the system label spread is asked for).
         required: true
         type: string
 
@@ -46,14 +50,15 @@ jobs:
       - name: Upload binary artifact
         uses: actions/upload-artifact@v7
         with:
-          name: binary-${{ inputs.runner }}
+          name: binary-${{ inputs.arch }}
           path: ./concierge
 
   define-matrix:
     name: Define spread matrix
     runs-on: ubuntu-latest
     outputs:
-      suites: ${{ steps.suites.outputs.suites }}
+      critical: ${{ steps.suites.outputs.critical }}
+      extras: ${{ steps.suites.outputs.extras }}
     steps:
       - name: Checkout
         uses: actions/checkout@v6.0.2
@@ -73,8 +78,12 @@ jobs:
         id: suites
         env:
           ARCH: ${{ inputs.arch }}
+          BASES: ${{ inputs.bases }}
         run: |
-          list="$(spread -list github-ci | sed "s|github-ci:ubuntu-24.04:tests/||g" | jq -r -ncR '[inputs | select(length>0)]')"
+          # Enumerate suite names from a single system; the same suites apply
+          # to every system declared on the github-ci backend, so the (system,
+          # suite) cross-product is built here as a flat include list.
+          list="$(spread -list github-ci:ubuntu-24.04 | sed "s|github-ci:ubuntu-24.04:tests/||g" | jq -r -ncR '[inputs | select(length>0)]')"
           case $ARCH in
             ppc64le|s390x)
               skip='{
@@ -98,19 +107,37 @@ jobs:
               echo "Unknown architecture $ARCH, using all tests."
               ;;
           esac
-          echo "suites=$list"
-          echo "suites=$list" >> $GITHUB_OUTPUT
 
-  spread-test:
-    name: Spread (${{ matrix.suite }})
-    runs-on: ${{ inputs.runner }}
+          # Suites whose failure should block merge. The required-check
+          # aggregator (spread-required) only gates on these. Everything
+          # else still runs in spread-extras so we keep the signal, but a
+          # red extras job does not block the PR.
+          critical_suites='[
+            "preset-machine", "preset-k8s", "preset-microk8s", "preset-dev", "preset-crafts",
+            "provider-lxd", "provider-lxd-init-no-bootstrap", "provider-k8s", "provider-microk8s", "provider-google", "provider-none",
+            "dry-run-prepare", "dry-run-restore", "restore", "restore-without-prepare"
+          ]'
+
+          # critical/extras are GHA matrix configs: {"include": [ {"suite": "...", "base": "...", "runner": "..."}, ... ]}.
+          # The cross-product of $bases x $suites is split by membership in critical_suites.
+          critical=$(jq -c -n --argjson suites "$list" --argjson bases "$BASES" --argjson crit "$critical_suites" \
+            '{include: [ $bases[] as $b | $suites[] | select(. as $s | $crit | index($s)) | {suite: ., base: $b.base, runner: $b.runner} ]}')
+          extras=$(jq -c -n --argjson suites "$list" --argjson bases "$BASES" --argjson crit "$critical_suites" \
+            '{include: [ $bases[] as $b | $suites[] | select(. as $s | $crit | index($s) | not) | {suite: ., base: $b.base, runner: $b.runner} ]}')
+          echo "critical=$critical"
+          echo "extras=$extras"
+          echo "critical=$critical" >> $GITHUB_OUTPUT
+          echo "extras=$extras" >> $GITHUB_OUTPUT
+
+  spread-critical:
+    name: Spread (${{ matrix.suite }}, ${{ matrix.base }})
+    runs-on: ${{ matrix.runner }}
     needs:
       - binaries
       - define-matrix
     strategy:
       fail-fast: false
-      matrix:
-        suite: ${{ fromJSON(needs.define-matrix.outputs.suites) }}
+      matrix: ${{ fromJSON(needs.define-matrix.outputs.critical) }}
     steps:
       - name: Checkout
         uses: actions/checkout@v6.0.2
@@ -120,7 +147,7 @@ jobs:
       - name: Download binary artifact
         uses: actions/download-artifact@v8
         with:
-          name: binary-${{ inputs.runner }}
+          name: binary-${{ inputs.arch }}
 
       - name: Setup Go
         uses: actions/setup-go@v6
@@ -135,5 +162,62 @@ jobs:
       - name: Run integration tests
         env:
           SUITE: ${{ matrix.suite }}
+          BASE: ${{ matrix.base }}
         run: |
-          spread -v "github-ci:ubuntu-24.04:tests/${SUITE}"
+          spread -v "github-ci:${BASE}:tests/${SUITE}"
+
+  spread-extras:
+    name: Spread extras (${{ matrix.suite }}, ${{ matrix.base }})
+    runs-on: ${{ matrix.runner }}
+    needs:
+      - binaries
+      - define-matrix
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(needs.define-matrix.outputs.extras) }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Download binary artifact
+        uses: actions/download-artifact@v8
+        with:
+          name: binary-${{ inputs.arch }}
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: "go.mod"
+          architecture: ${{ inputs.arch }}
+
+      - name: Install
+        run: |
+          go install github.com/canonical/spread/cmd/spread@a3a44a96b6d00a72b0476756c70e3fb6610e7b48  # 2026-03-26
+
+      - name: Run integration tests
+        env:
+          SUITE: ${{ matrix.suite }}
+          BASE: ${{ matrix.base }}
+        run: |
+          spread -v "github-ci:${BASE}:tests/${SUITE}"
+
+  spread-required:
+    # Stable-named aggregator job for branch protection. Mark this as the
+    # required check; matrix entry names (which change as suites are added
+    # or shuffled) are not stable enough to pin individually.
+    name: Spread (required)
+    runs-on: ubuntu-latest
+    needs:
+      - spread-critical
+    if: always()
+    steps:
+      - name: Check critical spread tests passed
+        env:
+          RESULT: ${{ needs.spread-critical.result }}
+        run: |
+          if [[ "$RESULT" != "success" ]]; then
+            echo "spread-critical aggregate result: $RESULT"
+            exit 1
+          fi

.github/workflows/push.yaml

@@ -72,4 +72,8 @@ jobs:
     uses: ./.github/workflows/_tests.yaml
     with:
       arch: amd64
-      runner: ubuntu-24.04
+      bases: >-
+        [
+          {"base": "ubuntu-24.04", "runner": "ubuntu-24.04"},
+          {"base": "ubuntu-26.04", "runner": "ubuntu-26.04"}
+        ]

.github/workflows/test-on-alternative-arches.yaml

@@ -13,10 +13,14 @@ jobs:
     uses: ./.github/workflows/_tests.yaml
     with:
       arch: ppc64le  # note: ppc64le for arch, ppc64el in runner name
-      runner: self-hosted-linux-ppc64el-noble-edge
+      # Only noble (24.04) self-hosted runners exist for these arches, so the
+      # 26.04 base declared in spread.yaml is exercised by amd64 push.yaml only.
+      bases: >-
+        [{"base": "ubuntu-24.04", "runner": "self-hosted-linux-ppc64el-noble-edge"}]
 
   s390x:
     uses: ./.github/workflows/_tests.yaml
     with:
       arch: s390x
-      runner: self-hosted-linux-s390x-noble-edge
+      bases: >-
+        [{"base": "ubuntu-24.04", "runner": "self-hosted-linux-s390x-noble-edge"}]

spread.yaml

@@ -9,7 +9,10 @@ backends:
   lxd:
     type: adhoc
     allocate: |
-      BASE="${BASE:-noble}"
+      case "$SPREAD_SYSTEM" in
+        ubuntu-24.04) BASE="${BASE:-noble}" ;;
+        *)            BASE="${BASE:-resolute}" ;;
+      esac
       VM_NAME="${VM_NAME:-concierge-ubuntu-${BASE}-${RANDOM}}"
       DISK="${DISK:-20}"
       CPU="${CPU:-4}"
@@ -41,6 +44,9 @@ backends:
       - ubuntu-24.04:
           username: spread
           workers: 1
+      - ubuntu-26.04:
+          username: spread
+          workers: 1
 
   github-ci:
     type: adhoc
@@ -65,6 +71,9 @@ backends:
       - ubuntu-24.04:
           username: spread
           workers: 1
+      - ubuntu-26.04:
+          username: spread
+          workers: 1
 
 suites:
   tests/:

tests/disable-juju-config/task.yaml

@@ -1,6 +1,6 @@
 summary: Run concierge with just a LXD provider with Juju disabled in config
 systems:
-  - ubuntu-24.04
+  - ubuntu-*
 
 execute: |
   pushd "${SPREAD_PATH}/${SPREAD_TASK}"

tests/disable-juju-env-var/task.yaml

@@ -1,6 +1,6 @@
 summary: Run concierge with the k8s preset, but disable Juju with an env var override
 systems:
-  - ubuntu-24.04
+  - ubuntu-*
 
 execute: |
   pushd "${SPREAD_PATH}/${SPREAD_TASK}"

tests/disable-juju-flag/task.yaml

@@ -1,6 +1,6 @@
 summary: Run concierge with the machine preset, but disable juju with a flag
 systems:
-  - ubuntu-24.04
+  - ubuntu-*
 
 execute: |
   pushd "${SPREAD_PATH}/${SPREAD_TASK}"

tests/dry-run-prepare/task.yaml

@@ -1,6 +1,6 @@
 summary: Test dry-run mode for prepare command
 systems:
-  - ubuntu-24.04
+  - ubuntu-*
 
 execute: |
   pushd "${SPREAD_PATH}/${SPREAD_TASK}"

tests/dry-run-restore/task.yaml

@@ -1,6 +1,6 @@
 summary: Test dry-run mode for restore command
 systems:
-  - ubuntu-24.04
+  - ubuntu-*
 
 execute: |
   pushd "${SPREAD_PATH}/${SPREAD_TASK}"

tests/extra-debs/task.yaml

@@ -1,6 +1,6 @@
 summary: Run concierge with no providers, but add extra debs
 systems:
-  - ubuntu-24.04
+  - ubuntu-*
 
 execute: |
   pushd "${SPREAD_PATH}/${SPREAD_TASK}"

tests/extra-packages-config-file/task.yaml

@@ -1,14 +1,14 @@
 summary: Run concierge with no providers, but add extra snaps/debs from config
 systems:
-  - ubuntu-24.04
+  - ubuntu-*
 
 execute: |
   pushd "${SPREAD_PATH}/${SPREAD_TASK}"
 
   "$SPREAD_PATH"/concierge --trace prepare
 
   command -v pip | MATCH /usr/bin/pip
-  python3 -m venv -h | head -n1 | grep -q -e "usage: venv"
+  python3 -m venv /tmp/v && test -x /tmp/v/bin/python && rm -rf /tmp/v
 
   list="$(snap list)"
   echo $list | MATCH charmcraft

tests/extra-snaps/task.yaml

@@ -1,6 +1,6 @@
 summary: Run concierge with no providers, but add extra snaps
 systems:
-  - ubuntu-24.04
+  - ubuntu-*
 
 execute: |
   pushd "${SPREAD_PATH}/${SPREAD_TASK}"

tests/juju-extra-bootstrap-args/task.yaml

@@ -1,6 +1,6 @@
 summary: Run concierge with extra bootstrap arguments
 systems:
-  - ubuntu-24.04
+  - ubuntu-*
 
 execute: |
   pushd "${SPREAD_PATH}/${SPREAD_TASK}"

tests/juju-model-defaults/task.yaml

@@ -1,6 +1,6 @@
 summary: Run concierge with some explicit Juju model defaults
 systems:
-  - ubuntu-24.04
+  - ubuntu-*
 
 execute: |
   pushd "${SPREAD_PATH}/${SPREAD_TASK}"

tests/juju-revision-invalid/task.yaml

@@ -1,6 +1,6 @@
 summary: Run concierge with an invalid Juju snap revision and ensure the error surfaces
 systems:
-  - ubuntu-24.04
+  - ubuntu-*
 
 execute: |
   pushd "${SPREAD_PATH}/${SPREAD_TASK}"

tests/juju-revision/task.yaml

@@ -1,6 +1,6 @@
 summary: Run concierge with a pinned Juju snap revision
 systems:
-  - ubuntu-24.04
+  - ubuntu-*
 
 execute: |
   pushd "${SPREAD_PATH}/${SPREAD_TASK}"

tests/k8s-image-registry/task.yaml

@@ -1,7 +1,7 @@
 summary: Test K8s image registry configuration with a local authenticated mirror
 
 systems:
-  - ubuntu-24.04
+  - ubuntu-*
 
 environment:
   REGISTRY_USERNAME: testuser

tests/k8s-pre-bootstrapped/task.yaml

@@ -1,7 +1,7 @@
 summary: Run concierge prepare on a K8s cluster that is already bootstrapped
 
 systems:
-  - ubuntu-24.04
+  - ubuntu-*
 
 execute: |
   pushd "${SPREAD_PATH}/${SPREAD_TASK}"

tests/microk8s-image-registry/concierge.yaml

@@ -2,7 +2,7 @@ providers:
   microk8s:
     enable: true
     bootstrap: false
-    channel: 1.31-strict/stable
+    channel: 1.36-strict/stable
     addons:
       - dns
     image-registry:

tests/microk8s-image-registry/task.yaml

@@ -1,7 +1,7 @@
 summary: Test MicroK8s image registry configuration with a local authenticated mirror
 
 systems:
-  - ubuntu-24.04
+  - ubuntu-*
 
 environment:
   REGISTRY_USERNAME: testuser

tests/overrides-env/task.yaml

@@ -1,6 +1,6 @@
 summary: Run concierge with the dev preset, and environment overrides
 systems:
-  - ubuntu-24.04
+  - ubuntu-*
 
 execute: |
   pushd "${SPREAD_PATH}/${SPREAD_TASK}"

tests/overrides-priority/task.yaml

@@ -1,6 +1,6 @@
 summary: Run concierge with the dev preset, and environment overrides
 systems:
-  - ubuntu-24.04
+  - ubuntu-*
 
 execute: |
   pushd "${SPREAD_PATH}/${SPREAD_TASK}"

tests/preset-crafts/task.yaml

@@ -1,6 +1,6 @@
 summary: Run concierge with the crafts preset
 systems:
-  - ubuntu-24.04
+  - ubuntu-*
 
 execute: |
   pushd "${SPREAD_PATH}/${SPREAD_TASK}"