main added install-e2e.yml + install-e2e-run.yml; mirror them as newci-*
so the migration gets the same signal it has for the other lanes. triggers
match production exactly (same tag filters, same 12h cadence, cron offset
:20 -> :25 so the two runs don't contend for the pool).
it cannot fail the production job. it's a separate workflow that production
never calls or reads, and belt-and-braces the e2e step is continue-on-error
so a failing leg is reported in the summary instead of reddening a check.
the tolerance lives on the STEP, not the job: job-level continue-on-error is
not a legal keyword on a job that calls a reusable workflow (only name/uses/
with/secrets/strategy/needs/if/concurrency/permissions are) — my first draft
had it on the matrix jobs and would not have parsed. noted in the header so
nobody "fixes" it back.
the legs are expected to SKIP for now. the e2e runs inside dev-sandbox.sh
(bubblewrap), which needs to remount / as slave and mount a fresh /proc, and
a stock ARC pod denies both. probed in-cluster on nous-gke-runner:
default pod Failed to make / slave: EPERM
capabilities.add: [SYS_ADMIN] Can't mount proc: EPERM
SYS_ADMIN + apparmor/seccomp Unconfined Can't mount proc: EPERM
privileged: true works
arc-runner-docker does NOT qualify — only its dind sidecar is privileged,
the runner container isn't. so a ~30s preflight job probes bwrap and skips
the legs with the capability matrix in the step summary, rather than burning
~11min per leg to fail at the same mount. when infra adds a privileged set,
pass its label as `runner` and the legs start running with no other change.
actionlint clean; summary script exercised for both skipped-legs and
failing-leg shapes (exits 0 in both).
16f88e178c