Use self hosted runners

.github/workflows/approve-playwright-snapshots.yml

@@ -5,7 +5,7 @@ on:
 jobs:
   comment-action-start:
     name: Comment action started
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64]
     if: github.event.issue.pull_request && contains(github.event.comment.body, '/approve-snapshots') && github.event.comment.author_association == 'MEMBER'
     outputs:
       pr_head: ${{ steps.comment-branch.outputs.head_ref }}
@@ -34,7 +34,7 @@ jobs:
   update-snapshots-aarch64:
     name: Update Snapshots aarch64
     if: github.event.issue.pull_request && contains(github.event.comment.body, '/approve-snapshots') && github.event.comment.author_association == 'MEMBER'
-    runs-on: ubuntu-22.04-arm
+    runs-on: [self-hosted, Linux, X64]
     permissions:
       contents: write
       pull-requests: write
@@ -56,21 +56,17 @@ jobs:
         with:
           attic_token: ${{ secrets.ATTIC_TOKEN }}
           github_token: ${{ secrets.GITHUB_TOKEN }}
-      - name: Install Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: "22"
       - name: Install dependencies
         run: |
-          npm ci
+          nix develop .#ci --command npm ci
         working-directory: frontend
       - name: Build application
         run: |
           nix build .#thymis-controller
       - name: Run tests
         run: |
           export THYMIS_FLAKE_ROOT='..'
-          nix develop .#forNpmTesting --command npm run test:integration -- --update-snapshots
+          nix develop .#ci --command ../.github/npm_test_integration.sh -- --update-snapshots
         working-directory: frontend
       - name: Upload Playwright report
         uses: actions/upload-artifact@v4
@@ -94,7 +90,7 @@ jobs:
   update-snapshots-x86_64:
     name: Update Snapshots x86_64
     if: github.event.issue.pull_request && contains(github.event.comment.body, '/approve-snapshots') && github.event.comment.author_association == 'MEMBER'
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64]
     permissions:
       contents: write
       pull-requests: write
@@ -116,13 +112,9 @@ jobs:
         with:
           attic_token: ${{ secrets.ATTIC_TOKEN }}
           github_token: ${{ secrets.GITHUB_TOKEN }}
-      - name: Install Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: "22"
       - name: Install dependencies
         run: |
-          npm ci
+          nix develop .#ci --command npm ci
         working-directory: frontend
       - name: Build application
         run: |
@@ -131,7 +123,7 @@ jobs:
         run: |
           if [ -f "tests/x86_vm.spec.ts" ]; then
             export THYMIS_FLAKE_ROOT='..'
-            nix develop .#forNpmTesting --command npm run test:integration -- "tests/x86_vm.spec.ts" --update-snapshots
+            nix develop .#ci --command ../.github/npm_test_integration.sh -- "tests/x86_vm.spec.ts" --update-snapshots
           fi
         working-directory: frontend
       - name: Upload Playwright report
@@ -150,7 +142,7 @@ jobs:
 
   upload-artifacts:
     name: Upload Artifacts
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64]
     needs: [comment-action-start, update-snapshots-aarch64, update-snapshots-x86_64]
     steps:
       - name: Get Thymis App Token

.github/workflows/test.yml

@@ -8,7 +8,7 @@
 
 jobs:
   changes:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64]
     permissions:
       pull-requests: read
     outputs:
@@ -22,297 +22,266 @@
             package-lock-json:
               - 'frontend/package-lock.json'
   test-controller:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64]
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-nix
         with:
           attic_token: ${{ secrets.ATTIC_TOKEN }}
           github_token: ${{ secrets.GITHUB_TOKEN }}
       - name: Configure poetry
         run: |
           nix develop .#ci --command poetry config virtualenvs.in-project true
 
       - name: Cache the virtualenv
         uses: actions/cache@v4
         with:
           path: ./controller/.venv
           key: ${{ runner.os }}-venv-${{ hashFiles('**/poetry.lock') }}
 
       - name: Cache dev env
         uses: ./.github/actions/run-command-with-nix-cache-upload
         with:
           attic_token: ${{ secrets.ATTIC_TOKEN }}
           github_token: ${{ secrets.GITHUB_TOKEN }}
           script: |
             nix develop .#ci --command echo "Cache dev env"
 
       - name: Install dependencies
         run: |
           nix develop .#ci --command poetry install
         working-directory: controller
 
       - name: Run tests
         run: |
           nix develop .#ci --command poetry run python -m pytest -sxv
         working-directory: controller
 
   test-frontend-integration:
-    runs-on: ubuntu-22.04-arm
+    runs-on: [self-hosted, Linux, X64]
     needs: changes
     if: ${{ ! (needs.changes.outputs.package-lock-json == 'true' && github.actor == 'renovate[bot]' && github.event_name == 'pull_request') }}
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-nix
         with:
           attic_token: ${{ secrets.ATTIC_TOKEN }}
           github_token: ${{ secrets.GITHUB_TOKEN }}
-      - name: Install Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: "22"
       - name: Install dependencies
         run: |
-          npm ci
+          nix develop .#ci --command npm ci
         working-directory: frontend
       - name: Build application
         uses: ./.github/actions/run-command-with-nix-cache-upload
         with:
           attic_token: ${{ secrets.ATTIC_TOKEN }}
           github_token: ${{ secrets.GITHUB_TOKEN }}
           script: |
             nix build .#thymis-controller --print-build-logs
       - name: Run tests
         run: |
           export THYMIS_FLAKE_ROOT='..'
-          ../.github/npm_test_integration.sh
+          nix develop .#ci --command ../.github/npm_test_integration.sh
         working-directory: frontend
       - uses: actions/upload-artifact@v4
         id: artifact-upload
         if: always()
         with:
           name: playwright-report
           path: frontend/playwright-report/
           retention-days: 30
       - name: Comment on PR with report link
         uses: thollander/actions-comment-pull-request@v3
         if: ${{ always() && github.event_name == 'pull_request' && env.SNAPSHOT_DIFFERENCES == 'true' }}
         with:
           message: |
             ### Playwright visual snapshot differences were detected.
             View the [Playwright report](${{ steps.artifact-upload.outputs.artifact-url }}) to review the visual differences.
             **To approve the snapshot changes and update the snapshots, please comment:** /approve-snapshots
           comment-tag: playwright-snapshots
       - name: Get Thymis App Token
         id: generate-token
         if: ${{ failure() && env.MISSING_BROWSERS == 'true' }}
         uses: actions/create-github-app-token@v1
         with:
           app-id: ${{ vars.THYMIS_APP_ID }}
           private-key: ${{ secrets.THYMIS_APP_PRIVATE_KEY }}
       - uses: actions/checkout@v4
         if: ${{ failure() && env.MISSING_BROWSERS == 'true' }}
         with:
           token: ${{ steps.generate-token.outputs.token }}
           path: thymis-2
           ref: ${{ github.head_ref || github.ref_name }}
       - name: check if failed because of playwright hash failure, in that case, commit the new hash
         if: ${{ failure() && env.MISSING_BROWSERS == 'true' }}
         env:
           GH_TOKEN: ${{ steps.generate-token.outputs.token }}
           BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
         run: |
           cd thymis-2
           USER_NAME=${{ steps.generate-token.outputs.app-slug }}[bot]
           USER_ID=$(gh api "/users/${USER_NAME}" --jq '.id')
           USER_EMAIL="${USER_ID}+${{ steps.generate-token.outputs.app-slug }}[bot]@users.noreply.github.com"
           git config user.email $USER_EMAIL
           git config user.name $USER_NAME
 
           # get version of playwright using jq (./frontend/package-lock.json)
           playwrightVersion=$(jq -r '.packages["node_modules/playwright-core"].version' ../frontend/package-lock.json)
 
           # call ./nix/playwright-by-version/add-version.sh with the playwright version
           ./nix/playwright-by-version/add-version.sh $playwrightVersion
 
           # if this is a renovate PR (identify by the branch name, "renovate/" prefix)
           # then amend the commit instead of creating a new one, so that renovate does not panic
           # we need to force push in this case
           # additional condition: only if the last commits author is "renovate[bot]"
           lastCommitAuthor=$(git log -1 --pretty=format:'%an')
           echo "last commit author: '$lastCommitAuthor'"
           # only push if no changes were made to the branch since this added
           if [[ ${{ github.event.pull_request.head.sha || github.sha }} == $(git rev-parse HEAD) ]]; then
             git commit -m "chore(nix,automation): add playwright version $playwrightVersion"
             git push
           else
             echo "Changes were made to the branch since the last commit, not pushing"
           fi
 
   test-frontend-integration-stable-input:
-    runs-on: ubuntu-22.04-arm
+    runs-on: [self-hosted, Linux, X64]
     needs: changes
     if: ${{ ! (needs.changes.outputs.package-lock-json == 'true' && github.actor == 'renovate[bot]' && github.event_name == 'pull_request') }}
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-nix
         with:
           attic_token: ${{ secrets.ATTIC_TOKEN }}
           github_token: ${{ secrets.GITHUB_TOKEN }}
-      - name: Install Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: "22"
       - name: Install dependencies
         run: |
-          npm ci
+          nix develop .#ci --command npm ci
         working-directory: frontend
       - name: Build application
         uses: ./.github/actions/run-command-with-nix-cache-upload
         with:
           attic_token: ${{ secrets.ATTIC_TOKEN }}
           github_token: ${{ secrets.GITHUB_TOKEN }}
           script: |
             nix build .#thymis-controller --print-build-logs
       - name: Run tests
         run: |
           # export THYMIS_FLAKE_ROOT='..' # stable input needs THYMIS_FLAKE_ROOT to be unset
-          ../.github/npm_test_integration.sh
+          nix develop .#ci --command ../.github/npm_test_integration.sh
         working-directory: frontend
       - uses: actions/upload-artifact@v4
         id: artifact-upload
         if: always()
         with:
           name: playwright-report-stable-input
           path: frontend/playwright-report/
           retention-days: 30
       - name: Comment on PR with report link
         uses: thollander/actions-comment-pull-request@v3
         if: ${{ always() && github.event_name == 'pull_request' && env.SNAPSHOT_DIFFERENCES == 'true' }}
         with:
           message: |
             ### Playwright visual snapshot differences were detected.
             View the [Playwright report](${{ steps.artifact-upload.outputs.artifact-url }}) to review the visual differences.
             **To approve the snapshot changes and update the snapshots, please comment:** /approve-snapshots
           comment-tag: playwright-snapshots
 
   test-frontend-integration-x64:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64]
     needs: changes
     if: ${{ ! (needs.changes.outputs.package-lock-json == 'true' && github.actor == 'renovate[bot]' && github.event_name == 'pull_request') }}
     steps:
-      - name: Delete huge unnecessary tools folder
-        run: |
-          cd /opt
-          find . -maxdepth 1 -mindepth 1 '!' -path ./containerd '!' -path ./actionarchivecache '!' -path ./runner '!' -path ./runner-cache -exec rm -rf '{}' ';'
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-nix
         with:
           attic_token: ${{ secrets.ATTIC_TOKEN }}
           github_token: ${{ secrets.GITHUB_TOKEN }}
-      - name: Install Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: "22"
       - name: Install dependencies
         run: |
-          npm ci
+          nix develop .#ci --command npm ci
         working-directory: frontend
       - name: Build application
         uses: ./.github/actions/run-command-with-nix-cache-upload
         with:
           attic_token: ${{ secrets.ATTIC_TOKEN }}
           github_token: ${{ secrets.GITHUB_TOKEN }}
           script: |
             nix build .#thymis-controller --print-build-logs
       - name: Run tests
         run: |
           export THYMIS_FLAKE_ROOT='..'
-          ../.github/npm_test_integration.sh -- tests/x86_vm.spec.ts
+          nix develop .#ci --command ../.github/npm_test_integration.sh -- tests/x86_vm.spec.ts
         working-directory: frontend
       - uses: actions/upload-artifact@v4
         id: artifact-upload
         if: always()
         with:
           name: playwright-report-x64
           path: frontend/playwright-report/
           retention-days: 30
       - name: Comment on PR with report link
         uses: thollander/actions-comment-pull-request@v3
         if: ${{ always() && github.event_name == 'pull_request' && env.SNAPSHOT_DIFFERENCES == 'true' }}
         with:
           message: |
             ### Playwright visual snapshot differences were detected.
             View the [Playwright report](${{ steps.artifact-upload.outputs.artifact-url }}) to review the visual differences.
             **To approve the snapshot changes and update the snapshots, please comment:** /approve-snapshots
           comment-tag: playwright-snapshots
 
   test-frontend-integration-stable-input-x64:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64]
     needs: changes
     if: ${{ ! (needs.changes.outputs.package-lock-json == 'true' && github.actor == 'renovate[bot]' && github.event_name == 'pull_request') }}
     steps:
-      - name: Delete huge unnecessary tools folder
-        run: |
-          cd /opt
-          find . -maxdepth 1 -mindepth 1 '!' -path ./containerd '!' -path ./actionarchivecache '!' -path ./runner '!' -path ./runner-cache -exec rm -rf '{}' ';'
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-nix
         with:
           attic_token: ${{ secrets.ATTIC_TOKEN }}
           github_token: ${{ secrets.GITHUB_TOKEN }}
-      - name: Install Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: "22"
       - name: Install dependencies
         run: |
-          npm ci
+          nix develop .#ci --command npm ci
         working-directory: frontend
       - name: Build application
         uses: ./.github/actions/run-command-with-nix-cache-upload
         with:
           attic_token: ${{ secrets.ATTIC_TOKEN }}
           github_token: ${{ secrets.GITHUB_TOKEN }}
           script: |
             nix build .#thymis-controller --print-build-logs
       - name: Run tests
         run: |
           # export THYMIS_FLAKE_ROOT='..' # stable input needs THYMIS_FLAKE_ROOT to be unset
-          ../.github/npm_test_integration.sh -- tests/x86_vm.spec.ts
+          nix develop .#ci --command ../.github/npm_test_integration.sh -- tests/x86_vm.spec.ts
         working-directory: frontend
       - uses: actions/upload-artifact@v4
         id: artifact-upload
         if: always()
         with:
           name: playwright-report-stable-input-x64
           path: frontend/playwright-report/
           retention-days: 30
       - name: Comment on PR with report link
         uses: thollander/actions-comment-pull-request@v3
         if: ${{ always() && github.event_name == 'pull_request' && env.SNAPSHOT_DIFFERENCES == 'true' }}
         with:
           message: |
             ### Playwright visual snapshot differences were detected.
             View the [Playwright report](${{ steps.artifact-upload.outputs.artifact-url }}) to review the visual differences.
             **To approve the snapshot changes and update the snapshots, please comment:** /approve-snapshots
           comment-tag: playwright-snapshots
 
   test-pre-commit:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64]
     steps:
       - uses: actions/checkout@v4
-      - name: Setup Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: 3.13
-      - name: Install pre-commit
-        run: |
-          python -m pip install pre-commit
       - name: Install node dependencies
         run: |
-          npm ci
+          nix develop .#ci --command npm ci
         working-directory: frontend
       - name: Run pre-commit
         run: |
-          pre-commit run --all-files
+          nix develop .#ci --command pre-commit run --all-files

frontend/playwright.config.ts

@@ -2,7 +2,7 @@ import { devices, type PlaywrightTestConfig } from '@playwright/test';
 
 // if env THYMIS_DEV_SHELL is set, use poetry run uvicorn reload stuff, else use nix run
 
-let command = `nix run .#thymis-controller`;
+let command = `nix run --show-trace .#thymis-controller`;
 
 if (process.env.THYMIS_DEV_SHELL) {
 	console.log('Using poetry run uvicorn reload');

frontend/tests/x86_vm.spec.ts

@@ -85,24 +85,25 @@ test('Create a x64 vm and run it', async ({ page, request, baseURL }, testInfo)
 	await page.locator('button').filter({ hasText: 'Build and start VM' }).first().click();
 
 	// wait until: 1x on screen "completed", 1x on screen "running"
-	test.setTimeout(360000);
+	test.setTimeout(240000);
 	await page
 		.locator('td', { hasText: 'completed' })
 		.nth(1)
 		.or(page.locator('td', { hasText: 'failed' }).first())
-		.waitFor({ timeout: 360000 });
+		.waitFor({ timeout: 180000 });
 	await expect(page.locator('td', { hasText: 'completed' }).nth(1)).toBeVisible();
 
 	await page
 		.locator('td', { hasText: 'running' })
 		.nth(1)
 		.or(page.locator('td', { hasText: 'failed' }).first())
-		.waitFor({ timeout: 360000 });
+		.waitFor({ timeout: 120000 });
 	await expect(page.locator('td', { hasText: 'running' }).nth(1)).toBeVisible();
 
 	// go to "Devices" page and wait until "Connected" is shown twice
+	await page.waitForTimeout(1000); // try to prevent invalidate timing issues
 	await goToDevicesPage(page, baseURL);
-	await page.locator('td', { hasText: 'Connected' }).nth(1).waitFor({ timeout: 60000 });
+	await page.locator('td', { hasText: 'Connected' }).nth(1).waitFor({ timeout: 90000 });
 
 	await expectScreenshot(page, testInfo, screenshotCounter, {
 		maxDiffPixels: maxDiffPixels
@@ -167,7 +168,7 @@ test('Create a x64 vm and run it', async ({ page, request, baseURL }, testInfo)
 	await deployButtonModal.click();
 
 	// Wait for a fifth "completed" status
-	await page.locator('td', { hasText: 'completed' }).nth(4).waitFor({ timeout: 360000 });
+	await page.locator('td', { hasText: 'completed' }).nth(4).waitFor({ timeout: 60000 });
 
 	// Navigate back to "Details" tab
 	await page.locator('a', { hasText: 'Details' }).first().click();
@@ -180,10 +181,11 @@ test('Create a x64 vm and run it', async ({ page, request, baseURL }, testInfo)
 	});
 
 	// Now, navigate to "Devices" page using sidebar and take a screenshot
+	await page.waitForTimeout(1000); // try to prevent invalidate timing issues
 	await goToDevicesPage(page, baseURL);
 
 	// Wait for 2 "Connected" statuses
-	await page.locator('td', { hasText: 'Connected' }).nth(1).waitFor({ timeout: 60000 });
+	await page.locator('td', { hasText: 'Connected' }).nth(1).waitFor({ timeout: 90000 });
 
 	await expectScreenshot(page, testInfo, screenshotCounter, {
 		maxDiffPixels: maxDiffPixels
@@ -207,6 +209,5 @@ test('Create a x64 vm and run it', async ({ page, request, baseURL }, testInfo)
 		.filter({ hasText: 'Commit & Download Device Image' })
 		.first()
 		.click();
-	test.setTimeout(360000);
 	await page.waitForEvent('download');
 });