ci: replace the integration workflow with the flake checks and a legacy pipeline

CI runs nix build .#checks.<system>.integration-* instead of the bespoke docker
matrix — the generated checks are the matrix. The tests the hermetic VM can't
run (real-internet DERP, docker cable-pull) run via cmd/hi in a slim legacy
workflow, which also keeps cmd/hi and the integration Dockerfiles exercised.
check-tests guards the pinned versions against capver drift.

Author: kradalby

.github/workflows/check-tests.yaml

@@ -37,9 +37,23 @@ jobs:
         if: steps.changed-files.outputs.files == 'true'
         run: |
           (cd .github/workflows && go generate)
-          git diff --exit-code .github/workflows/test-integration.yaml
+          git diff --exit-code integration/tests.nix integration/postgres-tests.nix integration/excluded-tests.json
 
       - name: Show missing tests
         if: failure()
         run: |
-          git diff .github/workflows/test-integration.yaml
+          git diff integration/tests.nix integration/postgres-tests.nix integration/excluded-tests.json
+
+      # The pinned tailscale images must match the versions the suite requests
+      # (MustTestVersions); a capver bump that isn't mirrored here makes the
+      # offline integration checks fail at runtime.
+      - name: Check tailscale version pins match capver
+        if: steps.changed-files.outputs.files == 'true'
+        run: |
+          want=$(nix develop --command go run ./cmd/hi list-versions --set=must --exclude=head | tr ' ' '\n' | sort)
+          have=$(jq -r '.images | keys[]' integration/tailscale-versions.json | sort)
+          if [ "$want" != "$have" ]; then
+            echo "::error::integration/tailscale-versions.json is stale vs capver; run 'update-integration-images' in the dev shell"
+            diff <(echo "$want") <(echo "$have") || true
+            exit 1
+          fi

.github/workflows/integration-test-template.yml

@@ -0,0 +1,75 @@
+name: integration-legacy
+
+on:
+  pull_request:
+    branches:
+      - main
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+# A small number of integration tests cannot run as hermetic NixOS-VM checks
+# because they need Tailscale's public DERP relays (real internet) — see
+# excludedFromNixChecks in gh-action-integration-generator.go. They run here the
+# legacy way, via cmd/hi against Dockerfile-built images, which also keeps the
+# cmd/hi path and the integration Dockerfiles exercised in CI. The matrix is the
+# generated integration/excluded-tests.json so this list has a single source.
+jobs:
+  list:
+    runs-on: ubuntu-latest
+    outputs:
+      tests: ${{ steps.list.outputs.tests }}
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - id: list
+        run: echo "tests=$(jq -c . integration/excluded-tests.json)" >> "$GITHUB_OUTPUT"
+
+  test:
+    needs: list
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        test: ${{ fromJSON(needs.list.outputs.tests) }}
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: NixOS/nix-installer-action@6b8548fe06acfb0155a50ab5d561accb215764cc # main
+      - uses: Mic92/hestia/action@ff07bb902a9968ac0c3d0e51d90a606662a375d8 # main
+
+      # Docker 29's default containerd snapshotter regresses these images; the
+      # classic overlay2 graph driver is the known-good path (mirrors the VM checks).
+      - name: Force overlay2 storage driver
+        run: |
+          sudo mkdir -p /etc/docker
+          echo '{"storage-driver":"overlay2"}' | sudo tee /etc/docker/daemon.json
+          sudo systemctl restart docker
+
+      - name: Login to Docker Hub
+        env:
+          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_CI_USERNAME }}
+          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_CI_TOKEN }}
+        if: env.DOCKERHUB_USERNAME != ''
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          username: ${{ env.DOCKERHUB_USERNAME }}
+          password: ${{ env.DOCKERHUB_TOKEN }}
+
+      # cmd/hi requires prebuilt head images in CI (util.IsCI); released versions
+      # pull from the registry and tailscale-rs is built inline by tsric.
+      # Dockerfile.integration-ci COPYs a prebuilt headscale binary from the
+      # build context, so build it first (tailscale-HEAD builds from source).
+      - name: Build headscale + tailscale-HEAD images
+        run: |
+          nix develop --command bash -c 'CGO_ENABLED=0 GOOS=linux go build -o headscale ./cmd/headscale'
+          docker build --file Dockerfile.integration-ci --tag headscale:ci .
+          docker build --file Dockerfile.tailscale-HEAD --tag tailscale-head:ci .
+
+      - name: Run ${{ matrix.test }}
+        env:
+          HEADSCALE_INTEGRATION_HEADSCALE_IMAGE: headscale:ci
+          HEADSCALE_INTEGRATION_TAILSCALE_IMAGE: tailscale-head:ci
+        run: nix develop --command go run ./cmd/hi run "^${{ matrix.test }}$" --timeout=900s