Catch errors in tests of the kitchen sink image

While looking into pulumi/templates#929 I noticed that the kitchen sink job was not failing https://github.com/pulumi/pulumi-docker-containers/actions/runs/15796277766/job/44529555986#step:16:1064

To fix this we now run the `docker run … | sed` bit in a subshell so we get a single pid to wait for. We also grab the exit code from each test run and make sure we fail the job if either is non-zero.

Also fixes the image name for the `nonroot` variant.

Author: julienp

.github/workflows/ci.yml

@@ -163,7 +163,8 @@ jobs:
         run: |
           set -exo pipefail
           chmod o+r $GOOGLE_APPLICATION_CREDENTIALS
-          docker run \
+          # Run root test in background
+          (docker run \
             -e RUN_CONTAINER_TESTS=true \
             -e IMAGE_VARIANT=pulumi \
             -e PULUMI_ACCESS_TOKEN=${PULUMI_ACCESS_TOKEN} \
@@ -183,8 +184,11 @@ jobs:
             --volume /tmp:/src \
             --entrypoint /src/pulumi-test-containers \
             ${{ env.DOCKER_ORG }}/pulumi:${{ env.PULUMI_VERSION }}-${{ matrix.arch }} \
-            -test.parallel=8 -test.timeout=1h -test.v | sed 's/.*/[root] &/' &
-          docker run \
+            -test.parallel=8 -test.timeout=1h -test.v | sed 's/.*/[root] &/') &
+          ROOT_PID=$!
+
+          # Run nonroot test in background
+          (docker run \
             -e RUN_CONTAINER_TESTS=true \
             -e IMAGE_VARIANT=pulumi-nonroot \
             -e PULUMI_ACCESS_TOKEN=${PULUMI_ACCESS_TOKEN} \
@@ -203,9 +207,20 @@ jobs:
             --mount type=bind,source=$GOOGLE_APPLICATION_CREDENTIALS,target=/src/creds.json \
             --volume /tmp:/src \
             --entrypoint /src/pulumi-test-containers \
-            ${{ env.DOCKER_ORG }}/pulumi:${{ env.PULUMI_VERSION }}-${{ matrix.arch }}-nonroot \
-            -test.parallel=8 -test.timeout=1h -test.v | sed 's/.*/[nonroot] &/' &
-          wait
+            ${{ env.DOCKER_ORG }}/pulumi:${{ env.PULUMI_VERSION }}-nonroot-${{ matrix.arch }} \
+            -test.parallel=8 -test.timeout=1h -test.v | sed 's/.*/[nonroot] &/') &
+          NONROOT_PID=$!
+
+          # Wait for both processes and check their exit codes
+          wait $ROOT_PID
+          ROOT_EXIT=$?
+          wait $NONROOT_PID
+          NONROOT_EXIT=$?
+
+          if [ $ROOT_EXIT -ne 0 ] || [ $NONROOT_EXIT -ne 0 ]; then
+            echo "Tests failed: root exit code $ROOT_EXIT, nonroot exit code $NONROOT_EXIT"
+            exit 1
+          fi
 
   provider-build-environment:
     name: Provider Build Environment image