Catch errors in tests of the kitchen sink image

While looking into pulumi/templates#929 I noticed that the kitchen sink job was not failing https://github.com/pulumi/pulumi-docker-containers/actions/runs/15796277766/job/44529555986#step:16:1064

Author: julienp

.github/workflows/ci.yml

@@ -77,6 +77,7 @@ jobs:
     strategy:
       matrix:
         arch: ["arm64", "amd64"]
+        variant: ["", "-nonroot"]
         include:
           - arch: amd64
             runner: ubuntu-24.04
@@ -104,34 +105,20 @@ jobs:
         uses: docker/setup-buildx-action@v3
         with:
           install: true
-      - name: Build
+      - name: Build ${{ env.PULUMI_VERSION }}${{ matix.variant }}-${{ matrix.arch }}
         run: |
           docker build \
             -f docker/pulumi/Dockerfile \
             --platform linux/${{ matrix.arch }} \
-            -t ${{ env.DOCKER_ORG }}/pulumi:${{ env.PULUMI_VERSION }}-${{ matrix.arch }} \
+            -t ${{ env.DOCKER_ORG }}/pulumi:${{ env.PULUMI_VERSION }}${{ matix.variant }}-${{ matrix.arch }} \
             --target base \
             --build-arg PULUMI_VERSION=${{ env.PULUMI_VERSION }} \
             --load \
             docker/pulumi
       - name: Image Info
         run: |
-          docker image ls ${{ env.DOCKER_ORG }}/pulumi:${{ env.PULUMI_VERSION }}-${{ matrix.arch }}
-          docker history ${{ env.DOCKER_ORG }}/pulumi:${{ env.PULUMI_VERSION }}-${{ matrix.arch }}
-      - name: Build nonroot variant
-        run: |
-          docker build \
-            -f docker/pulumi/Dockerfile \
-            --platform linux/${{ matrix.arch }} \
-            -t ${{ env.DOCKER_ORG }}/pulumi:${{ env.PULUMI_VERSION }}-nonroot-${{ matrix.arch }} \
-            --target nonroot \
-            --build-arg PULUMI_VERSION=${{ env.PULUMI_VERSION }} \
-            --load \
-            docker/pulumi
-      - name: Image Info
-        run: |
-          docker image ls ${{ env.DOCKER_ORG }}/pulumi:${{ env.PULUMI_VERSION }}-nonroot-${{ matrix.arch }}
-          docker history ${{ env.DOCKER_ORG }}/pulumi:${{ env.PULUMI_VERSION }}-nonroot-${{ matrix.arch }}
+          docker image ls ${{ env.DOCKER_ORG }}/pulumi:${{ env.PULUMI_VERSION }}${{ matrix.variant }}-${{ matrix.arch }}
+          docker history ${{ env.DOCKER_ORG }}/pulumi:${{ env.PULUMI_VERSION }}${{ matrix.variant }}-${{ matrix.arch }}
       - name: Install go
         uses: actions/setup-go@v5
         with:
@@ -182,30 +169,8 @@ jobs:
             --mount type=bind,source=$GOOGLE_APPLICATION_CREDENTIALS,target=/src/creds.json \
             --volume /tmp:/src \
             --entrypoint /src/pulumi-test-containers \
-            ${{ env.DOCKER_ORG }}/pulumi:${{ env.PULUMI_VERSION }}-${{ matrix.arch }} \
-            -test.parallel=8 -test.timeout=1h -test.v | sed 's/.*/[root] &/' &
-          docker run \
-            -e RUN_CONTAINER_TESTS=true \
-            -e IMAGE_VARIANT=pulumi-nonroot \
-            -e PULUMI_ACCESS_TOKEN=${PULUMI_ACCESS_TOKEN} \
-            -e PULUMI_ORG=${PULUMI_ORG} \
-            -e ARM_CLIENT_ID=${ARM_CLIENT_ID} \
-            -e ARM_CLIENT_SECRET=${ARM_CLIENT_SECRET} \
-            -e ARM_TENANT_ID=${ARM_TENANT_ID} \
-            -e ARM_SUBSCRIPTION_ID=${ARM_SUBSCRIPTION_ID} \
-            -e AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} \
-            -e AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} \
-            -e AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN} \
-            -e AWS_REGION=${AWS_REGION} \
-            -e GCP_PROJECT_NAME=${GCP_PROJECT_NAME} \
-            -e GCP_PROJECT_NUMBER=${GCP_PROJECT_NUMBER} \
-            -e GOOGLE_APPLICATION_CREDENTIALS=/src/creds.json \
-            --mount type=bind,source=$GOOGLE_APPLICATION_CREDENTIALS,target=/src/creds.json \
-            --volume /tmp:/src \
-            --entrypoint /src/pulumi-test-containers \
-            ${{ env.DOCKER_ORG }}/pulumi:${{ env.PULUMI_VERSION }}-${{ matrix.arch }}-nonroot \
-            -test.parallel=8 -test.timeout=1h -test.v | sed 's/.*/[nonroot] &/' &
-          wait
+            ${{ env.DOCKER_ORG }}/pulumi:${{ env.PULUMI_VERSION }}${{ matrix.variant }}-${{ matrix.arch }} \
+            -test.parallel=8 -test.timeout=1h -test.v
 
   provider-build-environment:
     name: Provider Build Environment image