ci(tests): lint and test the runner, tmachine and conformance suite

Run fmt, clippy and nextest for tests/tmachine and tests/runner, and fmt and
clippy for the new `sandbox` suite crate, wherever tests/testkit already runs
them: the mise tasks and Branch Checks. The suite's tests need a gateway, so they
run through `mise run e2e:testkit` against a local Docker gateway and, on CI,
through the test runner rather than the unit-test job.

The lockfile task and the Cargo lockfiles job also run the alignment check, and
its own tests run with `mise run test`.

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

Author: matthewgrossman

.github/workflows/branch-checks.yml

@@ -222,6 +222,9 @@ jobs:
           cargo fmt --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml --all -- --check
           cargo fmt --manifest-path examples/isolation-backend-v8/Cargo.toml --all -- --check
           cargo fmt --manifest-path tests/testkit/Cargo.toml --all -- --check
+          cargo fmt --manifest-path tests/tmachine/Cargo.toml --all -- --check
+          cargo fmt --manifest-path tests/runner/Cargo.toml --all -- --check
+          cargo fmt --manifest-path tests/suites/conformance/Cargo.toml -p sandbox -- --check
 
   cargo-lockfiles:
     name: Cargo lockfiles
@@ -239,7 +242,9 @@ jobs:
 
       - name: Verify Cargo lockfiles
         shell: nix develop -c bash -euo pipefail {0}
-        run: tasks/scripts/check-cargo-lockfiles.sh
+        run: |
+          tasks/scripts/check-cargo-lockfiles.sh
+          uv run tasks/scripts/check_cargo_lockfile_alignment.py
 
   rust-lint:
     name: Rust lint (${{ matrix.system }})
@@ -279,6 +284,9 @@ jobs:
           cargo clippy --locked --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml --all-targets -- -D warnings
           cargo clippy --locked --manifest-path examples/isolation-backend-v8/Cargo.toml --all-targets -- -D warnings
           cargo clippy --locked --manifest-path tests/testkit/Cargo.toml --all-targets -- -D warnings
+          cargo clippy --locked --manifest-path tests/tmachine/Cargo.toml --all-targets -- -D warnings
+          cargo clippy --locked --manifest-path tests/runner/Cargo.toml --all-targets -- -D warnings
+          cargo clippy --locked --manifest-path tests/suites/conformance/Cargo.toml -p sandbox --all-targets -- -D warnings
 
   rust-test:
     name: Rust test (${{ matrix.system }})
@@ -328,6 +336,8 @@ jobs:
           cargo nextest run --locked --profile ci --workspace --features openshell-server/test-support
           cargo nextest run --locked --config-file .config/nextest.toml --profile ci --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml
           cargo nextest run --locked --config-file .config/nextest.toml --profile ci --manifest-path tests/testkit/Cargo.toml
+          cargo nextest run --locked --config-file .config/nextest.toml --profile ci --manifest-path tests/tmachine/Cargo.toml
+          cargo nextest run --locked --config-file .config/nextest.toml --profile ci --manifest-path tests/runner/Cargo.toml
 
   rust-postgres-test:
     name: Rust PostgreSQL tests

tasks/rust.toml

@@ -18,8 +18,11 @@ run_windows = "powershell -NoProfile -ExecutionPolicy Bypass -File tasks/scripts
 hide = true
 
 ["rust:lockfiles:check"]
-description = "Verify all tracked Cargo lockfiles are current"
-run = "tasks/scripts/check-cargo-lockfiles.sh"
+description = "Verify all tracked Cargo lockfiles are current and aligned with the root"
+run = [
+  "tasks/scripts/check-cargo-lockfiles.sh",
+  "uv run tasks/scripts/check_cargo_lockfile_alignment.py",
+]
 run_windows = "powershell -NoProfile -ExecutionPolicy Bypass -File tasks/scripts/check-cargo-lockfiles.ps1"
 hide = true
 
@@ -34,6 +37,9 @@ run = [
   "cargo clippy --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml --all-targets -- -D warnings",
   "cargo clippy --manifest-path examples/isolation-backend-v8/Cargo.toml --all-targets -- -D warnings",
   "cargo clippy --manifest-path tests/testkit/Cargo.toml --all-targets -- -D warnings",
+  "cargo clippy --manifest-path tests/tmachine/Cargo.toml --all-targets -- -D warnings",
+  "cargo clippy --manifest-path tests/runner/Cargo.toml --all-targets -- -D warnings",
+  "cargo clippy --manifest-path tests/suites/conformance/Cargo.toml -p sandbox --all-targets -- -D warnings",
 ]
 run_windows = "powershell -NoProfile -ExecutionPolicy Bypass -File tasks/scripts/windows-msvc.ps1 lint native"
 hide = true
@@ -47,6 +53,9 @@ run = [
   "cargo fmt --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml --all",
   "cargo fmt --manifest-path examples/isolation-backend-v8/Cargo.toml --all",
   "cargo fmt --manifest-path tests/testkit/Cargo.toml --all",
+  "cargo fmt --manifest-path tests/tmachine/Cargo.toml --all",
+  "cargo fmt --manifest-path tests/runner/Cargo.toml --all",
+  "cargo fmt --manifest-path tests/suites/conformance/Cargo.toml -p sandbox",
 ]
 hide = true
 
@@ -59,6 +68,9 @@ run = [
   "cargo fmt --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml --all -- --check",
   "cargo fmt --manifest-path examples/isolation-backend-v8/Cargo.toml --all -- --check",
   "cargo fmt --manifest-path tests/testkit/Cargo.toml --all -- --check",
+  "cargo fmt --manifest-path tests/tmachine/Cargo.toml --all -- --check",
+  "cargo fmt --manifest-path tests/runner/Cargo.toml --all -- --check",
+  "cargo fmt --manifest-path tests/suites/conformance/Cargo.toml -p sandbox -- --check",
 ]
 hide = true
 

tasks/test.toml

@@ -23,8 +23,13 @@ depends = [
   "test:docs-website",
   "test:docs-nav",
   "test:maintainer-approval",
+  "test:cargo-lockfile-alignment",
 ]
 
+["test:cargo-lockfile-alignment"]
+description = "Test the Cargo lockfile alignment check"
+run = "uv run --no-project --with pytest pytest tasks/scripts/check_cargo_lockfile_alignment_test.py"
+
 ["test:docs-website"]
 description = "Test the docs-website sync script"
 # --no-project skips installing the OpenShell package; --with supplies the test
@@ -120,6 +125,8 @@ run = [
   "cargo test -p openshell-server --features test-support",
   "cargo nextest run --config-file .config/nextest.toml --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml",
   "cargo nextest run --config-file .config/nextest.toml --manifest-path tests/testkit/Cargo.toml",
+  "cargo nextest run --config-file .config/nextest.toml --manifest-path tests/tmachine/Cargo.toml",
+  "cargo nextest run --config-file .config/nextest.toml --manifest-path tests/runner/Cargo.toml",
 ]
 run_windows = "powershell -NoProfile -ExecutionPolicy Bypass -File tasks/scripts/windows-msvc.ps1 test-precommit native"
 hide = true
@@ -160,6 +167,10 @@ run = "OPENSHELL_TEST_CONTAINER_ENGINE=docker e2e/with-docker-gateway.sh cargo t
 description = "Run the shared OCI image feature suite against a Podman-backed gateway"
 run = "OPENSHELL_TEST_CONTAINER_ENGINE=podman e2e/with-podman-gateway.sh cargo test --locked --manifest-path tests/suites/features/Cargo.toml -p openshell-test-feature-oci-image -- --test-threads 1 --nocapture"
 
+["e2e:testkit"]
+description = "Run the testkit suites in tests/suites/conformance against a Docker-backed gateway"
+run = "e2e/with-docker-gateway.sh cargo nextest run --locked --manifest-path tests/suites/conformance/Cargo.toml --workspace --exclude openshell-test-conformance-cli --test-threads 1 --no-fail-fast"
+
 ["e2e:rust:push"]
 description = "Run CLI conformance and policy e2e tests against a Docker gateway that pushes configuration"
 depends = ["e2e:conformance:build"]