From c9852c43da33eb6df41c16ce447a0c5d72ad5e3a Mon Sep 17 00:00:00 2001
From: Kristoffer Dalby <kristoffer@dalby.cc>
Date: Wed, 7 Oct 2026 14:30:37 +0000
Subject: [PATCH] ci: distribute the compiled integration test binary

---
 .github/workflows/test-integration.yaml | 19 +++++++------------
 cmd/hi/docker.go                        |  6 ++++++
 cmd/hi/run_test.go                      |  4 +++-
 3 files changed, 16 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/test-integration.yaml b/.github/workflows/test-integration.yaml
index a8fa57a2d..4c7413392 100644
--- a/.github/workflows/test-integration.yaml
+++ b/.github/workflows/test-integration.yaml
@@ -46,14 +46,14 @@ jobs:
         if: steps.changed-files.outputs.files == 'true'
       - uses: Mic92/hestia@dfed9ced335d28978ba74e513939a10db1f71025 # v3.1.0
         if: steps.changed-files.outputs.files == 'true'
-      - name: Build binaries and warm Go cache
+      - name: Build binaries
         if: steps.changed-files.outputs.files == 'true'
         run: |
-          # Build all Go binaries in one nix shell to maximize cache reuse
+          # Build once for the native worker architecture. Static binaries
+          # also run in the minimal Headscale image without a Go toolchain.
           go build -o hi ./cmd/hi
           CGO_ENABLED=0 GOOS=linux go build -o headscale ./cmd/headscale
-          # Build integration test binary to warm the cache with all dependencies
-          go test -c ./integration -o /dev/null 2>/dev/null || true
+          CGO_ENABLED=0 GOOS=linux go test -c ./integration -o integration.test
       - name: Upload hi binary
         if: steps.changed-files.outputs.files == 'true'
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -61,17 +61,12 @@ jobs:
           name: hi-binary
           path: hi
           retention-days: 10
-      - name: Package Go cache
-        if: steps.changed-files.outputs.files == 'true'
-        run: |
-          # Package Go module cache and build cache
-          tar -czf go-cache.tar.gz -C ~ go .cache/go-build
-      - name: Upload Go cache
+      - name: Upload integration test binary
         if: steps.changed-files.outputs.files == 'true'
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: go-cache
-          path: go-cache.tar.gz
+          name: integration-test-binary
+          path: integration.test
           retention-days: 10
       - name: Force overlay2 storage driver
         if: steps.changed-files.outputs.files == 'true'
diff --git a/cmd/hi/docker.go b/cmd/hi/docker.go
index 788081d95..b9350dc2c 100644
--- a/cmd/hi/docker.go
+++ b/cmd/hi/docker.go
@@ -289,6 +289,12 @@ func createTestContainer(ctx context.Context, cli *client.Client, config *RunCon
 		},
 	}
 
+	if config.TestBinary != "" {
+		// A custom server image may have its own entrypoint; run the tests directly.
+		containerConfig.Entrypoint = testCmd[:1]
+		containerConfig.Cmd = testCmd[1:]
+	}
+
 	// Get the correct Docker socket path from the current context
 	dockerSocketPath := getDockerSocketPath()
 
diff --git a/cmd/hi/run_test.go b/cmd/hi/run_test.go
index 94c8d3747..48df6e83f 100644
--- a/cmd/hi/run_test.go
+++ b/cmd/hi/run_test.go
@@ -142,8 +142,10 @@ func TestCompiledTestContainer(t *testing.T) {
 
 	request := <-requests
 	assert.Equal(t, "headscale:ci-test", request.Image)
+	// A custom server image may already have a headscale entrypoint.
+	assert.Equal(t, []string{"/integration.test"}, []string(request.Entrypoint))
 	assert.Equal(t, []string{
-		"/integration.test", "-test.run", config.TestPattern,
+		"-test.run", config.TestPattern,
 		"-test.failfast", "-test.timeout", "15m0s", "-test.v",
 	}, []string(request.Cmd))
 	assert.Contains(t, request.Env, "HEADSCALE_INTEGRATION_POSTGRES=1")