From 65a69f312702a5f0feda86a6dd9157027631bb03 Mon Sep 17 00:00:00 2001
From: Jake Mc <3658522+startswithaj@users.noreply.github.com>
Date: Mon, 29 Jun 2026 11:32:33 +0000
Subject: [PATCH 1/3] runs the test bed in ci on pull requests and main

---
 .github/workflows/test.yml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100644 .github/workflows/test.yml

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000..0cb5e2e
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,21 @@
+name: Test
+
+# Runs the test bed (test/run.sh): builds a lean image and verifies the firewall,
+# the CAP_NET_ADMIN drop, network egress, and rootless Docker end to end.
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Run test bed
+        run: test/run.sh

From 0eb5649d7a68900a6e8800d23829a22fc400cbf3 Mon Sep 17 00:00:00 2001
From: Jake Mc <3658522+startswithaj@users.noreply.github.com>
Date: Mon, 29 Jun 2026 11:36:13 +0000
Subject: [PATCH 2/3] gates image publishing on the test suite passing

---
 .github/workflows/{release.yml => ci.yml} | 37 ++++++++++++++---------
 .github/workflows/test.yml                | 21 -------------
 2 files changed, 23 insertions(+), 35 deletions(-)
 rename .github/workflows/{release.yml => ci.yml} (75%)
 delete mode 100644 .github/workflows/test.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/ci.yml
similarity index 75%
rename from .github/workflows/release.yml
rename to .github/workflows/ci.yml
index 275fbc7..ce88068 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/ci.yml
@@ -1,30 +1,39 @@
-name: Release image
+name: CI
 
-# On every merge/push to main: bump a SemVer tag, then build and publish the
-# image to GitHub Container Registry for linux/amd64 + linux/arm64.
-#
-# The bump is patch by default; include "#minor" or "#major" anywhere in the
-# latest commit message (e.g. the merge commit) to bump more. Can also be run
-# manually from the Actions tab.
-#
-# Note: arm64 builds under QEMU emulation, so each release takes a while.
+# Pull requests: run the test bed only.
+# Pushes to main (and manual runs): run the test bed, then — only if it passes —
+# bump a SemVer tag and publish the image to GHCR for linux/amd64 + linux/arm64.
 
 on:
+  pull_request:
   push:
     branches:
       - main
   workflow_dispatch:
 
 permissions:
-  contents: write # create and push the version tag
-  packages: write # push the image to ghcr
-
-env:
-  IMAGE: ghcr.io/${{ github.repository }}
+  contents: read
 
 jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Run test bed
+        run: test/run.sh
+
   release:
+    # Publish only from main / manual runs, and only after the tests pass.
+    needs: test
+    if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # create and push the version tag
+      packages: write # push the image to ghcr
+    env:
+      IMAGE: ghcr.io/${{ github.repository }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
deleted file mode 100644
index 0cb5e2e..0000000
--- a/.github/workflows/test.yml
+++ /dev/null
@@ -1,21 +0,0 @@
-name: Test
-
-# Runs the test bed (test/run.sh): builds a lean image and verifies the firewall,
-# the CAP_NET_ADMIN drop, network egress, and rootless Docker end to end.
-
-on:
-  pull_request:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Run test bed
-        run: test/run.sh

From f16956af1dd73f3edaeee09b8318dcc7af74bdda Mon Sep 17 00:00:00 2001
From: Jake Mc <3658522+startswithaj@users.noreply.github.com>
Date: Mon, 29 Jun 2026 11:51:03 +0000
Subject: [PATCH 3/3] allows unprivileged user namespaces so the rootless
 docker test runs in ci

---
 .github/workflows/ci.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ce88068..c1a9737 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,6 +21,13 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      # Ubuntu 24.04 (the ubuntu-latest runner) restricts unprivileged user
+      # namespaces via AppArmor, which the rootless Docker test needs. Relax it
+      # so the --docker check can create its namespace. Harmless on kernels
+      # without the knob.
+      - name: Allow unprivileged user namespaces
+        run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
+
       - name: Run test bed
         run: test/run.sh