ci: Use cargo-nextest for integration tests

The nextest config (.config/nextest.toml) was previously dead code — tests
were run via the libtest-mimic binary directly. Switch the Justfile targets
and CI workflow to prefer nextest when available, so the parallelism controls
(threads-required = 2 for privileged VM tests) actually take effect and
prevent OOM kills on 16 GB CI runners.

Also fix the nextest filter syntax: ~^foo never matches because nextest's
~ operator treats ^ as a literal character. Use /regex/ syntax instead.

Assisted-by: OpenCode (Claude Opus 4)
Signed-off-by: Colin Walters <walters@verbum.org>

Author: cgwalters

.config/nextest.toml

@@ -14,6 +14,11 @@ failure-output = "immediate"
 success-output = "never"
 status-level = "pass"
 
+# Tests that pull OCI images need more time (especially on cold CI runners)
+[[profile.default.overrides]]
+filter = 'test(/digest_stability|oci_pull/)'
+slow-timeout = { period = "300s", terminate-after = 2 }
+
 # Profile for integration tests — run with limited parallelism due to QEMU/KVM resources
 [profile.integration]
 test-threads = 2
@@ -30,7 +35,12 @@ path = "junit.xml"
 store-success-output = true
 store-failure-output = true
 
-# VM tests boot an ephemeral QEMU instance per test, limit parallelism
+# Privileged tests boot an ephemeral QEMU instance per test — limit
+# parallelism to avoid OOM kills on 16 GB CI runners.
+# Requiring all 2 threads effectively serialises them.
+#
+# NOTE: use /regex/ syntax, not ~substring — the ~ operator treats ^ $ as
+# literal characters, so ~^foo never matches anything.
 [[profile.integration.overrides]]
-filter = 'test(~^vm_)'
-threads-required = 4
+filter = 'test(/^privileged_/)'
+threads-required = 2

.github/workflows/ci.yml

@@ -51,6 +51,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: bootc-dev/actions/bootc-ubuntu-setup@main
       - uses: dtolnay/rust-toolchain@stable
+      - uses: taiki-e/install-action@nextest
       - uses: Swatinem/rust-cache@v2
       - run: just test-integration
 
@@ -114,6 +115,7 @@ jobs:
           libvirt: true
 
       - uses: dtolnay/rust-toolchain@stable
+      - uses: taiki-e/install-action@nextest
 
       - uses: Swatinem/rust-cache@v2
 

Justfile

@@ -54,18 +54,37 @@ cfsctl_features := env("COMPOSEFS_CFSCTL_FEATURES", "pre-6.15")
 _test_image := if base_image =~ "debian" { "localhost/composefs-rs-test-debian:latest" } else if base_image =~ "stream9" { "localhost/composefs-rs-test-c9s:latest" } else { "localhost/composefs-rs-test:latest" }
 
 # Run unprivileged integration tests against the cfsctl binary (no root, no VM)
-test-integration: build
-    CFSCTL_PATH=$(pwd)/target/debug/cfsctl cargo run -p integration-tests --bin cfsctl-integration-tests -- --skip privileged_
+# Prefers nextest for parallelism control and better UX; falls back to direct harness.
+test-integration *ARGS: build
+    #!/usr/bin/env bash
+    set -euo pipefail
+    export CFSCTL_PATH=$(pwd)/target/debug/cfsctl
+    if command -v cargo-nextest &> /dev/null; then
+        cargo nextest run -p integration-tests -E 'not test(/^privileged_/)' {{ ARGS }}
+    else
+        cargo test -p integration-tests --test cfsctl-integration-tests -- --skip privileged_ {{ ARGS }}
+    fi
 
 # Build the test container image for VM-based integration tests
 _integration-container-build:
     podman build --build-arg base_image={{base_image}} --build-arg cfsctl_features={{cfsctl_features}} -t {{_test_image}} .
 
 # Run all integration tests including privileged VM tests (requires podman + libvirt)
-test-integration-vm: build _integration-container-build
-    COMPOSEFS_TEST_IMAGE={{_test_image}} \
-        CFSCTL_PATH=$(pwd)/target/debug/cfsctl \
-        cargo run -p integration-tests --bin cfsctl-integration-tests
+# Uses nextest with the integration profile for parallelism control of VM tests.
+test-integration-vm *ARGS: build _integration-container-build
+    #!/usr/bin/env bash
+    set -euo pipefail
+    export COMPOSEFS_TEST_IMAGE={{_test_image}}
+    export CFSCTL_PATH=$(pwd)/target/debug/cfsctl
+    if command -v cargo-nextest &> /dev/null; then
+        cargo nextest run -P integration -p integration-tests {{ ARGS }}
+    else
+        cargo test -p integration-tests --test cfsctl-integration-tests -- {{ ARGS }}
+    fi
+
+# Install cargo-nextest if not already installed
+install-nextest:
+    @which cargo-nextest > /dev/null 2>&1 || cargo install cargo-nextest --locked
 
 # Run everything: checks + full integration tests including VM
 ci: check test-integration-vm

crates/integration-tests/Cargo.toml

@@ -2,17 +2,27 @@
 name = "integration-tests"
 publish = false
 description = "Integration tests for composefs-rs (not published)"
+autobins = false
+autotests = false
 
 edition.workspace = true
 license.workspace = true
 repository.workspace = true
 rust-version.workspace = true
 version.workspace = true
 
+# The integration test runner is declared as both [[bin]] (for the container
+# image build) and [[test]] (so nextest discovers the libtest-mimic tests).
+# Cargo warns about the shared source file — this is harmless.
 [[bin]]
 name = "cfsctl-integration-tests"
 path = "src/main.rs"
 
+[[test]]
+name = "cfsctl-integration-tests"
+path = "src/main.rs"
+harness = false
+
 [[bin]]
 name = "test-cleanup"
 path = "src/cleanup.rs"