From e32b9bf6634d513e654f4736e55ca325d00db1ab Mon Sep 17 00:00:00 2001
From: Chad Smith <chad.smith@canonical.com>
Date: Fri, 17 Apr 2026 03:24:55 +0000
Subject: [PATCH 1/7] chore(ci): rename and renumber workflow files to 1xx
 scheme

Rename the reusable dispatch workflow to 100-dispatch-common.yml to
establish a convention where 1xx = reusable/callable workflows.

Workflow indexes 11x/12x/13x are caller workflows grouped by platform:
  lxd_container, lxd_vm and ec2.

Move scheduled daily-integration-*-lxd-container.yml files to
11x-daily-integration-*-lxd_container.yml equivalent.

Each platform group of scheduled workflows will be ordered by
increasing Ubuntu series: 22.04, 24.04, 25.10, 26.04.
---
 .../{11-dispatch-common.yml => 100-dispatch-common.yml}       | 0
 ...iner.yml => 110-daily-integration-22.04-lxd_container.yml} | 4 ++--
 ...iner.yml => 111-daily-integration-24.04-lxd_container.yml} | 4 ++--
 ...iner.yml => 112-daily-integration-25.10-lxd_container.yml} | 4 ++--
 ...iner.yml => 113-daily-integration-26.04-lxd_container.yml} | 4 ++--
 5 files changed, 8 insertions(+), 8 deletions(-)
 rename .github/workflows/{11-dispatch-common.yml => 100-dispatch-common.yml} (100%)
 rename .github/workflows/{03-daily-integration-22.04-lxd-container.yml => 110-daily-integration-22.04-lxd_container.yml} (63%)
 rename .github/workflows/{02-daily-integration-24.04-lxd-container.yml => 111-daily-integration-24.04-lxd_container.yml} (63%)
 rename .github/workflows/{01-daily-integration-25.10-lxd-container.yml => 112-daily-integration-25.10-lxd_container.yml} (64%)
 rename .github/workflows/{00-daily-integration-26.04-lxd-container.yml => 113-daily-integration-26.04-lxd_container.yml} (64%)

diff --git a/.github/workflows/11-dispatch-common.yml b/.github/workflows/100-dispatch-common.yml
similarity index 100%
rename from .github/workflows/11-dispatch-common.yml
rename to .github/workflows/100-dispatch-common.yml
diff --git a/.github/workflows/03-daily-integration-22.04-lxd-container.yml b/.github/workflows/110-daily-integration-22.04-lxd_container.yml
similarity index 63%
rename from .github/workflows/03-daily-integration-22.04-lxd-container.yml
rename to .github/workflows/110-daily-integration-22.04-lxd_container.yml
index d17a36f39c5..1c3746754c7 100644
--- a/.github/workflows/03-daily-integration-22.04-lxd-container.yml
+++ b/.github/workflows/110-daily-integration-22.04-lxd_container.yml
@@ -1,4 +1,4 @@
-name: "Daily(22.04): lxd_container"
+name: "Daily 22.04: lxd_container"
 
 on:
   workflow_dispatch:
@@ -7,7 +7,7 @@ on:
 
 jobs:
   jammy-lxd_container:
-    uses: ./.github/workflows/11-dispatch-common.yml
+    uses: ./.github/workflows/100-dispatch-common.yml
     with:
       release: jammy
       platform: lxd_container
diff --git a/.github/workflows/02-daily-integration-24.04-lxd-container.yml b/.github/workflows/111-daily-integration-24.04-lxd_container.yml
similarity index 63%
rename from .github/workflows/02-daily-integration-24.04-lxd-container.yml
rename to .github/workflows/111-daily-integration-24.04-lxd_container.yml
index acfd4c9e0f9..cbb76e1889a 100644
--- a/.github/workflows/02-daily-integration-24.04-lxd-container.yml
+++ b/.github/workflows/111-daily-integration-24.04-lxd_container.yml
@@ -1,4 +1,4 @@
-name: "Daily(24.04): lxd_container"
+name: "Daily 24.04: lxd_container"
 
 on:
   workflow_dispatch:
@@ -7,7 +7,7 @@ on:
 
 jobs:
   noble-lxd_container:
-    uses: ./.github/workflows/11-dispatch-common.yml
+    uses: ./.github/workflows/100-dispatch-common.yml
     with:
       release: noble
       platform: lxd_container
diff --git a/.github/workflows/01-daily-integration-25.10-lxd-container.yml b/.github/workflows/112-daily-integration-25.10-lxd_container.yml
similarity index 64%
rename from .github/workflows/01-daily-integration-25.10-lxd-container.yml
rename to .github/workflows/112-daily-integration-25.10-lxd_container.yml
index b2eb301cbee..73d2c450f29 100644
--- a/.github/workflows/01-daily-integration-25.10-lxd-container.yml
+++ b/.github/workflows/112-daily-integration-25.10-lxd_container.yml
@@ -1,4 +1,4 @@
-name: "Daily(25.10): lxd_container"
+name: "Daily 25.10: lxd_container"
 
 on:
   workflow_dispatch:
@@ -7,7 +7,7 @@ on:
 
 jobs:
   questing-lxd_container:
-    uses: ./.github/workflows/11-dispatch-common.yml
+    uses: ./.github/workflows/100-dispatch-common.yml
     with:
       release: questing
       platform: lxd_container
diff --git a/.github/workflows/00-daily-integration-26.04-lxd-container.yml b/.github/workflows/113-daily-integration-26.04-lxd_container.yml
similarity index 64%
rename from .github/workflows/00-daily-integration-26.04-lxd-container.yml
rename to .github/workflows/113-daily-integration-26.04-lxd_container.yml
index 0c4193bd1b5..b503d2d3e02 100644
--- a/.github/workflows/00-daily-integration-26.04-lxd-container.yml
+++ b/.github/workflows/113-daily-integration-26.04-lxd_container.yml
@@ -1,4 +1,4 @@
-name: "Daily(26.04): lxd_container"
+name: "Daily 26.04: lxd_container"
 
 on:
   workflow_dispatch:
@@ -7,7 +7,7 @@ on:
 
 jobs:
   resolute-lxd_container:
-    uses: ./.github/workflows/11-dispatch-common.yml
+    uses: ./.github/workflows/100-dispatch-common.yml
     with:
       release: resolute
       platform: lxd_container

From d6da62d0b7099399eef5f03e49a05b2d180c617d Mon Sep 17 00:00:00 2001
From: Chad Smith <chad.smith@canonical.com>
Date: Fri, 17 Apr 2026 03:26:13 +0000
Subject: [PATCH 2/7] ci: require PYCLOUDLIB_TOML and SSH key secrets, write
 config to runner temp

- Declare PYCLOUDLIB_TOML, SSH_PRIVATE_KEY, and SSH_PUBLIC_KEY as
  required secrets on the workflow_call trigger.
- Add an early assertion step that exits immediately if
  PYCLOUDLIB_TOML is empty.
- Replace the ssh-keygen throwaway key with a new 'Setup SSH' step
  that writes the injected public/private key pair to ~/.ssh, for use
  in authentication to instances under test
- base64-decode PYCLOUDLIB_TOML secret and write it to
  $RUNNER_TEMP/pycloudlib.toml to keep secrets off the persistent filesystem.
  Add cleanup to remove the file unconditionally on exit.
---
 .github/workflows/100-dispatch-common.yml     | 48 +++++++++++++++----
 ...-daily-integration-22.04-lxd_container.yml |  4 ++
 ...-daily-integration-24.04-lxd_container.yml |  4 ++
 ...-daily-integration-25.10-lxd_container.yml |  4 ++
 ...-daily-integration-26.04-lxd_container.yml |  4 ++
 5 files changed, 56 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/100-dispatch-common.yml b/.github/workflows/100-dispatch-common.yml
index 9a463e4d872..de8a4930545 100644
--- a/.github/workflows/100-dispatch-common.yml
+++ b/.github/workflows/100-dispatch-common.yml
@@ -1,3 +1,6 @@
+# WARNING: This workflow handles repository secrets (PYCLOUDLIB_TOML, SSH keys).
+# It MUST NOT be triggered by PR-driven workflows to prevent secret exposure to
+# untrusted code submitted via pull requests.
 name: "Dispatch: Integration"
 
 on:
@@ -46,6 +49,13 @@ on:
       filter_tests:
         required: false
         type: string
+    secrets:
+      PYCLOUDLIB_TOML:
+        required: true
+      SSH_PRIVATE_KEY:
+        required: true
+      SSH_PUBLIC_KEY:
+        required: true
 
 jobs:
   lxc:
@@ -53,14 +63,21 @@ jobs:
     if: github.repository == 'canonical/cloud-init'
 
     env:
-      CLOUD_INIT_PLATFORM: ${{ inputs.platform || 'lxd_container' }}
-      CLOUD_INIT_OS_IMAGE: ${{ inputs.release || 'questing' }}
-      CLOUD_INIT_OS_IMAGE_TYPE: ${{ inputs.image_type || 'generic' }}
-      CLOUD_INIT_CLOUD_INIT_SOURCE: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
-      CLOUD_INIT_LOCAL_LOG_PATH: ${{ github.workspace }}/cloud_init_test_logs
-
+      REQUIRED_SECRET: ${{ secrets.PYCLOUDLIB_TOML }}
+      SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
+      SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
+      CLOUD_INIT_PLATFORM: ${{ inputs.platform }}
+      CLOUD_INIT_OS_IMAGE: ${{ inputs.release }}
+      CLOUD_INIT_OS_IMAGE_TYPE: ${{ inputs.image_type }}
+      CLOUD_INIT_CLOUD_INIT_SOURCE: ${{ inputs.install_source }}
 
     steps:
+      - name: Assert repo secrets.PYCLOUDLIB_TOML is set
+        run: |
+          if [ -z "${{ env.REQUIRED_SECRET }}" ]; then
+             echo "ERROR: Missing required repo secrets.PYCLOUDLIB_TOML non-empty value."
+             exit 1
+          fi
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - name: Setup LXD
@@ -70,15 +87,26 @@ jobs:
       - name: Clean workspace
         run: |
           rm -rf ${{ github.workspace }}/cloud_init_test_logs/
+      - name: Setup SSH
+        run: |
+          mkdir -p ~/.ssh
+          # Dump secrets using a subprocess to avoid accidental leaks while debugging.
+          sh -c 'printf "%s\n" "$SSH_PUBLIC_KEY" > ~/.ssh/cloudinit_id_rsa.pub'
+          sh -c 'printf "%s\n" "$SSH_PRIVATE_KEY" > ~/.ssh/cloudinit_id_rsa'
+          chmod 600 ~/.ssh/cloudinit_id_rsa
       - name: Setup pycloudlib
+        env:
+          PYCLOUDLIB_CONFIG: ${{ runner.temp }}/pycloudlib.toml
         run: |
-          ssh-keygen -P "" -q -f ~/.ssh/id_rsa
-          echo "[lxd]" > /home/$USER/.config/pycloudlib.toml
+          sh -c 'echo "${{ secrets.PYCLOUDLIB_TOML}}" | base64 -d > "$PYCLOUDLIB_CONFIG"'
       - name: Install Dependencies
         run: |
           sudo DEBIAN_FRONTEND=noninteractive apt-get -qy update
           sudo DEBIAN_FRONTEND=noninteractive apt-get -qy install tox distro-info-data devscripts
       - name: Run integration Tests
+        env:
+          PYCLOUDLIB_CONFIG: ${{ runner.temp }}/pycloudlib.toml
+          CLOUD_INIT_LOCAL_LOG_PATH: ${{ github.workspace }}/cloud_init_test_logs
         run: |
           tox -e integration-tests -- --junitxml="${{ github.workspace }}/reports/junit-report-${{ inputs.platform }}-${{ inputs.release }}.xml" --color=yes ${{ inputs.filter_tests || 'tests/integration_tests' }}
       - name: Publish Test Report with Insights
@@ -117,3 +145,7 @@ jobs:
           name: failure-${{ github.job }}
           path: ${{ github.workspace }}/cloud_init_test_logs/
           retention-days: 2
+      - name: Clean pycloudlib
+        if: ${{ always() }}
+        run: |
+          rm -f ${{ runner.temp }}/pycloudlib.toml
diff --git a/.github/workflows/110-daily-integration-22.04-lxd_container.yml b/.github/workflows/110-daily-integration-22.04-lxd_container.yml
index 1c3746754c7..62031eae83b 100644
--- a/.github/workflows/110-daily-integration-22.04-lxd_container.yml
+++ b/.github/workflows/110-daily-integration-22.04-lxd_container.yml
@@ -11,3 +11,7 @@ jobs:
     with:
       release: jammy
       platform: lxd_container
+    secrets:
+      PYCLOUDLIB_TOML: ${{ secrets.PYCLOUDLIB_TOML }}
+      SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
+      SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
diff --git a/.github/workflows/111-daily-integration-24.04-lxd_container.yml b/.github/workflows/111-daily-integration-24.04-lxd_container.yml
index cbb76e1889a..b1c3e69a2ad 100644
--- a/.github/workflows/111-daily-integration-24.04-lxd_container.yml
+++ b/.github/workflows/111-daily-integration-24.04-lxd_container.yml
@@ -11,3 +11,7 @@ jobs:
     with:
       release: noble
       platform: lxd_container
+    secrets:
+      PYCLOUDLIB_TOML: ${{ secrets.PYCLOUDLIB_TOML }}
+      SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
+      SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
diff --git a/.github/workflows/112-daily-integration-25.10-lxd_container.yml b/.github/workflows/112-daily-integration-25.10-lxd_container.yml
index 73d2c450f29..06ee39a3e83 100644
--- a/.github/workflows/112-daily-integration-25.10-lxd_container.yml
+++ b/.github/workflows/112-daily-integration-25.10-lxd_container.yml
@@ -11,3 +11,7 @@ jobs:
     with:
       release: questing
       platform: lxd_container
+    secrets:
+      PYCLOUDLIB_TOML: ${{ secrets.PYCLOUDLIB_TOML }}
+      SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
+      SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
diff --git a/.github/workflows/113-daily-integration-26.04-lxd_container.yml b/.github/workflows/113-daily-integration-26.04-lxd_container.yml
index b503d2d3e02..430d8f5c76c 100644
--- a/.github/workflows/113-daily-integration-26.04-lxd_container.yml
+++ b/.github/workflows/113-daily-integration-26.04-lxd_container.yml
@@ -11,3 +11,7 @@ jobs:
     with:
       release: resolute
       platform: lxd_container
+    secrets:
+      PYCLOUDLIB_TOML: ${{ secrets.PYCLOUDLIB_TOML }}
+      SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
+      SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}

From d4ef1d5fd5900653f0bd14ce81a97a7c5bbe695a Mon Sep 17 00:00:00 2001
From: Chad Smith <chad.smith@canonical.com>
Date: Fri, 17 Apr 2026 03:27:25 +0000
Subject: [PATCH 3/7] ci: add lxd_vm and EC2 integration test workflows

Add workflow files 120-123 for lxd_vm, daily, on all supported releases.
Add workflow files 130-133 for EC2, twice weekly, all supported releases

All new caller workflows expose an install_source workflow_dispatch
input, defaulting to ppa:cloud-init-dev/daily, and forward the
three required secrets to the common dispatch workflow.
---
 .github/workflows/100-dispatch-common.yml     |  8 +++---
 ...-daily-integration-22.04-lxd_container.yml |  2 ++
 ...-daily-integration-24.04-lxd_container.yml |  2 ++
 ...-daily-integration-25.10-lxd_container.yml |  2 ++
 ...-daily-integration-26.04-lxd_container.yml |  2 ++
 .../120-daily-integration-22.04-lxd_vm.yml    | 24 ++++++++++++++++++
 .../121-daily-integration-24.04-lxd_vm.yml    | 24 ++++++++++++++++++
 .../122-daily-integration-25.10-lxd_vm.yml    | 24 ++++++++++++++++++
 .../123-daily-integration-26.04-lxd_vm.yml    | 24 ++++++++++++++++++
 .../130-daily-integration-22.04-ec2.yml       | 25 +++++++++++++++++++
 .../131-daily-integration-24.04-ec2.yml       | 25 +++++++++++++++++++
 .../132-daily-integration-25.10-ec2.yml       | 25 +++++++++++++++++++
 .../133-daily-integration-26.04-ec2.yml       | 24 ++++++++++++++++++
 13 files changed, 208 insertions(+), 3 deletions(-)
 create mode 100644 .github/workflows/120-daily-integration-22.04-lxd_vm.yml
 create mode 100644 .github/workflows/121-daily-integration-24.04-lxd_vm.yml
 create mode 100644 .github/workflows/122-daily-integration-25.10-lxd_vm.yml
 create mode 100644 .github/workflows/123-daily-integration-26.04-lxd_vm.yml
 create mode 100644 .github/workflows/130-daily-integration-22.04-ec2.yml
 create mode 100644 .github/workflows/131-daily-integration-24.04-ec2.yml
 create mode 100644 .github/workflows/132-daily-integration-25.10-ec2.yml
 create mode 100644 .github/workflows/133-daily-integration-26.04-ec2.yml

diff --git a/.github/workflows/100-dispatch-common.yml b/.github/workflows/100-dispatch-common.yml
index de8a4930545..b292e642dcc 100644
--- a/.github/workflows/100-dispatch-common.yml
+++ b/.github/workflows/100-dispatch-common.yml
@@ -10,16 +10,17 @@ on:
         required: true
         type: choice
         options:
+        - resolute
         - questing
         - jammy
         - noble
-        - resolute
       platform:
         required: true
         type: choice
         options:
         - lxd_container
         - lxd_vm
+        - ec2
       image_type:
         type: choice
         options:
@@ -41,10 +42,10 @@ on:
         required: true
         type: string
       image_type:
-        required: false
+        required: true
         type: string
       install_source:
-        required: false
+        required: true
         type: string
       filter_tests:
         required: false
@@ -81,6 +82,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - name: Setup LXD
+        if: ${{ contains(fromJSON('["lxd_vm", "lxd_container"]'), env.CLOUD_INIT_PLATFORM ) }}
         uses: canonical/setup-lxd@8c6a87bfb56aa48f3fb9b830baa18562d8bfd4ee # v0.1.2
         with:
           channel: 6/stable
diff --git a/.github/workflows/110-daily-integration-22.04-lxd_container.yml b/.github/workflows/110-daily-integration-22.04-lxd_container.yml
index 62031eae83b..834cf319fb6 100644
--- a/.github/workflows/110-daily-integration-22.04-lxd_container.yml
+++ b/.github/workflows/110-daily-integration-22.04-lxd_container.yml
@@ -11,6 +11,8 @@ jobs:
     with:
       release: jammy
       platform: lxd_container
+      install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
+      image_type: generic
     secrets:
       PYCLOUDLIB_TOML: ${{ secrets.PYCLOUDLIB_TOML }}
       SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
diff --git a/.github/workflows/111-daily-integration-24.04-lxd_container.yml b/.github/workflows/111-daily-integration-24.04-lxd_container.yml
index b1c3e69a2ad..265f2a6d14d 100644
--- a/.github/workflows/111-daily-integration-24.04-lxd_container.yml
+++ b/.github/workflows/111-daily-integration-24.04-lxd_container.yml
@@ -11,6 +11,8 @@ jobs:
     with:
       release: noble
       platform: lxd_container
+      install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
+      image_type: generic
     secrets:
       PYCLOUDLIB_TOML: ${{ secrets.PYCLOUDLIB_TOML }}
       SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
diff --git a/.github/workflows/112-daily-integration-25.10-lxd_container.yml b/.github/workflows/112-daily-integration-25.10-lxd_container.yml
index 06ee39a3e83..e52dbe6a693 100644
--- a/.github/workflows/112-daily-integration-25.10-lxd_container.yml
+++ b/.github/workflows/112-daily-integration-25.10-lxd_container.yml
@@ -11,6 +11,8 @@ jobs:
     with:
       release: questing
       platform: lxd_container
+      install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
+      image_type: generic
     secrets:
       PYCLOUDLIB_TOML: ${{ secrets.PYCLOUDLIB_TOML }}
       SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
diff --git a/.github/workflows/113-daily-integration-26.04-lxd_container.yml b/.github/workflows/113-daily-integration-26.04-lxd_container.yml
index 430d8f5c76c..16842bf4f6f 100644
--- a/.github/workflows/113-daily-integration-26.04-lxd_container.yml
+++ b/.github/workflows/113-daily-integration-26.04-lxd_container.yml
@@ -11,6 +11,8 @@ jobs:
     with:
       release: resolute
       platform: lxd_container
+      install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
+      image_type: generic
     secrets:
       PYCLOUDLIB_TOML: ${{ secrets.PYCLOUDLIB_TOML }}
       SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
diff --git a/.github/workflows/120-daily-integration-22.04-lxd_vm.yml b/.github/workflows/120-daily-integration-22.04-lxd_vm.yml
new file mode 100644
index 00000000000..0f0ed71d0d7
--- /dev/null
+++ b/.github/workflows/120-daily-integration-22.04-lxd_vm.yml
@@ -0,0 +1,24 @@
+name: "Daily 22.04: lxd_vm"
+
+on:
+  workflow_dispatch:
+    inputs:
+      install_source:
+        required: false
+        type: string
+        default: 'ppa:cloud-init-dev/daily'
+  schedule:
+    - cron: '2 23 * * *'
+
+jobs:
+  jammy-lxd_vm:
+    uses: ./.github/workflows/100-dispatch-common.yml
+    with:
+      release: jammy
+      platform: lxd_vm
+      install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
+      image_type: generic
+    secrets:
+      PYCLOUDLIB_TOML: ${{ secrets.PYCLOUDLIB_TOML }}
+      SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
+      SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
diff --git a/.github/workflows/121-daily-integration-24.04-lxd_vm.yml b/.github/workflows/121-daily-integration-24.04-lxd_vm.yml
new file mode 100644
index 00000000000..efd38a6e97e
--- /dev/null
+++ b/.github/workflows/121-daily-integration-24.04-lxd_vm.yml
@@ -0,0 +1,24 @@
+name: "Daily 24.04: lxd_vm"
+
+on:
+  workflow_dispatch:
+    inputs:
+      install_source:
+        required: false
+        type: string
+        default: 'ppa:cloud-init-dev/daily'
+  schedule:
+    - cron: '2 23 * * *'
+
+jobs:
+  noble-lxd_vm:
+    uses: ./.github/workflows/100-dispatch-common.yml
+    with:
+      release: noble
+      platform: lxd_vm
+      install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
+      image_type: generic
+    secrets:
+      PYCLOUDLIB_TOML: ${{ secrets.PYCLOUDLIB_TOML }}
+      SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
+      SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
diff --git a/.github/workflows/122-daily-integration-25.10-lxd_vm.yml b/.github/workflows/122-daily-integration-25.10-lxd_vm.yml
new file mode 100644
index 00000000000..0d39b2d4d79
--- /dev/null
+++ b/.github/workflows/122-daily-integration-25.10-lxd_vm.yml
@@ -0,0 +1,24 @@
+name: "Daily 25.10: lxd_vm"
+
+on:
+  workflow_dispatch:
+    inputs:
+      install_source:
+        required: false
+        type: string
+        default: 'ppa:cloud-init-dev/daily'
+  schedule:
+    - cron: '2 23 * * *'
+
+jobs:
+  questing-lxd_vm:
+    uses: ./.github/workflows/100-dispatch-common.yml
+    with:
+      release: questing
+      platform: lxd_vm
+      install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
+      image_type: generic
+    secrets:
+      PYCLOUDLIB_TOML: ${{ secrets.PYCLOUDLIB_TOML }}
+      SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
+      SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
diff --git a/.github/workflows/123-daily-integration-26.04-lxd_vm.yml b/.github/workflows/123-daily-integration-26.04-lxd_vm.yml
new file mode 100644
index 00000000000..46d55c7b3c1
--- /dev/null
+++ b/.github/workflows/123-daily-integration-26.04-lxd_vm.yml
@@ -0,0 +1,24 @@
+name: "Daily 26.04: lxd_vm"
+
+on:
+  workflow_dispatch:
+    inputs:
+      install_source:
+        required: false
+        type: string
+        default: 'ppa:cloud-init-dev/daily'
+  schedule:
+    - cron: '2 23 * * *'
+
+jobs:
+  resolute-lxd_vm:
+    uses: ./.github/workflows/100-dispatch-common.yml
+    with:
+      release: resolute
+      platform: lxd_vm
+      install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
+      image_type: generic
+    secrets:
+      PYCLOUDLIB_TOML: ${{ secrets.PYCLOUDLIB_TOML }}
+      SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
+      SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
diff --git a/.github/workflows/130-daily-integration-22.04-ec2.yml b/.github/workflows/130-daily-integration-22.04-ec2.yml
new file mode 100644
index 00000000000..98ae5b4a574
--- /dev/null
+++ b/.github/workflows/130-daily-integration-22.04-ec2.yml
@@ -0,0 +1,25 @@
+name: "Twice weekly 22.04: ec2"
+
+on:
+  workflow_dispatch:
+    inputs:
+      install_source:
+        required: false
+        type: string
+        default: 'ppa:cloud-init-dev/daily'
+  schedule:
+    # Run Mon & Thurs for high-cost test runs
+    - cron: '2 22 * * 1,4'
+
+jobs:
+  jammy-ec2:
+    uses: ./.github/workflows/100-dispatch-common.yml
+    with:
+      release: jammy
+      platform: ec2
+      install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
+      image_type: generic
+    secrets:
+      PYCLOUDLIB_TOML: ${{ secrets.PYCLOUDLIB_TOML }}
+      SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
+      SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
diff --git a/.github/workflows/131-daily-integration-24.04-ec2.yml b/.github/workflows/131-daily-integration-24.04-ec2.yml
new file mode 100644
index 00000000000..d29da095113
--- /dev/null
+++ b/.github/workflows/131-daily-integration-24.04-ec2.yml
@@ -0,0 +1,25 @@
+name: "Twice weekly 24.04: ec2"
+
+on:
+  workflow_dispatch:
+    inputs:
+      install_source:
+        required: false
+        type: string
+        default: 'ppa:cloud-init-dev/daily'
+  schedule:
+    # Run Mon & Thurs for high-cost test runs
+    - cron: '2 22 * * 1,4'
+
+jobs:
+  noble-ec2:
+    uses: ./.github/workflows/100-dispatch-common.yml
+    with:
+      release: noble
+      platform: ec2
+      install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
+      image_type: generic
+    secrets:
+      PYCLOUDLIB_TOML: ${{ secrets.PYCLOUDLIB_TOML }}
+      SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
+      SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
diff --git a/.github/workflows/132-daily-integration-25.10-ec2.yml b/.github/workflows/132-daily-integration-25.10-ec2.yml
new file mode 100644
index 00000000000..6feb85c8b43
--- /dev/null
+++ b/.github/workflows/132-daily-integration-25.10-ec2.yml
@@ -0,0 +1,25 @@
+name: "Twice weekly 25.10: ec2"
+
+on:
+  workflow_dispatch:
+    inputs:
+      install_source:
+        required: false
+        type: string
+        default: 'ppa:cloud-init-dev/daily'
+  schedule:
+    # Run Mon & Thurs for high-cost test runs
+    - cron: '2 22 * * 1,4'
+
+jobs:
+  questing-ec2:
+    uses: ./.github/workflows/100-dispatch-common.yml
+    with:
+      release: questing
+      platform: ec2
+      install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
+      image_type: generic
+    secrets:
+      PYCLOUDLIB_TOML: ${{ secrets.PYCLOUDLIB_TOML }}
+      SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
+      SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
diff --git a/.github/workflows/133-daily-integration-26.04-ec2.yml b/.github/workflows/133-daily-integration-26.04-ec2.yml
new file mode 100644
index 00000000000..f9362b6190d
--- /dev/null
+++ b/.github/workflows/133-daily-integration-26.04-ec2.yml
@@ -0,0 +1,24 @@
+name: "Twice weekly 26.04: ec2"
+
+on:
+  workflow_dispatch:
+    inputs:
+      install_source:
+        required: false
+        type: string
+        default: 'ppa:cloud-init-dev/daily'
+  schedule:
+    # Run Mon & Thurs for high-cost test runs
+    - cron: '2 22 * * 1,4'
+
+jobs:
+  resolute-ec2:
+    uses: ./.github/workflows/100-dispatch-common.yml
+    with:
+      release: resolute
+      platform: ec2
+      install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
+    secrets:
+      PYCLOUDLIB_TOML: ${{ secrets.PYCLOUDLIB_TOML }}
+      SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
+      SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}

From 24c62a74a84ab0c05a4d7993bfe2304bd1478940 Mon Sep 17 00:00:00 2001
From: Chad Smith <chad.smith@canonical.com>
Date: Fri, 17 Apr 2026 03:28:50 +0000
Subject: [PATCH 4/7] ci: switch to pytest-json-ctrf and refactor job
 env/defaults

Avoid dependency on ctrf.io integrations and shift to pytest-json-ctrf
for report formatting needs.

- Add pytest-json-ctrf to integration-requirements.txt; this plugin
  writes a native CTRF JSON report file and provide --ctrf to pytest.
- Set a descriptive title that includes  platform, release, image_type,
  and install_source.

Job and environment cleanup:
- Move CLOUD_INIT_OS_IMAGE, CLOUD_INIT_OS_IMAGE_TYPE,
  CLOUD_INIT_CLOUD_INIT_SOURCE, and CLOUD_INIT_LOCAL_LOG_PATH from
  the job-level env block into the 'Run integration Tests' step env,
  keeping the job env focused on credentials and config that steps
  other than the test runner need.
- Add a default of 'ppa:cloud-init-dev/daily' to the workflow_call
  install_source input so callers that omit it still get a sensible
  value.
- Add install_source workflow_dispatch input with the same default to
  the lxd_container caller workflows (110-113) and pass it through.
---
 .github/workflows/100-dispatch-common.yml     | 29 +++++--------------
 ...-daily-integration-22.04-lxd_container.yml |  5 ++++
 ...-daily-integration-24.04-lxd_container.yml |  5 ++++
 ...-daily-integration-25.10-lxd_container.yml |  5 ++++
 ...-daily-integration-26.04-lxd_container.yml |  5 ++++
 integration-requirements.txt                  |  1 +
 6 files changed, 29 insertions(+), 21 deletions(-)

diff --git a/.github/workflows/100-dispatch-common.yml b/.github/workflows/100-dispatch-common.yml
index b292e642dcc..58eb9a6106f 100644
--- a/.github/workflows/100-dispatch-common.yml
+++ b/.github/workflows/100-dispatch-common.yml
@@ -30,6 +30,7 @@ on:
       install_source:
         required: false
         type: string
+        default: 'ppa:cloud-init-dev/daily'
       filter_tests:
         required: false
         type: string
@@ -59,7 +60,7 @@ on:
         required: true
 
 jobs:
-  lxc:
+  integration-test:
     runs-on: ubuntu-latest
     if: github.repository == 'canonical/cloud-init'
 
@@ -110,38 +111,24 @@ jobs:
           PYCLOUDLIB_CONFIG: ${{ runner.temp }}/pycloudlib.toml
           CLOUD_INIT_LOCAL_LOG_PATH: ${{ github.workspace }}/cloud_init_test_logs
         run: |
-          tox -e integration-tests -- --junitxml="${{ github.workspace }}/reports/junit-report-${{ inputs.platform }}-${{ inputs.release }}.xml" --color=yes ${{ inputs.filter_tests || 'tests/integration_tests' }}
+          tox -e integration-tests -- --ctrf=${{ github.workspace }}/report.json --color=yes ${{ inputs.filter_tests || 'tests/integration_tests' }}
       - name: Publish Test Report with Insights
-        if: always()
+        if: ${{ always() }}
         uses: ctrf-io/github-test-reporter@024bc4b64d997ca9da86833c6b9548c55c620e40 # v1.0.26
         with:
-          report-path: '${{ github.workspace }}/reports/junit-report-${{ inputs.platform}}-${{ inputs.release }}.xml'
-          integrations-config: |
-            {
-              "junit-to-ctrf": {
-                "enabled": true,
-                "action": "convert",
-                "options": {
-                  "output": "./reports/ctrf-report-${{ inputs.platform }}-${{ inputs.release }}-${{ inputs.image_type }}.json",
-                  "toolname": "junit-to-ctrf",
-                  "useSuiteName": false,
-                  "env": {
-                    "appName": "my-app"
-                  }
-                }
-              }
-            }
+          report-path: '${{ github.workspace }}/report.json'
+          title: '${{ inputs.platform }}-${{ inputs.release }}-${{ inputs.image_type }}:${{ inputs.install_source }}'
           summary-delta-report: true
           insights-report: true
           flaky-rate-report: true
           slowest-report: true
           upload-artifact: true
           github-report: true
-          artifact-name: ctrf-report-${{ inputs.platform }}-${{inputs.release}}
+          artifact-name: ctrf-report-${{ inputs.platform }}-${{ inputs.release }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Upload failure artifacts
-        if: failure()
+        if: ${{ failure() }}
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: failure-${{ github.job }}
diff --git a/.github/workflows/110-daily-integration-22.04-lxd_container.yml b/.github/workflows/110-daily-integration-22.04-lxd_container.yml
index 834cf319fb6..52f0966dd09 100644
--- a/.github/workflows/110-daily-integration-22.04-lxd_container.yml
+++ b/.github/workflows/110-daily-integration-22.04-lxd_container.yml
@@ -2,6 +2,11 @@ name: "Daily 22.04: lxd_container"
 
 on:
   workflow_dispatch:
+    inputs:
+      install_source:
+        required: false
+        type: string
+        default: 'ppa:cloud-init-dev/daily'
   schedule:
     - cron: '2 22 * * *'
 
diff --git a/.github/workflows/111-daily-integration-24.04-lxd_container.yml b/.github/workflows/111-daily-integration-24.04-lxd_container.yml
index 265f2a6d14d..08f5c836890 100644
--- a/.github/workflows/111-daily-integration-24.04-lxd_container.yml
+++ b/.github/workflows/111-daily-integration-24.04-lxd_container.yml
@@ -2,6 +2,11 @@ name: "Daily 24.04: lxd_container"
 
 on:
   workflow_dispatch:
+    inputs:
+      install_source:
+        required: false
+        type: string
+        default: 'ppa:cloud-init-dev/daily'
   schedule:
     - cron: '2 22 * * *'
 
diff --git a/.github/workflows/112-daily-integration-25.10-lxd_container.yml b/.github/workflows/112-daily-integration-25.10-lxd_container.yml
index e52dbe6a693..c72945188bf 100644
--- a/.github/workflows/112-daily-integration-25.10-lxd_container.yml
+++ b/.github/workflows/112-daily-integration-25.10-lxd_container.yml
@@ -2,6 +2,11 @@ name: "Daily 25.10: lxd_container"
 
 on:
   workflow_dispatch:
+    inputs:
+      install_source:
+        required: false
+        type: string
+        default: 'ppa:cloud-init-dev/daily'
   schedule:
     - cron: '2 22 * * *'
 
diff --git a/.github/workflows/113-daily-integration-26.04-lxd_container.yml b/.github/workflows/113-daily-integration-26.04-lxd_container.yml
index 16842bf4f6f..56ed73872cc 100644
--- a/.github/workflows/113-daily-integration-26.04-lxd_container.yml
+++ b/.github/workflows/113-daily-integration-26.04-lxd_container.yml
@@ -2,6 +2,11 @@ name: "Daily 26.04: lxd_container"
 
 on:
   workflow_dispatch:
+    inputs:
+      install_source:
+        required: false
+        type: string
+        default: 'ppa:cloud-init-dev/daily'
   schedule:
     - cron: '2 22 * * *'
 
diff --git a/integration-requirements.txt b/integration-requirements.txt
index d0db753dabc..cf84b474469 100644
--- a/integration-requirements.txt
+++ b/integration-requirements.txt
@@ -5,6 +5,7 @@
 pycloudlib>=1!10.0.2,<1!11
 
 pytest-timeout
+pytest-json-ctrf  # Used for GH ctrf.io test report dashboard
 
 # Even when xdist is not actively used, we have fixtures that require it
 pytest-xdist

From 9cd0ff63cf407f03691ad8ea3a6ad5b109631996 Mon Sep 17 00:00:00 2001
From: Chad Smith <chad.smith@canonical.com>
Date: Wed, 6 May 2026 16:00:24 +0000
Subject: [PATCH 5/7] ci: update image_type defaults, validate required secrets
 set perms

Address review comments from copilot and Brett:
- update setup-lxd pinning
- validate presence of non-empty required SSH_*_KEY secrets
- simplifiy -z secret test conditionals to avoid multi-line issues
- use install -m 600 before creating SSH_PRIVATE_KEY file
- test and exit 1 on non-encoded PYCLOUDLIB_TOML repo secret
- set image_type: generic as defaults in 100-dispatch-common and ec2
  job.
---
 .github/workflows/100-dispatch-common.yml     | 25 +++++++++++++++----
 .../133-daily-integration-26.04-ec2.yml       |  1 +
 2 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/100-dispatch-common.yml b/.github/workflows/100-dispatch-common.yml
index 58eb9a6106f..8dd3d08c358 100644
--- a/.github/workflows/100-dispatch-common.yml
+++ b/.github/workflows/100-dispatch-common.yml
@@ -27,6 +27,7 @@ on:
         - generic
         - minimal
         required: false
+        default: generic
       install_source:
         required: false
         type: string
@@ -74,17 +75,26 @@ jobs:
       CLOUD_INIT_CLOUD_INIT_SOURCE: ${{ inputs.install_source }}
 
     steps:
-      - name: Assert repo secrets.PYCLOUDLIB_TOML is set
+      - name: Assert required repo secrets are set
         run: |
-          if [ -z "${{ env.REQUIRED_SECRET }}" ]; then
+          if [ -z "$REQUIRED_SECRET" ]; then
              echo "ERROR: Missing required repo secrets.PYCLOUDLIB_TOML non-empty value."
              exit 1
           fi
+          if [ -z "$SSH_PUBLIC_KEY" ]; then
+             echo "ERROR: Missing required repo secrets.SSH_PUBLIC_KEY non-empty value."
+             exit 1
+          fi
+          if [ -z "$SSH_PRIVATE_KEY" ]; then
+             echo "ERROR: Missing required repo secrets.SSH_PRIVATE_KEY non-empty value."
+             exit 1
+          fi
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - name: Setup LXD
+        # Avoid unnecessary snap install lxd on non-lxd platforms.
         if: ${{ contains(fromJSON('["lxd_vm", "lxd_container"]'), env.CLOUD_INIT_PLATFORM ) }}
-        uses: canonical/setup-lxd@8c6a87bfb56aa48f3fb9b830baa18562d8bfd4ee # v0.1.2
+        uses: canonical/setup-lxd@8c6a87bfb56aa48f3fb9b830baa18562d8bfd4ee # v1
         with:
           channel: 6/stable
       - name: Clean workspace
@@ -95,13 +105,18 @@ jobs:
           mkdir -p ~/.ssh
           # Dump secrets using a subprocess to avoid accidental leaks while debugging.
           sh -c 'printf "%s\n" "$SSH_PUBLIC_KEY" > ~/.ssh/cloudinit_id_rsa.pub'
+          # Create empty cloudinit_id_rsa with file mode 600.
+          touch ~/.ssh/cloudinit_id_rsa && chmod 600 ~/.ssh/cloudinit_id_rsa
           sh -c 'printf "%s\n" "$SSH_PRIVATE_KEY" > ~/.ssh/cloudinit_id_rsa'
-          chmod 600 ~/.ssh/cloudinit_id_rsa
       - name: Setup pycloudlib
         env:
           PYCLOUDLIB_CONFIG: ${{ runner.temp }}/pycloudlib.toml
         run: |
-          sh -c 'echo "${{ secrets.PYCLOUDLIB_TOML}}" | base64 -d > "$PYCLOUDLIB_CONFIG"'
+          sh -c 'echo "${{ secrets.PYCLOUDLIB_TOML}}" | base64 -d > "$PYCLOUDLIB_CONFIG"' | true
+          if [ ! -s $PYCLOUDLIB_CONFIG ]; then
+            echo "PYCLOUDLIB_TOML repo secret is not a base64-encoded string"
+            exit 1
+          fi
       - name: Install Dependencies
         run: |
           sudo DEBIAN_FRONTEND=noninteractive apt-get -qy update
diff --git a/.github/workflows/133-daily-integration-26.04-ec2.yml b/.github/workflows/133-daily-integration-26.04-ec2.yml
index f9362b6190d..553fe3ed5dc 100644
--- a/.github/workflows/133-daily-integration-26.04-ec2.yml
+++ b/.github/workflows/133-daily-integration-26.04-ec2.yml
@@ -18,6 +18,7 @@ jobs:
       release: resolute
       platform: ec2
       install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
+      image_type: generic
     secrets:
       PYCLOUDLIB_TOML: ${{ secrets.PYCLOUDLIB_TOML }}
       SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}

From cbfe7c6c253be6e727a0613b20ffd2d3d1f856b1 Mon Sep 17 00:00:00 2001
From: Chad Smith <chad.smith@canonical.com>
Date: Wed, 6 May 2026 16:44:16 +0000
Subject: [PATCH 6/7] ci: rename PYCLOUDLIB_TOML_B64 to indicate base64-encoded

---
 .github/workflows/100-dispatch-common.yml            | 12 ++++++------
 .../110-daily-integration-22.04-lxd_container.yml    |  2 +-
 .../111-daily-integration-24.04-lxd_container.yml    |  2 +-
 .../112-daily-integration-25.10-lxd_container.yml    |  2 +-
 .../113-daily-integration-26.04-lxd_container.yml    |  2 +-
 .../workflows/120-daily-integration-22.04-lxd_vm.yml |  2 +-
 .../workflows/121-daily-integration-24.04-lxd_vm.yml |  2 +-
 .../workflows/122-daily-integration-25.10-lxd_vm.yml |  2 +-
 .../workflows/123-daily-integration-26.04-lxd_vm.yml |  2 +-
 .../workflows/130-daily-integration-22.04-ec2.yml    |  2 +-
 .../workflows/131-daily-integration-24.04-ec2.yml    |  2 +-
 .../workflows/132-daily-integration-25.10-ec2.yml    |  2 +-
 .../workflows/133-daily-integration-26.04-ec2.yml    |  2 +-
 13 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/100-dispatch-common.yml b/.github/workflows/100-dispatch-common.yml
index 8dd3d08c358..1ad37f439b3 100644
--- a/.github/workflows/100-dispatch-common.yml
+++ b/.github/workflows/100-dispatch-common.yml
@@ -1,4 +1,4 @@
-# WARNING: This workflow handles repository secrets (PYCLOUDLIB_TOML, SSH keys).
+# WARNING: This workflow handles repository secrets (PYCLOUDLIB_TOML_B64, SSH keys).
 # It MUST NOT be triggered by PR-driven workflows to prevent secret exposure to
 # untrusted code submitted via pull requests.
 name: "Dispatch: Integration"
@@ -53,7 +53,7 @@ on:
         required: false
         type: string
     secrets:
-      PYCLOUDLIB_TOML:
+      PYCLOUDLIB_TOML_B64:
         required: true
       SSH_PRIVATE_KEY:
         required: true
@@ -66,7 +66,7 @@ jobs:
     if: github.repository == 'canonical/cloud-init'
 
     env:
-      REQUIRED_SECRET: ${{ secrets.PYCLOUDLIB_TOML }}
+      REQUIRED_SECRET: ${{ secrets.PYCLOUDLIB_TOML_B64 }}
       SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
       SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
       CLOUD_INIT_PLATFORM: ${{ inputs.platform }}
@@ -78,7 +78,7 @@ jobs:
       - name: Assert required repo secrets are set
         run: |
           if [ -z "$REQUIRED_SECRET" ]; then
-             echo "ERROR: Missing required repo secrets.PYCLOUDLIB_TOML non-empty value."
+             echo "ERROR: Missing required repo secrets.PYCLOUDLIB_TOML_B64 non-empty value."
              exit 1
           fi
           if [ -z "$SSH_PUBLIC_KEY" ]; then
@@ -112,9 +112,9 @@ jobs:
         env:
           PYCLOUDLIB_CONFIG: ${{ runner.temp }}/pycloudlib.toml
         run: |
-          sh -c 'echo "${{ secrets.PYCLOUDLIB_TOML}}" | base64 -d > "$PYCLOUDLIB_CONFIG"' | true
+          sh -c 'echo "${{ secrets.PYCLOUDLIB_TOML_B64}}" | base64 -d > "$PYCLOUDLIB_CONFIG"' | true
           if [ ! -s $PYCLOUDLIB_CONFIG ]; then
-            echo "PYCLOUDLIB_TOML repo secret is not a base64-encoded string"
+            echo "PYCLOUDLIB_TOML_B64 repo secret is not a base64-encoded string"
             exit 1
           fi
       - name: Install Dependencies
diff --git a/.github/workflows/110-daily-integration-22.04-lxd_container.yml b/.github/workflows/110-daily-integration-22.04-lxd_container.yml
index 52f0966dd09..6aea254ee4c 100644
--- a/.github/workflows/110-daily-integration-22.04-lxd_container.yml
+++ b/.github/workflows/110-daily-integration-22.04-lxd_container.yml
@@ -19,6 +19,6 @@ jobs:
       install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
       image_type: generic
     secrets:
-      PYCLOUDLIB_TOML: ${{ secrets.PYCLOUDLIB_TOML }}
+      PYCLOUDLIB_TOML_B64: ${{ secrets.PYCLOUDLIB_TOML_B64 }}
       SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
       SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
diff --git a/.github/workflows/111-daily-integration-24.04-lxd_container.yml b/.github/workflows/111-daily-integration-24.04-lxd_container.yml
index 08f5c836890..58eb7575cd9 100644
--- a/.github/workflows/111-daily-integration-24.04-lxd_container.yml
+++ b/.github/workflows/111-daily-integration-24.04-lxd_container.yml
@@ -19,6 +19,6 @@ jobs:
       install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
       image_type: generic
     secrets:
-      PYCLOUDLIB_TOML: ${{ secrets.PYCLOUDLIB_TOML }}
+      PYCLOUDLIB_TOML_B64: ${{ secrets.PYCLOUDLIB_TOML_B64 }}
       SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
       SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
diff --git a/.github/workflows/112-daily-integration-25.10-lxd_container.yml b/.github/workflows/112-daily-integration-25.10-lxd_container.yml
index c72945188bf..5eb45f4c7a9 100644
--- a/.github/workflows/112-daily-integration-25.10-lxd_container.yml
+++ b/.github/workflows/112-daily-integration-25.10-lxd_container.yml
@@ -19,6 +19,6 @@ jobs:
       install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
       image_type: generic
     secrets:
-      PYCLOUDLIB_TOML: ${{ secrets.PYCLOUDLIB_TOML }}
+      PYCLOUDLIB_TOML_B64: ${{ secrets.PYCLOUDLIB_TOML_B64 }}
       SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
       SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
diff --git a/.github/workflows/113-daily-integration-26.04-lxd_container.yml b/.github/workflows/113-daily-integration-26.04-lxd_container.yml
index 56ed73872cc..e99a7a2d626 100644
--- a/.github/workflows/113-daily-integration-26.04-lxd_container.yml
+++ b/.github/workflows/113-daily-integration-26.04-lxd_container.yml
@@ -19,6 +19,6 @@ jobs:
       install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
       image_type: generic
     secrets:
-      PYCLOUDLIB_TOML: ${{ secrets.PYCLOUDLIB_TOML }}
+      PYCLOUDLIB_TOML_B64: ${{ secrets.PYCLOUDLIB_TOML_B64 }}
       SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
       SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
diff --git a/.github/workflows/120-daily-integration-22.04-lxd_vm.yml b/.github/workflows/120-daily-integration-22.04-lxd_vm.yml
index 0f0ed71d0d7..ad9b530761d 100644
--- a/.github/workflows/120-daily-integration-22.04-lxd_vm.yml
+++ b/.github/workflows/120-daily-integration-22.04-lxd_vm.yml
@@ -19,6 +19,6 @@ jobs:
       install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
       image_type: generic
     secrets:
-      PYCLOUDLIB_TOML: ${{ secrets.PYCLOUDLIB_TOML }}
+      PYCLOUDLIB_TOML_B64: ${{ secrets.PYCLOUDLIB_TOML_B64 }}
       SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
       SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
diff --git a/.github/workflows/121-daily-integration-24.04-lxd_vm.yml b/.github/workflows/121-daily-integration-24.04-lxd_vm.yml
index efd38a6e97e..7a27d46eb78 100644
--- a/.github/workflows/121-daily-integration-24.04-lxd_vm.yml
+++ b/.github/workflows/121-daily-integration-24.04-lxd_vm.yml
@@ -19,6 +19,6 @@ jobs:
       install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
       image_type: generic
     secrets:
-      PYCLOUDLIB_TOML: ${{ secrets.PYCLOUDLIB_TOML }}
+      PYCLOUDLIB_TOML_B64: ${{ secrets.PYCLOUDLIB_TOML_B64 }}
       SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
       SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
diff --git a/.github/workflows/122-daily-integration-25.10-lxd_vm.yml b/.github/workflows/122-daily-integration-25.10-lxd_vm.yml
index 0d39b2d4d79..705b24d793f 100644
--- a/.github/workflows/122-daily-integration-25.10-lxd_vm.yml
+++ b/.github/workflows/122-daily-integration-25.10-lxd_vm.yml
@@ -19,6 +19,6 @@ jobs:
       install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
       image_type: generic
     secrets:
-      PYCLOUDLIB_TOML: ${{ secrets.PYCLOUDLIB_TOML }}
+      PYCLOUDLIB_TOML_B64: ${{ secrets.PYCLOUDLIB_TOML_B64 }}
       SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
       SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
diff --git a/.github/workflows/123-daily-integration-26.04-lxd_vm.yml b/.github/workflows/123-daily-integration-26.04-lxd_vm.yml
index 46d55c7b3c1..5046fd7d910 100644
--- a/.github/workflows/123-daily-integration-26.04-lxd_vm.yml
+++ b/.github/workflows/123-daily-integration-26.04-lxd_vm.yml
@@ -19,6 +19,6 @@ jobs:
       install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
       image_type: generic
     secrets:
-      PYCLOUDLIB_TOML: ${{ secrets.PYCLOUDLIB_TOML }}
+      PYCLOUDLIB_TOML_B64: ${{ secrets.PYCLOUDLIB_TOML_B64 }}
       SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
       SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
diff --git a/.github/workflows/130-daily-integration-22.04-ec2.yml b/.github/workflows/130-daily-integration-22.04-ec2.yml
index 98ae5b4a574..8b6bcbddad8 100644
--- a/.github/workflows/130-daily-integration-22.04-ec2.yml
+++ b/.github/workflows/130-daily-integration-22.04-ec2.yml
@@ -20,6 +20,6 @@ jobs:
       install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
       image_type: generic
     secrets:
-      PYCLOUDLIB_TOML: ${{ secrets.PYCLOUDLIB_TOML }}
+      PYCLOUDLIB_TOML_B64: ${{ secrets.PYCLOUDLIB_TOML_B64 }}
       SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
       SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
diff --git a/.github/workflows/131-daily-integration-24.04-ec2.yml b/.github/workflows/131-daily-integration-24.04-ec2.yml
index d29da095113..30c5196c292 100644
--- a/.github/workflows/131-daily-integration-24.04-ec2.yml
+++ b/.github/workflows/131-daily-integration-24.04-ec2.yml
@@ -20,6 +20,6 @@ jobs:
       install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
       image_type: generic
     secrets:
-      PYCLOUDLIB_TOML: ${{ secrets.PYCLOUDLIB_TOML }}
+      PYCLOUDLIB_TOML_B64: ${{ secrets.PYCLOUDLIB_TOML_B64 }}
       SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
       SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
diff --git a/.github/workflows/132-daily-integration-25.10-ec2.yml b/.github/workflows/132-daily-integration-25.10-ec2.yml
index 6feb85c8b43..2d3ae0f95d1 100644
--- a/.github/workflows/132-daily-integration-25.10-ec2.yml
+++ b/.github/workflows/132-daily-integration-25.10-ec2.yml
@@ -20,6 +20,6 @@ jobs:
       install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
       image_type: generic
     secrets:
-      PYCLOUDLIB_TOML: ${{ secrets.PYCLOUDLIB_TOML }}
+      PYCLOUDLIB_TOML_B64: ${{ secrets.PYCLOUDLIB_TOML_B64 }}
       SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
       SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
diff --git a/.github/workflows/133-daily-integration-26.04-ec2.yml b/.github/workflows/133-daily-integration-26.04-ec2.yml
index 553fe3ed5dc..f4117fbe7cf 100644
--- a/.github/workflows/133-daily-integration-26.04-ec2.yml
+++ b/.github/workflows/133-daily-integration-26.04-ec2.yml
@@ -20,6 +20,6 @@ jobs:
       install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
       image_type: generic
     secrets:
-      PYCLOUDLIB_TOML: ${{ secrets.PYCLOUDLIB_TOML }}
+      PYCLOUDLIB_TOML_B64: ${{ secrets.PYCLOUDLIB_TOML_B64 }}
       SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
       SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}

From 30090a6ac04514044515780c302418706818c657 Mon Sep 17 00:00:00 2001
From: Chad Smith <chad.smith@canonical.com>
Date: Thu, 7 May 2026 01:27:26 +0000
Subject: [PATCH 7/7] ci: standardize input/dispatch defaults, errors for
 missing secrets

Migrate away from deprecated pytest-json-ctrf reverting to use
ctrf intrgration junit-to-ctrf.
---
 .github/workflows/100-dispatch-common.yml     | 36 ++++++++++++-------
 ...-daily-integration-22.04-lxd_container.yml | 12 ++++++-
 ...-daily-integration-24.04-lxd_container.yml | 12 ++++++-
 ...-daily-integration-25.10-lxd_container.yml | 12 ++++++-
 ...-daily-integration-26.04-lxd_container.yml | 12 ++++++-
 .../120-daily-integration-22.04-lxd_vm.yml    | 12 ++++++-
 .../121-daily-integration-24.04-lxd_vm.yml    | 12 ++++++-
 .../122-daily-integration-25.10-lxd_vm.yml    | 12 ++++++-
 .../123-daily-integration-26.04-lxd_vm.yml    | 12 ++++++-
 .../130-daily-integration-22.04-ec2.yml       | 12 ++++++-
 .../131-daily-integration-24.04-ec2.yml       | 12 ++++++-
 .../132-daily-integration-25.10-ec2.yml       | 12 ++++++-
 .../133-daily-integration-26.04-ec2.yml       | 12 ++++++-
 integration-requirements.txt                  |  1 -
 14 files changed, 155 insertions(+), 26 deletions(-)

diff --git a/.github/workflows/100-dispatch-common.yml b/.github/workflows/100-dispatch-common.yml
index 1ad37f439b3..461f4eb801e 100644
--- a/.github/workflows/100-dispatch-common.yml
+++ b/.github/workflows/100-dispatch-common.yml
@@ -22,12 +22,11 @@ on:
         - lxd_vm
         - ec2
       image_type:
+        required: true
         type: choice
         options:
         - generic
         - minimal
-        required: false
-        default: generic
       install_source:
         required: false
         type: string
@@ -78,15 +77,15 @@ jobs:
       - name: Assert required repo secrets are set
         run: |
           if [ -z "$REQUIRED_SECRET" ]; then
-             echo "ERROR: Missing required repo secrets.PYCLOUDLIB_TOML_B64 non-empty value."
+             echo "ERROR: Missing required repo secret. Please provide the necessary repo secret at ${{ github.repository }}/settings/secrets/action."
              exit 1
           fi
           if [ -z "$SSH_PUBLIC_KEY" ]; then
-             echo "ERROR: Missing required repo secrets.SSH_PUBLIC_KEY non-empty value."
+             echo "ERROR: Missing required repo secret. Please provide SSH_PUBLIC_KEY repo secret at ${{ github.repository }}/settings/secrets/actions."
              exit 1
           fi
           if [ -z "$SSH_PRIVATE_KEY" ]; then
-             echo "ERROR: Missing required repo secrets.SSH_PRIVATE_KEY non-empty value."
+             echo "ERROR: Missing required repo secret. Please provide SSH_PRIVATE_KEY repo secret at ${{ github.repository }}/settings/secrets/actions."
              exit 1
           fi
       - name: Checkout
@@ -106,17 +105,13 @@ jobs:
           # Dump secrets using a subprocess to avoid accidental leaks while debugging.
           sh -c 'printf "%s\n" "$SSH_PUBLIC_KEY" > ~/.ssh/cloudinit_id_rsa.pub'
           # Create empty cloudinit_id_rsa with file mode 600.
-          touch ~/.ssh/cloudinit_id_rsa && chmod 600 ~/.ssh/cloudinit_id_rsa
+          install -m 600 /dev/null  ~/.ssh/cloudinit_id_rsa
           sh -c 'printf "%s\n" "$SSH_PRIVATE_KEY" > ~/.ssh/cloudinit_id_rsa'
       - name: Setup pycloudlib
         env:
           PYCLOUDLIB_CONFIG: ${{ runner.temp }}/pycloudlib.toml
         run: |
-          sh -c 'echo "${{ secrets.PYCLOUDLIB_TOML_B64}}" | base64 -d > "$PYCLOUDLIB_CONFIG"' | true
-          if [ ! -s $PYCLOUDLIB_CONFIG ]; then
-            echo "PYCLOUDLIB_TOML_B64 repo secret is not a base64-encoded string"
-            exit 1
-          fi
+          sh -c 'echo "${{ secrets.PYCLOUDLIB_TOML_B64}}" | base64 -d > "$PYCLOUDLIB_CONFIG"'
       - name: Install Dependencies
         run: |
           sudo DEBIAN_FRONTEND=noninteractive apt-get -qy update
@@ -126,13 +121,28 @@ jobs:
           PYCLOUDLIB_CONFIG: ${{ runner.temp }}/pycloudlib.toml
           CLOUD_INIT_LOCAL_LOG_PATH: ${{ github.workspace }}/cloud_init_test_logs
         run: |
-          tox -e integration-tests -- --ctrf=${{ github.workspace }}/report.json --color=yes ${{ inputs.filter_tests || 'tests/integration_tests' }}
+          tox -e integration-tests -- --junitxml="${{ github.workspace }}/junit-report.xml" --color=yes ${{ inputs.filter_tests || 'tests/integration_tests' }}
       - name: Publish Test Report with Insights
         if: ${{ always() }}
         uses: ctrf-io/github-test-reporter@024bc4b64d997ca9da86833c6b9548c55c620e40 # v1.0.26
         with:
-          report-path: '${{ github.workspace }}/report.json'
+          report-path: '${{ github.workspace }}/junit-report.xml'
           title: '${{ inputs.platform }}-${{ inputs.release }}-${{ inputs.image_type }}:${{ inputs.install_source }}'
+          integrations-config: |
+            {
+              "junit-to-ctrf": {
+                "enabled": true,
+                "action": "convert",
+                "options": {
+                  "output": "./ctrf-report.json",
+                  "toolname": "junit-to-ctrf",
+                  "useSuiteName": false,
+                  "env": {
+                    "appName": "my-app"
+                  }
+                }
+              }
+            }
           summary-delta-report: true
           insights-report: true
           flaky-rate-report: true
diff --git a/.github/workflows/110-daily-integration-22.04-lxd_container.yml b/.github/workflows/110-daily-integration-22.04-lxd_container.yml
index 6aea254ee4c..bf719312c78 100644
--- a/.github/workflows/110-daily-integration-22.04-lxd_container.yml
+++ b/.github/workflows/110-daily-integration-22.04-lxd_container.yml
@@ -7,6 +7,15 @@ on:
         required: false
         type: string
         default: 'ppa:cloud-init-dev/daily'
+      image_type:
+        required: true
+        type: choice
+        options:
+        - generic
+        - minimal
+      filter_tests:
+        required: false
+        type: string
   schedule:
     - cron: '2 22 * * *'
 
@@ -17,7 +26,8 @@ jobs:
       release: jammy
       platform: lxd_container
       install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
-      image_type: generic
+      image_type: ${{ inputs.image_type || 'generic' }}
+      filter_tests: ${{ inputs.filter_tests }}
     secrets:
       PYCLOUDLIB_TOML_B64: ${{ secrets.PYCLOUDLIB_TOML_B64 }}
       SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
diff --git a/.github/workflows/111-daily-integration-24.04-lxd_container.yml b/.github/workflows/111-daily-integration-24.04-lxd_container.yml
index 58eb7575cd9..73fcd9e302d 100644
--- a/.github/workflows/111-daily-integration-24.04-lxd_container.yml
+++ b/.github/workflows/111-daily-integration-24.04-lxd_container.yml
@@ -7,6 +7,15 @@ on:
         required: false
         type: string
         default: 'ppa:cloud-init-dev/daily'
+      image_type:
+        required: true
+        type: choice
+        options:
+        - generic
+        - minimal
+      filter_tests:
+        required: false
+        type: string
   schedule:
     - cron: '2 22 * * *'
 
@@ -17,7 +26,8 @@ jobs:
       release: noble
       platform: lxd_container
       install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
-      image_type: generic
+      image_type: ${{ inputs.image_type || 'generic' }}
+      filter_tests: ${{ inputs.filter_tests }}
     secrets:
       PYCLOUDLIB_TOML_B64: ${{ secrets.PYCLOUDLIB_TOML_B64 }}
       SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
diff --git a/.github/workflows/112-daily-integration-25.10-lxd_container.yml b/.github/workflows/112-daily-integration-25.10-lxd_container.yml
index 5eb45f4c7a9..e59de2c3feb 100644
--- a/.github/workflows/112-daily-integration-25.10-lxd_container.yml
+++ b/.github/workflows/112-daily-integration-25.10-lxd_container.yml
@@ -7,6 +7,15 @@ on:
         required: false
         type: string
         default: 'ppa:cloud-init-dev/daily'
+      image_type:
+        required: true
+        type: choice
+        options:
+        - generic
+        - minimal
+      filter_tests:
+        required: false
+        type: string
   schedule:
     - cron: '2 22 * * *'
 
@@ -17,7 +26,8 @@ jobs:
       release: questing
       platform: lxd_container
       install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
-      image_type: generic
+      image_type: ${{ inputs.image_type || 'generic' }}
+      filter_tests: ${{ inputs.filter_tests }}
     secrets:
       PYCLOUDLIB_TOML_B64: ${{ secrets.PYCLOUDLIB_TOML_B64 }}
       SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
diff --git a/.github/workflows/113-daily-integration-26.04-lxd_container.yml b/.github/workflows/113-daily-integration-26.04-lxd_container.yml
index e99a7a2d626..2e12f25ce03 100644
--- a/.github/workflows/113-daily-integration-26.04-lxd_container.yml
+++ b/.github/workflows/113-daily-integration-26.04-lxd_container.yml
@@ -7,6 +7,15 @@ on:
         required: false
         type: string
         default: 'ppa:cloud-init-dev/daily'
+      image_type:
+        required: true
+        type: choice
+        options:
+        - generic
+        - minimal
+      filter_tests:
+        required: false
+        type: string
   schedule:
     - cron: '2 22 * * *'
 
@@ -17,7 +26,8 @@ jobs:
       release: resolute
       platform: lxd_container
       install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
-      image_type: generic
+      image_type: ${{ inputs.image_type || 'generic' }}
+      filter_tests: ${{ inputs.filter_tests }}
     secrets:
       PYCLOUDLIB_TOML_B64: ${{ secrets.PYCLOUDLIB_TOML_B64 }}
       SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
diff --git a/.github/workflows/120-daily-integration-22.04-lxd_vm.yml b/.github/workflows/120-daily-integration-22.04-lxd_vm.yml
index ad9b530761d..2b81dfca8e0 100644
--- a/.github/workflows/120-daily-integration-22.04-lxd_vm.yml
+++ b/.github/workflows/120-daily-integration-22.04-lxd_vm.yml
@@ -7,6 +7,15 @@ on:
         required: false
         type: string
         default: 'ppa:cloud-init-dev/daily'
+      image_type:
+        required: true
+        type: choice
+        options:
+        - generic
+        - minimal
+      filter_tests:
+        required: false
+        type: string
   schedule:
     - cron: '2 23 * * *'
 
@@ -17,7 +26,8 @@ jobs:
       release: jammy
       platform: lxd_vm
       install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
-      image_type: generic
+      image_type: ${{ inputs.image_type || 'generic' }}
+      filter_tests: ${{ inputs.filter_tests }}
     secrets:
       PYCLOUDLIB_TOML_B64: ${{ secrets.PYCLOUDLIB_TOML_B64 }}
       SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
diff --git a/.github/workflows/121-daily-integration-24.04-lxd_vm.yml b/.github/workflows/121-daily-integration-24.04-lxd_vm.yml
index 7a27d46eb78..fa1b671223a 100644
--- a/.github/workflows/121-daily-integration-24.04-lxd_vm.yml
+++ b/.github/workflows/121-daily-integration-24.04-lxd_vm.yml
@@ -7,6 +7,15 @@ on:
         required: false
         type: string
         default: 'ppa:cloud-init-dev/daily'
+      image_type:
+        required: true
+        type: choice
+        options:
+        - generic
+        - minimal
+      filter_tests:
+        required: false
+        type: string
   schedule:
     - cron: '2 23 * * *'
 
@@ -17,7 +26,8 @@ jobs:
       release: noble
       platform: lxd_vm
       install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
-      image_type: generic
+      image_type: ${{ inputs.image_type || 'generic' }}
+      filter_tests: ${{ inputs.filter_tests }}
     secrets:
       PYCLOUDLIB_TOML_B64: ${{ secrets.PYCLOUDLIB_TOML_B64 }}
       SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
diff --git a/.github/workflows/122-daily-integration-25.10-lxd_vm.yml b/.github/workflows/122-daily-integration-25.10-lxd_vm.yml
index 705b24d793f..c14c2abd9bb 100644
--- a/.github/workflows/122-daily-integration-25.10-lxd_vm.yml
+++ b/.github/workflows/122-daily-integration-25.10-lxd_vm.yml
@@ -7,6 +7,15 @@ on:
         required: false
         type: string
         default: 'ppa:cloud-init-dev/daily'
+      image_type:
+        required: true
+        type: choice
+        options:
+        - generic
+        - minimal
+      filter_tests:
+        required: false
+        type: string
   schedule:
     - cron: '2 23 * * *'
 
@@ -17,7 +26,8 @@ jobs:
       release: questing
       platform: lxd_vm
       install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
-      image_type: generic
+      image_type: ${{ inputs.image_type || 'generic' }}
+      filter_tests: ${{ inputs.filter_tests }}
     secrets:
       PYCLOUDLIB_TOML_B64: ${{ secrets.PYCLOUDLIB_TOML_B64 }}
       SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
diff --git a/.github/workflows/123-daily-integration-26.04-lxd_vm.yml b/.github/workflows/123-daily-integration-26.04-lxd_vm.yml
index 5046fd7d910..54a5dc4413a 100644
--- a/.github/workflows/123-daily-integration-26.04-lxd_vm.yml
+++ b/.github/workflows/123-daily-integration-26.04-lxd_vm.yml
@@ -7,6 +7,15 @@ on:
         required: false
         type: string
         default: 'ppa:cloud-init-dev/daily'
+      image_type:
+        required: true
+        type: choice
+        options:
+        - generic
+        - minimal
+      filter_tests:
+        required: false
+        type: string
   schedule:
     - cron: '2 23 * * *'
 
@@ -17,7 +26,8 @@ jobs:
       release: resolute
       platform: lxd_vm
       install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
-      image_type: generic
+      image_type: ${{ inputs.image_type || 'generic' }}
+      filter_tests: ${{ inputs.filter_tests }}
     secrets:
       PYCLOUDLIB_TOML_B64: ${{ secrets.PYCLOUDLIB_TOML_B64 }}
       SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
diff --git a/.github/workflows/130-daily-integration-22.04-ec2.yml b/.github/workflows/130-daily-integration-22.04-ec2.yml
index 8b6bcbddad8..499d6d7bdea 100644
--- a/.github/workflows/130-daily-integration-22.04-ec2.yml
+++ b/.github/workflows/130-daily-integration-22.04-ec2.yml
@@ -7,6 +7,15 @@ on:
         required: false
         type: string
         default: 'ppa:cloud-init-dev/daily'
+      image_type:
+        required: true
+        type: choice
+        options:
+        - generic
+        - minimal
+      filter_tests:
+        required: false
+        type: string
   schedule:
     # Run Mon & Thurs for high-cost test runs
     - cron: '2 22 * * 1,4'
@@ -18,7 +27,8 @@ jobs:
       release: jammy
       platform: ec2
       install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
-      image_type: generic
+      image_type: ${{ inputs.image_type || 'generic' }}
+      filter_tests: ${{ inputs.filter_tests }}
     secrets:
       PYCLOUDLIB_TOML_B64: ${{ secrets.PYCLOUDLIB_TOML_B64 }}
       SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
diff --git a/.github/workflows/131-daily-integration-24.04-ec2.yml b/.github/workflows/131-daily-integration-24.04-ec2.yml
index 30c5196c292..460cec7570b 100644
--- a/.github/workflows/131-daily-integration-24.04-ec2.yml
+++ b/.github/workflows/131-daily-integration-24.04-ec2.yml
@@ -7,6 +7,15 @@ on:
         required: false
         type: string
         default: 'ppa:cloud-init-dev/daily'
+      image_type:
+        required: true
+        type: choice
+        options:
+        - generic
+        - minimal
+      filter_tests:
+        required: false
+        type: string
   schedule:
     # Run Mon & Thurs for high-cost test runs
     - cron: '2 22 * * 1,4'
@@ -18,7 +27,8 @@ jobs:
       release: noble
       platform: ec2
       install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
-      image_type: generic
+      image_type: ${{ inputs.image_type || 'generic' }}
+      filter_tests: ${{ inputs.filter_tests }}
     secrets:
       PYCLOUDLIB_TOML_B64: ${{ secrets.PYCLOUDLIB_TOML_B64 }}
       SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
diff --git a/.github/workflows/132-daily-integration-25.10-ec2.yml b/.github/workflows/132-daily-integration-25.10-ec2.yml
index 2d3ae0f95d1..38a92882077 100644
--- a/.github/workflows/132-daily-integration-25.10-ec2.yml
+++ b/.github/workflows/132-daily-integration-25.10-ec2.yml
@@ -7,6 +7,15 @@ on:
         required: false
         type: string
         default: 'ppa:cloud-init-dev/daily'
+      image_type:
+        required: true
+        type: choice
+        options:
+        - generic
+        - minimal
+      filter_tests:
+        required: false
+        type: string
   schedule:
     # Run Mon & Thurs for high-cost test runs
     - cron: '2 22 * * 1,4'
@@ -18,7 +27,8 @@ jobs:
       release: questing
       platform: ec2
       install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
-      image_type: generic
+      image_type: ${{ inputs.image_type || 'generic' }}
+      filter_tests: ${{ inputs.filter_tests }}
     secrets:
       PYCLOUDLIB_TOML_B64: ${{ secrets.PYCLOUDLIB_TOML_B64 }}
       SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
diff --git a/.github/workflows/133-daily-integration-26.04-ec2.yml b/.github/workflows/133-daily-integration-26.04-ec2.yml
index f4117fbe7cf..1bf1c757a30 100644
--- a/.github/workflows/133-daily-integration-26.04-ec2.yml
+++ b/.github/workflows/133-daily-integration-26.04-ec2.yml
@@ -7,6 +7,15 @@ on:
         required: false
         type: string
         default: 'ppa:cloud-init-dev/daily'
+      image_type:
+        required: true
+        type: choice
+        options:
+        - generic
+        - minimal
+      filter_tests:
+        required: false
+        type: string
   schedule:
     # Run Mon & Thurs for high-cost test runs
     - cron: '2 22 * * 1,4'
@@ -18,7 +27,8 @@ jobs:
       release: resolute
       platform: ec2
       install_source: ${{ inputs.install_source || 'ppa:cloud-init-dev/daily' }}
-      image_type: generic
+      image_type: ${{ inputs.image_type || 'generic' }}
+      filter_tests: ${{ inputs.filter_tests }}
     secrets:
       PYCLOUDLIB_TOML_B64: ${{ secrets.PYCLOUDLIB_TOML_B64 }}
       SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
diff --git a/integration-requirements.txt b/integration-requirements.txt
index cf84b474469..d0db753dabc 100644
--- a/integration-requirements.txt
+++ b/integration-requirements.txt
@@ -5,7 +5,6 @@
 pycloudlib>=1!10.0.2,<1!11
 
 pytest-timeout
-pytest-json-ctrf  # Used for GH ctrf.io test report dashboard
 
 # Even when xdist is not actively used, we have fixtures that require it
 pytest-xdist