Switch from pull_request to push on pull-request/[0-9]+ branches
so CI runs via copy-pr-bot, required for self-hosted GPU runners.

Signed-off-by: Davanum Srinivas <[email protected]>

The GPU runner user lacks write access to /usr/local/bin/.
Add sudo to curl, mv, and chmod commands for kind, kubectl,
and helm installation.

Signed-off-by: Davanum Srinivas <[email protected]>

CDI mode prevents /proc/driver/nvidia from being mounted into kind
node containers, which causes nvkind's PatchProcDriverNvidia() to
fail with "umount: /proc/driver/nvidia: not mounted". Use legacy
device injection instead.

Signed-off-by: Davanum Srinivas <[email protected]>

Use the same nvidia-ctk configuration pattern as NVIDIA/OSMO:
- Enable CDI mode (--cdi.enabled)
- Set accept-nvidia-visible-devices-envvar-when-unprivileged=false
- Tolerate nvkind umount errors (expected with CDI device injection
  since /proc/driver/nvidia is not bind-mounted into kind nodes)

The cluster is still validated via kubectl cluster-info after creation.

Signed-off-by: Davanum Srinivas <[email protected]>

The standalone nvidia-device-plugin Helm chart requires NFD labels
(nvidia.com/gpu.present) to schedule. Without NFD, the daemonset
matches 0 nodes and GPUs are never advertised.

Switch to the GPU Operator (matching NVIDIA/OSMO pattern) with:
- driver.enabled=false (host driver already present)
- toolkit.enabled=false (nvkind handles toolkit inside nodes)
- nfd.enabled=true (provides node labeling for device plugin)

Signed-off-by: Davanum Srinivas <[email protected]>

Add a Docker GPU validation step before cluster creation to catch
host-level GPU plumbing issues early (matching OSMO pattern).

Add explicit kubectl wait for node readiness after cluster creation
with a 300s timeout instead of just checking cluster-info.

Signed-off-by: Davanum Srinivas <[email protected]>

After validating nvidia-smi works in a pod, build the eidos image
with ko, load it into the kind cluster, then run eidos snapshot
in agent mode to verify the full snapshot pipeline on a GPU node.

Signed-off-by: Davanum Srinivas <[email protected]>

Print the complete snapshot YAML instead of just the first 100 lines.
Add an explicit validation step that fails if T4 GPU is not found
in the snapshot output.

Signed-off-by: Davanum Srinivas <[email protected]>

Print the full snapshot YAML and use yq to extract exact fields
(gpu.model and gpu-count) from the structured snapshot output
instead of a loose grep. Fail if the T4 GPU model is not found
or gpu-count is less than 1.

Signed-off-by: Davanum Srinivas <[email protected]>

ko with --bare produces images tagged as ko.local:<tag> without a path
component, not ko.local/eidos:<tag>. Fix both the kind load and the
eidos snapshot --image references.

Signed-off-by: Davanum Srinivas <[email protected]>

In CDI environments (e.g., kind with nvkind), GPU devices and nvidia-smi
are only injected into containers that explicitly request nvidia.com/gpu
resources. The existing privileged+hostPID approach works on bare metal
but not in CDI mode.

Add --require-gpu flag to snapshot and validate commands that adds
nvidia.com/gpu: 1 to the agent pod's resource limits, triggering CDI
device injection. Also available via EIDOS_REQUIRE_GPU env var.

Use --require-gpu in the GPU smoke test CI workflow.

Signed-off-by: Davanum Srinivas <[email protected]>

Extract CLI flag definitions from validateCmd into validateCmdFlags
to bring the function under the 200-line funlen limit.

Signed-off-by: Davanum Srinivas <[email protected]>