build: Convert to module

.github/workflows/ci.yaml

@@ -0,0 +1,39 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+permissions:
+  contents: read
+
+# One run per branch. A push that supersedes another cancels it, except on main, where every commit is checked.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  # One interpreter for both: ruff takes the target version from its config and ty takes `python-version` from
+  # `[tool.ty.environment]`, so what the runner runs on decides nothing. The unit tests below are where the
+  # interpreter is a real axis.
+  lint_check:
+    name: Lint check
+    uses: apify/workflows/.github/workflows/python_lint_check.yaml@main
+    with:
+      python_versions: '["3.13"]'
+
+  type_check:
+    name: Type check
+    uses: apify/workflows/.github/workflows/python_type_check.yaml@main
+    with:
+      python_versions: '["3.13"]'
+
+  unit_tests:
+    name: Unit tests
+    uses: apify/workflows/.github/workflows/python_unit_tests.yaml@main
+    with:
+      python_versions: '["3.10", "3.11", "3.12", "3.13", "3.14"]'
+      operating_systems: '["ubuntu-latest"]'
+      run_tests_command: uv run poe unit-tests

.github/workflows/e2e.yaml

@@ -0,0 +1,129 @@
+name: E2E
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# One run per branch. A superseded push is cancelled, except on main, where every commit is checked. These
+# lanes boot virtual machines, so a queue of stale runs is expensive.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  # The interpreter is a real axis only for what the probe runs on: the container tests below bring their own
+  # interpreters with uv, and running them once per version would repeat identical work five times.
+  machine:
+    name: machine (python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ['3.10', '3.11', '3.12', '3.13', '3.14']
+    env:
+      # The suite itself, and with it the probe on this machine, runs on the version of the matrix.
+      UV_PYTHON: ${{ matrix.python-version }}
+      E2E_INTERFACE: cgroup-v2
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Set up uv package manager
+        uses: astral-sh/setup-uv@v10.0.1
+
+      - name: Install dependencies
+        run: uv run poe install-dev
+
+      # This runner is a plain cgroup v2 machine with systemd and passwordless sudo, so every machine test
+      # holds here and none is excluded.
+      - name: Run the machine tests
+        run: uv run pytest tests/e2e/test_machine.py
+
+  containers:
+    name: containers
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      E2E_INTERFACE: cgroup-v2
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Set up uv package manager
+        uses: astral-sh/setup-uv@v10.0.1
+
+      - name: Install dependencies
+        run: uv run poe install-dev
+
+      - name: Run the container tests
+        run: uv run pytest tests/e2e/test_docker.py
+
+  kubernetes:
+    name: kubernetes
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Set up uv package manager
+        uses: astral-sh/setup-uv@v10.0.1
+
+      - name: Install kind
+        uses: helm/kind-action@v1.14.0
+        with:
+          cluster_name: cgroups-sensor-e2e
+
+      - name: Install dependencies
+        run: uv run poe install-dev
+
+      - name: Run the kubernetes tests
+        run: uv run pytest tests/e2e/test_kubernetes.py
+
+  guest:
+    name: guest (${{ matrix.profile }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        # The Ubuntu profiles are the only way to reach cgroup v1. The Fedora one runs the same suite on a
+        # second distribution, with a much newer systemd.
+        profile: [ubuntu-v1-hybrid, ubuntu-v1-legacy, fedora-v2]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Set up uv package manager
+        uses: astral-sh/setup-uv@v10.0.1
+
+      - name: Install QEMU
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends qemu-system-x86 cloud-image-utils
+
+      - name: Let this user reach /dev/kvm
+        run: |
+          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' \
+            | sudo tee /etc/udev/rules.d/99-kvm4all.rules
+          sudo udevadm control --reload-rules
+          sudo udevadm trigger --name-match=kvm
+
+      - name: Cache the guest image
+        uses: actions/cache@v4
+        with:
+          # The images only, not the keys and overlays a run creates next to them.
+          path: ~/.cache/cgroups-sensor-guest
+          key: guest-images-${{ hashFiles('tests/e2e/scripts/guest.sh') }}
+
+      - name: Run the e2e suite inside the guest
+        env:
+          GUEST_PROFILE: ${{ matrix.profile }}
+        run: ./tests/e2e/scripts/guest.sh

.gitignore

@@ -215,4 +215,6 @@ marimo/_lsp/
 __marimo__/
 
 # Streamlit
-.streamlit/secrets.toml
+.streamlit/secrets.toml
+# Analysis material: the bench that validated the implementation, kept out of the module.
+analysis/

CHANGELOG.md

@@ -0,0 +1,5 @@
+# Changelog
+
+## [Unreleased]
+
+Nothing is released yet.

LICENSE

@@ -186,7 +186,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright [yyyy] [name of copyright owner]
+   Copyright 2026 Apify Technologies s.r.o.
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.