From 4e8594263fe17aad3e3dcd05bfcad3b3c3904657 Mon Sep 17 00:00:00 2001 From: "Claude Opus 4.8" Date: Fri, 10 Jul 2026 14:44:46 +0200 Subject: [PATCH] Clean up fidelity sidecars so they never leak on the runner (#69) The fidelity gate starts pandoc + Gotenberg via `docker run` on the shared act_runner host but never removed them: a leaked (Chromium-backed) Gotenberg container wasted memory until the next run and broke re-runs on the container name. Pre-clean before starting, tear down with `if: always()`, and add a 10-minute job timeout so a hung sidecar can't linger. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1 --- .gitea/workflows/ci.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index 6f77196..6b18f96 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -346,6 +346,9 @@ jobs: fidelity: name: Import/export fidelity gate runs-on: ubuntu-latest + # A guard so a hung sidecar can never keep the job (and its containers) + # alive on the shared runner host; the suite itself finishes in ~1 min. + timeout-minutes: 10 steps: - name: Check out repository uses: actions/checkout@v4 @@ -380,6 +383,9 @@ jobs: # ports avoid colliding with anything else on the runner. - name: Start pinned pandoc + Gotenberg sidecars run: | + # Clear any leftovers from an earlier interrupted run so the named + # containers never collide, and nothing leaks on the shared host. + docker rm -f fidelity-pandoc fidelity-gotenberg 2>/dev/null || true docker run -d --name fidelity-pandoc -p 13030:3030 pandoc/core:3.6 server docker run -d --name fidelity-gotenberg -p 13000:3000 gotenberg/gotenberg:8 GW=$(ip -4 route show default | awk '{print $3; exit}') @@ -410,6 +416,13 @@ jobs: echo '--- pandoc ---'; docker logs fidelity-pandoc 2>&1 | tail -30 || true echo '--- gotenberg ---'; docker logs fidelity-gotenberg 2>&1 | tail -30 || true + # Always tear the sidecars down — they run on the shared runner host, so a + # leaked (especially Chromium-backed Gotenberg) container would waste its + # memory until the next run and break re-runs on the container name. + - name: Stop sidecars + if: always() + run: docker rm -f fidelity-pandoc fidelity-gotenberg 2>/dev/null || true + images: name: Build container images # PR-only: on main the CD workflow builds and pushes the same images —