Fix publication process cleanup and remove arbitrary site-size limits

ClaudiuSchuster commented

2026-10-15 20:45:11 +00:00

Owner

Publication helper calls now release their pipe readers on terminal failure, including when descendant processes keep output pipes open. Deterministic regressions cover timeout, interruption and overflow while preserving normal output collection.

Site validation keeps HTML and transfer measurements while allowing valid pages to grow. The repository CI removes its fixed job/step deadlines, and the documentation and size-policy regression fixtures follow the same policy. Content, asset-inventory and security checks remain in place.

Validation: both component branches passed independent review; a fresh composition review confirmed the exact nine-file union and matching component blobs. Combined repository checks passed, including 56 closure tests in normal and optimized Python, 8 size-policy tests in both modes, 20 identity tests in both modes, release-artifact checks and workflow parsing. Real Forgejo CI is required before merge. This source change does not itself replace the installed publication helper or publish a new site.

Publication helper calls now release their pipe readers on terminal failure, including when descendant processes keep output pipes open. Deterministic regressions cover timeout, interruption and overflow while preserving normal output collection. Site validation keeps HTML and transfer measurements while allowing valid pages to grow. The repository CI removes its fixed job/step deadlines, and the documentation and size-policy regression fixtures follow the same policy. Content, asset-inventory and security checks remain in place. Validation: both component branches passed independent review; a fresh composition review confirmed the exact nine-file union and matching component blobs. Combined repository checks passed, including 56 closure tests in normal and optimized Python, 8 size-policy tests in both modes, 20 identity tests in both modes, release-artifact checks and workflow parsing. Real Forgejo CI is required before merge. This source change does not itself replace the installed publication helper or publish a new site.

ClaudiuSchuster added 6 commits

2026-10-15 20:45:11 +00:00

feat(closure): transplant bounded parent-side output capture from PR18 0795224b44

Reapply the PR18 change verbatim (byte-identical, sha256-verified):
replace the podman-attach child-side RLIMIT_FSIZE preexec_fn with a
parent-side bounded_run() that drains stdout/stderr through reader
threads under one combined budget, so rootless podman no longer
propagates the transcript bound into untrusted in-container processes.
Fail-closed semantics preserved: overflow, capture failure, or timeout
kill and fully reap the client before raising.

fix(closure): collect children and bound joins on all bounded_run exit paths d065248df9

fix(closure): release drain readers on terminal signal under sustained capture readiness ba418f6a4a

fix(site): replace arbitrary size/CI cutoffs with reporting and platform defaults 8a5a21d7ad

docs(faq): reconcile size budget sentence with size-reporting checks 47bc252bab

test(site): robust size-policy suite against any valid page sizes; drop stale image cap

Repository checks / repository-baseline (pull_request) Failing after 16m17s

Details Explain this check

45872081b5

ClaudiuSchuster added 1 commit

2026-10-15 21:57:06 +00:00

test(closure): zombie-aware descendant liveness for CI container reaping

Repository checks / repository-baseline (pull_request) Successful in 23m56s