Never let the harness fall into a password prompt #4
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Resource limit sensors | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - 'claude/**' | |
| pull_request: | |
| workflow_dispatch: | |
| jobs: | |
| limits: | |
| # A GitHub-hosted Ubuntu runner is a full VM: systemd is PID 1 and the | |
| # unified cgroup hierarchy is mounted, so transient scopes really do apply | |
| # limits here. Both are asserted in the preflight step below. | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.12' | |
| - name: Install dependencies | |
| run: pip install -r requirements-dev.txt | |
| - name: Preflight - the runner can impose the limits under test | |
| run: | | |
| set -euo pipefail | |
| echo "::group::versions" | |
| systemd-run --version | head -1 | |
| python --version | |
| nproc | |
| free -m | |
| echo "::endgroup::" | |
| filesystem="$(stat -fc %T /sys/fs/cgroup)" | |
| echo "cgroup filesystem: $filesystem" | |
| if [ "$filesystem" != "cgroup2fs" ]; then | |
| echo "::error::cgroup v2 is not mounted; the memory and CPU limits under test cannot be applied" | |
| exit 1 | |
| fi | |
| echo "controllers: $(cat /sys/fs/cgroup/cgroup.controllers)" | |
| # Prove the harness can actually create a scope that applies limits, | |
| # by the same launcher selection the tests use. Exits nonzero if not. | |
| python tests/limited_run.py | |
| - name: Report the limits for the examples from the request | |
| continue-on-error: true | |
| run: | | |
| # Informational: the exact shell forms the sensor has to understand. | |
| # Both must report 90 MiB, once from the cgroup and once from ulimit. | |
| PYTHON="$(which python)" | |
| for example in "102400 90M" "92160 100M"; do | |
| set -- $example | |
| echo "::group::(ulimit -v $1; systemd-run --scope -p MemoryMax=$2 -p MemorySwapMax=0 python3 tests/report_limits.py)" | |
| ( ulimit -v "$1" | |
| sudo -n systemd-run --scope --quiet -p "MemoryMax=$2" -p MemorySwapMax=0 -- \ | |
| "$PYTHON" tests/report_limits.py ) | python -m json.tool | |
| echo "::endgroup::" | |
| done | |
| - name: Run the resource limit tests | |
| env: | |
| # Never let "cannot impose limits here" turn into a silent skip. | |
| CGROUPS_SENSOR_REQUIRE_LIMITS: '1' | |
| run: python -m pytest -v |