From 56b5ae675f1effb748c16509510011a666e1afff Mon Sep 17 00:00:00 2001 From: gopal tathe <44522021+techgopal@users.noreply.github.com> Date: Sun, 15 Nov 2026 07:45:47 +0100 Subject: [PATCH 1/2] ci: the test, wheels and generated jobs free runner disk; the test build drops debug info The `test` job runs out of disk on most open PRs. It already frees about 32 GB and builds with line tables, but on 2026-11-15 it started with 119 GB free and ended at 84 MB (#746, #756: the runner crashes with "No space left on device" and keeps no log), or ld died with SIGBUS while linking krishiv-server's tests (#772). - New composite action `.github/actions/free-disk`: the cleanup list the test, coverage and nightly jobs already used, plus removal of the preinstalled container images (as #768 did for diff-coverage), with `df -h /` before and after. - `test`: uses it; builds with `CARGO_PROFILE_DEV_DEBUG` and `CARGO_PROFILE_TEST_DEBUG` set to `false` (backtraces keep function names, lose line numbers; no test reads DWARF); removes the workspace run's test executables after the doctests, before the four feature-specific runs build their own; prints `df` and the size of `target` there and at the end. - `wheels` (both legs): uses the action; prints `df` at the end. - `generated` (docs-site.yml): uses the action, builds without debug info, prints `df` at the end. `diff-coverage` is unchanged: since #768 its runs end at 73-78% of the disk (#751, #772), and those two now fail the 90% added-line gate itself. Signed-off-by: gopal tathe <44522021+techgopal@users.noreply.github.com> --- .github/actions/free-disk/action.yml | 26 +++++++++++++++++++ .github/workflows/ci.yml | 38 ++++++++++++++++++---------- .github/workflows/docs-site.yml | 9 +++++++ 3 files changed, 59 insertions(+), 14 deletions(-) create mode 100644 .github/actions/free-disk/action.yml diff --git a/.github/actions/free-disk/action.yml b/.github/actions/free-disk/action.yml new file mode 100644 index 000000000..198f04701 --- /dev/null +++ b/.github/actions/free-disk/action.yml @@ -0,0 +1,26 @@ +name: Free runner disk +description: >- + Removes toolchains, SDKs and container images that the runner image ships and no Krishiv job uses (about 35 GB on + ubuntu-latest), printing `df -h /` before and after. Used by the jobs that build the whole workspace, whose + build outputs otherwise fill the 145 GB disk. +inputs: + prune-images: + description: Also remove the image's preinstalled container images (for jobs that run no containers). + default: "true" +runs: + using: composite + steps: + - name: Free runner disk + shell: bash + env: + PRUNE_IMAGES: ${{ inputs.prune-images }} + run: | + df -h / + sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc /usr/local/.ghcup /opt/hostedtoolcache/CodeQL \ + /usr/share/swift /usr/local/share/powershell /usr/local/share/chromium /usr/local/share/boost \ + /opt/microsoft /opt/az /usr/lib/google-cloud-sdk /usr/lib/mono /usr/local/julia* /usr/local/graalvm \ + /opt/hostedtoolcache/Java_* /opt/hostedtoolcache/Ruby /opt/hostedtoolcache/go /opt/hostedtoolcache/PyPy + if [ "$PRUNE_IMAGES" = true ] && command -v docker > /dev/null; then + sudo docker image prune --all --force > /dev/null || true + fi + df -h / diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d9018dd72..39887e699 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -252,11 +252,14 @@ jobs: needs: changes if: needs.changes.outputs.rust == 'true' runs-on: ubuntu-latest - # Debuginfo of the whole workspace test build does not fit the runner's disk next to the spill tests - # ("No space left on device" in the bench-runner spill tests, an ld Bus error in otlp_collector; merge-queue - # ejections 2026-11-07/08). Line tables keep panic backtraces and cost a fraction of the space. + # The whole workspace test build fills the runner's disk ("No space left on device" in the bench-runner spill + # tests, ld Bus errors; merge-queue ejections 2026-11-07/08). Line tables were not enough: on 2026-11-15 the job + # started with 119 GB free and ended with 84 MB (#746, #756) or with ld killed by SIGBUS (#772). So the test + # build carries no debug info (panic backtraces keep function names, not line numbers; no test reads DWARF), + # and the workspace run's test binaries are removed before the feature runs below build their own. env: - CARGO_PROFILE_DEV_DEBUG: line-tables-only + CARGO_PROFILE_DEV_DEBUG: "false" + CARGO_PROFILE_TEST_DEBUG: "false" steps: - name: Harden the runner (audit egress) uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 @@ -265,15 +268,8 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - # The runner image ships toolchains and images the build never uses; same list as the nightly jobs. - - name: Free runner disk - run: | - df -h / - sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc /usr/local/.ghcup /opt/hostedtoolcache/CodeQL \ - /usr/share/swift /usr/local/share/powershell /usr/local/share/chromium /usr/local/share/boost \ - /opt/microsoft /opt/az /usr/lib/google-cloud-sdk /usr/lib/mono /usr/local/julia* /usr/local/graalvm \ - /opt/hostedtoolcache/Java_* /opt/hostedtoolcache/Ruby /opt/hostedtoolcache/go /opt/hostedtoolcache/PyPy - df -h / + # The runner image ships toolchains and images the build never uses (the job runs no containers). + - uses: $/.github/actions/free-disk - uses: $/.github/actions/setup-rust with: toolchain: 1.99.1 @@ -305,6 +301,14 @@ jobs: KRISHIV_TEST_UDF_PYTHON: ${{ runner.temp }}/udf-python/bin/python KRISHIV_UDF_POOL_REQUIRED: "1" - run: cargo test --workspace --doc --locked + # The workspace run's test executables are not reused by the feature runs below (other features, other + # hashes); libraries and build-script outputs stay, so those runs still reuse what they can. + - name: Remove the workspace run's test binaries + run: | + df -h / + find target/debug/deps -maxdepth 1 -type f -perm -u+x ! -name '*.so' -delete + du -sh target 2> /dev/null || true + df -h / - run: cargo nextest run -p krishiv-session --features telemetry-otlp --test otlp_collector --locked # Server TLS (`tls`) and OIDC (`oidc`), both off by default: the in-memory rustls handshakes, # and the JWT verifier against keys generated per run. @@ -314,7 +318,9 @@ jobs: - run: cargo nextest run -p krishiv-cli --features server --test server --locked - name: Disk left if: always() - run: df -h / "$RUNNER_TEMP" + run: | + df -h / "$RUNNER_TEMP" + du -sh target target/debug/deps target/debug/build 2> /dev/null || true deny: needs: changes @@ -690,6 +696,7 @@ jobs: with: fetch-depth: ${{ github.event_name == 'pull_request' && 2 || 1 }} persist-credentials: false + - uses: $/.github/actions/free-disk - run: rustup show active-toolchain - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 - uses: $/.github/actions/setup-mold @@ -794,6 +801,9 @@ jobs: with: name: wheel-${{ matrix.name }} path: dist/*.whl + - name: Disk left + if: always() + run: df -h / # P2-T103: every wheel target (wheels.yml), on PRs that can change them and in the nightly run (nightly.yml calls # this workflow). Not in the merge queue, and a push to main only measures (main-measure.yml); `wheels-ok` passes. diff --git a/.github/workflows/docs-site.yml b/.github/workflows/docs-site.yml index ce036c112..3fa83e00c 100644 --- a/.github/workflows/docs-site.yml +++ b/.github/workflows/docs-site.yml @@ -75,6 +75,11 @@ jobs: generated: runs-on: ubuntu-latest timeout-minutes: 40 + # The generators and the rerun examples build much of the workspace; no debug info keeps that build off the + # runner's disk limit (their output does not depend on it). + env: + CARGO_PROFILE_DEV_DEBUG: "false" + CARGO_PROFILE_TEST_DEBUG: "false" steps: - name: Harden the runner (audit egress) uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 @@ -83,6 +88,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false + - uses: $/.github/actions/free-disk - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable with: toolchain: 1.99.1 @@ -96,3 +102,6 @@ jobs: cargo xtask docs-python --check cargo xtask docs-config "$RUNNER_TEMP/configuration.md" diff -u docs/reference/config/index.md "$RUNNER_TEMP/configuration.md" + - name: Disk left + if: always() + run: df -h / From cbaa5be710f3906104a5ed5d70674efe9945d1c7 Mon Sep 17 00:00:00 2001 From: gopal tathe <44522021+techgopal@users.noreply.github.com> Date: Sun, 15 Nov 2026 04:22:31 +0000 Subject: [PATCH 2/2] ci: repin dtolnay/rust-toolchain to the rewritten stable commit dtolnay/rust-toolchain's `stable` branch was rewritten on 2026-11-15 02:32 UTC. The pinned commit b725eda5 no longer has history in that repository, so zizmor's impostor-commit audit now fails on every PR that touches a workflow (#769, #774). Repin the four uses (setup-rust action, binaries, docs-site) to the current `stable` head 39008827. Its action.yml is byte-identical to the old pin's, so the steps behave the same. Signed-off-by: gopal tathe <44522021+techgopal@users.noreply.github.com> --- .github/actions/setup-rust/action.yml | 4 ++-- .github/workflows/binaries.yml | 2 +- .github/workflows/docs-site.yml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/actions/setup-rust/action.yml b/.github/actions/setup-rust/action.yml index fe34208a0..9aa3868af 100644 --- a/.github/actions/setup-rust/action.yml +++ b/.github/actions/setup-rust/action.yml @@ -13,7 +13,7 @@ runs: using: composite steps: - id: first - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable + uses: dtolnay/rust-toolchain@39008827e6b4319a349e9a42dfc90579dd25f1ca # stable continue-on-error: true with: toolchain: ${{ inputs.toolchain }} @@ -24,7 +24,7 @@ runs: run: sleep 20 - name: Retry the toolchain install if: steps.first.outcome == 'failure' - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable + uses: dtolnay/rust-toolchain@39008827e6b4319a349e9a42dfc90579dd25f1ca # stable with: toolchain: ${{ inputs.toolchain }} components: ${{ inputs.components }} diff --git a/.github/workflows/binaries.yml b/.github/workflows/binaries.yml index c06c57314..2b3b52eab 100644 --- a/.github/workflows/binaries.yml +++ b/.github/workflows/binaries.yml @@ -179,7 +179,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable + - uses: dtolnay/rust-toolchain@39008827e6b4319a349e9a42dfc90579dd25f1ca # stable - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: key: krishiv-macos-arm64 diff --git a/.github/workflows/docs-site.yml b/.github/workflows/docs-site.yml index 3fa83e00c..5a194c73f 100644 --- a/.github/workflows/docs-site.yml +++ b/.github/workflows/docs-site.yml @@ -89,7 +89,7 @@ jobs: with: persist-credentials: false - uses: $/.github/actions/free-disk - - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable + - uses: dtolnay/rust-toolchain@39008827e6b4319a349e9a42dfc90579dd25f1ca # stable with: toolchain: 1.99.1 - name: Pages match their generators, examples rerun