Denozordec
eb48c83c7e
nightly-perf.yaml (push) Invalid workflow file
quality / changes (push) Successful in 7s
quality / commitlint (push) Skipped
quality / docker-check (push) Canceled after 0s
quality / api (push) Canceled after 0s
quality / web (push) Canceled after 25s
CD / quality (push) Canceled after 34s
CD / publish (push) Skipped
50 lines
2.8 KiB
YAML
50 lines
2.8 KiB
YAML
# Ночной нагрузочный smoke: образ под лимитами compose + autocannon + бюджеты p99/RPS/RSS.
|
|
name: nightly-perf
|
|
|
|
on:
|
|
schedule:
|
|
- cron: "0 3 * * *"
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
load:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
steps:
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
- uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
|
|
- id: setup
|
|
uses: ./.gitea/actions/setup-pnpm
|
|
- name: Build image
|
|
working-directory: deploy/docker
|
|
env:
|
|
BUILDX_BAKE_ENTITLEMENTS_FS: "0"
|
|
BUILDX_BAKE_FILE_RELATIVE_PATHS: "1"
|
|
run: |
|
|
set -euxo pipefail
|
|
docker buildx bake --allow=fs.read="${{ github.workspace }}" -f docker-bake.hcl --set 'authportal.output=type=docker' --set 'authportal.tags=authportal:load' authportal
|
|
- name: Run container with production limits
|
|
run: |
|
|
set -euxo pipefail
|
|
docker volume create load-data
|
|
docker run --rm -v load-data:/data --user root --entrypoint sh authportal:load -c 'chown 1000:1000 /data'
|
|
docker run -d --name authportal-load --init --memory 256m --memory-swap 256m --cpus 1.0 --read-only --tmpfs /tmp --cap-drop ALL -v load-data:/data -e JWT_SECRET=load-jwt-secret-0123456789 -e ADMIN_PASSWORD=load-admin-pass-1 -e [email protected] -e ISSUER=http://127.0.0.1:8080 -e RATE_LIMIT_MAX=1000000 authportal:load
|
|
for i in $(seq 1 40); do docker exec authportal-load wget -q -O /dev/null http://127.0.0.1:8080/ready && break; sleep 0.5; done
|
|
# Раннер сам в контейнере: нагрузку гоним из соседнего контейнера в сетевом namespace приложения.
|
|
- name: Load test (autocannon в namespace приложения)
|
|
run: |
|
|
set -euxo pipefail
|
|
docker run --rm -i --network container:authportal-load -e LOAD_PASSWORD=load-admin-pass-1 -e LOAD_DURATION_S=15 node:22-alpine sh -c 'mkdir /w && cd /w && npm i --silent --no-audit --no-fund [email protected] && cat > load.mjs && node load.mjs http://127.0.0.1:8080' < scripts/perf/load.mjs
|
|
- name: RSS после нагрузки
|
|
run: |
|
|
set -euxo pipefail
|
|
rss=$(docker stats --no-stream --format '{{.MemUsage}}' authportal-load | sed -E 's/^([0-9.]+)([KMG]i?B).*/ /' | awk '{u=$2; v=$1; if(u ~ /^G/) v*=1024; else if(u ~ /^K/) v/=1024; printf "%d", v}')
|
|
echo "RSS: ${rss} MiB (budget 200)"
|
|
[ "$rss" -le 200 ]
|
|
- name: Container logs on failure
|
|
if: failure()
|
|
run: docker logs --tail 100 authportal-load || true
|