fix(crates-sync): reap git zombie processes and harden worker loop

.dockerignore

@@ -14,10 +14,12 @@ tools/**
 docs
 
 # Exclude scripts by default (large / unused in most images), but keep the
-# paths required by scripts/init_mega/Dockerfile (mega-init image).
+# paths required by scripts/init_mega and scripts/mono-reset Dockerfiles.
 scripts/*
 !scripts/init_mega/
 !scripts/init_mega/**
+!scripts/mono-reset/
+!scripts/mono-reset/**
 !scripts/import-buck2-deps/
 !scripts/import-buck2-deps/**
 

.github/workflows/mono-reset-deploy.yml

@@ -0,0 +1,54 @@
+name: Mono Reset deploy
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/mono-reset-deploy.yml"
+      - "scripts/mono-reset/**"
+      - "scripts/init_mega/**"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  REPOSITORY: mega/mono-reset
+  IMAGE_TAG: latest
+  HARBOR_REGISTRY: registry.xuanwu.openatom.cn
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.HARBOR_REGISTRY }}
+          username: ${{ secrets.HARBOR_USERNAME }}
+          password: ${{ secrets.HARBOR_PASSWORD }}
+
+      - name: Build, tag, and push docker image to Harbor
+        run: |
+          set -euo pipefail
+
+          HARBOR_IMAGE_BASE="${{ env.HARBOR_REGISTRY }}/${{ env.REPOSITORY }}"
+          IMAGE_TAG="${{ env.IMAGE_TAG }}"
+          SHORT_SHA="${GITHUB_SHA:0:7}"
+
+          docker build \
+            -f scripts/mono-reset/Dockerfile \
+            -t "$HARBOR_IMAGE_BASE:$IMAGE_TAG" \
+            -t "$HARBOR_IMAGE_BASE:$SHORT_SHA" \
+            .
+
+          docker push "$HARBOR_IMAGE_BASE:$IMAGE_TAG"
+          docker push "$HARBOR_IMAGE_BASE:$SHORT_SHA"

.github/workflows/release.yml

@@ -35,6 +35,10 @@ jobs:
             context: scripts/crates-sync
             dockerfile: scripts/crates-sync/Dockerfile
 
+          - name: mono-reset
+            context: .
+            dockerfile: scripts/mono-reset/Dockerfile
+
     steps:
       - name: Checkout
         uses: actions/checkout@v4

ceres/src/transport/pack/import_repo.rs

@@ -448,9 +448,7 @@ impl RepoHandler for ImportRepo {
                 .expect("command_list lock poisoned");
             cmds.iter()
                 .find(|c| {
-                    c.ref_type == RefTypeEnum::Branch
-                        && c.status == "ok"
-                        && c.new_id != ZERO_ID
+                    c.ref_type == RefTypeEnum::Branch && c.status == "ok" && c.new_id != ZERO_ID
                 })
                 .map(|c| c.new_id.clone())
         };

ceres/src/transport/pack/monorepo.rs

@@ -85,14 +85,11 @@ impl RepoHandler for MonoRepo {
         // Tip metadata was captured at handler construction, before the
         // protocol layer rejected commands (deletions, missing targets); keep
         // it pointing at surviving work so finalize events stay valid.
-        if let Some(command) = commands
-            .iter()
-            .find(|x| {
-                x.ref_type == RefTypeEnum::Branch
-                    && x.command_type != CommandType::Delete
-                    && x.status == "ok"
-            })
-        {
+        if let Some(command) = commands.iter().find(|x| {
+            x.ref_type == RefTypeEnum::Branch
+                && x.command_type != CommandType::Delete
+                && x.status == "ok"
+        }) {
             let mut tip = self.tip.lock().expect("branch tip lock poisoned");
             tip.from_hash = command.old_id.clone();
             tip.to_hash = command.new_id.clone();

ceres/src/transport/protocol/mod.rs

@@ -19,7 +19,9 @@ use tokio::sync::RwLock;
 use crate::{
     bus::TransportRuntime,
     transport::pack::{
-        RepoHandler, import_repo::ImportRepo, monorepo::{BranchTip, MonoRepo},
+        RepoHandler,
+        import_repo::ImportRepo,
+        monorepo::{BranchTip, MonoRepo},
     },
 };
 
@@ -252,7 +254,9 @@ impl SmartSession {
             // deletion itself is rejected and other updates land.
             let tip = commands
                 .iter()
-                .find(|x| x.ref_type == RefTypeEnum::Branch && x.command_type != CommandType::Delete)
+                .find(|x| {
+                    x.ref_type == RefTypeEnum::Branch && x.command_type != CommandType::Delete
+                })
                 .map(|command| BranchTip {
                     base_branch: command
                         .ref_name

jupiter/src/storage/git_db_storage.rs

@@ -548,7 +548,8 @@ impl GitDbStorage {
     }
 
     /// Find single tag by repo id and tag name
-    pub async fn get_tag_by_repo_and_name(        &self,
+    pub async fn get_tag_by_repo_and_name(
+        &self,
         repo_id: i64,
         name: &str,
     ) -> Result<Option<git_tag::Model>, MegaError> {

scripts/crates-sync/Dockerfile

@@ -14,6 +14,7 @@ RUN sed -i 's|http://deb.debian.org|https://deb.debian.org|g' /etc/apt/sources.l
     && apt-get -o Acquire::https::Verify-Peer=false -o Acquire::https::Verify-Host=false install -y --no-install-recommends \
         ca-certificates \
         git \
+        tini \
     && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app
@@ -24,4 +25,8 @@ ENV PYTHONUNBUFFERED=1
 # Build context must be the scripts/crates-sync directory (this folder).
 COPY . scripts/crates-sync/
 
-ENTRYPOINT ["python3", "-u", "scripts/crates-sync/run_job.py"]
+# tini as PID 1: every git HTTP op leaves an orphaned `git remote-http` shim
+# behind; a Python PID 1 never reaps adopted orphans, so they accumulate as
+# zombies until the pod hits its pids cgroup limit and all forks fail (EAGAIN),
+# which surfaces as mass "push rejected" errors. tini reaps them (-g: group-wide).
+ENTRYPOINT ["tini", "-g", "--", "python3", "-u", "scripts/crates-sync/run_job.py"]