fix: constrain Gitea Go memory

config/platform-infra/gitea.yaml

@@ -801,6 +801,8 @@ app:
     runAsUser: 1000
     runAsGroup: 1000
     fsGroup: 1000
+  runtime:
+    goMemoryLimit: 512MiB
   resources:
     requests:
       cpu: 100m

scripts/src/platform-infra-gitea-config.ts

@@ -138,6 +138,9 @@ export interface GiteaConfig {
       runAsGroup: number;
       fsGroup: number;
     };
+    runtime: {
+      goMemoryLimit: string;
+    };
     resources: {
       requests: { cpu: string; memory: string };
       limits: { cpu: string; memory: string };
@@ -357,6 +360,7 @@ export function readGiteaConfig(): GiteaConfig {
   const configStorage = y.objectField(storage, "config", "app.storage");
   const publicExposure = y.objectField(app, "publicExposure", "app");
   const securityContext = y.objectField(app, "securityContext", "app");
+  const runtime = y.objectField(app, "runtime", "app");
   const resources = y.objectField(app, "resources", "app");
   const requests = y.objectField(resources, "requests", "app.resources");
   const limits = y.objectField(resources, "limits", "app.resources");
@@ -447,6 +451,9 @@ export function readGiteaConfig(): GiteaConfig {
         runAsGroup: positiveInteger(securityContext, "runAsGroup", "app.securityContext"),
         fsGroup: positiveInteger(securityContext, "fsGroup", "app.securityContext"),
       },
+      runtime: {
+        goMemoryLimit: goMemoryLimit(runtime, "goMemoryLimit", "app.runtime"),
+      },
       resources: {
         requests: { cpu: y.stringField(requests, "cpu", "app.resources.requests"), memory: quantity(requests, "memory", "app.resources.requests") },
         limits: { cpu: y.stringField(limits, "cpu", "app.resources.limits"), memory: quantity(limits, "memory", "app.resources.limits") },
@@ -468,6 +475,14 @@ export function readGiteaConfig(): GiteaConfig {
   return parsed;
 }
 
+function goMemoryLimit(record: Record<string, unknown>, key: string, path: string): string {
+  const value = y.stringField(record, key, path);
+  if (!/^[1-9][0-9]*(?:KiB|MiB|GiB)$/u.test(value)) {
+    throw new Error(`${configLabel}.${path}.${key} must use a positive KiB, MiB, or GiB value`);
+  }
+  return value;
+}
+
 function parseAdminCredential(record: Record<string, unknown>, path: string): GiteaAdminCredential {
   return {
     sourceRef: secretSourceRefField(record, "sourceRef", path),

scripts/src/platform-infra-gitea.ts

@@ -1257,6 +1257,7 @@ function envVars(gitea: GiteaConfig, target: GiteaTarget): string {
     GITEA__webhook__ALLOWED_HOST_LIST: app.webhook.allowedHostList,
     GITEA__service__DISABLE_REGISTRATION: app.registration.disabled ? "true" : "false",
     GITEA__log__LEVEL: "Info",
+    GOMEMLIMIT: app.runtime.goMemoryLimit,
     UNIDESK_GITEA_TARGET: target.id,
   };
   return Object.entries(values).map(([name, value]) => `            - name: ${name}