From 0bbb3c88bf38552a25593e1a4fa489bcac8f2c13 Mon Sep 17 00:00:00 2001
From: pikastech <liang6516@outlook.com>
Date: Wed, 22 Jul 2026 09:02:03 +0200
Subject: [PATCH] fix: constrain Gitea Go memory

---
 config/platform-infra/gitea.yaml           |  2 ++
 scripts/src/platform-infra-gitea-config.ts | 15 +++++++++++++++
 scripts/src/platform-infra-gitea.ts        |  1 +
 3 files changed, 18 insertions(+)

diff --git a/config/platform-infra/gitea.yaml b/config/platform-infra/gitea.yaml
index 6f22cc00..22faf116 100644
--- a/config/platform-infra/gitea.yaml
+++ b/config/platform-infra/gitea.yaml
@@ -801,6 +801,8 @@ app:
     runAsUser: 1000
     runAsGroup: 1000
     fsGroup: 1000
+  runtime:
+    goMemoryLimit: 512MiB
   resources:
     requests:
       cpu: 100m
diff --git a/scripts/src/platform-infra-gitea-config.ts b/scripts/src/platform-infra-gitea-config.ts
index c3c2d938..446b492e 100644
--- a/scripts/src/platform-infra-gitea-config.ts
+++ b/scripts/src/platform-infra-gitea-config.ts
@@ -138,6 +138,9 @@ export interface GiteaConfig {
       runAsGroup: number;
       fsGroup: number;
     };
+    runtime: {
+      goMemoryLimit: string;
+    };
     resources: {
       requests: { cpu: string; memory: string };
       limits: { cpu: string; memory: string };
@@ -357,6 +360,7 @@ export function readGiteaConfig(): GiteaConfig {
   const configStorage = y.objectField(storage, "config", "app.storage");
   const publicExposure = y.objectField(app, "publicExposure", "app");
   const securityContext = y.objectField(app, "securityContext", "app");
+  const runtime = y.objectField(app, "runtime", "app");
   const resources = y.objectField(app, "resources", "app");
   const requests = y.objectField(resources, "requests", "app.resources");
   const limits = y.objectField(resources, "limits", "app.resources");
@@ -447,6 +451,9 @@ export function readGiteaConfig(): GiteaConfig {
         runAsGroup: positiveInteger(securityContext, "runAsGroup", "app.securityContext"),
         fsGroup: positiveInteger(securityContext, "fsGroup", "app.securityContext"),
       },
+      runtime: {
+        goMemoryLimit: goMemoryLimit(runtime, "goMemoryLimit", "app.runtime"),
+      },
       resources: {
         requests: { cpu: y.stringField(requests, "cpu", "app.resources.requests"), memory: quantity(requests, "memory", "app.resources.requests") },
         limits: { cpu: y.stringField(limits, "cpu", "app.resources.limits"), memory: quantity(limits, "memory", "app.resources.limits") },
@@ -468,6 +475,14 @@ export function readGiteaConfig(): GiteaConfig {
   return parsed;
 }
 
+function goMemoryLimit(record: Record<string, unknown>, key: string, path: string): string {
+  const value = y.stringField(record, key, path);
+  if (!/^[1-9][0-9]*(?:KiB|MiB|GiB)$/u.test(value)) {
+    throw new Error(`${configLabel}.${path}.${key} must use a positive KiB, MiB, or GiB value`);
+  }
+  return value;
+}
+
 function parseAdminCredential(record: Record<string, unknown>, path: string): GiteaAdminCredential {
   return {
     sourceRef: secretSourceRefField(record, "sourceRef", path),
diff --git a/scripts/src/platform-infra-gitea.ts b/scripts/src/platform-infra-gitea.ts
index 2f875216..b82bebec 100644
--- a/scripts/src/platform-infra-gitea.ts
+++ b/scripts/src/platform-infra-gitea.ts
@@ -1257,6 +1257,7 @@ function envVars(gitea: GiteaConfig, target: GiteaTarget): string {
     GITEA__webhook__ALLOWED_HOST_LIST: app.webhook.allowedHostList,
     GITEA__service__DISABLE_REGISTRATION: app.registration.disabled ? "true" : "false",
     GITEA__log__LEVEL: "Info",
+    GOMEMLIMIT: app.runtime.goMemoryLimit,
     UNIDESK_GITEA_TARGET: target.id,
   };
   return Object.entries(values).map(([name, value]) => `            - name: ${name}