fix: 为 Gitea 同步进程启用子进程回收

config/platform-infra/gitea.yaml

@@ -126,6 +126,9 @@ sourceAuthority:
       secretName: gitea-github-sync-secrets
       configMapName: gitea-github-sync-config
       image: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
+      initCommand:
+        - /usr/bin/tini
+        - --
       replicas: 1
       httpPort: 8080
       serviceAccountName: gitea-github-sync

scripts/src/platform-infra-gitea-config.test.ts

@@ -136,6 +136,16 @@ describe("platform-infra Gitea repository GitHub credentials", () => {
     expect(nc01Manifest).toContain(`"tokenEnv": "${selfmediaTokenEnv}"`);
   });
 
+  test("runs the GitHub sync bridge and candidate under the YAML-declared init reaper", () => {
+    const config = readGiteaConfig();
+    const target = resolveTarget(config, "NC01");
+    const manifest = renderManifest(config, target);
+
+    expect(config.sourceAuthority.webhookSync.bridge.initCommand).toEqual(["/usr/bin/tini", "--"]);
+    expect(manifest).toContain('command:\n            - "/usr/bin/tini"\n            - "--"\n            - node\n            - /etc/gitea-github-sync/entrypoint.mjs');
+    expect(manifest).toContain('command:\n            - "/usr/bin/tini"\n            - "--"\n            - /bin/sh\n            - -eu');
+  });
+
   test("keeps missing selfmedia webhook status bounded and stack-free", () => {
     const payload = syntheticBlockedResult();
     const credentials = payload.credentials as Array<Record<string, unknown>>;

scripts/src/platform-infra-gitea-config.ts

@@ -230,6 +230,7 @@ export interface GiteaWebhookSync {
     secretName: string;
     configMapName: string;
     image: string;
+    initCommand: string[];
     replicas: number;
     httpPort: number;
     serviceAccountName: string;
@@ -554,6 +555,7 @@ function parseWebhookSync(record: Record<string, unknown>, path: string): GiteaW
       secretName: y.kubernetesNameField(bridge, "secretName", `${path}.bridge`),
       configMapName: y.kubernetesNameField(bridge, "configMapName", `${path}.bridge`),
       image: y.stringField(bridge, "image", `${path}.bridge`),
+      initCommand: y.stringArrayField(bridge, "initCommand", `${path}.bridge`),
       replicas: positiveInteger(bridge, "replicas", `${path}.bridge`),
       httpPort: y.portField(bridge, "httpPort", `${path}.bridge`),
       serviceAccountName: y.kubernetesNameField(bridge, "serviceAccountName", `${path}.bridge`),

scripts/src/platform-infra-gitea.ts

@@ -745,6 +745,7 @@ function renderGithubSyncManifest(gitea: GiteaConfig, target: GiteaTarget): stri
   const reposJson = JSON.stringify(repositoriesForTarget(gitea, target).map(remoteRepoSpec), null, 2);
   const serverSource = readFileSync(githubSyncServerFile, "utf8");
   const entrypointSource = readFileSync(githubSyncEntrypointFile, "utf8");
+  const bridgeInitCommand = sync.bridge.initCommand.map((argument) => `            - ${yamlQuote(argument)}`).join("\n");
   const ownsHookReconcile = sync.hookReconcile.enabled && sync.hookReconcile.ownerTargetId.toLowerCase() === target.id.toLowerCase();
   const hookTopologyJson = ownsHookReconcile ? JSON.stringify(githubHookTopology(gitea), null, 2) : "";
   const hookReconcilerSource = ownsHookReconcile ? readFileSync(githubHookReconcilerFile, "utf8") : "";
@@ -853,6 +854,7 @@ spec:
           image: ${sync.bridge.image}
           imagePullPolicy: IfNotPresent
           command:
+${bridgeInitCommand}
             - /bin/sh
             - -eu
             - -c
@@ -1041,6 +1043,7 @@ spec:
           image: ${sync.bridge.image}
           imagePullPolicy: IfNotPresent
           command:
+${bridgeInitCommand}
             - node
             - /etc/gitea-github-sync/entrypoint.mjs
           ports: