fix(infra): cap observability containers' memory to protect the e2e browser (refs #123 )

verify-e2e (registration.spec) timed out on the shared CI runner — locator waits failing at different steps across attempt/retry, the signature of memory contention, not a logic bug (this e2e has an OOM history, d5e5fa2). The three observability containers had no memory bound; cap them (tempo/prometheus 400m, grafana 512m — generous vs idle) so they can't starve the app stack + the Playwright chromium. Frees back more headroom than the OTel SDK added. refs #123
docs: demo note + backlog tick for distributed tracing (refs #123 )
2026-07-23 15:31:52 +02:00 · 2026-07-23 14:37:50 +02:00 · 2026-07-23 14:35:47 +02:00 · 2026-07-23 14:30:59 +02:00
1 changed files with 4 additions and 18 deletions
@@ -9,12 +9,6 @@ on:
 permissions:
  contents: read

-# Supersede stale runs: a new push to the same branch/PR cancels the previous run, so the runner's
-# concurrency slots aren't spent on commits nobody is waiting for (refs #127).
-concurrency:
-  group: ci-${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 # Self-hosted runner — see docs/runbooks/ci.md for the runner setup.
 # `uses:` are absolute, tag-pinned URLs (CLAUDE.md §8.7 / §15).

@@ -135,20 +129,12 @@ jobs:
          path: services/bff/StrykerOutput/**/reports/mutation-report.html
          if-no-files-found: warn

-  # One stage for every check that needs the live stack. Booting OpenZaak once (instead
-  # of once per job) is the cheapest layout (issue #58). No setup-dotnet: the ACL test runs
-  # in a built image and everything reaches services by container IP. Needs Docker + egress
+  # One stage for every check that needs the live stack. On the single self-hosted
+  # runner jobs run sequentially, so booting OpenZaak once (instead of once per job)
+  # is the cheapest layout (issue #58). No setup-dotnet: the ACL test runs in a built
+  # image and everything reaches services by container IP. Needs Docker + egress
  # (base images, nuget, selectielijst.openzaak.nl).
-  #
-  # `needs: [mutation]` is NOT a data dependency — it serialises the two memory-heavy jobs so
-  # they never co-schedule now the runner has capacity >1. A concurrent Stryker run + full-stack
-  # bring-up + Playwright browser on one host is what OOMs the e2e (commit d5e5fa2, #126). The
-  # light .NET/frontend jobs have no `needs`, so they still parallelise up to runner capacity.
-  # `if: !cancelled()` keeps verify-stack running even when the mutation ratchet fails (so we don't
-  # lose its signal) while still honouring run cancellation from the concurrency group above.
  verify-stack:
-    needs: [mutation]
-    if: ${{ !cancelled() }}
    runs-on: ubuntu-latest
    steps:
      - uses: https://github.com/actions/checkout@v4
Author	SHA1	Message	Date
not	4ab2ef4285	fix(infra): cap observability containers' memory to protect the e2e browser (refs #123 ) CI / frontend (pull_request) Successful in 2m55s Details CI / mutation (pull_request) Successful in 6m17s Details CI / verify-stack (pull_request) Successful in 5m31s Details CI / lint (pull_request) Successful in 1m28s Details CI / build (pull_request) Successful in 1m19s Details CI / unit (pull_request) Successful in 1m21s Details verify-e2e (registration.spec) timed out on the shared CI runner — locator waits failing at different steps across attempt/retry, the signature of memory contention, not a logic bug (this e2e has an OOM history, `d5e5fa2`). The three observability containers had no memory bound; cap them (tempo/prometheus 400m, grafana 512m — generous vs idle) so they can't starve the app stack + the Playwright chromium. Frees back more headroom than the OTel SDK added. refs #123	2026-07-23 15:31:52 +02:00
not	8474b72bf4	docs: demo note + backlog tick for distributed tracing (refs #123 ) CI / lint (pull_request) Successful in 4m29s Details CI / build (pull_request) Successful in 59s Details CI / unit (pull_request) Successful in 1m16s Details CI / frontend (pull_request) Successful in 2m36s Details CI / mutation (pull_request) Successful in 6m6s Details CI / verify-stack (pull_request) Failing after 13m54s Details refs #123	2026-07-23 14:37:50 +02:00
not	271c54197e	feat(obs): OpenTelemetry distributed tracing across the five .NET services (refs #123 ) Each host adds AddOpenTelemetry().WithTracing with ASP.NET Core + HttpClient auto-instrumentation and an OTLP exporter to Tempo; service name + endpoint from OTEL_* env set per app service in compose. Since every cross-service call goes through a typed HttpClient, traceparent propagates for free, so a request is one connected trace (bff → domain/projection → acl → openzaak). /health is filtered out. The exporter no-ops harmlessly when Tempo is unreachable (verified: domain boots healthy with no collector). refs #123	2026-07-23 14:35:47 +02:00
not	b32c352f20	test(infra): verify-tracing asserts one connected trace across services in Tempo (refs #123 ) Generates anonymous BFF→projection-api traffic and asserts Tempo holds a single trace containing both service.names — proving OTLP export plus traceparent propagation across the HttpClient hop. Fails until the services are instrumented (next commit). Runs in-network like the other verify checks. refs #123	2026-07-23 14:30:59 +02:00