clawbot
55edebaea1
Some checks failed
check / check (push) Has been cancelled
fx defaults the stop timeout to 15s and the Dockerfile sets no STOPSIGNAL or grace override, so Docker's 10s default SIGKILLs the process five seconds before the bound can fire. Everything gated on it — including the "shutdown timed out, goroutines still running" error log that tells an operator a component is wedged — was unreachable in the image this repo produces. Set fx.StopTimeout to 5s: inside the grace with headroom for signal delivery and process exit. The option set moves into newApp() so a test can read (*fx.App).StopTimeout() back and pin it against drift; dropping the option makes that test report fx's 15s default. Lower the HTTP drain budget (server.ShutdownTimeout) from 5s to 3s. fx bounds the whole stop sequence and returns without running its remaining hooks once the stop context expires, so two equal values meant a drain that used its full budget exhausted the sequence budget at that instant and skipped every later hook — the delivery engine, the healthcheck, the webhook DB manager and the database close — in exactly the case where the drain mattered. The tail hooks are microsecond-scale in normal operation, so 2s of remaining budget is ample, and holding the total at 5s keeps a wide margin under Docker's 10s grace. This does not make the database close unconditional: the ArchiveSweeper and RetentionReaper hooks run before the server and can still consume the whole budget. Bound the Sentry flush by the remaining stop budget. The server's stop hook is not only the drain: cleanShutdown calls sentry.Flush after it, in the same hook, and sentry.Flush takes a bare duration and honours no context. With SENTRY_DSN set to an unreachable endpoint, a full-length drain plus a stalled 2s flush spent the whole 5s sequence budget by itself and the tail hooks — database close included — were skipped again, on a configuration the README documents. SentryFlushBudget now clamps the flush to what is left on the stop context less server.TailHookReserve, skipping it below 250ms rather than making a useless attempt, so a full-length drain drops Sentry events instead of the database close. TestStopTimeout_LeavesHeadroomForTailHooks now walks every drain length the hook can produce and asserts drain plus flush still leaves the 2s tail margin, so it covers the hook's real worst case rather than the drain alone; unbounding the flush fails it at a 1.01s drain. TestSentryFlushBudget covers the clamp directly. Also fix a latent coin flip in the shared stop-hook waiter. It selected on the drained channel against ctx.Done() with no preamble, and select picks uniformly among ready cases, so a component that drained against an already-expired context reported a timeout about half the time. Not reachable through fx, which re-checks ctx.Err() before each hook, but the helper is shared and a direct caller can reach it. waitDone now settles the drained case in a non-blocking preamble first; the test drives it over 1000 passes, so a restored coin flip cannot pass by luck. README records the real stop-hook order (ArchiveSweeper, RetentionReaper, server, delivery.Engine, healthcheck, WebhookDBManager, database close), the two timeouts and their relationship, why the Sentry flush is clamped rather than allowed its own fixed budget, and the container stop grace: that lowering the grace below the bound puts SIGKILL back in front of it, and that an expired stop context makes fx skip its remaining hooks, so a wedge in the first-stopped component means the database close never runs. The Package Layout tree gets its internal/lifecycle/ entry in the sorted position, dropping the out-of-order duplicate this branch rebased onto.
114 lines
2.7 KiB
Go
114 lines
2.7 KiB
Go
package lifecycle_test
|
|
|
|
import (
|
|
"context"
|
|
"log/slog"
|
|
"sync"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
"sneak.berlin/go/webhooker/internal/lifecycle"
|
|
)
|
|
|
|
// waitTimeout is the stop budget the timeout case gives a
|
|
// goroutine that never returns. The test's own patience is the
|
|
// go test deadline, so the only thing this value affects is how
|
|
// long the case takes.
|
|
const waitTimeout = 100 * time.Millisecond
|
|
|
|
func discardLogger() *slog.Logger {
|
|
return slog.New(slog.DiscardHandler)
|
|
}
|
|
|
|
func TestWaitForShutdown_DrainedGroup(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
var wg sync.WaitGroup
|
|
|
|
wg.Go(func() {})
|
|
|
|
require.NoError(
|
|
t,
|
|
lifecycle.WaitForShutdown(
|
|
context.Background(), discardLogger(),
|
|
"test component", &wg,
|
|
),
|
|
)
|
|
}
|
|
|
|
// racePasses is how many times the both-cases-ready race is run.
|
|
// Without the preamble each pass is an independent coin flip, so
|
|
// the probability of the whole loop passing by luck is 2^-N: at
|
|
// this N the test is deterministic in practice, and it involves no
|
|
// wall-clock waiting at all.
|
|
const racePasses = 1000
|
|
|
|
// TestWaitDone_DrainedBeforeExpiredContext covers the case where a
|
|
// component drained cleanly but the stop context had already
|
|
// expired. Both select cases are ready, and Go chooses among ready
|
|
// cases uniformly at random, so the drained case must be settled by
|
|
// the preamble before the bounded select ever runs.
|
|
func TestWaitDone_DrainedBeforeExpiredContext(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
done := make(chan struct{})
|
|
close(done)
|
|
|
|
ctx, cancel := context.WithCancel(context.Background())
|
|
cancel()
|
|
|
|
for pass := range racePasses {
|
|
require.NoErrorf(
|
|
t,
|
|
lifecycle.WaitDone(
|
|
ctx, discardLogger(), "test component", done,
|
|
),
|
|
"pass %d reported a timeout for a drained component",
|
|
pass,
|
|
)
|
|
}
|
|
}
|
|
|
|
// TestWaitDone_ExpiredContext pins the other side of the preamble:
|
|
// an expired context with a component that has not drained is still
|
|
// a timeout.
|
|
func TestWaitDone_ExpiredContext(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
ctx, cancel := context.WithCancel(context.Background())
|
|
cancel()
|
|
|
|
err := lifecycle.WaitDone(
|
|
ctx, discardLogger(), "test component",
|
|
make(chan struct{}),
|
|
)
|
|
|
|
require.ErrorIs(t, err, context.Canceled)
|
|
require.ErrorContains(t, err, "test component")
|
|
}
|
|
|
|
func TestWaitForShutdown_ContextExpires(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
release := make(chan struct{})
|
|
|
|
t.Cleanup(func() { close(release) })
|
|
|
|
var wg sync.WaitGroup
|
|
|
|
wg.Go(func() { <-release })
|
|
|
|
ctx, cancel := context.WithTimeout(
|
|
context.Background(), waitTimeout,
|
|
)
|
|
defer cancel()
|
|
|
|
err := lifecycle.WaitForShutdown(
|
|
ctx, discardLogger(), "test component", &wg,
|
|
)
|
|
|
|
require.ErrorIs(t, err, context.DeadlineExceeded)
|
|
require.ErrorContains(t, err, "test component")
|
|
}
|