fix(ci): smoke и nightly обращаются к контейнеру изнутри (раннер сам в контейнере)

.gitea/workflows/nightly-perf.yaml

@@ -30,20 +30,20 @@ jobs:
         run: |
           set -euxo pipefail
           docker volume create load-data
-          docker run --rm -v load-data:/data --entrypoint sh authportal:load -c 'chown 1000:1000 /data'
-          docker run -d --name authportal-load --init --memory 256m --memory-swap 256m --cpus 1.0 \
-            --read-only --tmpfs /tmp --cap-drop ALL -v load-data:/data -p 18080:8080 \
-            -e JWT_SECRET=load-jwt-secret-0123456789 -e ADMIN_PASSWORD=load-admin-pass-1 \
-            -e ADMIN_EMAIL=admin@smoke.local -e ISSUER=http://127.0.0.1:18080 -e RATE_LIMIT_MAX=1000000 authportal:load
-          for i in $(seq 1 40); do curl -fsS http://127.0.0.1:18080/ready && break; sleep 0.5; done
-      - name: Load test
-        env:
-          PNPM_CACHE_HIT: ${{ steps.setup.outputs.cache-hit }}
-          LOAD_PASSWORD: load-admin-pass-1
+          docker run --rm -v load-data:/data --user root --entrypoint sh authportal:load -c 'chown 1000:1000 /data'
+          docker run -d --name authportal-load --init --memory 256m --memory-swap 256m --cpus 1.0             --read-only --tmpfs /tmp --cap-drop ALL -v load-data:/data             -e JWT_SECRET=load-jwt-secret-0123456789 -e ADMIN_PASSWORD=load-admin-pass-1             -e ADMIN_EMAIL=admin@smoke.local -e ISSUER=http://127.0.0.1:8080 -e RATE_LIMIT_MAX=1000000 authportal:load
+          for i in $(seq 1 40); do docker exec authportal-load wget -q -O /dev/null http://127.0.0.1:8080/ready && break; sleep 0.5; done
+      # Раннер сам в контейнере: нагрузку гоним из соседнего контейнера в сетевом namespace приложения.
+      - name: Load test (autocannon в namespace приложения)
         run: |
           set -euxo pipefail
-          sh scripts/ci/pnpm-ci.sh
-          node scripts/perf/load.mjs http://127.0.0.1:18080 authportal-load
+          docker run --rm -i --network container:authportal-load             -e LOAD_PASSWORD=load-admin-pass-1 -e LOAD_DURATION_S=15             node:22-alpine sh -c 'mkdir /w && cd /w && npm i --silent --no-audit --no-fund autocannon@7.15.0 && cat > load.mjs && node load.mjs http://127.0.0.1:8080'             < scripts/perf/load.mjs
+      - name: RSS после нагрузки
+        run: |
+          set -euxo pipefail
+          rss=$(docker stats --no-stream --format '{{.MemUsage}}' authportal-load | sed -E 's/^([0-9.]+)([KMG]i?B).*/
 /' | awk '{u=$2; v=$1; if(u ~ /^G/) v*=1024; else if(u ~ /^K/) v/=1024; printf "%d", v}')
+          echo "RSS: ${rss} MiB (budget 200)"
+          [ "$rss" -le 200 ]
       - name: Container logs on failure
         if: failure()
         run: docker logs --tail 100 authportal-load || true