ci: isolate staging dependency install

.gitea/workflows/backend-quality-gate.yml

@@ -32,6 +32,8 @@ jobs:
     timeout-minutes: 45
     env:
       GITEA_SHA: ${{ gitea.sha }}
+      NODE_TOOL_SOURCE_IMAGE: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/library/node:22-bookworm-slim@sha256:ef343465b6a14bbdf2ab52f6e100ec0659a792464fcf72c462370d88b3df909c
+      NODE_TOOL_IMAGE: node:22-bookworm-slim
     steps:
       - name: Checkout exact Gitea revision
         run: |
@@ -96,9 +98,6 @@ jobs:
           docker compose --help | grep -q -- '--project-name'
 
       - name: Prepare pinned Node tooling
-        env:
-          NODE_TOOL_SOURCE_IMAGE: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/library/node:22-bookworm-slim@sha256:ef343465b6a14bbdf2ab52f6e100ec0659a792464fcf72c462370d88b3df909c
-          NODE_TOOL_IMAGE: node:22-bookworm-slim
         run: |
           set -euo pipefail
           if ! docker image inspect "$NODE_TOOL_SOURCE_IMAGE" >/dev/null 2>&1; then
@@ -167,7 +166,23 @@ jobs:
             "pandas==2.3.3" \
             "timezonefinder==8.2.5" \
             -r requirements.txt -r requirements-dev.txt
-          npm ci --prefix frontend
+          workdir="$(pwd -P)"
+          docker run --rm \
+            --cpus=1.5 \
+            --memory=2g \
+            --memory-swap=2g \
+            --pids-limit=256 \
+            --user "$(id -u):$(id -g)" \
+            --volume "$workdir:$workdir" \
+            --workdir "$workdir" \
+            --env HOME=/tmp \
+            --env "NPM_CONFIG_REGISTRY=$NPM_CONFIG_REGISTRY" \
+            "$NODE_TOOL_SOURCE_IMAGE" \
+            npm ci --prefix frontend \
+              --no-audit \
+              --no-fund \
+              --progress=false \
+              --maxsockets=4
 
       - name: Validate backend, package, frontend, and database contracts
         run: |

docs/BUG_HISTORY.md

@@ -2536,3 +2536,19 @@
 - 相关记录：BUG-146、BUG-147
 - 复发自：无
 - 修复版本：2026-08-08 staging 变更
+
+## BUG-149 | staging quality gate 宿主 npm ci 触发控制面持续 502 并被基础设施终止
+
+- 状态：resolved（local candidate，远端 gate/deploy 待本提交）
+- 首次发现：2026-08-09
+- 最近更新：2026-08-09
+- 影响面：Gitea staging quality gate 的依赖安装阶段、`manman-linux` runner 与 Gitea/runner 控制面可用性；测试、lint、build、exact-SHA checkout/publish/deploy 合同未改变。
+- 用户现象：quality gate 在宿主机直接执行 `npm ci` 期间，Gitea 与 runner 控制面持续返回 502；步骤日志没有 npm 安装错误，任务最终由基础设施终止，无法进入后续远端 gate/deploy 收口。
+- 触发条件：self-hosted runner 在宿主环境执行无独立资源边界的 frontend `npm ci`，同时由共享控制面维持 job 调度、状态与日志链路。
+- 根因：依赖安装直接占用宿主资源且缺少 CPU、内存、swap、PID 与并发 socket 上限，故障证据落在 runner/控制面资源争用和基础设施终止边界，而不是 npm 包解析或安装错误。
+- 修复：仅将 `npm ci` 放入 digest-pinned Node 容器，并限制为 CPU 1.5、memory 2g、no swap、pids 256、`npm_config_maxsockets=4`；测试、lint、build 与 exact-SHA 行为保持原样，不扩大容器化范围，也不改变发布和部署信任边界。
+- 验证：本地 deployment contracts 45/45、workflow contracts 29/29；独立 review 无 P0/P1。远端 staging gate/deploy 待本提交后验证，本记录不提前声称远端收口。
+- 防复发：宿主依赖安装必须维持 digest-pinned Node runtime 和显式资源上限；合同测试需锁定只有 `npm ci` 在受限容器内执行，并持续确认测试、lint、build、exact-SHA checkout/publish/deploy 语义未漂移。
+- 相关记录：BUG-129、BUG-136、BUG-142
+- 复发自：无
+- 修复版本：待本次提交 / gate / deploy

frontend/tests/staging-backend-workflows.test.ts

@@ -171,8 +171,8 @@ test("Gitea quality gate validates before publishing an immutable ACR manifest",
   assert.equal((workflow.match(/timeout 180 docker pull "\$NODE_TOOL_SOURCE_IMAGE"/g) ?? []).length, 2);
   assert.equal((workflow.match(/docker tag "\$NODE_TOOL_SOURCE_IMAGE" "\$NODE_TOOL_IMAGE"/g) ?? []).length, 2);
   assert.equal((workflow.match(/cat > "\$tool_dir\/node" <<'EOF'/g) ?? []).length, 1);
-  assert.equal((workflow.match(/--volume "\$workdir:\$workdir"/g) ?? []).length, 2);
-  assert.equal((workflow.match(/--workdir "\$workdir"/g) ?? []).length, 2);
+  assert.equal((workflow.match(/--volume "\$workdir:\$workdir"/g) ?? []).length, 3);
+  assert.equal((workflow.match(/--workdir "\$workdir"/g) ?? []).length, 3);
   assert.equal((workflow.match(/ln -s node "\$tool_dir\/npm"/g) ?? []).length, 1);
   assert.equal((workflow.match(/>> "\$GITHUB_PATH"/g) ?? []).length, 2);
   assert.match(workflow, /node:22-bookworm-slim "\$\{0##\*\/\}" "\$@"/);
@@ -182,6 +182,26 @@ test("Gitea quality gate validates before publishing an immutable ACR manifest",
   assert.match(workflow, /docker cp "\$container_id:\/usr\/local\/lib\/node_modules\/npm" "\$tool_dir\/npm-package"/);
   assert.match(workflow, /node --version \| grep -Eq '\^v22\\\.'/);
   assert.match(workflow, /npm --version/);
+  assert.match(
+    workflow,
+    /validate:[\s\S]*?env:\n\s+GITEA_SHA: \$\{\{ gitea\.sha \}\}\n\s+NODE_TOOL_SOURCE_IMAGE: swr\.cn-north-4\.myhuaweicloud\.com\/ddn-k8s\/docker\.io\/library\/node:22-bookworm-slim@sha256:ef343465b6a14bbdf2ab52f6e100ec0659a792464fcf72c462370d88b3df909c\n\s+NODE_TOOL_IMAGE: node:22-bookworm-slim[\s\S]*?- name: Prepare pinned Node tooling/,
+  );
+  const installStep = workflow.match(
+    /- name: Install dependencies[\s\S]*?(?=\n\s+- name: Validate backend, package, frontend, and database contracts)/,
+  )?.[0] ?? "";
+  assert.match(installStep, /workdir="\$\(pwd -P\)"/);
+  assert.match(installStep, /docker run --rm/);
+  assert.match(installStep, /--cpus=1\.5/);
+  assert.match(installStep, /--memory=2g/);
+  assert.match(installStep, /--memory-swap=2g/);
+  assert.match(installStep, /--pids-limit=256/);
+  assert.match(installStep, /--user "\$\(id -u\):\$\(id -g\)"/);
+  assert.match(installStep, /--volume "\$workdir:\$workdir"/);
+  assert.match(installStep, /--workdir "\$workdir"/);
+  assert.match(installStep, /--env HOME=\/tmp/);
+  assert.match(installStep, /--env "NPM_CONFIG_REGISTRY=\$NPM_CONFIG_REGISTRY"/);
+  assert.match(installStep, /"\$NODE_TOOL_SOURCE_IMAGE" \\\n\s+npm ci --prefix frontend \\\n\s+--no-audit \\\n\s+--no-fund \\\n\s+--progress=false \\\n\s+--maxsockets=4/);
+  assert.doesNotMatch(installStep, /--ignore-scripts|--omit(?:=|\s+)optional|--force/);
   assert.match(workflow, /docker compose version --short/);
   assert.match(workflow, /docker compose --help \| grep -q -- '--project-name'/);
   assert.match(