From 619f42c3b1d3bc2dd5a3d89766146cb9161f3c3b Mon Sep 17 00:00:00 2001
From: Michael Heller <21163552+mdheller@users.noreply.github.com>
Date: Thu, 23 Jul 2026 12:29:35 -0400
Subject: [PATCH 1/3] =?UTF-8?q?linux=20ci:=20add=2024G=20swap=20+=20-j2=20?=
 =?UTF-8?q?=E2=80=94=20nightly-linux=20OOM-dead=20(exit=20143)=20for=20a?=
 =?UTF-8?q?=20week?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The GitHub-hosted nightly-linux has failed every day for 8+ days, across many
commits predating any recent work — all exit 143 (SIGTERM/OOM). Firefox is too
big for the 16GB standard runner without swap. Same fix that got the Windows
lane past its OOM wall: 24G swapfile (ubuntu leg; fedora runs in a container
where swapon isn't available) + cap mach at -j2 so concurrent heavy TUs don't
exhaust RAM. The sovereign builder (32c/128GB) stays at full parallelism.
---
 .github/workflows/nightly-linux.yml | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/nightly-linux.yml b/.github/workflows/nightly-linux.yml
index e3a8106..00f5346 100644
--- a/.github/workflows/nightly-linux.yml
+++ b/.github/workflows/nightly-linux.yml
@@ -71,6 +71,17 @@ jobs:
           sudo docker image prune --all --force || true
           df -h /
 
+      - name: Add swap (16GB runners OOM the Firefox compile → exit 143)
+        if: matrix.container == ''
+        run: |
+          sudo swapoff -a || true
+          sudo rm -f /mnt/swapfile /swapfile || true
+          sudo fallocate -l 24G /mnt/swapfile
+          sudo chmod 600 /mnt/swapfile
+          sudo mkswap /mnt/swapfile
+          sudo swapon /mnt/swapfile
+          free -h
+
       - name: Install system dependencies
         run: |
           ${{ matrix.pkg_update }}
@@ -120,7 +131,10 @@ jobs:
 
       - name: Build BearBrowser
         working-directory: build/workspaces/${{ env.PROFILE }}-${{ env.VERSION }}-${{ env.RELEASE }}/source/bearbrowser-${{ env.VERSION }}-${{ env.RELEASE }}
-        run: MOZBUILD_STATE_PATH=${{ github.workspace }}/.mozbuild ./mach build
+        # -j2: mach's memory heuristic over-parallelizes on the 16GB runner and
+        # OOM-kills the compile (exit 143). Cap concurrent heavy TUs; the 24G
+        # swap above absorbs the rest. Same fix as nightly-windows.
+        run: MOZBUILD_STATE_PATH=${{ github.workspace }}/.mozbuild ./mach build -j2
 
       - name: Measure fingerprint on the REAL compiled binary (authoritative)
         if: matrix.distro == 'ubuntu'

From 9062225e9a0a6944c4a57218576a295012e60d01 Mon Sep 17 00:00:00 2001
From: Michael Heller <21163552+mdheller@users.noreply.github.com>
Date: Thu, 23 Jul 2026 15:24:47 -0400
Subject: [PATCH 2/3] linux ci: package via mach package + make fedora
 non-blocking
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

With the OOM fix, the ubuntu build finally SUCCEEDED for the first time — and
immediately exposed a latent packaging bug: the tarball step tarred a
dist/bearbrowser/ dir that only 'mach package' creates, but the workflow only
ran 'mach build' (which leaves dist/bin). Never surfaced before because the
build always OOM'd first. Now run 'mach package' (proven on the sovereign Linux
builder) and ship its real dist/bearbrowser-*.tar.xz (with omni.ja).

Also mark the fedora leg continue-on-error: it builds in a container where
swapon isn't available (so no OOM headroom) and hits a mirror-recipe cfg-copy
quirk. Ubuntu is the primary Linux artifact and stays blocking.
---
 .github/workflows/nightly-linux.yml | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/nightly-linux.yml b/.github/workflows/nightly-linux.yml
index 00f5346..63a6624 100644
--- a/.github/workflows/nightly-linux.yml
+++ b/.github/workflows/nightly-linux.yml
@@ -22,6 +22,12 @@ jobs:
     name: Build (${{ matrix.distro }})
     runs-on: ubuntu-24.04
     timeout-minutes: 360
+    # fedora builds in a container where swapon isn't available, so it can't get
+    # the OOM headroom the ubuntu leg does; it also hits a mirror-recipe cfg-copy
+    # quirk. Keep it as a best-effort signal — ubuntu is the primary Linux
+    # artifact and must stay blocking. (Revisit fedora once CI moves to the
+    # sovereign runner with real RAM.)
+    continue-on-error: ${{ matrix.distro == 'fedora' }}
 
     strategy:
       fail-fast: false
@@ -163,10 +169,18 @@ jobs:
         id: tarball
         run: |
           DATE=$(date +%Y%m%d)
-          OBJ="build/workspaces/${{ env.PROFILE }}-${{ env.VERSION }}-${{ env.RELEASE }}/source/bearbrowser-${{ env.VERSION }}-${{ env.RELEASE }}/obj-x86_64-pc-linux-gnu"
-          TAR="BearBrowser-${{ env.VERSION }}-${DATE}-${{ matrix.artifact_suffix }}.tar.bz2"
+          SRC="build/workspaces/${{ env.PROFILE }}-${{ env.VERSION }}-${{ env.RELEASE }}/source/bearbrowser-${{ env.VERSION }}-${{ env.RELEASE }}"
+          OBJ="$SRC/obj-x86_64-pc-linux-gnu"
+          # `mach build` alone leaves dist/bin (a dev tree). Run `mach package` to
+          # get the real distributable tarball (dist/bearbrowser-*.tar.xz, with
+          # omni.ja) — the old step tarred a dist/bearbrowser/ dir that only
+          # `mach package` creates, so it failed the moment the build finally
+          # got far enough to package. Proven on the sovereign Linux builder.
+          ( cd "$SRC" && MOZBUILD_STATE_PATH=${{ github.workspace }}/.mozbuild ./mach package )
+          SRC_TAR="$(ls "$OBJ"/dist/bearbrowser-*.linux-x86_64.tar.* 2>/dev/null | head -1)"
+          TAR="BearBrowser-${{ env.VERSION }}-${DATE}-${{ matrix.artifact_suffix }}.tar.xz"
           mkdir -p build/nightly
-          tar -C "${OBJ}/dist" -cjf "build/nightly/${TAR}" bearbrowser/
+          cp "$SRC_TAR" "build/nightly/${TAR}"
           echo "name=${TAR}" >> $GITHUB_OUTPUT
           echo "path=build/nightly/${TAR}" >> $GITHUB_OUTPUT
 

From cd26d82a0f154a4c10373a9825bb9f91fa44210e Mon Sep 17 00:00:00 2001
From: Michael Heller <21163552+mdheller@users.noreply.github.com>
Date: Thu, 23 Jul 2026 17:34:01 -0400
Subject: [PATCH 3/3] linux ci: add contents: write so the nightly release can
 publish
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The ubuntu leg now BUILDS + PACKAGES + makes the AppImage successfully (the
swap+mach-package fixes worked) — it failed only at the final 'Publish nightly
release' step: the default GITHUB_TOKEN is read-only, so 'gh release upload
--clobber' 403'd (hidden by 2>/dev/null) and the fallback 'gh release create'
errored on the nightly-<date> tag a sibling lane had already created. Same
one-line permissions fix already on nightly-dmg + nightly-windows. This is the
last step before the first green Linux nightly.
---
 .github/workflows/nightly-linux.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/workflows/nightly-linux.yml b/.github/workflows/nightly-linux.yml
index 63a6624..e506819 100644
--- a/.github/workflows/nightly-linux.yml
+++ b/.github/workflows/nightly-linux.yml
@@ -17,6 +17,14 @@ on:
       - 'packaging/bundled-fonts/**'
       - '.github/workflows/nightly-linux.yml'
 
+# Needed by the "Publish nightly release" step: the default GITHUB_TOKEN is
+# read-only, so `gh release upload --clobber` / `gh release create` 403 without
+# this (same fix already on nightly-dmg + nightly-windows). Without write, the
+# --clobber upload silently failed and the fallback create errored on the tag
+# that a sibling lane had already made.
+permissions:
+  contents: write
+
 jobs:
   nightly-linux:
     name: Build (${{ matrix.distro }})