fix(ci): make GitHub-hosted fallback actually build and test

Author: TheodoreSpeaks

.github/actions/docker-build/action.yml

@@ -19,6 +19,10 @@ inputs:
   tags:
     description: Comma-separated list of tags to push.
     required: true
+  build-args:
+    description: Newline-separated build args forwarded to the builder.
+    required: false
+    default: ''
 
 # Registry logins must already have run in the calling job — both backends read
 # the same ~/.docker/config.json. provenance/sbom stay off everywhere: the
@@ -40,6 +44,7 @@ runs:
         platforms: ${{ inputs.platforms }}
         push: true
         tags: ${{ inputs.tags }}
+        build-args: ${{ inputs.build-args }}
         provenance: false
         sbom: false
 
@@ -51,6 +56,11 @@ runs:
     # the GitHub equivalent (cache-to: type=gha) shares the same 10 GB repo
     # cache quota as the bun/node_modules/turbo mounts, and four images of
     # layers would evict them. Fallback builds are cold by design.
+    # NEXT_BUILD_HEAP_MB is trimmed from the 8192 default here because these
+    # runners have 16 GB total and `next build` was getting OOM-killed (exit
+    # 137) partway through. Only app.Dockerfile declares the arg; the other
+    # images ignore it harmlessly, so it is set unconditionally rather than
+    # threaded per-image through every call site.
     - name: Build and push (GitHub)
       if: inputs.provider != '' && inputs.provider != 'blacksmith'
       uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
@@ -60,5 +70,8 @@ runs:
         platforms: ${{ inputs.platforms }}
         push: true
         tags: ${{ inputs.tags }}
+        build-args: |
+          NEXT_BUILD_HEAP_MB=4096
+          ${{ inputs.build-args }}
         provenance: false
         sbom: false

.github/workflows/ci.yml

@@ -21,9 +21,15 @@ name: CI
 # branch would hard-fail.
 #
 # GitHub mode is a break-glass fallback, not a peer. Public-repo ubuntu-latest is
-# 4 vCPU with no free 8-core tier, the 10 GB repo cache quota will thrash across
-# the bun/node_modules/turbo mounts, and image builds start from cold layers — so
-# expect slower runs, not different results. Blacksmith-only actions are reached
+# 4 vCPU / 16 GB with no free 8-core tier, the 10 GB repo cache quota will thrash
+# across the bun/node_modules/turbo mounts, and image builds start from cold
+# layers. The first live flip (2026-07-21) proved it is not merely slower: the
+# app image OOM-killed `next build`, and one test failed because it shells out to
+# `rg`, which Blacksmith's image ships and GitHub's does not. Both are addressed
+# now — ripgrep is installed explicitly in test-build.yml, and the GitHub path
+# trims NEXT_BUILD_HEAP_MB — but the app image build stays the tight spot here
+# and is the first thing to check if a fallback run fails. Blacksmith-only
+# actions are reached
 # exclusively through .github/actions/cache-mount and .github/actions/docker-build,
 # which branch internally; a bare useblacksmith/* step added anywhere else will
 # hard-fail in GitHub mode rather than silently degrade.

.github/workflows/test-build.yml

@@ -153,6 +153,14 @@ jobs:
       - name: Type-check realtime server
         run: bunx turbo run type-check --filter=@sim/realtime
 
+      # cloud-review-tools.test.ts runs the real helper script, which shells out
+      # to `rg`. In production that script runs inside the E2B sandbox, whose
+      # template apt-installs ripgrep — but the test executes it on the runner,
+      # so the runner needs it too. Blacksmith's image ships rg and GitHub's does
+      # not, which made this an invisible dependency on the runner provider.
+      - name: Install ripgrep
+        run: command -v rg || (sudo apt-get update && sudo apt-get install -y ripgrep)
+
       - name: Run tests with coverage
         env:
           NODE_OPTIONS: '--no-warnings --max-old-space-size=8192'

apps/sim/package.json

@@ -17,7 +17,7 @@
     "load:workflow:baseline": "BASE_URL=${BASE_URL:-http://localhost:3000} WARMUP_DURATION=${WARMUP_DURATION:-10} WARMUP_RATE=${WARMUP_RATE:-2} PEAK_RATE=${PEAK_RATE:-8} HOLD_DURATION=${HOLD_DURATION:-20} bunx artillery run scripts/load/workflow-concurrency.yml",
     "load:workflow:waves": "BASE_URL=${BASE_URL:-http://localhost:3000} WAVE_ONE_DURATION=${WAVE_ONE_DURATION:-10} WAVE_ONE_RATE=${WAVE_ONE_RATE:-6} QUIET_DURATION=${QUIET_DURATION:-5} WAVE_TWO_DURATION=${WAVE_TWO_DURATION:-15} WAVE_TWO_RATE=${WAVE_TWO_RATE:-8} WAVE_THREE_DURATION=${WAVE_THREE_DURATION:-20} WAVE_THREE_RATE=${WAVE_THREE_RATE:-10} bunx artillery run scripts/load/workflow-waves.yml",
     "load:workflow:isolation": "BASE_URL=${BASE_URL:-http://localhost:3000} ISOLATION_DURATION=${ISOLATION_DURATION:-30} TOTAL_RATE=${TOTAL_RATE:-9} WORKSPACE_A_WEIGHT=${WORKSPACE_A_WEIGHT:-8} WORKSPACE_B_WEIGHT=${WORKSPACE_B_WEIGHT:-1} bunx artillery run scripts/load/workflow-isolation.yml",
-    "build": "bun run build:sandbox-bundles && NODE_OPTIONS='--max-old-space-size=8192' next build",
+    "build": "bun run build:sandbox-bundles && NODE_OPTIONS=--max-old-space-size=${NEXT_BUILD_HEAP_MB:-8192} next build",
     "build:sandbox-bundles": "bun run ./lib/execution/sandbox/bundles/build.ts",
     "start": "next start",
     "prepare": "cd ../.. && bun husky",

docker/app.Dockerfile

@@ -76,6 +76,13 @@ ENV DATABASE_URL=${DATABASE_URL}
 ARG NEXT_PUBLIC_APP_URL="http://localhost:3000"
 ENV NEXT_PUBLIC_APP_URL=${NEXT_PUBLIC_APP_URL}
 
+# V8 old-space ceiling for `next build`. Turbopack's own allocations are native
+# and sit outside this budget, so the ceiling has to leave room for them plus
+# the daemon and BuildKit — on a 16 GB runner the default 8192 is enough to get
+# the process OOM-killed. Only the heap size changes; build output does not.
+ARG NEXT_BUILD_HEAP_MB=8192
+ENV NEXT_BUILD_HEAP_MB=${NEXT_BUILD_HEAP_MB}
+
 # Per-platform cache id keeps arm64/amd64 SWC artifacts isolated.
 RUN --mount=type=cache,id=next-cache-${TARGETPLATFORM},target=/app/apps/sim/.next/cache \
     --mount=type=cache,id=turbo-cache-${TARGETPLATFORM},target=/app/.turbo \