fix(tests): kill executor by port, not by name — safe for concurrent CI runners

[marvin-bot-coasys]

Problem

With multiple concurrent CircleCI runner instances on the same host machine, pkill -f "ad4m" and killProcess("ad4m") would terminate executor processes belonging to other concurrent CI jobs, causing random test failures.

Root cause

Three places killed by process name:

1. scripts/cleanup.js — killProcess("ad4m") called between every test file in test-all
2. email-verification-test-with-setup.sh — pkill -f "rust-executor" + pkill -f "ad4m"
3. test-multi-user-with-setup.sh — same

Fix

Each test file uses a unique port range, so killing by port is precise and safe:

Test file	Ports
app.test.ts	15000-15002
authentication.test.ts	15100-15102, 15200-15203
integration.test.ts	15300-15302
simple.test.ts	15600-15602
publishTestLangs.ts (setup)	15700-15702
multi-user-connect.test.ts	15800-15802
multi-user-simple.test.ts	15900-15902
email-verification.test.ts	15920-15922
prolog-and-literals.test.ts	16600-16602

• cleanup.js: replaced killProcess("ad4m") with lsof -ti:PORT | xargs -r kill -9 for each port in the sequence
• Shell scripts: removed pkill lines, kept/expanded port-based kills only

Summary by CodeRabbit

• Chores
  • Updated CI/CD infrastructure with expanded system dependencies and integrated CUDA 12.5 support, enabling CUDA-enabled Linux builds and release artifacts.
  • Extended CI publishing workflows to produce additional platform binaries (Linux CUDA, Windows, macOS) and adjusted release asset uploads.
  • Improved test isolation and cleanup to prevent cross-job interference by scoping test ports and targeted process cleanup.
  • Unified container image references across workflows for consistency.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 8a0d539 and 7264342.

📒 Files selected for processing (6)

• .circleci/config.yml
• .github/workflows/agent-language-tests.yml
• .github/workflows/direct-message-language-tests.yml
• .github/workflows/file-storage-language-tests.yml
• .github/workflows/p-diff-sync-tests.yml
• .github/workflows/publish.yml

🚧 Files skipped from review as they are similar to previous changes (6)

• .github/workflows/direct-message-language-tests.yml
• .github/workflows/publish.yml
• .circleci/config.yml
• .github/workflows/p-diff-sync-tests.yml
• .github/workflows/file-storage-language-tests.yml
• .github/workflows/agent-language-tests.yml

---

📝 Walkthrough

Walkthrough

The PR updates CI infrastructure: adds CUDA 12.5 and many system deps to the CI Dockerfile, pins/updates CI image digests across CircleCI and GitHub Actions, adds new CUDA-enabled Linux and expanded Windows publish jobs, and replaces name-based test cleanup with port-based cleanup and environment-configurable ports.

Changes

Cohort / File(s)	Summary
Docker & CI image \.circleci/Dockerfile	Added CUDA 12.5 toolkit, many system libraries/dev headers, normalized Go env vars, and set CUDA PATH/LD_LIBRARY_PATH.
CircleCI config \.circleci/config.yml	Added ad4m_image anchor referencing the pinned CI image digest.
GitHub Actions — workflow image updates \.github/workflows/agent-language-tests.yml, \.github/workflows/direct-message-language-tests.yml, \.github/workflows/file-storage-language-tests.yml, \.github/workflows/p-diff-sync-tests.yml, \.github/workflows/publish.yml	Replaced container image digests to the new pinned CUDA-ready image (digest updated only).
GitHub Actions — publish_staging \.github/workflows/publish_staging.yml	Added Linux CUDA binary build job, expanded Windows CI build/publish job, adjusted macOS caching/cargo update steps, and switched publish upload assets to include CUDA-specific binaries; multiple image digests updated.
Test cleanup & ports (scripts) tests/js/scripts/cleanup.js, tests/js/email-verification-test-with-setup.sh, tests/js/test-multi-user-with-setup.sh	Replaced process-name pkill with targeted port-based termination; added/exported job-specific port env vars (AD4M_SETUP_GQL_PORT, AD4M_SETUP_HC_ADMIN_PORT, AD4M_SETUP_HC_APP_PORT) and documented port assignments.
Test utilities tests/js/utils/publishTestLangs.ts	Read GQL/HC ports from environment variables with fallbacks (supports the new exported port vars).

Sequence Diagram(s)

sequenceDiagram
  participant GH as GitHub Actions
  participant Runner as CI Runner (container image)
  participant Build as Build toolchain (cargo/go/clang)
  participant Release as GitHub Releases

  GH->>Runner: start job (uses pinned CUDA-enabled image)
  Runner->>Build: checkout code, install deps, setup CUDA env
  Build->>Build: build Linux CUDA binary & AppImage, build Windows artifacts (on respective jobs)
  Build->>Release: upload artifacts (AppImage, CUDA binary, Windows MSI/NSIS)
  Release-->>GH: artifacts published (release assets)

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• ci: Use Docker container for npm-publish workflow #657: updates/pins CI Docker image digests and modifies publishing workflows; closely related to the workflow image changes here.
• fix(test-runner): remove stale process kills and perspect3vism refs #686: adjusts test/tooling process-cleanup logic; related to the move from name-based to port-based cleanup in tests.

Suggested reviewers

• lucksus
• data-coasys

Poem

🐰 With crates and CUDA in tow, I hop and compile bright,
Ports tidy like carrots lined up neat in the night.
Images pinned, builds take flight, artifacts in a row,
Tests whisper safe and quiet — no rogue process on the go.
Hooray for clean CI gardens — the rabbit skips in light!

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and accurately summarizes the main change: replacing name-based process termination with port-based termination to prevent concurrent CI runners from interfering with each other.
Docstring Coverage	✅ Passed	Docstring coverage is 80.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/concurrent-runner-pid-kill

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (4)

.github/workflows/publish_staging.yml (2)

391-434: Consider updating GitHub Actions to their latest major versions.

The static analysis flagged several actions as outdated. While they may still work, newer versions often include security fixes and performance improvements:

• actions/checkout@v3 → @v4
• actions/setup-go@v4 → @v5
• actions/setup-python@v4 → @v5
• actions/setup-node@v3 → @v4

♻️ Proposed fixes for Windows job

     steps:
     - name: Fetch source code
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     # Rust toolchain configured via rust-toolchain.toml
     - name: Install Rust toolchain

     - name: Install GO
-      uses: actions/setup-go@v4
+      uses: actions/setup-go@v5
       with:
         go-version: '1.24.6'
         cache: true
 
     - name: Install Deno
       uses: denoland/setup-deno@v1
       with:
         deno-version: v2.x
 
     - name: Use Python 3.11
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v5
       with:
         python-version: '3.11'
 
     - uses: pnpm/action-setup@v4
 
     - name: Use Node.js 18.x
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
         node-version: 18.x
         cache: 'pnpm'

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/publish_staging.yml around lines 391 - 434, Update the
outdated GitHub Actions uses in the workflow: replace actions/checkout@v3 with
actions/checkout@v4, actions/setup-go@v4 with actions/setup-go@v5,
actions/setup-python@v4 with actions/setup-python@v5, and actions/setup-node@v3
with actions/setup-node@v4; edit the corresponding steps named "Fetch source
code", "Install GO", "Use Python 3.11", and "Use Node.js 18.x" to point to the
new major versions and verify their inputs (like node-version, go-version,
python-version, and cache) remain compatible after the bump.

---

451-454: Cargo update with error suppression.

The || true pattern silently ignores failures. If the V8 pre-built binary alignment is critical for Windows builds, consider logging when the update fails rather than silently continuing.

♻️ Optional: Log on failure

     - name: Update cargo git deps (ensure pre-built V8 from coasys/rusty_v8 tag)
       working-directory: rust-executor
       shell: bash
-      run: cargo update -p v8 2>/dev/null || cargo update 2>/dev/null || true
+      run: cargo update -p v8 2>/dev/null || cargo update 2>/dev/null || echo "Warning: cargo update skipped"

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/publish_staging.yml around lines 451 - 454, The CI step
named "Update cargo git deps (ensure pre-built V8 from coasys/rusty_v8 tag)"
currently suppresses errors with "|| true"; change the step so failures are not
silently ignored—capture the exit status of `cargo update -p v8` (and fallback
`cargo update`) and when either command fails, print a clear diagnostic (e.g.,
echo a message including stderr) and either fail the job or emit a warning so
the log shows the failure; update the shell/run command in that step to detect
non-zero exit codes and log the error instead of swallowing it with "|| true".

.circleci/Dockerfile (2)

7-28: Consider adding --no-install-recommends to reduce image size.

The apt-get install commands pull in recommended packages by default, which can significantly increase image size. Adding --no-install-recommends is a common Docker best practice for CI images.

♻️ Proposed fix

-RUN apt-get update && apt-get install -y software-properties-common && add-apt-repository universe && apt-get update && apt-get install -y \
+RUN apt-get update && apt-get install -y --no-install-recommends software-properties-common && add-apt-repository universe && apt-get update && apt-get install -y --no-install-recommends \
     libgtk-3-dev \

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.circleci/Dockerfile around lines 7 - 28, Update the long RUN layer that
performs apt-get install (the line starting with "RUN apt-get update && apt-get
install -y ...") to add --no-install-recommends to the apt-get install
invocations so apt doesn't pull recommended packages and the CI Docker image
size is reduced; ensure both apt-get install commands in that RUN use
--no-install-recommends and keep the rest of the package list and chaining
unchanged.

---

89-99: CUDA 12.5 installation looks correct.

The CUDA toolkit installation follows the standard NVIDIA installation procedure for Ubuntu 22.04. PATH and LD_LIBRARY_PATH are correctly configured.

Consider applying --no-install-recommends here as well for consistency:

♻️ Proposed fix for consistency

-RUN apt-get install -y gnupg2 wget && \
+RUN apt-get install -y --no-install-recommends gnupg2 wget && \
     wget https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2204/x86_64/cuda-keyring_1.1-1_all.deb && \
     dpkg -i cuda-keyring_1.1-1_all.deb && \
     rm cuda-keyring_1.1-1_all.deb && \
     apt-get update && \
-    apt-get install -y cuda-toolkit-12-5 && \
+    apt-get install -y --no-install-recommends cuda-toolkit-12-5 && \
     apt-get clean && rm -rf /var/lib/apt/lists/*

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.circleci/Dockerfile around lines 89 - 99, The RUN command that installs
CUDA toolkit should use --no-install-recommends for consistency and smaller
image size; update the apt-get install invocations inside the RUN block that
downloads and installs cuda-keyring and cuda-toolkit-12-5 to include
--no-install-recommends (i.e., change "apt-get install -y gnupg2 wget" and
"apt-get install -y cuda-toolkit-12-5" to use "--no-install-recommends -y"),
leaving the ENV PATH and ENV LD_LIBRARY_PATH lines unchanged.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/publish_staging.yml:
- Line 49: The workflow uses a different image digest for the Docker image
(coasys/ad4m-ci-linux:latest@sha256:0eddf04e4380f892968297a248da05c734f64d089e9e01cf7b89e3ff4328db4c)
than all other workflows and CircleCI (which use
sha256:bffabe1dfc4ef18ca64105318d342ab61c2db946ae6ba16718dcd8d1d57c2cff); either
update this digest to the canonical sha256:bffabe1d... value to match the other
workflows or add a concise inline comment next to the image reference explaining
why this different digest is intentional (e.g., specific staging/CUDA
requirements) so the divergence is documented.

---

Nitpick comments:
In @.circleci/Dockerfile:
- Around line 7-28: Update the long RUN layer that performs apt-get install (the
line starting with "RUN apt-get update && apt-get install -y ...") to add
--no-install-recommends to the apt-get install invocations so apt doesn't pull
recommended packages and the CI Docker image size is reduced; ensure both
apt-get install commands in that RUN use --no-install-recommends and keep the
rest of the package list and chaining unchanged.
- Around line 89-99: The RUN command that installs CUDA toolkit should use
--no-install-recommends for consistency and smaller image size; update the
apt-get install invocations inside the RUN block that downloads and installs
cuda-keyring and cuda-toolkit-12-5 to include --no-install-recommends (i.e.,
change "apt-get install -y gnupg2 wget" and "apt-get install -y
cuda-toolkit-12-5" to use "--no-install-recommends -y"), leaving the ENV PATH
and ENV LD_LIBRARY_PATH lines unchanged.

In @.github/workflows/publish_staging.yml:
- Around line 391-434: Update the outdated GitHub Actions uses in the workflow:
replace actions/checkout@v3 with actions/checkout@v4, actions/setup-go@v4 with
actions/setup-go@v5, actions/setup-python@v4 with actions/setup-python@v5, and
actions/setup-node@v3 with actions/setup-node@v4; edit the corresponding steps
named "Fetch source code", "Install GO", "Use Python 3.11", and "Use Node.js
18.x" to point to the new major versions and verify their inputs (like
node-version, go-version, python-version, and cache) remain compatible after the
bump.
- Around line 451-454: The CI step named "Update cargo git deps (ensure
pre-built V8 from coasys/rusty_v8 tag)" currently suppresses errors with "||
true"; change the step so failures are not silently ignored—capture the exit
status of `cargo update -p v8` (and fallback `cargo update`) and when either
command fails, print a clear diagnostic (e.g., echo a message including stderr)
and either fail the job or emit a warning so the log shows the failure; update
the shell/run command in that step to detect non-zero exit codes and log the
error instead of swallowing it with "|| true".

---

ℹ️ Review info

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 9a2d277 and 8a0d539.

📒 Files selected for processing (12)

• .circleci/Dockerfile
• .circleci/config.yml
• .github/workflows/agent-language-tests.yml
• .github/workflows/direct-message-language-tests.yml
• .github/workflows/file-storage-language-tests.yml
• .github/workflows/p-diff-sync-tests.yml
• .github/workflows/publish.yml
• .github/workflows/publish_staging.yml
• tests/js/email-verification-test-with-setup.sh
• tests/js/scripts/cleanup.js
• tests/js/test-multi-user-with-setup.sh
• tests/js/utils/publishTestLangs.ts

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify the image digests used across workflow files
echo "=== Digests in GitHub workflows ==="
rg -n 'coasys/ad4m-ci-linux:latest@sha256:' .github/workflows/ --no-heading
echo ""
echo "=== Digest in CircleCI config ==="
rg -n 'coasys/ad4m-ci-linux:latest@sha256:' .circleci/config.yml --no-heading

Repository: coasys/ad4m

Length of output: 1668

---

Image digest differs from other workflow files and CircleCI config.

This file uses digest sha256:0eddf04e4380f892968297a248da05c734f64d089e9e01cf7b89e3ff4328db4c (appearing on lines 49, 153, 513, 620), while all other GitHub workflows (publish.yml, agent-language-tests.yml, direct-message-language-tests.yml, file-storage-language-tests.yml, p-diff-sync-tests.yml) and the CircleCI config use sha256:bffabe1dfc4ef18ca64105318d342ab61c2db946ae6ba16718dcd8d1d57c2cff.

If this intentional for staging-specific requirements (e.g., CUDA support), add a comment to document why. Otherwise, align the digests for consistency.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/publish_staging.yml at line 49, The workflow uses a
different image digest for the Docker image
(coasys/ad4m-ci-linux:latest@sha256:0eddf04e4380f892968297a248da05c734f64d089e9e01cf7b89e3ff4328db4c)
than all other workflows and CircleCI (which use
sha256:bffabe1dfc4ef18ca64105318d342ab61c2db946ae6ba16718dcd8d1d57c2cff); either
update this digest to the canonical sha256:bffabe1d... value to match the other
workflows or add a concise inline comment next to the image reference explaining
why this different digest is intentional (e.g., specific staging/CUDA
requirements) so the divergence is documented.