ci: gate every job that builds the frontend, and scope the check in its header

release.yaml (all three jobs), sites.yaml and release-assets.yaml run the same cold production build that the review jobs do, so they get the same pre-install check.

The header now says what the check rules out (an undersized box) and what it does not (two jobs sharing one box), so the MemAvailable warning is not read as a gate.

.gitea/scripts/check-runner-memory.sh

@@ -19,6 +19,12 @@
 # kernel. A 4 GB box reports under 4000 MB, so 7 GB separates the two sizes
 # with room for a box that reserves a little more than ours do.
 #
+# What this does not catch is oversubscription: two client jobs landing on one
+# box. A box that passes the floor can still OOM a build when another job is
+# resident, and MemAvailable at start is the only sign of it - that is reported
+# as a warning, not a failure, because a busy box is transient where a small
+# box is not. Keep one client job per runner.
+#
 # Usage: check-runner-memory.sh [min_total_mb]
 #   or:  MIN_TOTAL_MB=4096 check-runner-memory.sh
 set -euo pipefail

.gitea/workflows/release-assets.yaml

@@ -34,6 +34,10 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+      - name: Check runner size
+        # Builds the same frontend as the release jobs; an undersized runner
+        # fails inside the build - see the script.
+        run: bash .gitea/scripts/check-runner-memory.sh
       - uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VERSION }}

.gitea/workflows/release.yaml

@@ -18,6 +18,11 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+      - name: Check runner size
+        # A release job that OOMs costs the tag as well as the slot; fail in
+        # seconds on an undersized runner instead of twenty minutes in - see
+        # the script.
+        run: bash .gitea/scripts/check-runner-memory.sh
       - uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VERSION }}
@@ -91,6 +96,10 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+      - name: Check runner size
+        # The development build plus a browser: same undersized-runner failure
+        # as the review jobs, on the path that makes the tag - see the script.
+        run: bash .gitea/scripts/check-runner-memory.sh
       - uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VERSION }}
@@ -257,6 +266,10 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+      - name: Check runner size
+        # This job builds the frontend twice (webdoc and the release check);
+        # both die the same way on an undersized runner - see the script.
+        run: bash .gitea/scripts/check-runner-memory.sh
       - uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VERSION }}

.gitea/workflows/sites.yaml

@@ -38,6 +38,10 @@ jobs:
           # The tag is what the client's build stamp describes (src/version.ts
           # runs git-describe), so the demo build needs the tags in the clone.
           fetch-depth: 0
+      - name: Check runner size
+        # The demo build is the same cold production build; an undersized
+        # runner fails inside it - see the script.
+        run: bash .gitea/scripts/check-runner-memory.sh
       - uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VERSION }}