Change cache to avoid memory use

Orignally, the cache was intended to be long lived to handle incoming webhooks at any time. Currently, we are just polling, and just need the cache to handle a single "EnforceAll" run, where we hit the same paths multiple times in that run. Therefore, change the cache to be per-installation, and free it after each "EnforceAll". Signed-off-by: Jeff Mendoza <[email protected]>
ossf · Mar 7, 2024 · 7d718eb · 7d718eb
1 parent 24b20ac
commit 7d718eb
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 9 deletions.
diff --git a/pkg/enforce/enforce.go b/pkg/enforce/enforce.go
@@ -156,6 +156,7 @@ func EnforceAll(ctx context.Context, ghc ghclients.GhClientsInterface, specificP
 				}
 				enforceAllResults[policyName]["totalFailed"] += results["totalFailed"]
 			}
+			ghc.Free(iid)
 			mu.Unlock()
 
 			if err != nil {
@@ -170,7 +171,6 @@ func EnforceAll(ctx context.Context, ghc ghclients.GhClientsInterface, specificP
 	if err := g.Wait(); err != nil {
 		return enforceAllResults, err
 	}
-	ghc.LogCacheSize()
 	log.Info().
 		Str("area", "bot").
 		Int("count", repoCount).

diff --git a/pkg/ghclients/ghclients.go b/pkg/ghclients/ghclients.go
@@ -49,15 +49,14 @@ func init() {
 
 type GhClientsInterface interface {
 	Get(i int64) (*github.Client, error)
-	LogCacheSize()
+	Free(i int64)
 }
 
 // GHClients stores clients per-installation for re-use throughout a process.
 type GHClients struct {
 	clients map[int64]*github.Client
 	tr      http.RoundTripper
 	key     []byte
-	cache   *memoryCache
 }
 
 // NewGHClients returns a new GHClients. The provided RoundTripper will be
@@ -71,10 +70,13 @@ func NewGHClients(ctx context.Context, t http.RoundTripper) (*GHClients, error)
 		clients: make(map[int64]*github.Client),
 		tr:      t,
 		key:     key,
-		cache:   newMemoryCache(),
 	}, nil
 }
 
+func (g *GHClients) Free(i int64) {
+	delete(g.clients, i)
+}
+
 // Get gets the client for installation id i, If i is 0 it gets the client for
 // the app-level api. If a stored client is not available, it creates a new
 // client with auth and caching built in.
@@ -85,7 +87,7 @@ func (g *GHClients) Get(i int64) (*github.Client, error) {
 
 	ctr := &httpcache.Transport{
 		Transport:           g.tr,
-		Cache:               g.cache,
+		Cache:               newMemoryCache(),
 		MarkCachedResponses: true,
 	}
 
@@ -103,10 +105,6 @@ func (g *GHClients) Get(i int64) (*github.Client, error) {
 	return g.clients[i], nil
 }
 
-func (g *GHClients) LogCacheSize() {
-	g.cache.LogCacheSize()
-}
-
 func getKeyFromSecretReal(ctx context.Context, keySecretVal string) ([]byte, error) {
 	v, err := runtimevar.OpenVariable(ctx, keySecretVal)
 	if err != nil {