[dukelion]

When running 100+ HTTP checks concurrently, response bodies were not always closed after validation. This caused unclosed TCP connections to accumulate, holding TLS state and transport buffers until the client timeout expired, leading to OOM kills under memory limits.

Checklist

• make test-all (UNIX) passes. CI will also test this
• unit and/or integration tests are included (if applicable)
• documentation is changed or added (if applicable)

Description of change

Fixes OOM when goss is configured with many HTTP checks and limited RAM.

• Add Close() to the system.HTTP interface and DefHTTP
• Defer sysHTTP.Close() from HTTP resource validation for guaranteed cleanup
• Always close resp.Body when Close() is called, including after a body matcher reads it
• Add a unit test covering close-after-body-read behavior

[kgaughan]

Hi! I fixed the integration test pipelines recently. Could you rebase or merge from master? I checked you integration test failures, and most if not all of them would be fixed by that.

[dukelion]

Rebased this branch onto current goss-org/master and force-pushed with lease.

I also tightened the cleanup path so DefHTTP.Close() closes resp.Body even after a body matcher reads it, and added a focused unit test for that lifecycle.

Local validation run on Windows:

• go test ./system -run TestDefHTTPCloseClosesBodyAfterBodyRead
• go test ./resource
• git diff --check HEAD~1..HEAD

[leemeo3]

I took a look at the current failing Ubuntu check for this PR.

Evidence:

• Failing job: Integration tests (ubuntu-latest) in https://github.com/goss-org/goss/actions/runs/27196730484/job/85238831313
• Failing command path: make test-int-all -> cd integration-tests/ && ./test.sh bullseye 386
• In this PR run, integration-tests/test.sh could not find Dockerfile_bullseye.md5, rebuilt ghcr.io/goss-org/goss_integration_bullseye:latest, and Debian bullseye currently installs apache2 2.4.67-1~deb11u3.
• The validation still expects 2.4.67-1~deb11u2, so bullseye-32 fails with Count: 127, Failed: 1, Skipped: 5.
• This PR's own diff only touches resource/http.go, system/http.go, and system/http_test.go; I locally checked the focused test from the PR with go test ./system -run TestDefHTTPCloseClosesBodyAfterBodyRead, and it passes.
• Current master has a passing Integration tests run at https://github.com/goss-org/goss/actions/runs/28747084644, and its integration-tests/test.sh now unconditionally pulls the published integration image instead of rebuilding it locally.

Given that, this looks more like the branch being behind current master integration-test infrastructure than a failure caused by the HTTP response-body cleanup itself. A rebase onto current master and rerun of CI looks like the least invasive next step.

I did not open a separate PR because changing the integration test golden package versions or image behavior would be broader than this PR's HTTP cleanup scope and may overlap with the ongoing release/pipeline work.

AI assistance disclosure: I used Codex to help inspect logs and compare branches, then reviewed the evidence and local command results before posting.

[kgaughan]

The problem is the lack is the .md5 file. That's used to determine if an image should be built from scratch. It's an easy fix, but annoying that I missed it when fixing the integration tests.

[kgaughan]

I know what the issue is. @dukelion or @aelsabbahy, could one of you merge from master? The issue is that this PR is still using an older version of integration-tests/test.sh.

[aelsabbahy]

Merging based on discussion here: #1049 (comment)