feat: modular architecture, memory-safe concurrency, and OOM protection

- Refactor handlers into modular packages (objects/, multipart/, routing/)
- Memory-based concurrency limiting with backpressure (replaces count-based)
- Accurate memory accounting for encrypted GETs and streaming PUTs
- Container-based OOM proof test (256MB container, 5GB+ data survives)
- Redis state management with automatic recovery
- Split CI into parallel unit/integration jobs, separate OOM workflow
- Comprehensive unit and integration test suites (300+ tests)
- Hardened error handling, XML escaping, and streaming safety
- Helm chart restructured with PDB and standardized labels

Author: ServerSideHannes

.github/workflows/cluster-test.yml

@@ -3,7 +3,7 @@ name: Build and Push Docker Image
 on:
   push:
     branches: [main]
-    tags: ['v*']
+    tags: ['*']
 
 jobs:
   build-and-push:
@@ -20,8 +20,8 @@ jobs:
         id: tags
         run: |
           OWNER=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')
-          if [[ "$GITHUB_REF" == refs/tags/v* ]]; then
-            VERSION=${GITHUB_REF#refs/tags/v}
+          if [[ "$GITHUB_REF" == refs/tags/* ]]; then
+            VERSION=${GITHUB_REF#refs/tags/}
             echo "tags=ghcr.io/${OWNER}/s3proxy-python:${VERSION}" >> $GITHUB_OUTPUT
           else
             echo "tags=ghcr.io/${OWNER}/s3proxy-python:latest" >> $GITHUB_OUTPUT

.github/workflows/docker-publish.yml

@@ -3,7 +3,7 @@ name: Helm Lint
 on:
   pull_request:
     paths:
-      - 'manifests/**'
+      - 'chart/**'
 
 jobs:
   helm-lint:
@@ -22,12 +22,12 @@ jobs:
 
       - name: Update Helm dependencies
         run: |
-          helm dependency update manifests/
+          helm dependency update chart/
 
       - name: Lint Helm chart
         run: |
-          helm lint manifests/
+          helm lint chart/
 
       - name: Validate Helm template
         run: |
-          helm template s3proxy manifests/ --debug > /dev/null
+          helm template s3proxy chart/ --debug > /dev/null

.github/workflows/helm-lint.yml

@@ -3,7 +3,7 @@ name: Package and Push Helm Chart
 on:
   push:
     branches: [main]
-    tags: ['v*']
+    tags: ['*']
 
 jobs:
   helm-publish:
@@ -30,30 +30,30 @@ jobs:
 
       - name: Update Helm dependencies
         run: |
-          helm dependency update manifests/
+          helm dependency update chart/
 
       - name: Get version
         id: version
         run: |
-          if [[ "$GITHUB_REF" == refs/tags/v* ]]; then
-            VERSION=${GITHUB_REF#refs/tags/v}
+          if [[ "$GITHUB_REF" == refs/tags/* ]]; then
+            VERSION=${GITHUB_REF#refs/tags/}
           else
             VERSION="0.0.0-latest"
           fi
           echo "version=$VERSION" >> $GITHUB_OUTPUT
 
       - name: Update chart version
         run: |
-          sed -i "s/^version:.*/version: ${{ steps.version.outputs.version }}/" manifests/Chart.yaml
-          sed -i "s/^appVersion:.*/appVersion: \"${{ steps.version.outputs.version }}\"/" manifests/Chart.yaml
+          sed -i "s/^version:.*/version: ${{ steps.version.outputs.version }}/" chart/Chart.yaml
+          sed -i "s/^appVersion:.*/appVersion: \"${{ steps.version.outputs.version }}\"/" chart/Chart.yaml
 
       - name: Lint Helm chart
         run: |
-          helm lint manifests/
+          helm lint chart/
 
       - name: Package Helm chart
         run: |
-          helm package manifests/ --destination .
+          helm package chart/ --destination .
 
       - name: Push Helm chart to OCI registry
         run: |

.github/workflows/helm-publish.yml

@@ -0,0 +1,20 @@
+name: Lint
+
+on:
+  push:
+
+jobs:
+  ruff:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Install ruff
+        run: pipx install ruff
+
+      - name: Ruff check
+        run: ruff check .
+
+      - name: Ruff format
+        run: ruff format --check .

.github/workflows/lint.yml

@@ -0,0 +1,31 @@
+name: OOM Proof Test
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 's3proxy/**'
+      - 'tests/**'
+  workflow_dispatch:
+
+jobs:
+  oom-test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.14'
+          cache: 'pip'
+
+      - name: Install uv
+        run: pip install uv
+
+      - name: Install dependencies
+        run: uv sync --extra dev
+
+      - name: OOM proof test (256MB container)
+        run: make test-oom