fix(render): cancel on SIGINT/SIGTERM so deferred cleanup runs

[jcogilvie]

Description of your changes

Stacked on #402 (→ #404 → #408); only the top two commits are new in this PR.

Interrupting crossplane render (Ctrl+C / SIGTERM) mid-render leaked every Function container, the crossplane internal render container and the temporary network. All of that cleanup is defer-based, but nothing converted SIGINT/SIGTERM into context cancellation, and the spinner's only signal handler called os.Exit(130), which skips defers.

Signal handling (fix(render): cancel on SIGINT/SIGTERM so deferred cleanup runs)

• cmd/crossplane/main.go: derive a context with signal.NotifyContext(ctx, os.Interrupt, syscall.SIGTERM) and bind it into kong as context.Context. If the run was interrupted, the process prints any error and exits 130.
• render xr / render op: Run now takes the bound context.Context and bases its timeout context on it, so an interrupt cancels in-flight work and the deferred cleanup runs. The deferred closure from fix(render): warn on stderr when function runtimes can't be cleaned up #402 passes that ctx to StopFunctionRuntimes, which (as of fix(render): stop every function runtime gracefully and always remove Remove-policy containers #404) detaches cancellation internally with context.WithoutCancel, so cleanup still works after an interrupt. No //nolint:contextcheck is needed.
• internal/terminal/spinner.go: the spinner no longer installs a signal handler or calls os.Exit. Signals are handled once for all commands in main. Spinner lifetime is handled once by the SpinnerPrinter wrappers, which start the spinner, run the wrapped func, then stop it, so a spinner stops when cancellation makes the wrapped func return.

Attach fix (fix(docker): unblock container attach read on context cancellation)

RunContainer blocked in stdcopy.StdCopy on the attach stream, and that call never checks ctx. So even after cancellation, the run waited until the render container exited by itself. RunContainer now closes the attach connection via context.AfterFunc(ctx, ...), and on cancellation it returns a wrapped ctx.Err() (context canceled) instead of the raw read error. The existing deferred force-remove then tears down the container.

Measured with a Function that hangs: before, cleanup finished ~115s after SIGINT. Re-verified on this stacked branch: the process exits 130 ~0.3s after SIGINT. The two fnlc-sigint-* Function containers, the crossplane/crossplane:stable render container and the crossplane-render-* network were all present mid-run and all gone afterwards.

Second signal

I checked what happens on a second Ctrl+C while a pretty spinner is running. Setup: crossplane dependency add http://127.0.0.1:18765/crds.yaml against a local server that accepts connections and never responds, run under a pseudo-TTY with script. This command still uses context.Background(), so the first SIGINT doesn't stop it and the spinner keeps running. Then I sent a second SIGINT.

• With the default handler restored after the first signal (the previous revision of this PR), the second SIGINT killed the process. The captured output contained \x1b[?25l (hide cursor) and \x1b[?2004h (bracketed paste on) with no matching \x1b[?25h or \x1b[?2004l. The terminal was left with a hidden cursor and bracketed paste enabled. As a control, a normal spinner stop emits \x1b[?25h\x1b[?2004l.
• So main now handles the second signal itself, once for all commands. After the first signal it listens for another SIGINT/SIGTERM. When one arrives, it writes ansi.ShowCursor + ansi.ResetModeBracketedPaste to stderr (only if stderr is a terminal) and calls os.Exit(130). Re-tested: the process exits 0.06s after the second SIGINT, and the output ends in \x1b[?25h\x1b[?2004l. With stderr redirected to a file, nothing extra is written.

A second signal still skips the remaining cleanup by design. That's the escape hatch if cleanup itself hangs.

Other commands

The root context is only injected into commands that ask for a context.Context in Run. Today that's just the two render commands. Other commands still build their own context.Background(), so they don't react to cancellation. Because NotifyContext now catches the first SIGINT for every command, an interrupted non-render command keeps running until it finishes and then exits 130. Before this change it died immediately. A second Ctrl+C exits immediately, as described above. Wiring the remaining commands to the bound context can be a follow-up.

Testing

I updated the existing render tests for the new Run signature. I didn't add a new automated test: this behaviour is signal and process-exit wiring, and testing it needs a subprocess harness. I verified it manually with Docker and a pseudo-TTY, as described above.

Fixes #400

I have:

• Read and followed Crossplane's contribution process.
• Run ./nix.sh flake check to ensure this PR is ready for review.
• Added or updated unit tests. I only updated existing tests for the signature change (see above).
• Linked a PR or a docs tracking issue to document this change.
• Added backport release-x.y labels to auto-backport this PR.

Need help with this checklist? See the cheat sheet.

🤖 Generated with Claude Code