Fix input file descriptor leak across multi-file evaluation

[fzlzjerry]

Summary

• return an owned io.ReadCloser from readStream
• close each input within a per-file scope in both streaming and all-at-once evaluators
• keep readers passed to ReadDocuments caller-owned
• add low file-descriptor acceptance coverage for eval and eval-all

Root cause

readStream wrapped each opened *os.File in a *bufio.Reader. The evaluator cleanup type-switch therefore could not reach the underlying file, so descriptors accumulated until garbage collection or process exit.

The new per-file helpers defer closing the owned reader, covering both successful evaluation and error returns without retaining descriptors for the full multi-file run.

User impact

Multi-file commands now work under low file-descriptor limits instead of failing partway through with too many open files.

Fixes #2796.

Validation

• bash acceptance_tests/file-descriptors.sh
• original prlimit --nofile=32:32 reproduction for both eval and eval-all
• full bash scripts/acceptance.sh
• full Go tests with only the independently reproduced baseline TestTomlScenarios failure skipped
• go test -tags goinstall -run TestGoInstallCompatibility .
• make test: formatting, spelling, gosec, and golangci-lint passed; the Go test phase hit the same TOML error-message mismatch reproduced on clean origin/master

[Copilot]

Pull request overview

This PR fixes a file-descriptor leak when evaluating many input files by ensuring that readers created by readStream are closable and then closed within a per-file scope in both the streaming (eval) and all-at-once (eval-all) evaluators. It also clarifies ownership by keeping ReadDocuments caller-owned (i.e., it no longer closes the provided reader).

Changes:

• Change readStream to return an owned io.ReadCloser (wrapping *os.File behind a closable reader) and remove EOF-time closing from readDocuments.
• Introduce per-file helpers that defer SafelyCloseReader(...) so each input is closed promptly on both success and error paths.
• Add regression coverage: a Go unit test asserting ReadDocuments does not close caller-owned readers, plus an acceptance test that runs under a low ulimit -n for both eval and eval-all.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
pkg/yqlib/utils.go	Makes readStream return an owned io.ReadCloser and removes implicit closing from readDocuments to enforce caller ownership.
pkg/yqlib/stream_evaluator.go	Closes each per-file reader via a helper that defers SafelyCloseReader, preventing FD accumulation in eval.
pkg/yqlib/all_at_once_evaluator.go	Adds a helper that opens+reads+closes per file, preventing FD accumulation in eval-all.
pkg/yqlib/file_utils.go	Extends SafelyCloseReader to close any io.Closer, enabling safe closure of wrapped readers.
pkg/yqlib/front_matter_test.go	Updates test to explicitly close the reader it opened (since readDocuments no longer closes).
pkg/yqlib/all_at_once_evaluator_test.go	Adds a unit test verifying ReadDocuments leaves caller-owned readers open.
acceptance_tests/file-descriptors.sh	Adds a low-file-descriptor acceptance test for both eval and eval-all.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.