Files
pnpm/.github/workflows/benchmark.yml
Zoltan Kochan 6b2a955a15 ci: address zizmor findings across workflows (#11608)
Resolves all 30 zizmor alerts reported on main after #11607:

- template-injection (19): move `${{ ... }}` interpolations in `run:` blocks
  to `env:` so untrusted-ish values (workflow_dispatch inputs, github.ref_name,
  github.actor) can't break out of shell quoting.
- artipacked (8): add `persist-credentials: false` to `actions/checkout` in
  audit, benchmark, ci, codeql-analysis, docker, release, test workflows.
  `update-lockfile.yml` keeps the persisted token (later step pushes to a
  branch) with a `zizmor: ignore[artipacked]` comment and justification.
- dependabot-cooldown (1): add a 7-day cooldown so brand-new (potentially
  malicious) Actions releases don't get auto-PR'd day-of-release.
- ref-version-mismatch (1): `bluwy/release-for-reddit-action` SHA pointed at
  the `v2` tag, not a non-existent `v2.0.0`. Fix the comment.
- superfluous-actions (1): mark `softprops/action-gh-release` with a
  `zizmor: ignore` and justification — the release pipeline is sensitive and
  the action is battle-tested; we're not swapping it for `gh release` here.

Verified locally with `zizmor --persona regular .github` (online audits on):
  No findings to report. Good job! (2 ignored, 32 suppressed)

---
Written by an agent (Claude Code, claude-opus-4-7).
2026-05-12 22:03:41 +02:00

130 lines
4.0 KiB
YAML

name: Benchmarks
on:
workflow_dispatch:
inputs:
pr_number:
description: 'PR number to benchmark (works with fork PRs too)'
required: false
default: ''
type: string
runs:
description: 'Number of benchmark runs per scenario'
required: false
default: '10'
type: string
warmup:
description: 'Number of warmup runs before timing'
required: false
default: '1'
type: string
permissions:
contents: read
pull-requests: write
jobs:
benchmark:
name: Run Benchmarks
runs-on: ubuntu-latest
timeout-minutes: 180
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
persist-credentials: false
- name: Checkout PR head
if: inputs.pr_number != ''
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
PR_NUMBER: ${{ inputs.pr_number }}
run: |
echo "Fetching PR #$PR_NUMBER head..."
git fetch origin "refs/pull/${PR_NUMBER}/head:refs/remotes/origin/pr-${PR_NUMBER}"
git checkout "origin/pr-${PR_NUMBER}"
echo "Checked out PR #$PR_NUMBER at $(git rev-parse --short HEAD)"
- name: Install pnpm and Node
uses: pnpm/setup@b1cac37306e39c21283b9dd6cb0ac288fb35ba6b
with:
runtime: node@26.0.0
- name: Install hyperfine
run: |
wget -q https://github.com/sharkdp/hyperfine/releases/download/v1.18.0/hyperfine_1.18.0_amd64.deb
sudo dpkg -i hyperfine_1.18.0_amd64.deb
- name: Compile
run: pnpm run compile
- name: Run benchmarks
id: bench
continue-on-error: true
run: |
set -o pipefail
./benchmarks/bench.sh 2>&1 | tee bench-output.txt
BENCH_DIR=$(grep "Temp directory kept at:" bench-output.txt | sed 's/Temp directory kept at: //')
echo "bench_dir=$BENCH_DIR" >> "$GITHUB_OUTPUT"
env:
RUNS: ${{ inputs.runs }}
WARMUP: ${{ inputs.warmup }}
- name: Comment on PR
if: steps.bench.outputs.bench_dir != ''
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
BENCH_DIR: ${{ steps.bench.outputs.bench_dir }}
INPUT_PR_NUMBER: ${{ inputs.pr_number }}
REF_NAME: ${{ github.ref_name }}
RUN_ID: ${{ github.run_id }}
SERVER_URL: ${{ github.server_url }}
REPO: ${{ github.repository }}
RUNS: ${{ inputs.runs }}
ACTOR: ${{ github.actor }}
run: |
RESULTS_FILE="$BENCH_DIR/results.md"
if [ ! -f "$RESULTS_FILE" ]; then
echo "::warning::Results file not found at $RESULTS_FILE"
exit 0
fi
echo "--- Benchmark Results ---"
cat "$RESULTS_FILE"
echo "-------------------------"
if [ -n "$INPUT_PR_NUMBER" ]; then
PR_NUMBER="$INPUT_PR_NUMBER"
else
PR_NUMBER=$(gh pr list --head "$REF_NAME" --json number --jq '.[0].number' 2>/dev/null || echo "")
fi
if [ -z "$PR_NUMBER" ]; then
echo "::notice::No open PR found for branch $REF_NAME. Results printed above."
exit 0
fi
MARKER="<!-- pnpm-benchmark-results -->"
{
echo "$MARKER"
cat "$RESULTS_FILE"
echo ""
echo "_Run [${RUN_ID}](${SERVER_URL}/${REPO}/actions/runs/${RUN_ID}) · ${RUNS} runs per scenario · triggered by @${ACTOR}_"
} > /tmp/comment-body.md
COMMENT_ID=$(gh api "repos/${REPO}/issues/${PR_NUMBER}/comments" \
--jq "[.[] | select(.body | startswith(\"$MARKER\"))] | .[0].id // empty" 2>/dev/null || echo "")
if [ -n "$COMMENT_ID" ]; then
echo "Updating existing benchmark comment $COMMENT_ID on PR #$PR_NUMBER"
gh api "repos/${REPO}/issues/comments/${COMMENT_ID}" \
-X PATCH \
-F "body=@/tmp/comment-body.md"
else
echo "Creating new benchmark comment on PR #$PR_NUMBER"
gh pr comment "$PR_NUMBER" --body-file /tmp/comment-body.md
fi