mirror of
https://github.com/pnpm/pnpm.git
synced 2026-05-13 02:55:56 -04:00
Resolves all 30 zizmor alerts reported on main after #11607: - template-injection (19): move `${{ ... }}` interpolations in `run:` blocks to `env:` so untrusted-ish values (workflow_dispatch inputs, github.ref_name, github.actor) can't break out of shell quoting. - artipacked (8): add `persist-credentials: false` to `actions/checkout` in audit, benchmark, ci, codeql-analysis, docker, release, test workflows. `update-lockfile.yml` keeps the persisted token (later step pushes to a branch) with a `zizmor: ignore[artipacked]` comment and justification. - dependabot-cooldown (1): add a 7-day cooldown so brand-new (potentially malicious) Actions releases don't get auto-PR'd day-of-release. - ref-version-mismatch (1): `bluwy/release-for-reddit-action` SHA pointed at the `v2` tag, not a non-existent `v2.0.0`. Fix the comment. - superfluous-actions (1): mark `softprops/action-gh-release` with a `zizmor: ignore` and justification — the release pipeline is sensitive and the action is battle-tested; we're not swapping it for `gh release` here. Verified locally with `zizmor --persona regular .github` (online audits on): No findings to report. Good job! (2 ignored, 32 suppressed) --- Written by an agent (Claude Code, claude-opus-4-7).
130 lines
4.0 KiB
YAML
130 lines
4.0 KiB
YAML
name: Benchmarks
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
pr_number:
|
|
description: 'PR number to benchmark (works with fork PRs too)'
|
|
required: false
|
|
default: ''
|
|
type: string
|
|
runs:
|
|
description: 'Number of benchmark runs per scenario'
|
|
required: false
|
|
default: '10'
|
|
type: string
|
|
warmup:
|
|
description: 'Number of warmup runs before timing'
|
|
required: false
|
|
default: '1'
|
|
type: string
|
|
|
|
permissions:
|
|
contents: read
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
benchmark:
|
|
name: Run Benchmarks
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 180
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
|
|
- name: Checkout PR head
|
|
if: inputs.pr_number != ''
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
PR_NUMBER: ${{ inputs.pr_number }}
|
|
run: |
|
|
echo "Fetching PR #$PR_NUMBER head..."
|
|
git fetch origin "refs/pull/${PR_NUMBER}/head:refs/remotes/origin/pr-${PR_NUMBER}"
|
|
git checkout "origin/pr-${PR_NUMBER}"
|
|
echo "Checked out PR #$PR_NUMBER at $(git rev-parse --short HEAD)"
|
|
|
|
- name: Install pnpm and Node
|
|
uses: pnpm/setup@b1cac37306e39c21283b9dd6cb0ac288fb35ba6b
|
|
with:
|
|
runtime: node@26.0.0
|
|
|
|
- name: Install hyperfine
|
|
run: |
|
|
wget -q https://github.com/sharkdp/hyperfine/releases/download/v1.18.0/hyperfine_1.18.0_amd64.deb
|
|
sudo dpkg -i hyperfine_1.18.0_amd64.deb
|
|
|
|
- name: Compile
|
|
run: pnpm run compile
|
|
|
|
- name: Run benchmarks
|
|
id: bench
|
|
continue-on-error: true
|
|
run: |
|
|
set -o pipefail
|
|
./benchmarks/bench.sh 2>&1 | tee bench-output.txt
|
|
BENCH_DIR=$(grep "Temp directory kept at:" bench-output.txt | sed 's/Temp directory kept at: //')
|
|
echo "bench_dir=$BENCH_DIR" >> "$GITHUB_OUTPUT"
|
|
env:
|
|
RUNS: ${{ inputs.runs }}
|
|
WARMUP: ${{ inputs.warmup }}
|
|
|
|
- name: Comment on PR
|
|
if: steps.bench.outputs.bench_dir != ''
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
BENCH_DIR: ${{ steps.bench.outputs.bench_dir }}
|
|
INPUT_PR_NUMBER: ${{ inputs.pr_number }}
|
|
REF_NAME: ${{ github.ref_name }}
|
|
RUN_ID: ${{ github.run_id }}
|
|
SERVER_URL: ${{ github.server_url }}
|
|
REPO: ${{ github.repository }}
|
|
RUNS: ${{ inputs.runs }}
|
|
ACTOR: ${{ github.actor }}
|
|
run: |
|
|
RESULTS_FILE="$BENCH_DIR/results.md"
|
|
|
|
if [ ! -f "$RESULTS_FILE" ]; then
|
|
echo "::warning::Results file not found at $RESULTS_FILE"
|
|
exit 0
|
|
fi
|
|
|
|
echo "--- Benchmark Results ---"
|
|
cat "$RESULTS_FILE"
|
|
echo "-------------------------"
|
|
|
|
if [ -n "$INPUT_PR_NUMBER" ]; then
|
|
PR_NUMBER="$INPUT_PR_NUMBER"
|
|
else
|
|
PR_NUMBER=$(gh pr list --head "$REF_NAME" --json number --jq '.[0].number' 2>/dev/null || echo "")
|
|
fi
|
|
|
|
if [ -z "$PR_NUMBER" ]; then
|
|
echo "::notice::No open PR found for branch $REF_NAME. Results printed above."
|
|
exit 0
|
|
fi
|
|
|
|
MARKER="<!-- pnpm-benchmark-results -->"
|
|
{
|
|
echo "$MARKER"
|
|
cat "$RESULTS_FILE"
|
|
echo ""
|
|
echo "_Run [${RUN_ID}](${SERVER_URL}/${REPO}/actions/runs/${RUN_ID}) · ${RUNS} runs per scenario · triggered by @${ACTOR}_"
|
|
} > /tmp/comment-body.md
|
|
|
|
COMMENT_ID=$(gh api "repos/${REPO}/issues/${PR_NUMBER}/comments" \
|
|
--jq "[.[] | select(.body | startswith(\"$MARKER\"))] | .[0].id // empty" 2>/dev/null || echo "")
|
|
|
|
if [ -n "$COMMENT_ID" ]; then
|
|
echo "Updating existing benchmark comment $COMMENT_ID on PR #$PR_NUMBER"
|
|
gh api "repos/${REPO}/issues/comments/${COMMENT_ID}" \
|
|
-X PATCH \
|
|
-F "body=@/tmp/comment-body.md"
|
|
else
|
|
echo "Creating new benchmark comment on PR #$PR_NUMBER"
|
|
gh pr comment "$PR_NUMBER" --body-file /tmp/comment-body.md
|
|
fi
|