Publish Nitro Performance #119
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish Nitro Performance | |
| on: | |
| workflow_run: | |
| workflows: [Nitro Performance] | |
| types: [completed] | |
| permissions: | |
| actions: read | |
| contents: read | |
| pull-requests: write | |
| jobs: | |
| publish: | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Checkout trusted publishing code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 | |
| with: | |
| bun-version: 1.3.14 | |
| - name: Select exact report artifact | |
| id: select | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: bun scripts/performance/select-report.ts | |
| - name: Download performance report | |
| id: download | |
| if: steps.select.outputs.artifact_id != '' | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| artifact-ids: ${{ steps.select.outputs.artifact_id }} | |
| path: untrusted-artifact | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| run-id: ${{ github.event.workflow_run.id }} | |
| - name: Validate publication provenance | |
| id: validate | |
| if: steps.download.outcome == 'success' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| EVENT_NAME=$(jq -r '.workflow_run.event' "$GITHUB_EVENT_PATH") | |
| TRUSTED_PR_ARGUMENTS=() | |
| if [[ "$EVENT_NAME" == 'pull_request' ]]; then | |
| PR_NUMBER=$(jq -r '.pullRequestNumber' untrusted-artifact/metadata.json) | |
| if [[ ! "$PR_NUMBER" =~ ^[1-9][0-9]*$ ]]; then | |
| echo 'Invalid pull request number in performance artifact.' >&2 | |
| exit 1 | |
| fi | |
| gh api "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER" > trusted-pull-request.json | |
| TRUSTED_PR_ARGUMENTS=(--trusted-pull-request trusted-pull-request.json) | |
| fi | |
| bun scripts/performance/validate-report.ts \ | |
| --artifact-directory untrusted-artifact \ | |
| --output-directory validated-report \ | |
| --expected-repository "$GITHUB_REPOSITORY" \ | |
| --trusted-workflow-event "$GITHUB_EVENT_PATH" \ | |
| "${TRUSTED_PR_ARGUMENTS[@]}" | |
| - name: Create Nitro Modules Bot token | |
| id: performance-bot-token | |
| if: steps.download.outcome == 'success' && steps.validate.outputs.stale != 'true' && vars.NITRO_PERFORMANCE_APP_CLIENT_ID != '' && github.event.workflow_run.event == 'pull_request' | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3 | |
| with: | |
| client-id: ${{ vars.NITRO_PERFORMANCE_APP_CLIENT_ID }} | |
| private-key: ${{ secrets.NITRO_PERFORMANCE_APP_PRIVATE_KEY }} | |
| permission-pull-requests: write | |
| - name: Post paired comparison to the PR | |
| if: steps.download.outcome == 'success' && steps.validate.outputs.stale != 'true' | |
| env: | |
| GITHUB_TOKEN: ${{ steps.performance-bot-token.outputs.token || secrets.GITHUB_TOKEN }} | |
| GITHUB_APP_SLUG: ${{ steps.performance-bot-token.outputs.app-slug }} | |
| run: bun scripts/performance/github-report.ts --directory validated-report | |
| - name: Install Bencher CLI | |
| if: steps.download.outcome == 'success' && steps.validate.outputs.stale != 'true' | |
| uses: bencherdev/bencher@8d75325c3bc59403a2186a056b472c4f49d42838 # v0.6.12 | |
| with: | |
| version: '0.6.12' | |
| - name: Verify pinned Bencher binary | |
| if: steps.download.outcome == 'success' && steps.validate.outputs.stale != 'true' | |
| run: | | |
| printf '%s %s\n' 'c2d3a6a7fae654246134e5ced1408bdb9ba4e198b0ac3b903af17a06574a7e08' "$(command -v bencher)" | sha256sum --check - | |
| - name: Publish Bencher history | |
| if: steps.download.outcome == 'success' && steps.validate.outputs.stale != 'true' | |
| env: | |
| BENCHER_API_KEY: ${{ secrets.BENCHER_KEY }} | |
| BENCHER_PROJECT: nitro | |
| run: bun scripts/performance/publish.ts --directory validated-report --data-directory untrusted-artifact |