Publish Nitro Performance #187
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish Nitro Performance | |
| on: | |
| workflow_run: | |
| workflows: [Nitro Performance] | |
| types: [in_progress, completed] | |
| # Share the request job's lock so an older publisher cannot overwrite a new request. | |
| concurrency: | |
| group: performance-status-${{ github.event.workflow_run.display_title }} | |
| queue: max | |
| permissions: | |
| actions: read | |
| contents: read | |
| pull-requests: write | |
| statuses: write | |
| jobs: | |
| publish: | |
| if: github.event.workflow_run.event == 'issue_comment' | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Checkout trusted publishing code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 | |
| with: | |
| bun-version: 1.3.14 | |
| - name: Select exact report artifact | |
| id: select | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: bun scripts/performance/select-report.ts | |
| - name: Download performance request | |
| id: request | |
| if: ${{ !cancelled() && steps.select.outputs.request_artifact_id != '' }} | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| artifact-ids: ${{ steps.select.outputs.request_artifact_id }} | |
| path: performance-request | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| run-id: ${{ github.event.workflow_run.id }} | |
| - name: Validate requested commit | |
| id: request-validation | |
| if: ${{ !cancelled() && steps.request.outcome == 'success' }} | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: bun scripts/performance/workflow-status.ts --directory performance-request --mode validate | |
| - name: Download performance report | |
| id: download | |
| if: steps.select.outputs.artifact_id != '' | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| artifact-ids: ${{ steps.select.outputs.artifact_id }} | |
| path: untrusted-artifact | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| run-id: ${{ github.event.workflow_run.id }} | |
| - name: Validate publication provenance | |
| id: validate | |
| if: steps.download.outcome == 'success' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| set -euo pipefail | |
| # The run name is set by the default-branch workflow using the triggering PR. | |
| PR_NUMBER=$(jq -er '.workflow_run.display_title | capture("^Nitro Performance for PR #(?<number>[1-9][0-9]*)$").number' "$GITHUB_EVENT_PATH") | |
| gh api "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER" > trusted-pull-request.json | |
| bun scripts/performance/validate-report.ts \ | |
| --artifact-directory untrusted-artifact \ | |
| --output-directory validated-report \ | |
| --expected-repository "$GITHUB_REPOSITORY" \ | |
| --trusted-workflow-event "$GITHUB_EVENT_PATH" \ | |
| --trusted-pull-request trusted-pull-request.json | |
| - name: Create Nitro Modules Bot token | |
| id: performance-bot-token | |
| if: ${{ !cancelled() && steps.request-validation.outcome == 'success' && (failure() || steps.select.outputs.artifact_id != '') && vars.NITRO_PERFORMANCE_APP_CLIENT_ID != '' }} | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3 | |
| with: | |
| client-id: ${{ vars.NITRO_PERFORMANCE_APP_CLIENT_ID }} | |
| private-key: ${{ secrets.NITRO_PERFORMANCE_APP_PRIVATE_KEY }} | |
| permission-pull-requests: write | |
| - name: Post paired comparison to the PR | |
| if: steps.download.outcome == 'success' && steps.validate.outputs.stale != 'true' | |
| env: | |
| GITHUB_TOKEN: ${{ steps.performance-bot-token.outputs.token || secrets.GITHUB_TOKEN }} | |
| GITHUB_APP_SLUG: ${{ steps.performance-bot-token.outputs.app-slug }} | |
| run: bun scripts/performance/github-report.ts --directory validated-report | |
| - name: Install Bencher CLI | |
| if: steps.download.outcome == 'success' && steps.validate.outputs.stale != 'true' | |
| uses: bencherdev/bencher@8d75325c3bc59403a2186a056b472c4f49d42838 # v0.6.12 | |
| with: | |
| version: '0.6.12' | |
| - name: Verify pinned Bencher binary | |
| if: steps.download.outcome == 'success' && steps.validate.outputs.stale != 'true' | |
| run: | | |
| printf '%s %s\n' 'c2d3a6a7fae654246134e5ced1408bdb9ba4e198b0ac3b903af17a06574a7e08' "$(command -v bencher)" | sha256sum --check - | |
| - name: Publish Bencher history | |
| if: steps.download.outcome == 'success' && steps.validate.outputs.stale != 'true' | |
| env: | |
| BENCHER_API_KEY: ${{ secrets.BENCHER_KEY }} | |
| BENCHER_PROJECT: nitro | |
| run: bun scripts/performance/publish.ts --directory validated-report --data-directory untrusted-artifact | |
| - name: Report failure on the PR | |
| if: failure() && steps.request-validation.outcome == 'success' | |
| env: | |
| GITHUB_TOKEN: ${{ steps.performance-bot-token.outputs.token || secrets.GITHUB_TOKEN }} | |
| GITHUB_APP_SLUG: ${{ steps.performance-bot-token.outputs.app-slug }} | |
| REPORT_VALIDATED: ${{ steps.validate.outcome == 'success' && steps.validate.outputs.stale != 'true' }} | |
| run: bun scripts/performance/notify-failure.ts --directory validated-report | |
| - name: Update performance status on the PR | |
| if: always() && steps.request-validation.outcome == 'success' | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PUBLICATION_STATUS: ${{ job.status }} | |
| run: bun scripts/performance/workflow-status.ts --directory performance-request --mode update |