Skip to content

ci: stage temporary benchmark deferral authority - #1091

Draft
intel352 wants to merge 1 commit into
mainfrom
fix/benchmark-defer-stage
Draft

intel352 wants to merge 1 commit into
mainfrom
fix/benchmark-defer-stage

Conversation

@intel352

Copy link
Copy Markdown
Contributor

Stage the exact workflow authority needed to temporarily defer performance
comparison while functional tests and security checks continue unchanged.

This is the trust-only staging phase. It does not disable the benchmark job.
It adds one presence, seven action, and 28 command rows for the future benchmark
context, retaining every existing active and unrelated row:

1d47daeb93beb73266e0ae678db5e11df8f38a5e883d1ea50a4df5c55575d56d

The separately reviewed adoption adds a literal false condition and explanatory
comments to the existing Performance Benchmarks job. That would skip collection,
comparison, comments, artifacts, and baseline-cache updates. Performance would
be unassessed, not passed. The existing parser, six samples, 20% threshold,
action/command identities, permissions, and functional/security workflows remain
unchanged. Adoption must follow safe integration of this staging change;
promotion follows adoption. Neither later phase is included here.

Validation on this exact staging commit:

  • Independent review found no blocking issues and confirmed the three-file scope.
  • The unchanged trusted checker accepts base, trust-only stage, adoption from
    staged trust, restored adoption, and promotion from adopted trust.
  • It rejects combined staging/adoption, unreviewed re-enablement, an unpinned
    command beneath the disabled job, and premature promotion.
  • Structural assertions preserve every unrelated authority row and all original
    action/command identities; git diff --check passes.
  • Optional local actionlint inspection of the future adoption reports the
    intentional constant-false condition. It was not suppressed or reported clean.

Keep this draft unmerged. Its original benchmark still runs and may retain
the known startup/baseline failure. A main push also currently starts snapshot
cleanup/publication, including release/tag deletion and GHCR publication. Those
effects need a separately established safe integration path. This PR changes no
release workflow, repository setting, credential, baseline data, or policy engine,
and does not waive branch requirements.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant