Bump github/codeql-action/upload-sarif from 3.37.3 to 4.37.6 #665
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Performance Regression Test | |
| on: | |
| pull_request: | |
| branches: | |
| - main | |
| - pre-main-integration | |
| paths-ignore: | |
| - '**.md' | |
| - 'doc/**' | |
| - 'CLAUDE.md' | |
| - 'LICENSE' | |
| push: | |
| branches: | |
| - main | |
| - pre-main-integration | |
| paths-ignore: | |
| - '**.md' | |
| - 'doc/**' | |
| - 'CLAUDE.md' | |
| - 'LICENSE' | |
| workflow_dispatch: | |
| inputs: | |
| publish_baseline: | |
| description: 'Publish this main-branch run as an intentional trusted baseline' | |
| required: false | |
| default: false | |
| type: boolean | |
| permissions: | |
| contents: read | |
| jobs: | |
| benchmark-regression: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up .NET | |
| uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 | |
| with: | |
| global-json-file: global.json | |
| - name: Cache NuGet packages | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: ~/.nuget/packages | |
| key: ${{ runner.os }}-nuget-${{ hashFiles('**/*.csproj') }} | |
| restore-keys: | | |
| ${{ runner.os }}-nuget- | |
| - name: Restore dependencies | |
| run: dotnet restore FolderDiffIL4DotNet.Benchmarks/FolderDiffIL4DotNet.Benchmarks.csproj | |
| - name: Run benchmarks | |
| run: dotnet run --project FolderDiffIL4DotNet.Benchmarks/FolderDiffIL4DotNet.Benchmarks.csproj --configuration Release -- --exporters json --filter '*' | |
| - name: Combine benchmark results | |
| run: | | |
| python3 - <<'PY' | |
| import json, glob, sys | |
| combined = [] | |
| for path in sorted(glob.glob("BenchmarkDotNet.Artifacts/results/*-report-full-compressed.json")): | |
| with open(path) as f: | |
| data = json.load(f) | |
| if "Benchmarks" in data: | |
| combined.extend(data["Benchmarks"]) | |
| if not combined: | |
| print("No benchmark results found.", file=sys.stderr) | |
| sys.exit(1) | |
| with open("BenchmarkDotNet.Artifacts/results/combined-report.json", "w") as f: | |
| json.dump({"Benchmarks": combined}, f, indent=2) | |
| print(f"Combined {len(combined)} benchmark(s).") | |
| PY | |
| - name: Check if baseline branch exists | |
| id: check-baseline | |
| run: | | |
| if git ls-remote --exit-code origin gh-benchmarks >/dev/null 2>&1; then | |
| echo "exists=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "exists=false" >> "$GITHUB_OUTPUT" | |
| echo "Baseline branch gh-benchmarks does not exist yet. Will be created on first push to main." | |
| fi | |
| - name: Resolve intended benchmark base | |
| id: benchmark-base | |
| shell: bash | |
| run: | | |
| base_sha="${{ github.event.pull_request.base.sha || github.event.before || github.sha }}" | |
| if [[ ! "$base_sha" =~ ^[0-9a-f]{40}$ ]] || ! git cat-file -e "$base_sha^{commit}"; then | |
| base_sha="$GITHUB_SHA" | |
| fi | |
| echo "sha=$base_sha" >> "$GITHUB_OUTPUT" | |
| - name: Fetch trusted benchmark history | |
| if: steps.check-baseline.outputs.exists == 'true' | |
| run: | | |
| git fetch --no-tags origin gh-benchmarks:refs/remotes/origin/gh-benchmarks | |
| git show refs/remotes/origin/gh-benchmarks:dev/bench/data.js \ | |
| > BenchmarkDotNet.Artifacts/results/baseline-data.js | |
| - name: Check evidence-based performance thresholds | |
| if: steps.check-baseline.outputs.exists == 'true' | |
| run: | | |
| python3 scripts/check_benchmark_regressions.py \ | |
| --current-report BenchmarkDotNet.Artifacts/results/combined-report.json \ | |
| --history-data BenchmarkDotNet.Artifacts/results/baseline-data.js \ | |
| --policy benchmark-regression-policy.json \ | |
| --baseline-ancestor "${{ steps.benchmark-base.outputs.sha }}" \ | |
| --repository-root . \ | |
| --summary "$GITHUB_STEP_SUMMARY" \ | |
| --allow-failure "${{ github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main' && inputs.publish_baseline }}" | |
| - name: Report missing benchmark baseline | |
| if: steps.check-baseline.outputs.exists != 'true' | |
| run: | | |
| { | |
| echo "## Performance regression gate" | |
| echo | |
| echo "⚠️ **WARMUP** — No trusted gh-benchmarks baseline exists yet." | |
| echo "This run remains visible and will seed the baseline only from a trusted main-branch publication." | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| - name: Upload benchmark results | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: BenchmarkResults | |
| if-no-files-found: warn | |
| path: BenchmarkDotNet.Artifacts/** | |
| - name: Upload combined benchmark report | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: BenchmarkCombinedReport | |
| if-no-files-found: error | |
| path: BenchmarkDotNet.Artifacts/results/combined-report.json | |
| publish-benchmark-baseline: | |
| needs: benchmark-regression | |
| if: >- | |
| (github.event_name == 'push' && github.ref == 'refs/heads/main') || | |
| (github.event_name == 'workflow_dispatch' && | |
| github.ref == 'refs/heads/main' && | |
| inputs.publish_baseline) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - name: Download combined benchmark report | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: BenchmarkCombinedReport | |
| path: BenchmarkDotNet.Artifacts/results | |
| - name: Check if baseline branch exists | |
| id: check-baseline | |
| run: | | |
| if git ls-remote --exit-code origin gh-benchmarks >/dev/null 2>&1; then | |
| echo "exists=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "exists=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Create gh-benchmarks branch if missing | |
| if: steps.check-baseline.outputs.exists != 'true' | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git checkout --orphan gh-benchmarks | |
| git rm -rf . 2>/dev/null || true | |
| git commit --allow-empty -m "Initialize gh-benchmarks branch" | |
| git push origin gh-benchmarks | |
| git checkout "$GITHUB_SHA" | |
| - name: Publish trusted benchmark baseline | |
| uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1.22.1 | |
| with: | |
| name: 'FolderDiffIL4DotNet Performance' | |
| tool: 'benchmarkdotnet' | |
| output-file-path: BenchmarkDotNet.Artifacts/results/combined-report.json | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| auto-push: true | |
| gh-pages-branch: gh-benchmarks | |
| benchmark-data-dir-path: dev/bench | |
| skip-fetch-gh-pages: ${{ steps.check-baseline.outputs.exists != 'true' }} |