From 78bd750ea3176e63f75bb91bebd6ef1386480829 Mon Sep 17 00:00:00 2001
From: uiolee <22849383+uiolee@users.noreply.github.com>
Date: Fri, 8 May 2026 02:47:52 +0800
Subject: [PATCH 1/3] remove comment-flamegraph

---
 .github/workflows/commenter.yml | 43 ---------------------------------
 1 file changed, 43 deletions(-)

diff --git a/.github/workflows/commenter.yml b/.github/workflows/commenter.yml
index 3ccb694fb..9627dec62 100644
--- a/.github/workflows/commenter.yml
+++ b/.github/workflows/commenter.yml
@@ -3,11 +3,6 @@ name: Commenter
 on:
   pull_request_target:
 
-  workflow_run:
-    workflows: ["Benchmark"]
-    types:
-      - completed
-
 permissions:
   contents: read
 
@@ -32,41 +27,3 @@ jobs:
             npm install
             npm test
             ```
-
-  comment-flamegraph:
-    name: Flamegraph
-    permissions:
-      pull-requests: write # for marocchino/sticky-pull-request-comment to create or update PR comment
-      actions: read # get artifact
-    runs-on: ubuntu-latest
-    if: ${{github.event_name == 'workflow_run' && github.event.workflow_run.conclusion=='success'}}
-    env:
-      comment_result: "tmp-comment-flamegraph.md"
-    steps:
-      - name: download artifact
-        uses: actions/download-artifact@v8
-        with:
-          github-token: ${{secrets.GITHUB_TOKEN}}
-          run-id: ${{toJSON(github.event.workflow_run.id)}}
-          pattern: "comment-*"
-          merge-multiple: true
-
-      - name: get PR number
-        run: |
-          echo "pr_number=$(cat tmp-comment-pr_number)" >> "$GITHUB_ENV"
-
-      - name: combime comment
-        if: ${{env.pr_number!=''}}
-        run: |
-          echo "## Flamegraph" > ${{env.comment_result}}
-          echo "" >> ${{env.comment_result}}
-          cat tmp-comment-flamegraph-*.md >> ${{env.comment_result}}
-
-      - name: Comment PR - flamegraph
-        if: ${{env.pr_number!=''}}
-        uses: marocchino/sticky-pull-request-comment@v3
-        with:
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
-          number: ${{env.pr_number}}
-          header: Flamegraph
-          path: ${{env.comment_result}}

From e79f630547cd8b2a92b1f6497a6f0f0e996a67fd Mon Sep 17 00:00:00 2001
From: uiolee <22849383+uiolee@users.noreply.github.com>
Date: Fri, 8 May 2026 02:52:40 +0800
Subject: [PATCH 2/3] ci: refact flamegraph publishing

---
 .github/workflows/benchmark-post.yml | 67 ++++++++++++++++++++++++++++
 .github/workflows/benchmark.yml      | 61 ++++++++++++++++++++-----
 2 files changed, 117 insertions(+), 11 deletions(-)
 create mode 100644 .github/workflows/benchmark-post.yml

diff --git a/.github/workflows/benchmark-post.yml b/.github/workflows/benchmark-post.yml
new file mode 100644
index 000000000..1b33cb7e7
--- /dev/null
+++ b/.github/workflows/benchmark-post.yml
@@ -0,0 +1,67 @@
+name: Benchmark - Post Process
+
+on:
+  workflow_run:
+    workflows: ["Benchmark"]
+    types:
+      - completed
+
+permissions:
+  contents: read
+
+jobs:
+  profiling-preview:
+    if:
+      ${{ github.event_name == 'workflow_run' && github.event.workflow_run.event
+      == 'pull_request' && github.event.workflow_run.conclusion == 'success' }}
+    runs-on: ubuntu-slim
+    environment:
+      name: "profiling-preview"
+      url: ${{ steps.get_info.outputs.url }}
+      deployment: false
+    permissions:
+      contents: read
+      pull-requests: write # for marocchino/sticky-pull-request-comment to create or update PR comment
+    env:
+      comment_result: "tmp-comment-flamegraph.md"
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          run-id: ${{ toJSON( github.event.workflow_run.id ) }}
+          pattern: "comment-*"
+          merge-multiple: true
+
+      - name: Get PR info
+        id: get_info
+        run: |
+          pr_number=$(cat tmp-comment-pr_number)
+
+          echo "pr_number=$pr_number" | tee -a "$GITHUB_OUTPUT"
+          echo "url=https://$pr_number-pr-hexo.surge.sh/" | tee -a "$GITHUB_OUTPUT"
+
+      - name: Publish flamegraph to ${{ steps.get_info.outputs.url }}
+        uses: dswistowski/surge-sh-action@v1
+        with:
+          domain: ${{ steps.get_info.outputs.url }}
+          project: ./flamegraph/
+          login: ${{ secrets.SURGE_LOGIN }}
+          token: ${{ secrets.SURGE_TOKEN }}
+
+      - name: Print full URLs
+        if: ${{ steps.get_info.outputs.pr_number!='' }}
+        run: |
+          echo "## Flamegraph" > ${{ env.comment_result }}
+          echo "" >> ${{ env.comment_result }}
+          cat tmp-comment-flamegraph-*.md >> ${{ env.comment_result }}
+
+          cat "${{ env.comment_result }}" | tee -a "$GITHUB_STEP_SUMMARY"
+
+      - name: Comment PR - flamegraph
+        if: ${{ steps.get_info.outputs.pr_number!='' }}
+        uses: marocchino/sticky-pull-request-comment@v3
+        with:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          number: ${{ steps.get_info.outputs.pr_number }}
+          header: Flamegraph
+          path: ${{ env.comment_result }}
diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index bc0993a3c..20e45a434 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -53,25 +53,64 @@ jobs:
         run: npm install --silent
       - name: Running profiling
         run: node test/benchmark.js --profiling
-      - name: Publish flamegraph to https://${{ github.sha }}-${{ matrix.node-version }}-hexo.surge.sh/flamegraph.html
-        uses: dswistowski/surge-sh-action@v1
-        with:
-          domain: ${{ github.sha }}-${{ matrix.node-version }}-hexo.surge.sh
-          project: ./.tmp-hexo-theme-unit-test/0x/
-          login: ${{ secrets.SURGE_LOGIN }}
-          token: ${{ secrets.SURGE_TOKEN }}
 
-      - name: save comment to file
+      - name: mv flamegraph
+        run: |
+          mkdir -p ./flamegraph/
+          mv ./.tmp-hexo-theme-unit-test/0x/ ./flamegraph/${{ matrix.node-version }}/
+
+      - name: save URL to file
+        if: ${{github.event_name != 'pull_request' }}
+        run: |
+          echo "https://${{ github.sha }}-hexo.surge.sh/${{ matrix.node-version }}/flamegraph.html" > ${{env.comment_file}}
+
+      - name: save URL to file
         if: ${{github.event_name == 'pull_request' }}
         run: |
-          echo "https://${{ github.sha }}-${{ matrix.node-version }}-hexo.surge.sh/flamegraph.html" > ${{env.comment_file}}
+          echo "https://${{ github.event.number }}-pr-hexo.surge.sh/${{ matrix.node-version }}/flamegraph.html" > ${{env.comment_file}}
 
       - uses: actions/upload-artifact@v7
-        if: ${{github.event_name == 'pull_request' }}
         with:
           retention-days: 1
           name: comment-node${{ matrix.node-version }}
-          path: ${{env.comment_file}}
+          path: |
+            ${{env.comment_file}}
+            ./flamegraph/${{ matrix.node-version }}/
+
+  profiling-preview:
+    needs: profiling
+    if: ${{ github.event_name != 'pull_request' }}
+    runs-on: ubuntu-slim
+    environment:
+      name: 'profiling-preview'
+      url: ${{ env.url }}
+      deployment: false
+    permissions:
+      contents: read
+    env:
+      url: https://${{ github.sha }}-hexo.surge.sh/
+      comment_result: "tmp-comment-flamegraph.md"
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          pattern: "comment-*"
+          merge-multiple: true
+
+      - name: Publish flamegraph to ${{ env.url }}
+        uses: dswistowski/surge-sh-action@v1
+        with:
+          domain: ${{ env.url }}
+          project: ./flamegraph/
+          login: ${{ secrets.SURGE_LOGIN }}
+          token: ${{ secrets.SURGE_TOKEN }}
+
+      - name: Print full URLs
+        run: |
+          echo "## Flamegraph" > ${{ env.comment_result }}
+          echo "" >> ${{ env.comment_result }}
+          cat tmp-comment-flamegraph-*.md >> ${{ env.comment_result }}
+
+          cat "${{ env.comment_result }}" | tee -a "$GITHUB_STEP_SUMMARY"
 
   number:
     runs-on: ubuntu-latest

From 9e0ede7407138ae2f122272efeb9cd6265203559 Mon Sep 17 00:00:00 2001
From: Mimi <1119186082@qq.com>
Date: Sat, 8 Aug 2026 20:32:42 +0800
Subject: [PATCH 3/3] ci: secure flamegraph artifact handling

---
 .github/workflows/benchmark-post.yml | 61 ++++++++++++++++++++++------
 .github/workflows/benchmark.yml      | 49 +++++-----------------
 2 files changed, 60 insertions(+), 50 deletions(-)

diff --git a/.github/workflows/benchmark-post.yml b/.github/workflows/benchmark-post.yml
index 1b33cb7e7..fbe4d39ee 100644
--- a/.github/workflows/benchmark-post.yml
+++ b/.github/workflows/benchmark-post.yml
@@ -20,6 +20,7 @@ jobs:
       url: ${{ steps.get_info.outputs.url }}
       deployment: false
     permissions:
+      actions: read # download artifacts from the triggering workflow run
       contents: read
       pull-requests: write # for marocchino/sticky-pull-request-comment to create or update PR comment
     env:
@@ -29,16 +30,50 @@ jobs:
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           run-id: ${{ toJSON( github.event.workflow_run.id ) }}
-          pattern: "comment-*"
+          pattern: "flamegraph-*"
+          path: ./flamegraph/
           merge-multiple: true
 
       - name: Get PR info
         id: get_info
-        run: |
-          pr_number=$(cat tmp-comment-pr_number)
+        uses: actions/github-script@v8
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const run = context.payload.workflow_run;
+            let pullRequests = run.pull_requests || [];
+
+            if (pullRequests.length !== 1) {
+              if (!run.head_repository || !run.head_branch) {
+                throw new Error(`Missing head repository metadata for workflow run ${run.id}`);
+              }
+
+              const response = await github.rest.pulls.list({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                state: 'all',
+                head: `${run.head_repository.owner.login}:${run.head_branch}`,
+                base: context.payload.repository.default_branch
+              });
 
-          echo "pr_number=$pr_number" | tee -a "$GITHUB_OUTPUT"
-          echo "url=https://$pr_number-pr-hexo.surge.sh/" | tee -a "$GITHUB_OUTPUT"
+              pullRequests = response.data.filter(pullRequest => (
+                pullRequest.head.sha === run.head_sha
+                && pullRequest.base.repo.full_name === `${context.repo.owner}/${context.repo.repo}`
+                && pullRequest.base.ref === context.payload.repository.default_branch
+              ));
+            }
+
+            if (pullRequests.length !== 1) {
+              throw new Error(`Expected one pull request for workflow run ${run.id}, found ${pullRequests.length}`);
+            }
+
+            const prNumber = pullRequests[0].number;
+            if (!Number.isSafeInteger(prNumber) || prNumber < 1) {
+              throw new Error(`Invalid pull request number for workflow run ${run.id}`);
+            }
+
+            core.setOutput('pr_number', prNumber);
+            core.setOutput('url', `https://${prNumber}-pr-hexo.surge.sh/`);
 
       - name: Publish flamegraph to ${{ steps.get_info.outputs.url }}
         uses: dswistowski/surge-sh-action@v1
@@ -49,16 +84,18 @@ jobs:
           token: ${{ secrets.SURGE_TOKEN }}
 
       - name: Print full URLs
-        if: ${{ steps.get_info.outputs.pr_number!='' }}
+        env:
+          preview_url: ${{ steps.get_info.outputs.url }}
         run: |
-          echo "## Flamegraph" > ${{ env.comment_result }}
-          echo "" >> ${{ env.comment_result }}
-          cat tmp-comment-flamegraph-*.md >> ${{ env.comment_result }}
-
-          cat "${{ env.comment_result }}" | tee -a "$GITHUB_STEP_SUMMARY"
+          {
+            echo "## Flamegraph"
+            echo ""
+            for node_version in 20 22 24; do
+              echo "${preview_url}${node_version}/flamegraph.html"
+            done
+          } | tee "${{ env.comment_result }}" >> "$GITHUB_STEP_SUMMARY"
 
       - name: Comment PR - flamegraph
-        if: ${{ steps.get_info.outputs.pr_number!='' }}
         uses: marocchino/sticky-pull-request-comment@v3
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 20e45a434..e2429353a 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -41,8 +41,6 @@ jobs:
         os: [ubuntu-latest]
         node-version: ["20", "22", "24"]
       fail-fast: false
-    env:
-      comment_file: "tmp-comment-flamegraph-node${{ matrix.node-version }}.md"
     steps:
       - uses: actions/checkout@v7
       - name: Use Node.js ${{ matrix.node-version }}
@@ -59,23 +57,11 @@ jobs:
           mkdir -p ./flamegraph/
           mv ./.tmp-hexo-theme-unit-test/0x/ ./flamegraph/${{ matrix.node-version }}/
 
-      - name: save URL to file
-        if: ${{github.event_name != 'pull_request' }}
-        run: |
-          echo "https://${{ github.sha }}-hexo.surge.sh/${{ matrix.node-version }}/flamegraph.html" > ${{env.comment_file}}
-
-      - name: save URL to file
-        if: ${{github.event_name == 'pull_request' }}
-        run: |
-          echo "https://${{ github.event.number }}-pr-hexo.surge.sh/${{ matrix.node-version }}/flamegraph.html" > ${{env.comment_file}}
-
       - uses: actions/upload-artifact@v7
         with:
           retention-days: 1
-          name: comment-node${{ matrix.node-version }}
-          path: |
-            ${{env.comment_file}}
-            ./flamegraph/${{ matrix.node-version }}/
+          name: flamegraph-node${{ matrix.node-version }}
+          path: ./flamegraph/
 
   profiling-preview:
     needs: profiling
@@ -89,11 +75,11 @@ jobs:
       contents: read
     env:
       url: https://${{ github.sha }}-hexo.surge.sh/
-      comment_result: "tmp-comment-flamegraph.md"
     steps:
       - uses: actions/download-artifact@v8
         with:
-          pattern: "comment-*"
+          pattern: "flamegraph-*"
+          path: ./flamegraph/
           merge-multiple: true
 
       - name: Publish flamegraph to ${{ env.url }}
@@ -106,23 +92,10 @@ jobs:
 
       - name: Print full URLs
         run: |
-          echo "## Flamegraph" > ${{ env.comment_result }}
-          echo "" >> ${{ env.comment_result }}
-          cat tmp-comment-flamegraph-*.md >> ${{ env.comment_result }}
-
-          cat "${{ env.comment_result }}" | tee -a "$GITHUB_STEP_SUMMARY"
-
-  number:
-    runs-on: ubuntu-latest
-    if: ${{github.event_name == 'pull_request' }}
-    env:
-      pr_number_file: tmp-comment-pr_number
-    steps:
-      - name: save PR number to file
-        run: |
-          echo -n "${{ github.event.number }}" > ${{env.pr_number_file}}
-      - uses: actions/upload-artifact@v7
-        with:
-          retention-days: 1
-          name: comment-pr_number
-          path: ${{env.pr_number_file}}
+          {
+            echo "## Flamegraph"
+            echo ""
+            for node_version in 20 22 24; do
+              echo "${{ env.url }}${node_version}/flamegraph.html"
+            done
+          } | tee -a "$GITHUB_STEP_SUMMARY"