Publish Nitro Performance #134
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish Nitro Performance | |
| on: | |
| workflow_run: | |
| workflows: [Nitro Performance] | |
| types: [completed] | |
| # Serialize publication attempts for the same run without combining separate requests. | |
| concurrency: | |
| group: performance-report-${{ github.event.workflow_run.id }} | |
| cancel-in-progress: false | |
| permissions: | |
| actions: read | |
| contents: read | |
| pull-requests: write | |
| jobs: | |
| publish: | |
| if: github.event.workflow_run.event == 'issue_comment' | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Checkout trusted publishing code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 | |
| with: | |
| bun-version: 1.3.14 | |
| - name: Select exact report artifact | |
| id: select | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: bun scripts/performance/select-report.ts | |
| - name: Download performance report | |
| id: download | |
| if: steps.select.outputs.artifact_id != '' | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| artifact-ids: ${{ steps.select.outputs.artifact_id }} | |
| path: untrusted-artifact | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| run-id: ${{ github.event.workflow_run.id }} | |
| - name: Validate publication provenance | |
| id: validate | |
| if: steps.download.outcome == 'success' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| set -euo pipefail | |
| # The run name is set by the default-branch workflow using the triggering PR. | |
| PR_NUMBER=$(jq -er '.workflow_run.display_title | capture("^Nitro Performance for PR #(?<number>[1-9][0-9]*)$").number' "$GITHUB_EVENT_PATH") | |
| gh api "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER" > trusted-pull-request.json | |
| bun scripts/performance/validate-report.ts \ | |
| --artifact-directory untrusted-artifact \ | |
| --output-directory validated-report \ | |
| --expected-repository "$GITHUB_REPOSITORY" \ | |
| --trusted-workflow-event "$GITHUB_EVENT_PATH" \ | |
| --trusted-pull-request trusted-pull-request.json | |
| - name: Create Nitro Modules Bot token | |
| id: performance-bot-token | |
| if: steps.download.outcome == 'success' && steps.validate.outputs.stale != 'true' && vars.NITRO_PERFORMANCE_APP_CLIENT_ID != '' | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3 | |
| with: | |
| client-id: ${{ vars.NITRO_PERFORMANCE_APP_CLIENT_ID }} | |
| private-key: ${{ secrets.NITRO_PERFORMANCE_APP_PRIVATE_KEY }} | |
| permission-pull-requests: write | |
| - name: Post paired comparison to the PR | |
| if: steps.download.outcome == 'success' && steps.validate.outputs.stale != 'true' | |
| env: | |
| GITHUB_TOKEN: ${{ steps.performance-bot-token.outputs.token || secrets.GITHUB_TOKEN }} | |
| GITHUB_APP_SLUG: ${{ steps.performance-bot-token.outputs.app-slug }} | |
| run: bun scripts/performance/github-report.ts --directory validated-report | |
| - name: Install Bencher CLI | |
| if: steps.download.outcome == 'success' && steps.validate.outputs.stale != 'true' | |
| uses: bencherdev/bencher@8d75325c3bc59403a2186a056b472c4f49d42838 # v0.6.12 | |
| with: | |
| version: '0.6.12' | |
| - name: Verify pinned Bencher binary | |
| if: steps.download.outcome == 'success' && steps.validate.outputs.stale != 'true' | |
| run: | | |
| printf '%s %s\n' 'c2d3a6a7fae654246134e5ced1408bdb9ba4e198b0ac3b903af17a06574a7e08' "$(command -v bencher)" | sha256sum --check - | |
| - name: Publish Bencher history | |
| if: steps.download.outcome == 'success' && steps.validate.outputs.stale != 'true' | |
| env: | |
| BENCHER_API_KEY: ${{ secrets.BENCHER_KEY }} | |
| BENCHER_PROJECT: nitro | |
| run: bun scripts/performance/publish.ts --directory validated-report --data-directory untrusted-artifact |