perf-publish.yml

name: Publish Performance Benchmarks

on: # zizmor: ignore[dangerous-triggers] trusted default-branch code validates data-only artifacts and never executes PR code
  workflow_run:
    workflows: [Performance Benchmarks]
    types: [completed]

permissions: {}

concurrency:
  group: performance-publish-${{ github.event.workflow_run.id }}-${{ github.event.workflow_run.run_attempt }}
  cancel-in-progress: false

jobs:
  publish:
    name: Validate and upload results
    if: github.event.workflow_run.conclusion == 'success'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      actions: read
      contents: read
    outputs:
      comment_enabled: ${{ steps.comment.outputs.enabled }}
      pull_request: ${{ steps.comment.outputs.pull_request }}
    steps:
      - name: Checkout trusted publisher
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.repository.default_branch }}
          persist-credentials: false
          fetch-depth: 0

      - name: Download untrusted benchmark data
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: performance-results
          path: performance-artifact
          github-token: ${{ github.token }}
          run-id: ${{ github.event.workflow_run.id }}

      - name: Validate benchmark metadata
        env:
          GITHUB_TOKEN: ${{ github.token }}
          VINEXT_PERF_SOURCE_EVENT: ${{ github.event.workflow_run.event }}
          VINEXT_PERF_SOURCE_RUN_ID: ${{ github.event.workflow_run.id }}
          VINEXT_PERF_SOURCE_RUN_ATTEMPT: ${{ github.event.workflow_run.run_attempt }}
        run: node benchmarks/perf/validate-results.mjs performance-artifact/perf-results.json

      - name: Upload to vinext dashboard
        env:
          COMPAT_INGEST_SECRET: ${{ secrets.COMPAT_INGEST_SECRET }}
          VINEXT_PERF_ARTIFACT_ROOT: ${{ github.workspace }}/performance-artifact
          VINEXT_PERF_UPLOAD_RESPONSE_PATH: ${{ github.workspace }}/performance-upload.json
        run: node benchmarks/perf/upload-results.mjs performance-artifact/perf-results.json

      - name: Build pull request comment
        id: comment
        run: |
          node benchmarks/perf/format-pr-comment.mjs \
            performance-artifact/perf-results.json \
            performance-upload.json \
            performance-comment.md
          if [ -s performance-comment.md ]; then
            echo "enabled=true" >> "$GITHUB_OUTPUT"
            node -e '
              const payload = JSON.parse(require("node:fs").readFileSync(process.argv[1], "utf8"));
              console.log(`pull_request=${payload.run.pullRequest}`);
            ' performance-artifact/perf-results.json >> "$GITHUB_OUTPUT"
          fi

      - name: Upload pull request comment
        if: steps.comment.outputs.enabled == 'true'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: performance-comment-${{ github.event.workflow_run.id }}-${{ github.event.workflow_run.run_attempt }}
          path: performance-comment.md
          retention-days: 1

  comment:
    name: Update pull request comment
    needs: publish
    if: needs.publish.outputs.comment_enabled == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      actions: read
      pull-requests: write
    steps:
      - name: Download rendered comment
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: performance-comment-${{ github.event.workflow_run.id }}-${{ github.event.workflow_run.run_attempt }}
          path: performance-comment

      - name: Update pull request comment
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          VINEXT_PERF_PR_NUMBER: ${{ needs.publish.outputs.pull_request }}
        with:
          script: |
            const fs = require('node:fs');
            const prNumber = Number(process.env.VINEXT_PERF_PR_NUMBER);
            if (!Number.isInteger(prNumber) || prNumber <= 0) {
              throw new Error('Invalid pull request number');
            }
            const marker = '<!-- vinext-performance-benchmarks -->';
            const body = fs.readFileSync('performance-comment/performance-comment.md', 'utf8');

            const comments = await github.paginate(github.rest.issues.listComments, {
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: prNumber,
              per_page: 100,
            });
            const existingComment = comments.find(
              comment =>
                comment.user?.login === 'github-actions[bot]' && comment.body?.includes(marker),
            );

            if (existingComment) {
              await github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: existingComment.id,
                body,
              });
            } else {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: prNumber,
                body,
              });
            }