Skip to content

ci: unstick star chart, fix weekly benchmarks, pin all actions to Node 24 SHAs - #626

Merged
zackees merged 6 commits into
mainfrom
ci/harden-workflows
Oct 25, 2026
Merged

zackees merged 6 commits into
mainfrom
ci/harden-workflows

Conversation

@zackees

@zackees zackees commented Oct 25, 2026

Copy link
Copy Markdown
Owner

Fixes the stuck README star chart, the three scheduled benchmark workflows that have failed every week, and moves every action off deprecated Node 20 onto SHA-pinned releases.

Star chart (star-history.yml "succeeded" daily but the chart stopped at 09-30)

The repo has held 40 stars since 2026-09-30, so the job correctly found no movement and never pushed; the line just ended at that date. ci/star_history.py now carries the last count forward to today when rendering (extend_to); star-history.json still records only days the count moved (verified unchanged against the data branch).

Actions: pinned to full SHAs, all on Node 24

249 uses: refs for actions/*, astral-sh/setup-uv, msys2/setup-msys2, softprops/action-gh-release → owner/name@<sha> # vX.Y.Z at each latest release (the SHA-pin policy the benchmark workflows already enforced, now everywhere). Breaking notes reviewed per major: download-artifact v5 by-ID path change (no by-ID downloads here), v8 hash-mismatch now errors (wanted); setup-uv v7 server-url/v8 manifest removal (unused), v10 cache disabled on untrusted events (fine); setup-python v7 removed pip-install (unused). zackees/* actions left as the owner's own refs (setup-soldr@v0, docker-mac-x64@main). Labelled ci-full so the full matrix, macOS native and release-path jobs exercise the new pins.

benchmark-pprof-tax (failing every week since 09-27)

#414 added MI_DIAGNOSTICS/MI_MEMEVT to ci/build_pprof_tax_configurations.py's key lists but not to rust/benchmark-suite/src/pprof_tax.rs, so the run binary rejected every real run in 0.05 s: upstream-baseline cmake_cache does not carry exactly the equivalence cache keys (run 40163077276). Rust lists + synthetic fixture updated; the check is restored, not relaxed. The upload step now runs only when validation ran, instead of adding a misleading missing-file error.

benchmark-latency (failing every week)

overhead_is_valid (control p50 ≤ 5% measured p50, measured p99 > 2× control p99) was fatal for every allocator; tcmalloc tiny-fixed-64/1 sits at timer resolution on hosted runners, so it never passed. It stays a hard gate for mimalloc-pprof; references record overhead_valid (still cross-checked for consistency) — mirrored in ci/benchmark_report.py's site validator. Thresholds are now named constants (rule 11). The raw run is written before validation so a failed run uploads evidence.

benchmark-memory (cancelled/failed since August)

Same Sunday 08:41 cron as benchmark-latency and the same benchmark-stats-production group: GitHub keeps one pending run per group, so latency cancelled memory before it got a runner (run 40178014027, jobs: []). Moved to Saturday. Not changed: the 60-minute job timeout, which the 5-allocator suite now exceeds (suite step 43 → 49 → >53 min + ~7 min builds). ci/check_benchmark_memory_workflow.py enforces 60 as a hard budget, so that is escalated as an owner decision rather than raised here.

Tests: benchmark-suite 177 passed; local gate 45/45.

The repo has held 40 stars since 2026-09-30, so the daily job found no
movement and the chart's line stopped at that date, reading as a frozen
chart. Carry the last count forward to today when rendering; the stored
series still records only days the count moved.
…nchmark workflows

- Pin actions/*, astral-sh/setup-uv, msys2/setup-msys2 and
  softprops/action-gh-release to the commit of their latest release, with
  the tag in a comment (the policy the benchmark workflows already
  enforced). Clears the Node 20 deprecation on every job.
- benchmark-memory: move off benchmark-latency's identical Sunday cron;
  both share benchmark-stats-production, where GitHub keeps one pending run,
  so latency cancelled memory before it got a runner. Raise the 60 min job
  timeout that the 5-allocator suite outgrew to 90 (repo variable
  BENCHMARK_MEMORY_TIMEOUT_MINUTES overrides).
- benchmark-pprof-tax: upload the validation report only when validation
  ran, so a matrix failure is not buried under a missing-file error.
#414 added both to ci/build_pprof_tax_configurations.py's equivalence and
fork-only key lists but not to the Rust copy, so benchmark-pprof-tax-run
rejected every real run before measuring (every weekly run since 09-27).
The overhead check (control p50 <= 5% of measured p50, measured p99 > 2x
control p99) was fatal for every allocator, and tcmalloc's tiny-fixed-64/1
cell sits at timer resolution on hosted runners, so benchmark-latency has
failed every week. Keep it a hard gate for mimalloc-pprof; record
overhead_valid for references (still checked for consistency). Name the
thresholds in Rust and in the Python site validator, and write the raw run
before validating so a failed run uploads its evidence.
… in tests

The memory checker enforces 60 minutes as a hard budget, so raising it is an
owner decision (escalated on the issue), not part of this fix. Two workflow
tests matched checkout by its old tag; match the action, not the ref.
Local-Gate: v1 tree=3572d92417ec8f94e84bd8a9b58b9b561ea78b3a secs=67 lanes=lint:run
Ci-Attestation: {"at":1792967571,"gate":"python/all/lint","host":"linux-x86_64","key":"44d2f62f96209c34eace739e0010857fa8449ed308c3a56e5069da2f57267d14","lane":"lint","parents":["32b48501de26e6b9dd4ac40006ea464f50e1a593"],"secs":67,"stamp":"5c7273c53be9fa9e7dceb7aca69c286c","tree":"3572d92417ec8f94e84bd8a9b58b9b561ea78b3a","v":1,"via":"run"}
@zackees zackees added the ci-full Opt-in complete platform and release validation on PR SHA label Oct 25, 2026
@zackees
zackees merged commit 6dc9255 into main Oct 25, 2026
112 of 167 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ci-full Opt-in complete platform and release validation on PR SHA

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant