Skip to content
Draft
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 15 additions & 2 deletions .github/workflows/benchmarks.yml
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,8 @@ on:
- cron: '0 0 * * *'

permissions:
contents: read
contents: write
deployments: write
Copy link

Copilot AI Mar 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

deployments: write permission is granted but nothing in this workflow uses the Deployments API (only contents is needed for pushing to a branch). Please remove this permission to follow least-privilege and reduce token scope.

Suggested change
deployments: write

Copilot uses AI. Check for mistakes.

jobs:
setup:
Expand Down Expand Up @@ -119,7 +120,7 @@ jobs:
- name: Run benchmarks
run: |
go test -bench=BenchmarkVM -benchtime=5x -run=^$ -v ./integration/... \
| tee /tmp/bench-output.txt
| tee /tmp/benchmark-output.txt

- name: Publish benchmark results to step summary
if: always()
Expand All @@ -131,3 +132,15 @@ jobs:
echo '```' >> $GITHUB_STEP_SUMMARY
grep -E '^(Benchmark|PASS|FAIL|ok|---)' /tmp/bench-output.txt >> $GITHUB_STEP_SUMMARY || true
echo '```' >> $GITHUB_STEP_SUMMARY

- name: Store benchmark results
uses: benchmark-action/github-action-benchmark@a7bc2366eda11037936ea57d811a43b3418d3073 # v1.21.0
with:
name: 'Nerdbox Benchmarks'
tool: 'go'
benchmark-data-dir-path: "data/benchmarks/linux/${{ matrix.arch }}"
output-file-path: '/tmp/benchmark-output.txt'
github-token: ${{ secrets.GITHUB_TOKEN }}

- name: Push benchmark result
run: git push 'https://github.com/containerd/nerdbox.git' ghpages:gh-pages
Comment on lines +144 to +146
Copy link

Copilot AI Mar 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This push command is very likely to fail: (1) ghpages is not a ref created anywhere in this job, so git push … ghpages:gh-pages will error unless that branch exists locally; and (2) pushing to a raw https://github.com/... remote won’t use the actions/checkout injected credentials, so it will be unauthenticated. Prefer pushing to origin (with checkout credentials) and push the ref that actually exists (e.g., git push origin HEAD:gh-pages), or enable the benchmark action’s built-in push/gh-pages options and drop the manual git push step.

Suggested change
- name: Push benchmark result
run: git push 'https://github.com/containerd/nerdbox.git' ghpages:gh-pages
auto-push: true
gh-pages-branch: gh-pages

Copilot uses AI. Check for mistakes.
Loading