docs: add decision queue for human-review items #63
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Benchmark workflow. | |
| # Security: only matrix.*, github.ref, and github.workflow are referenced — | |
| # all GitHub-controlled inputs, never attacker-controlled fields like | |
| # github.event.issue.title / pull_request.title / commit.message. No | |
| # untrusted strings reach any run: step (per command-injection guide). | |
| # Actions are pinned to full commit SHAs (repo policy: sha_pinning_required). | |
| name: Benchmark | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| concurrency: | |
| group: bench-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| bench: | |
| name: pytest-benchmark | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 | |
| with: | |
| # Pin uv so CI resolves uv.lock identically to local (lock revision is | |
| # uv-version-tied), keeping `uv sync --locked` reliable. | |
| version: "0.11.17" | |
| enable-cache: true | |
| python-version: "3.11" | |
| # Route PyPI installs through Takumi Guard (blocks known-malicious | |
| # packages before they execute; sets UV_INDEX_URL/PIP_INDEX_URL to the | |
| # screened registry for this job). Blocking-only mode, no account needed. | |
| - name: Route installs through Takumi Guard | |
| uses: flatt-security/setup-takumi-guard-pypi@733047c120b6377fa05fb77f714df8d8cd3a41a9 # v1.0.1 | |
| - name: Install (locked; dev + cli extras) | |
| run: uv sync --locked --extra dev --extra cli | |
| - name: Run benchmarks | |
| run: | | |
| uv run pytest tests/benchmarks/ -m benchmark \ | |
| --benchmark-only \ | |
| --benchmark-json=benchmark-results.json | |
| - name: Upload benchmark results | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: benchmark-results | |
| path: benchmark-results.json | |
| retention-days: 30 |