From fa4f19594b97140e9e44cc60c8e4232bb2b30ab4 Mon Sep 17 00:00:00 2001 From: Sebastien Blot Date: Fri, 21 Aug 2026 22:15:27 +0200 Subject: [PATCH 1/2] ci: make the inherited workflows runnable in this fork This fork has three workflows carried over from upstream and zero runs, ever. Two reasons, both fixed here; the third needs a human. tests.yml was pinned to actions/checkout v3.6.0 and actions/setup-go v4.3.0. Both run on a Node runtime GitHub has since removed from its runners, so the job fails at the first step regardless of the code under test. Moved to checkout v7.0.1 and setup-go v7.0.0, still pinned by SHA with the tag in a trailing comment so the next bump is legible. benchmark.yml targets `group: ARM LINUX SHARED, labels: arm-8core-linux`, DataDog's self-hosted pool. It does not exist here, so both jobs queue until they time out -- actionlint flags the label as unknown. Moved to ubuntu-latest. Shared runners are noisy enough that a benchstat delta there is a hint rather than a result; the workflow says so, and gains workflow_dispatch so it can be run deliberately. Also on tests.yml, none of which upstream had: - permissions: contents: read. Without the block the job inherits whatever the repository default is, which is not necessarily read-only. - persist-credentials: false, so no token is left in .git/config. - concurrency, keyed by workflow and ref, so a second push supersedes the first instead of running both. - timeout-minutes, so a wedged run cannot burn a full six hours. - fail-fast: false, to see every Go version that breaks rather than one. - gofmt and go vet, which nothing checked before. - -run '^$' on the fuzz steps, so the 60s budget is spent fuzzing instead of re-running the suite that already ran two steps earlier. Every `uses:` across all three workflows is now a 40-character SHA with a version comment; no tag-only references remain. Each step was run locally against this branch first: gofmt, vet, build, test, -race, and both fuzz targets pass. Co-Authored-By: Claude Opus 5 --- .github/workflows/benchmark.yml | 23 +++++++----- .github/workflows/tests.yml | 66 +++++++++++++++++++++++++++------ 2 files changed, 68 insertions(+), 21 deletions(-) diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml index 6c36d4f..3194a62 100644 --- a/.github/workflows/benchmark.yml +++ b/.github/workflows/benchmark.yml @@ -4,10 +4,11 @@ permissions: on: push: - branches: + branches: - "*" pull_request: types: [opened, reopened, synchronize] + workflow_dispatch: concurrency: group: ${{ github.ref }} @@ -16,16 +17,18 @@ concurrency: jobs: benchmark: if: github.ref != 'refs/heads/main' - runs-on: - group: ARM LINUX SHARED - labels: arm-8core-linux + # Upstream runs this on DataDog's self-hosted ARM pool, which does not + # exist in this fork -- jobs targeting it queue forever. GitHub-hosted + # runners are shared and noisy, so treat a benchstat delta here as a hint + # and confirm anything that matters on a quiet machine. + runs-on: ubuntu-latest strategy: matrix: go-version: [ '1.25.7' ] steps: - name: Setup Go ${{ matrix.go-version }} - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b + uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0 with: go-version: ${{ matrix.go-version }} - name: Display Go version @@ -86,15 +89,17 @@ jobs: benchmark_main: if: github.ref == 'refs/heads/main' - runs-on: - group: ARM LINUX SHARED - labels: arm-8core-linux + # Upstream runs this on DataDog's self-hosted ARM pool, which does not + # exist in this fork -- jobs targeting it queue forever. GitHub-hosted + # runners are shared and noisy, so treat a benchstat delta here as a hint + # and confirm anything that matters on a quiet machine. + runs-on: ubuntu-latest strategy: matrix: go-version: [ '1.25.7' ] steps: - name: Setup Go ${{ matrix.go-version }} - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b + uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0 with: go-version: ${{ matrix.go-version }} - name: Display Go version diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index abd310f..71e2591 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -6,31 +6,73 @@ on: pull_request: types: [opened, reopened, synchronize] -jobs: - build: +# Nothing here writes to the repository. Declared explicitly because the +# default for a workflow without this block is whatever the repository +# setting says, which is not necessarily read-only. +permissions: + contents: read + +# Supersede an in-flight run when the same ref is pushed again. Keyed by +# workflow as well as ref so it does not fight the other workflows. +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true +jobs: + test: runs-on: ubuntu-latest + timeout-minutes: 20 strategy: + # Report every Go version that fails, not just the first. + fail-fast: false matrix: - go-version: [ '1.25', '1.25.7' ] + go-version: ['1.25', '1.25.7'] steps: - - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + # Actions are pinned to a commit SHA rather than a tag: a tag can be + # moved to point at different code, a SHA cannot. The trailing comment + # is the tag that SHA carried when it was pinned, so the next person + # can tell what they are bumping from. + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + # The build never pushes, so leave no credentials in .git/config + # for a later step to pick up. + persist-credentials: false + - name: Setup Go ${{ matrix.go-version }} - uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4.3.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ matrix.go-version }} + - name: Display Go version run: go version - - name: Install dependencies - run: go get . + + - name: Check formatting + run: | + unformatted=$(gofmt -l .) + if [ -n "$unformatted" ]; then + echo "::error::gofmt reported unformatted files:" + echo "$unformatted" + exit 1 + fi + + - name: Vet + run: go vet ./... + - name: Build run: go build -v ./... + - name: Test run: go test -v ./... - - name: Test Race + + - name: Test with race detector run: go test -race -v ./... - - name: Fuzz Normalizer - run: go test -fuzz=FuzzNormalizer -fuzztime 60s - - name: Fuzz Obfuscator and Normalizer - run: go test -fuzz=FuzzObfuscatorAndNormalizer -fuzztime 60s + + # -run '^$' selects no unit tests, so the fuzz budget is spent fuzzing + # rather than re-running the suite that already ran above. + - name: Fuzz normalizer + run: go test -run '^$' -fuzz=FuzzNormalizer -fuzztime 60s + + - name: Fuzz obfuscator and normalizer + run: go test -run '^$' -fuzz=FuzzObfuscatorAndNormalizer -fuzztime 60s From 6a0e9a8c64b10e5b1ccb87df7e0d9909a5a0cce8 Mon Sep 17 00:00:00 2001 From: Sebastien Blot Date: Fri, 21 Aug 2026 23:03:41 +0200 Subject: [PATCH 2/2] ci: make the benchmark workflow opt-in It passed on ubuntu-latest, in 46m54s. Upstream ran it on an 8-core ARM pool; a shared 2-core runner is an order of magnitude slower, and that cost was being paid on every push to every branch. The output does not justify it. Benchmarking this repo on a GitHub-hosted runner, base branch against itself, swings -4.9% to +5.3% between runs -- wider than most regressions worth catching. Run automatically it would report noise for 47 minutes a PR; run deliberately, before and after a change meant to move performance, it is still useful. workflow_dispatch only. Dispatch from a branch to compare against main, from main to refresh the cached baseline. Co-Authored-By: Claude Opus 5 --- .github/workflows/benchmark.yml | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml index 3194a62..1f8ded6 100644 --- a/.github/workflows/benchmark.yml +++ b/.github/workflows/benchmark.yml @@ -2,12 +2,16 @@ name: Run benchmarks permissions: contents: read +# Opt-in only. Upstream ran this on an 8-core ARM machine on every push; on a +# shared 2-core runner the same job takes ~47 minutes, and the numbers it +# produces are not worth that. Comparing the base branch against *itself* on a +# GitHub-hosted runner swings -4.9% to +5.3% run to run, which is wider than +# most changes worth detecting -- so an automatic delta here would mostly +# report noise, at 47 minutes a PR. +# +# Run it deliberately from the Actions tab when a change is expected to move +# performance, and confirm anything that matters on a quiet machine. on: - push: - branches: - - "*" - pull_request: - types: [opened, reopened, synchronize] workflow_dispatch: concurrency: @@ -15,6 +19,7 @@ concurrency: cancel-in-progress: true jobs: + # Dispatched from a branch: benchmark it against main. benchmark: if: github.ref != 'refs/heads/main' # Upstream runs this on DataDog's self-hosted ARM pool, which does not @@ -87,6 +92,7 @@ jobs: path: bench + # Dispatched from main: refresh the cached baseline the job above compares to. benchmark_main: if: github.ref == 'refs/heads/main' # Upstream runs this on DataDog's self-hosted ARM pool, which does not