fix(ci): publish scheduled benchmark via unprotected data branch#8
Conversation
The default GITHUB_TOKEN cannot push to the ruleset-protected main, so the weekly benchmark now publishes its artifacts (api JSON + examples/benchmark report & archive) to an unprotected `telemetry` branch. The live stdlib endpoints (stats + benchmark-latest) fetch the freshest artifact from that branch at request time (Vercel runtime only) and fall back to the copy committed on main. Report/run URLs point at the telemetry branch; the static fixture stays on main. No secret, no change to main's branch protection.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c97f55e51a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| git commit -m "chore(benchmark): scheduled run [skip ci]" | ||
| git push | ||
| git -C .telemetry commit -m "telemetry: scheduled benchmark $(date -u +%Y-%m-%d)" | ||
| git -C .telemetry push origin telemetry |
There was a problem hiding this comment.
The workflow still allows workflow_dispatch, and the checkout step has no ref, so a manual run on a feature branch benchmarks that branch (actions/checkout defaults to the triggering ref/SHA) but this new push publishes the result to the shared telemetry branch that /api/stats and /api/benchmark-latest read in production. In that scenario unmerged fixture or runner changes can replace production telemetry; guard the publish job/step to refs/heads/main or explicitly checkout main before publishing.
Useful? React with 👍 / 👎.
| rm -rf .telemetry/examples/benchmark | ||
| cp -R "$stage/examples/benchmark" .telemetry/examples/ 2>/dev/null || true |
There was a problem hiding this comment.
On every run after the first, telemetry contains archive files that are not present in the protected main checkout. This deletes the telemetry branch's whole benchmark directory and then replaces it with $stage/examples/benchmark, which was copied from main plus only the current run, so previous telemetry-only archive/*.json files disappear and older run URLs stop resolving. Copy the existing archive forward or replace only the latest report/current run file.
Useful? React with 👍 / 👎.
1 participant
Same autonomous fix as data-quality-watchtower#8 / revenue-signal-copilot#8. The weekly benchmark's
git pushtomainfailed (exit 128/GH013) because the defaultGITHUB_TOKENcannot push to the ruleset-protected branch.Fix (no secret, no protection change): the workflow publishes its artifacts (api JSON + examples/benchmark report & archive) to an unprotected
telemetrybranch (worktree push, history seeded from there);api/stats.py+api/benchmark-latest.pyfetch the freshest artifact from that branch at request time (Vercel-runtime-guarded) with the committed file as fallback. Report/run URLs point attelemetry; the static fixture stays onmain.Verification: 25 Python tests pass; runner smoke-tested; workflow dispatched on this branch. Reversible by revert;
mainprotection untouched.