ci: persist dispatched LLGo pins before building

[zhouguangyuan0718]

Summary

• keep ci/llgo-size/llgo-version.env in the normal push trigger scope, so a committed LLGo pin update always runs the build and Pages publication;
• handle the future xgo-dev/llgo llgo-main-updated event by validating the payload, committing the new LLGO_COMMIT to benchmarks main, and explicitly dispatching the build with the same SHA;
• avoid running the build twice for one repository-dispatch event and document the ordered update/build flow.

Validation

• Ruby YAML parse of .github/workflows/llgo-binary-size.yml
• git diff --check
• verified sender payload fields match the receiver validation

[fennoai]

Review: ci — persist dispatched LLGo pins before building

The two-workflow split is sound and the design correctly relies on GitHub's rule that a workflow_dispatch sent via the REST API does create a run even when authenticated with GITHUB_TOKEN (workflow_dispatch/repository_dispatch are the documented exceptions), while the GITHUB_TOKEN-authored git push origin HEAD:main does not recursively trigger the push workflow. So exactly one build fires per dispatch — no double build, and the dispatched build does run. Payload handling is also good: attacker-influenceable fields are passed via env: (not string-interpolated into run:), DISPATCH_LLGO_COMMIT is validated to ^[0-9a-f]{40}$ before any sed/git/jq use, and the payload is built with jq -cn --arg — no command or JSON injection.

Findings below are hardening/robustness, not correctness blockers. Inline comments carry the specifics.

Additional notes (no reliable inline anchor):

• Non-existent SHA can be pinned to main (low). Validation confirms the SHA shape and the xgo-dev/llgo allow-list but never confirms the commit exists upstream. A garbage-but-well-formed SHA would be committed to main and only fail later at the build's git fetch ... "$LLGO_COMMIT" step — a noise/DoS vector, not code execution. Optional: git ls-remote https://github.com/xgo-dev/llgo "$DISPATCH_LLGO_COMMIT" before committing.
• Empty current_commit guard (low). If LLGO_COMMIT were ever absent from llgo-version.env, the awk yields empty, the idempotency check passes through, and sed matches nothing — producing an empty-diff git commit that aborts under set -euo pipefail. Asserting current_commit is a 40-hex value would make that failure explicit rather than incidental.

Prior reviews and inline threads: none on this PR.

View job run

[fennoai]

Least privilege: scope actions: write to the job that needs it. This is granted at the workflow level, so every job inherits it — including binary-size, which builds untrusted LLGo/Bent code on pull_request events. Only update-pin needs actions: write (for the workflow_dispatch API call). Consider dropping the workflow-level default to the minimum and adding a job-level permissions: { contents: write, actions: write } block on update-pin only.

[fennoai]

update-pin has no timeout-minutes. The old binary-size job's timeout-minutes: 120 moved to the new build job, leaving update-pin on the 360-minute default. Since it only does git + one curl, a small explicit timeout (e.g. timeout-minutes: 5) fails fast on a hung push/dispatch instead of holding the llgo-binary-size-pages concurrency slot for hours.

[fennoai]

Commit-then-dispatch is not atomic. The pin is committed and pushed to main here, then the build is dispatched separately below. If the subsequent curl fails (network blip, transient 5xx), main is left "pinned but not built" with no automatic retry — the next dispatch for a different SHA won't rebuild this one, and the same-SHA idempotency check (line 66) will now short-circuit it. Worth a mitigation: --retry/--max-time on the dispatch (see next comment), or ordering the dispatch before the push, or a follow-up that reconciles pinned-but-unbuilt commits.

[fennoai]

Dispatch curl has no timeout or retry. This is the load-bearing call that actually starts the build. Add --max-time/--connect-timeout and --retry 3 --retry-connrefused so a transient failure doesn't silently leave the repo pinned-but-unbuilt (see the commit-atomicity note above). --fail-with-body is good — it already fails the step on a non-2xx response.