Skip to content

ci: persist dispatched LLGo pins before building #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
zhouguangyuan0718 merged 2 commits into from
Jul 23, 2026
Merged

ci: persist dispatched LLGo pins before building #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8b5a60b
ci: persist dispatched LLGo pins before building
zhouguangyuan0718 Jul 23, 2026
29dc476
ci: guard Pages-only publication
zhouguangyuan0718 Jul 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .github/workflows/llgo-binary-size-pages.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,9 @@ concurrency:

jobs:
publish-site:
# Page-only publication is allowed only from the canonical main branch.
# Keep this guard even though pull_request is not currently a trigger.
if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v4
Expand All @@ -35,6 +38,7 @@ jobs:
ci/llgo-size/publish-site.sh "$pages_dir" ci/llgo-size/site

deploy-pages:
if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
needs: publish-site
runs-on: ubuntu-24.04
permissions:
Expand Down
76 changes: 56 additions & 20 deletions .github/workflows/llgo-binary-size.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,8 @@ on:
- ci/llgo-size/publish-site.sh
- ci/llgo-size/prepare-pages-branch.sh
- .github/workflows/llgo-binary-size-pages.yml
# ci/llgo-size/llgo-version.env is intentionally not ignored: changing
# the committed LLGo pin must trigger a binary-size build.
pull_request:
paths-ignore:
- ci/llgo-size/site/**
Expand All @@ -29,45 +31,79 @@ on:

permissions:
contents: write
actions: write

@fennoai fennoai Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Least privilege: scope actions: write to the job that needs it. This is granted at the workflow level, so every job inherits it — including binary-size, which builds untrusted LLGo/Bent code on pull_request events. Only update-pin needs actions: write (for the workflow_dispatch API call). Consider dropping the workflow-level default to the minimum and adding a job-level permissions: { contents: write, actions: write } block on update-pin only.


concurrency:
group: llgo-binary-size-pages
cancel-in-progress: false

jobs:
binary-size:
update-pin:

@fennoai fennoai Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

update-pin has no timeout-minutes. The old binary-size job's timeout-minutes: 120 moved to the new build job, leaving update-pin on the 360-minute default. Since it only does git + one curl, a small explicit timeout (e.g. timeout-minutes: 5) fails fast on a hung push/dispatch instead of holding the llgo-binary-size-pages concurrency slot for hours.

if: github.event_name == 'repository_dispatch'
runs-on: ubuntu-24.04
timeout-minutes: 120
steps:
- uses: actions/checkout@v4

- name: Read pinned toolchain versions
- name: Update the committed LLGo pin and start the build
env:
DISPATCH_SOURCE_REPOSITORY: ${{ github.event.client_payload.source_repository }}
DISPATCH_LLGO_REPOSITORY: ${{ github.event.client_payload.llgo_repository }}
DISPATCH_LLGO_COMMIT: ${{ github.event.client_payload.llgo_commit }}
GH_TOKEN: ${{ github.token }}
run: |
set -euo pipefail
if [[ "$DISPATCH_SOURCE_REPOSITORY" != "xgo-dev/llgo" || \
"$DISPATCH_LLGO_REPOSITORY" != "xgo-dev/llgo" ]]; then
echo "refusing binary-size dispatch from ${DISPATCH_SOURCE_REPOSITORY:-unknown}" >&2
exit 1
fi
if [[ ! "$DISPATCH_LLGO_COMMIT" =~ ^[0-9a-f]{40}$ ]]; then
echo "invalid dispatched LLGo commit: ${DISPATCH_LLGO_COMMIT:-missing}" >&2
exit 1
fi

current_commit="$(awk -F= '$1 == "LLGO_COMMIT" { print $2 }' ci/llgo-size/llgo-version.env)"
if [[ "$current_commit" == "$DISPATCH_LLGO_COMMIT" ]]; then
echo "LLGo pin is already $DISPATCH_LLGO_COMMIT; no build needed"
exit 0
fi

sed -i "s/^LLGO_COMMIT=.*/LLGO_COMMIT=${DISPATCH_LLGO_COMMIT}/" \
ci/llgo-size/llgo-version.env
git config user.name "github-actions[bot]"
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
git add ci/llgo-size/llgo-version.env
git commit -m "ci: pin LLGo ${DISPATCH_LLGO_COMMIT:0:12}"
git push origin HEAD:main

@fennoai fennoai Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Commit-then-dispatch is not atomic. The pin is committed and pushed to main here, then the build is dispatched separately below. If the subsequent curl fails (network blip, transient 5xx), main is left "pinned but not built" with no automatic retry — the next dispatch for a different SHA won't rebuild this one, and the same-SHA idempotency check (line 66) will now short-circuit it. Worth a mitigation: --retry/--max-time on the dispatch (see next comment), or ordering the dispatch before the push, or a follow-up that reconciles pinned-but-unbuilt commits.


payload="$(jq -cn \
--arg ref main \
--arg llgo_commit "$DISPATCH_LLGO_COMMIT" \
'{ref: $ref, inputs: {llgo_commit: $llgo_commit}}')"
curl --fail-with-body --location --request POST \

@fennoai fennoai Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dispatch curl has no timeout or retry. This is the load-bearing call that actually starts the build. Add --max-time/--connect-timeout and --retry 3 --retry-connrefused so a transient failure doesn't silently leave the repo pinned-but-unbuilt (see the commit-atomicity note above). --fail-with-body is good — it already fails the step on a non-2xx response.

--header 'Accept: application/vnd.github+json' \
--header "Authorization: Bearer ${GH_TOKEN}" \
--header 'X-GitHub-Api-Version: 2022-11-28' \
"https://api.github.com/repos/${GITHUB_REPOSITORY}/actions/workflows/llgo-binary-size.yml/dispatches" \
--data "$payload"

binary-size:
if: github.event_name != 'repository_dispatch'
runs-on: ubuntu-24.04
timeout-minutes: 120
steps:
- uses: actions/checkout@v4

- name: Read pinned toolchain versions
env:
MANUAL_LLGO_COMMIT: ${{ inputs.llgo_commit }}
run: |
set -euo pipefail
set -a
source ci/llgo-size/llgo-version.env
set +a

# The dispatched SHA is the run's runtime pin and is retained in
# results.json / Pages. Restrict automatic events to official LLGo.
if [[ "$GITHUB_EVENT_NAME" == "repository_dispatch" ]]; then
if [[ "$DISPATCH_SOURCE_REPOSITORY" != "xgo-dev/llgo" || \
"$DISPATCH_LLGO_REPOSITORY" != "xgo-dev/llgo" ]]; then
echo "refusing binary-size dispatch from ${DISPATCH_SOURCE_REPOSITORY:-unknown}" >&2
exit 1
fi
if [[ ! "$DISPATCH_LLGO_COMMIT" =~ ^[0-9a-f]{40}$ ]]; then
echo "invalid dispatched LLGo commit: ${DISPATCH_LLGO_COMMIT:-missing}" >&2
exit 1
fi
LLGO_REPOSITORY="$DISPATCH_LLGO_REPOSITORY"
LLGO_COMMIT="$DISPATCH_LLGO_COMMIT"
elif [[ -n "$MANUAL_LLGO_COMMIT" ]]; then
if [[ -n "$MANUAL_LLGO_COMMIT" ]]; then
if [[ ! "$MANUAL_LLGO_COMMIT" =~ ^[0-9a-f]{40}$ ]]; then
echo "manual LLGo commit must be a full 40-character SHA" >&2
exit 1
Expand Down Expand Up @@ -173,7 +209,7 @@ jobs:
if-no-files-found: error

- name: Publish binary-size history to Pages
if: github.event_name == 'repository_dispatch' || (github.event_name != 'pull_request' && github.ref == 'refs/heads/main')
if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
env:
PAGES_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
Expand All @@ -187,7 +223,7 @@ jobs:
"$pages_dir" \
ci/llgo-size/site
deploy-pages:
if: github.event_name == 'repository_dispatch' || (github.event_name != 'pull_request' && github.ref == 'refs/heads/main')
if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
needs: binary-size
runs-on: ubuntu-24.04
permissions:
Expand Down
19 changes: 13 additions & 6 deletions ci/llgo-size/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,12 +29,14 @@ and TSV result as an artifact. The summary also contains Bent's native per-case
build timings; `build-times.tsv`, `timing-summary.md`, `download-timings.log`,
and raw `.build` files are retained for diagnosing slow downloads or builds.

The `llgo-main-updated` repository-dispatch event from `xgo-dev/llgo` replaces
the default pin with its complete `llgo_commit` for that run. That exact commit
is retained in `results.json` and the Pages history, so every LLGo `main`
update has a comparable data point without committing a moving pin back to
this repository. GitHub requires the receiver workflow to be on the
benchmarks repository's default branch before it can receive this event.
The `llgo-main-updated` repository-dispatch event from `xgo-dev/llgo` first
updates `LLGO_COMMIT` on the benchmarks `main` branch, then explicitly starts a
`workflow_dispatch` build with that complete SHA. This makes the version-file
update and the published result one ordered operation without relying on a
`GITHUB_TOKEN`-created push to trigger another workflow. The exact commit is
retained in `results.json` and the Pages history, so every LLGo `main` update
has a comparable data point. GitHub requires the receiver workflow to be on
the benchmarks repository's default branch before it can receive this event.
The workflow sources `timing.sh` for its shared CI step timing output.
It invokes Bent with four configurable build workers (`BENT_BUILD_WORKERS=4`);
set that environment value to `1` to reproduce a serial build.
Expand All @@ -50,6 +52,11 @@ the Pages root lists all published runs and lets you compare any two runs by
benchmark and configuration. Pull requests still build and upload an artifact
but do not modify the history.

Changes that only touch the dashboard source or its publication scripts use the
separate `llgo-binary-size-pages.yml` workflow. That path publishes the updated
site directly without rebuilding benchmarks, and its publication jobs are
restricted to `main`; pull-request builds cannot publish Pages.

### First-time repository setup

The first publisher run creates the `pages` branch automatically. Before that
Expand Down
6 changes: 5 additions & 1 deletion docs/llgo-binary-size-handoff.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,13 +28,17 @@

入口工作流：[.github/workflows/llgo-binary-size.yml](../.github/workflows/llgo-binary-size.yml)

1. 读取 [ci/llgo-size/llgo-version.env](../ci/llgo-size/llgo-version.env) 的默认 LLGo、Go 和 LLVM 版本；LLGo `main` 的跨仓库事件会以其精确提交覆盖默认 LLGo pin。
1. 读取 [ci/llgo-size/llgo-version.env](../ci/llgo-size/llgo-version.env) 的默认 LLGo、Go 和 LLVM 版本；LLGo `main` 的跨仓库事件会先更新该 pin，再显式启动一次构建和 Pages 发布。
2. 安装 LLVM 19、构建 LLGo 命令与 LTO plugin。
3. 用 Bent 对每个 suite 运行 Go + 4 个 LLGo 配置，产出 `benchsize` 的 JSON/TSV/raw 文件；CI 通过 `-j="$BENT_BUILD_WORKERS"` 并发构建，当前值为 4。
4. [report.sh](../ci/llgo-size/report.sh) 整理结果和构建/下载耗时。
5. [publish.sh](../ci/llgo-size/publish.sh) 将结果归档到 `pages/data/runs/<run>-<attempt>/`，更新 `data/index.json`。
6. `deploy-pages` job 检出 `pages` 分支，用 Jekyll 构建后通过 GitHub Pages artifact 部署。

只修改仪表盘源码或页面发布脚本时，不进入二进制大小构建；独立的
`llgo-binary-size-pages.yml` 会直接刷新 `pages` 分支并部署站点。该工作流和
主工作流的发布 job 都限制在 `main`，PR 构建只验证和上传 artifact，不会发布。

核心文件：

- [Bent suites](../cmd/bent/configs/benchmarks-llgo-size.toml)
Expand Down