Security Benchmark #9
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Benchmark | |
| on: | |
| workflow_dispatch: | |
| schedule: | |
| - cron: '0 6 * * 0' # Sundays at 06:00 UTC — runs ~6h after the perf | |
| # benchmark, so the resulting deploy carries both | |
| # data files into the docs site. | |
| jobs: | |
| security: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 45 | |
| permissions: | |
| contents: write | |
| deployments: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.12' | |
| - name: Install Python dependencies | |
| # Mirrors the perf workflow's pinning style. | |
| run: pip install gitpython semver coloredlogs | |
| - name: Run security benchmark | |
| run: python -m benchmark security | |
| - name: Upload security results | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: security-results | |
| path: benchmark/results/security.json | |
| - name: Commit security results to repo | |
| run: | | |
| # `python -m benchmark security` already writes the redacted | |
| # docs/public/data/security.json via write_public_report (uses | |
| # benchmark/disclosures.toml). The raw, unredacted JSON in | |
| # benchmark/results/ is .gitignored. | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| git add docs/public/data/security.json | |
| git diff --cached --quiet || git commit -m "chore: update security benchmark results" | |
| git push | |
| # GITHUB_TOKEN commits don't trigger other workflows, so deploy here. | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '22' | |
| - name: Install site dependencies | |
| working-directory: docs | |
| run: npm ci | |
| - name: Build site | |
| working-directory: docs | |
| run: npm run build | |
| - name: Deploy to Cloudflare Pages | |
| uses: cloudflare/wrangler-action@v3 | |
| with: | |
| command: pages deploy docs/dist --project-name=githacker --branch=main --commit-dirty=true | |
| apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} |