releases/.github/workflows/benchmarks.yaml

name: Benchmarks

on:
  workflow_dispatch: {}
  push:
    branches: [main]
  merge_group: # needed for checks in merge queue

permissions:
  contents: read

jobs:
    # Check what types of changes this PR contains
  check-changes:
    name: Check what files changed
    runs-on: ubuntu-24.04
    outputs:
      go: ${{ steps.changes.outputs.go }}
    steps:
      - name: Check out code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Check for file changes
        id: changes
        run: | # zizmor: ignore[template-injection] These SHAs are generated by GitHub, not user-controlled.
          set -e
          # merge_group events use different context properties than push events
          if [ -n "${{ github.event.merge_group.base_sha }}" ]; then
            BEFORE_SHA="${{ github.event.merge_group.base_sha }}"
            CURRENT_SHA="${{ github.event.merge_group.head_sha }}"
          else
            BEFORE_SHA="${{ github.event.before }}"
            CURRENT_SHA="${{ github.event.after }}"
          fi

          # Default to running all checks
          echo "go=true" >> $GITHUB_OUTPUT

          echo "Comparing $BEFORE_SHA with $CURRENT_SHA"
          git diff --name-only "$BEFORE_SHA" "$CURRENT_SHA" > changed_files.txt
          if [ ! -s changed_files.txt ]; then
            echo "Warning: No changed files found"
            exit 0
          fi

          echo "Changed files:"
          cat changed_files.txt

          # Check for Go-related changes
          go_patterns="^(.*\.go$|\
          .*\.yaml$|\
          .*\.yml$|\
          .*\.json$|\
          .*\.mod$|\
          .*\.sum$|\
          .*\.sh$|\
          ^Makefile$|\
          ^\.go-version$|\
          ^cmd/|\
          ^internal/|\
          ^v1/)"
          if ! grep -E "$go_patterns" changed_files.txt > /dev/null 2>&1; then
            echo "go=false" >> $GITHUB_OUTPUT
            echo "No Go files changed, skipping Go checks"
          else
            echo "Found Go file changes"
          fi

          echo "Final outputs:"
          echo "go=$(grep '^go=' $GITHUB_OUTPUT | tail -1 | cut -d'=' -f2)"

  benchmarks:
    permissions:
      contents: write # we'll push to the `benchmarks` branch
    name: Benchmarks
    needs: check-changes
    if: ${{ needs.check-changes.outputs.go == 'true' }}
    runs-on: ubuntu-24.04
    steps:
      - name: Check out code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          path: opa
          persist-credentials: true
      - id: go_version
        name: Read go version
        run: echo "go_version=$(cat .go-version)" >> $GITHUB_OUTPUT
        working-directory: opa
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: ${{ steps.go_version.outputs.go_version }}
          cache-dependency-path: opa/go.sum
      - name: gobenchdata publish
        run: go run go.bobheadxi.dev/gobenchdata@v1 action
        env:
          INPUT_GO_TEST_FLAGS: "-tags=opa_wasm -timeout=120m -run=^#"
          INPUT_GO_TEST_PKGS: ./...
          INPUT_SUBDIRECTORY: opa
          INPUT_PUBLISH: true
          INPUT_PUBLISH_BRANCH: benchmarks
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        timeout-minutes: 120

  notebook:
    permissions:
      contents: write # we'll push to the `benchmarks` branch
    name: update notebook
    runs-on: ubuntu-24.04
    needs: [check-changes, benchmarks] # force sequential commits for notebook and benchmark results
    if: ${{ needs.check-changes.outputs.go == 'true' }}
    steps:
      - uses: open-policy-agent/setup-opa@950f159a49aa91f9323f36f1de81c7f6b5de9576 # v2.3.0
      - name: Check out code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: benchmarks
          persist-credentials: true
      - name: Install Node
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: 25
      - name: update notebook
        run: |
          npm ci
          cp ../benchmarks.json . # nodejs data loader can't access ../
          npm run docs:build
          rm benchmarks.json
        working-directory: src/
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: commit if changed
        working-directory: benchmarks/ # output dir of the docs:build command
        run: |
          if ! git diff-index --quiet HEAD -- .; then
            git config --local user.email "${GITHUB_ACTOR}@users.noreply.github.com"
            git config --local user.name "${GITHUB_ACTOR}"
            git add -f .
            git diff --staged
            git commit -m "benchmarks: update notebook for ${GITHUB_SHA}"
            git push origin benchmarks
          else
            echo "no changes, no commit"
          fi