prevent aggressive DCE in MWE w/ TinyGo and cull fmt package (#196)

* cull fmt package use and prevent aggressive DCE in MWE example with TinyGo * add noslog build tag and small reference section to README * add memci * fix ci * whoops, forgot memci.json to gitignore * whoops x2 * use noslog build tag * don't go ham on removing fmt useful data * remove old benchmarking CI
2026-09-07 23:39:04 +00:00 · 2026-09-06 17:17:14 -03:00
parent d219daa2c4
commit d7f3924489
24 changed files with 306 additions and 220 deletions
@@ -1,90 +0,0 @@
-name: Benchmark Comment
-
-# Rationale: This more privileged workflow runs in the base repo's
-# context (with a write token) only after the 'untrusted' CI workflow finishes.
-# It does NOT check out or execute PR code; it only consumes the benchmark
-# report artifact as inert, validated data.
-on:
-  workflow_run:
-    workflows: [CI]
-    types: [completed]
-
-permissions:
-  contents: read
-
-jobs:
-  comment:
-    # Only for PR-triggered CI runs that succeeded to suppress noise
-    if: >
-      github.event.workflow_run.event == 'pull_request' &&
-      github.event.workflow_run.conclusion == 'success'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write # needed to comment
-    steps:
-      - name: Download generated benchmark report
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.1
-        with:
-          name: bench-report
-          path: bench-report
-          run-id: ${{ github.event.workflow_run.id }}
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Validate report and upsert PR comment
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          REPO: ${{ github.repository }}
-          PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }}
-          HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
-          HEAD_OWNER: ${{ github.event.workflow_run.head_repository.owner.login }}
-          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
-        run: |
-          set -euo pipefail
-
-          report="bench-report/bench-report.md"
-          marker='<!-- lneto-bench -->'
-
-          # Treat the artifact as untrusted input: it was produced by a job that
-          # ran PR code. Basic validation before posting. TODO: Make more robust.
-          test -f "$report"
-          size="$(wc -c < "$report")"
-          if [ "$size" -le 0 ] || [ "$size" -gt 1000000 ]; then
-            echo "::error::benchmark report has unexpected size: ${size} bytes"
-            exit 1
-          fi
-          if ! grep -qF "$marker" "$report"; then
-            echo "::error::benchmark report missing marker ${marker}"
-            exit 1
-          fi
-
-          # Prefer the PR number from the workflow_run payload, which ties this
-          # privileged workflow to the PR-triggered CI run. Fall back to the
-          # run's head SHA/branch only when GitHub does not populate it.
-          pr="$PR_NUMBER"
-          if [ -z "$pr" ]; then
-            pr="$(gh api "repos/${REPO}/commits/${HEAD_SHA}/pulls" \
-              --jq 'map(select(.state == "open")) | .[0].number // empty')"
-          fi
-          if [ -z "$pr" ]; then
-            pr="$(gh api --method GET "repos/${REPO}/pulls" \
-              -f state=open \
-              -f head="${HEAD_OWNER}:${HEAD_BRANCH}" \
-              --jq '.[0].number // empty')"
-          fi
-          if [ -z "$pr" ]; then
-            echo "No open PR found for ${HEAD_SHA}; nothing to comment."
-            exit 0
-          fi
-
-          comment_id="$(
-            gh api "repos/${REPO}/issues/${pr}/comments" --paginate \
-              --jq ".[] | select(.body | contains(\"${marker}\")) | .id" | head -n1
-          )"
-          if [ -n "$comment_id" ]; then
-            gh api --method PATCH "repos/${REPO}/issues/comments/${comment_id}" \
-              --input - < <(jq -n --rawfile body "$report" '{body: $body}')
-          else
-            gh api --method POST "repos/${REPO}/issues/${pr}/comments" \
-              --input - < <(jq -n --rawfile body "$report" '{body: $body}')
-          fi
@@ -100,38 +100,21 @@ jobs:
      - name: Test (race + shuffle)
        run: go test -race -shuffle=on -count=1 -timeout=10m ./...

-  benchmark:
+  memci:
    needs: [test]
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
        with:
          go-version: "1.26"
-
-      - name: Run benchmarks
-        run: go test -bench=. -benchmem -count=5 -shuffle=on -run='^$' -timeout=15m ./... | tee bench-results.txt
-
-      - name: Generate benchmark report
-        run: |
-          go run ./internal/benchci -current bench-results.txt -out bench-report.md
-          cat bench-report.md >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Upload generated benchmark report
-        if: github.event_name == 'pull_request'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      # Needed because a build command in memci.json names tinygo. Keep the two
+      # versions in step: TinyGo 0.42 builds with Go 1.25 through 1.27 and
+      # refuses to run outside that window, in either direction.
+      - uses: acifani/setup-tinygo@v2
        with:
-          name: bench-report
-          path: bench-report.md
-          retention-days: 30
-
-      - name: Upload raw benchmark results
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+          tinygo-version: "0.42.0"
+      - uses: soypat/memci@main
        with:
-          name: bench-results
-          path: bench-results.txt
-          retention-days: 30
+          args: -kind package
+          targets: .github/workflows/memci.json
@@ -0,0 +1,24 @@
+name: memci comment
+
+# Runs in the base repo's context with a write token, after the untrusted memci
+# workflow finishes. It never checks out or runs PR code; it only consumes the
+# report artifact as inert data.
+
+on:
+  workflow_run:
+    workflows: [CI]
+    types: [completed]
+
+permissions: read-all
+
+jobs:
+  comment:
+    if: github.event.workflow_run.event == 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: soypat/memci/comment@main
+        with:
+          run-id: ${{ github.event.workflow_run.id }}
@@ -0,0 +1,13 @@
+[
+    {
+        "name":"Stack MWE",
+        "build":"go build -o=mwe.elf -tags=noslog ./examples/min-working-example",
+        "elf":"mwe.elf"
+    },
+    {
+        "name":"Stack MWE pico",
+        "build":"tinygo build -o=mwe-pico.elf -target=pico -tags=noslog -panic=trap ./examples/min-working-example",
+        "elf":"mwe-pico.elf",
+        "mem":true
+    }
+]