Restored CI perf-tests job for boot time benchmarking

[mike182uk]

ref #26512
ref https://app.incident.io/ghost/incidents/314

• job_perf-tests was removed in Removed CI perf-tests job that pushes to archived repo #26512 (2026-02-19) because TryGhost/Ghost-Benchmarks had been archived, so the push step failed on every main merge that touched core
• that repo was unarchived on 2026-07-19, so the original blocker is gone
• the measurement is a faithful restore: same hyperfine version (1.18.0), same invocation, same jq transform, same destination, so the existing 3,757-point series continues rather than restarting
• the surrounding plumbing had to change: ./.github/actions/restore-cache no longer exists (replaced by pnpm install), yarn became pnpm, and all actions are now SHA-pinned per org policy
• not added to job_required_tests - this charts a trend, it doesn't gate merges (at the moment)

[nx-cloud]

🤖 Nx Cloud AI Fix

Ensure the fix-ci command is configured to always run in your CI pipeline to get automatic fixes in future runs. For more information, please see https://nx.dev/ci/features/self-healing-ci

---

View your CI Pipeline Execution ↗ for commit 7751086

Command	Status	Duration	Result
nx run @tryghost/admin:test:acceptance	✅ Succeeded	5m 47s	View ↗

💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗

---

☁️ Nx Cloud last updated this comment at 2026-08-05 12:45:47 UTC

[coderabbitai]

Walkthrough

The CI setup job exposes whether a pull request has the perf-tests label. Eligible development-branch changes or labeled pull requests run a performance job. The job installs dependencies and hyperfine, builds TypeScript, measures Ghost boot time with warmups, converts the median and range to benchmark data, and publishes push-run results to the Ghost-Benchmarks repository.

Possibly related PRs

• TryGhost/Ghost#29454: Updates GitHub Actions conditions based on pull-request context and changed files.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly states that the CI performance-testing job was restored for boot-time benchmarking.
Description check	✅ Passed	The description directly explains the restoration, historical cause, implementation changes, and non-blocking purpose.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch inc-314-ghost-benchmarks

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.58%. Comparing base (80f25ba) to head (7751086).
⚠️ Report is 7 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #29769      +/-   ##
==========================================
+ Coverage   75.55%   75.58%   +0.02%     
==========================================
  Files        1613     1613              
  Lines      142672   142610      -62     
  Branches    17616    17639      +23     
==========================================
- Hits       107801   107796       -5     
+ Misses      33795    33736      -59     
- Partials     1076     1078       +2     

Flag	Coverage Δ
e2e-tests	77.72% <ø> (+0.03%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci.yml:
- Around line 489-493: Update the Hyperfine installation steps around
HYPERFINE_VERSION to define the trusted SHA-256 for the exact downloaded
archive, run sha256sum --check against that archive before tar extraction, and
only proceed to move and chmod the binary after verification succeeds.
- Line 466: Update the benchmark publishing condition and related benchmark
action configuration in the workflow so pull-request runs cannot receive the
canary push token or use auto-push. Gate publishing on a trusted post-merge push
run, preserving the existing changed-core and development checks where
applicable, and ensure publication occurs only after the pull request is merged.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 25f495cc-48ec-47b4-8b1c-4bba4aa5fca9

📥 Commits

Reviewing files that changed from the base of the PR and between 97fcc57 and 2630659.

📒 Files selected for processing (1)

• .github/workflows/ci.yml