Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 38 additions & 1 deletion .github/workflows/ci-host.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ on:

permissions:
checks: write
contents: read
contents: write
id-token: write
pull-requests: write
Comment on lines +24 to 26
Copy link

Copilot AI Apr 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Workflow-level permissions grants contents: write for all events (including pull_request). That unnecessarily broad scope increases the blast radius of any workflow change in a PR. Consider keeping workflow default at contents: read and granting contents: write only at the job (or step) that performs the baseline commit/push, gated to push on main.

Suggested change
contents: write
id-token: write
pull-requests: write
contents: read
id-token: write
pull-requests: read

Copilot uses AI. Check for mistakes.

Expand Down Expand Up @@ -219,6 +219,17 @@ jobs:
name: host-test-report-${{ matrix.shardIndex }}
path: junit/host-${{ matrix.shardIndex }}.xml
retention-days: 30
- name: Extract memory report
if: ${{ !cancelled() }}
run: node scripts/extract-memory-report.mjs /tmp/test-output.log /tmp/memory-report-${{ matrix.shardIndex }}.json
working-directory: packages/host
- name: Upload memory report
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: ${{ !cancelled() }}
with:
name: memory-report-${{ matrix.shardIndex }}
path: /tmp/memory-report-${{ matrix.shardIndex }}.json
retention-days: 30
- name: Print realm server logs
if: ${{ !cancelled() }}
run: cat /tmp/server.log
Expand Down Expand Up @@ -360,3 +371,29 @@ jobs:
with:
junit_files: host.xml
check_name: Host Test Results

- name: Download memory reports
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
if: ${{ !cancelled() }}
with:
path: all-memory-reports
pattern: memory-report-*
merge-multiple: true

- name: Check memory baseline
if: ${{ !cancelled() }}
run: node packages/host/scripts/check-memory-baseline.mjs all-memory-reports packages/host/memory-baseline.json

- name: Update memory baseline
if: ${{ !cancelled() && github.ref == 'refs/heads/main' && needs.host-test.result == 'success' }}
run: |
node packages/host/scripts/update-memory-baseline.mjs all-memory-reports packages/host/memory-baseline.json
if git diff --quiet packages/host/memory-baseline.json; then
echo "Baseline unchanged — nothing to commit."
else
git config user.name "github-actions[bot]"
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
git add packages/host/memory-baseline.json
git commit -m "Update host test memory baseline [skip ci]"
git push
fi
Loading
Loading