fix(ci): repair the benchmark gate and de-flake the two red platform legs

[raroche]

Fixes the three CI legs that have been red on main since at least the 1.0.2 release. Neither failure was what its label suggested, and one of them was silently voiding a guarantee we advertise.

No src/ changes, so no version bump: this is CI/test infrastructure only, and 1.1.0 is not yet tagged.

1. benchmark gate (linux-x64) — the gate had stopped measuring

Not a perf regression. It failed before taking a single measurement, so the CI performance gate promised in CLAUDE.md (3-page invoice ≤ 200 ms p50, etc.) was effectively vacuous — including the "under 200 ms" figure used in public launch material.

BenchmarkDotNet writes a per-job project under the benchmark project's output dir and restores it. That path is inside the repo, so MSBuild/NuGet walk up from it and pick up the root Directory.Build.props + Directory.Packages.props, dragging Central Package Management into the generated project. On the CI runner, restore then tried to resolve the generated assembly name — a GUID — as a NuGet package:

error NU1101: Unable to find package e0917db2-1744-4b6e-a1dc-bc1266567f06

Only 3 of 33 benchmarks survived. The gate compared that partial result set and died inside System.Text.Json (target element has type 'Null', exit 134) — a crash that read as an infra flake and hid that nothing was being measured.

Two changes:

• NetPdf.Benchmarks.csproj writes inert Directory.Build.props/.targets plus a CPM-off Directory.Packages.props into $(TargetDir), so the generated project's upward search stops below the repo root and it restores standalone. Sentinels live in bin/ (gitignored), rewritten each build. Two traps that bit during development are pinned in comments: $(OutDir) is relative (writes land beside the .csproj, turning CPM off for the project itself → NU1015), and <TargetFrameworks> runs an outer build with an empty $(TargetDir) (same result).
• scripts/benchmark-gate.sh no longer lets a partial run reach --compare. BDN exits 0 even when a generated project fails to build, so the script now exits 2 with a clear message when the run errors, when BDN reports a boilerplate build failure, or when fewer result files are produced than the baseline has. A silently incomplete suite can no longer masquerade as a measured one.

2. alpine-musl-x64 + linux-arm64 — a false positive, not native breakage

Both legs failed the same 2 tests while 8604 of 8609 passed, so this was never the SkiaSharp/native-asset problem the "non-blocking" labels imply.

AutoHeightFlexTimelineFooterTests identifies the footer note as "the run with the most glyphs", which silently assumes the note renders as one line. CI provisions fonts asymmetrically by design — linux-arm64 installs only fonts-dejavu-core, alpine only ttf-dejavu, while the enforcing linux-x64 runner has the full Ubuntu set. Under DejaVu metrics the note wrapped, so the detected "note" was only its first line and its own tail — "departure zulu", exactly the 14 glyphs the failure reported — became a run below it.

Wrapping a long line is correct engine behaviour; the test's single-line premise was the bug. The note is now white-space: nowrap with the font pinned like the sibling rendering tests. The invariant under test (the note must be last, never overlapped by timeline content) is still fully asserted.

Verification

Both fixes were verified by reproducing the failures, not by assuming:

• The flex failure was reproduced locally (no nowrap + wider font) yielding the exact CI signature — a run (glyphs=14) ... sits below the footer note — and the same document passes with the fix.
• The benchmark generated-project path was validated in a clean worktree: BDN generates, builds, and produces real measurements with the sentinels in place.

Local suites: build 0 errors · UnitTests 8607 passed / 3 skipped · RenderingCorpus 41 · RealDocuments 105.

Follow-up worth considering

Once this lands and the gate is green, benchmark gate should probably become a required check — as it stands, a genuine perf regression still wouldn't block a merge.

[Copilot]

Pull request overview

This PR repairs CI/test infrastructure to restore the BenchmarkDotNet performance gate’s integrity (preventing partial benchmark runs from being compared) and de-flakes two platform-specific rendering test failures caused by font-metrics-driven wrapping differences.

Changes:

• Add sentinel MSBuild/NuGet files under the benchmark output directory to prevent repo-level CPM inheritance in BenchmarkDotNet auto-generated job projects.
• Harden scripts/benchmark-gate.sh to fail fast (exit 2) on partial/errored benchmark runs before attempting --compare.
• Make AutoHeightFlexTimelineFooterTests deterministic across platforms by pinning font usage and forcing the footer note to remain single-line (white-space: nowrap).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
tests/NetPdf.UnitTests/Rendering/AutoHeightFlexTimelineFooterTests.cs	Prevents platform font differences from causing test false-positives by enforcing a single-line footer note.
tests/NetPdf.Benchmarks/NetPdf.Benchmarks.csproj	Writes sentinel files into benchmark output to isolate BenchmarkDotNet generated projects from repo-level MSBuild/NuGet inheritance.
scripts/benchmark-gate.sh	Detects benchmark run failures/partial result sets and stops before comparison to keep the gate meaningful.

Comments suppressed due to low confidence (1)

tests/NetPdf.Benchmarks/NetPdf.Benchmarks.csproj:74

• This paragraph refers to dropping the sentinel files in $(OutDir), but the target actually writes them to $(TargetDir). Aligning the comment with the implementation will avoid misleading future maintenance/debugging.

    Dropping inert sentinels in `$(OutDir)` stops the upward search BELOW the repo root, so the generated

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.