feat: publish main benchmarks from the current workflow

[cpunion]

Summary

• add optional current-run publishing immediately after a successful default-branch benchmark job
• preserve the default workflow-run mode for existing callers, including persistent Main, Branch, and Pull request Pages data, so current workflows need no migration
• use the split mode in this repository: default-branch pushes publish directly, while the trusted workflow_run publisher handles PR results without duplicating main runs
• resolve queued fork runs through the measured commit association while rejecting stale PR writes and comments

Security

PR workflows only upload artifacts and never receive the Pages write token. The privileged publisher runs from the default branch, requires either its exact triggering workflow run or the current default-branch push, and derives repository, branch, SHA, PR number, and series kind from GitHub run metadata. A PR therefore cannot select the Main series.

PR and branch data are persisted only when their configuration exactly matches config_path on the default branch, preventing an artifact from redirecting site-path or overwriting another suite. A first setup PR can still produce a preview and comment, but it does not write Pages until the configuration is trusted.

Compatibility

source_mode defaults to workflow-run; existing publisher workflows continue to work unchanged. current-run is opt-in. Consumers that add it should restrict their existing workflow_run publisher to PR events to avoid publishing a main run twice.

Validation

• npm run check (35 tests)
• npm run build
• npm audit --omit=dev

[fennoai]

Review: direct main publish

Solid refactor. The source_mode trust model is well designed: the persistent-publish gate is anchored to API-derived run metadata (kind==main requires RUN_EVENT==push && HEAD_BRANCH==DEFAULT_BRANCH, resolved from gh api .../actions/runs/${RUN_ID}), not caller-supplied inputs, so fork/PR runs cannot cause persistent Pages writes. RUN_ID is pinned to the trusted trigger, untrusted values are passed via env: and quoted/regex-validated, and the benchmark-publish.yml change (contents: write → read, plus the workflow_run.event == 'pull_request' guard) correctly confines the low-privilege path to comment-only. README and workflow YAML are consistent. No high/medium severity issues.

A few hardening and maintainability notes below.

Additional notes (no reliable inline location)

• publish.yml reusable-workflow invariant is caller-enforced. The "workflow-run mode = comment-only / no persistent write" property is enforced only by the caller (benchmark-publish.yml's event == 'pull_request' guard), not by publish.yml itself. A future caller invoking workflow-run mode from a workflow_run that was triggered by a push-to-main would resolve kind=main and persist. Consider asserting inside publish.yml that workflow-run mode never yields publish=true (or documenting that such callers must not grant contents: write), so the two-trust-model invariant is self-contained.

• publish.yml PR_NUMBER unbound-variable fragility (~line 190). On the push/branch paths PR_NUMBER is never assigned locally; the script survives set -u only because PR_NUMBER arrives via the step env: block. If someone later drops PR_NUMBER from env:, the push path breaks with an unbound-variable error far from the edit. Initializing PR_NUMBER="" at the top of the script makes the invariant local and obvious.

• publish.yml DATA_REPOSITORY not validated before clone (~line 263). The preview fallback clones https://github.com/$DATA_REPOSITORY.git without the ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ check applied to HEAD_REPOSITORY. It comes from a trusted workflow input so risk is minimal, but validating it would be consistent. (Optional.)

[cpunion]

Addressed the remaining review notes:

• b086acb makes the reusable workflow-run mode reject every non-pull_request source, so the comment-only trust boundary no longer depends solely on the caller.
• d113051 already initializes the PR number locally and validates the data repository before use.
• The two inline maintainability comments were also addressed in d113051; their threads are now resolved.

Local npm test (34 tests) and npm run build pass.

[cpunion]

Follow-up dac2651 supersedes the earlier comment-only workflow-run restriction while preserving the trust boundary:

• legacy trusted workflow_run callers can still publish main, branch, and PR data without changing their workflows;
• run identity and series kind come from the GitHub Run API, so a PR artifact cannot become Main;
• every non-main persistent write now requires an exact default-branch configuration match, preventing PR-controlled site-path or layout changes from damaging another series;
• the first configuration PR remains preview/comment-only until that configuration is on the default branch.

The repository itself uses current-run for main and restricts its separate workflow_run publisher to PRs, avoiding duplicate publication.

[github-actions]

setup-benchmark-go-action

05f175036449 | workflow run | long-term charts

Action bundle sizes

Bundle	Size	vs main
RecordBundle	326529 B	+0.0%
RenderBundle	327120 B	+0.0%

Parser and validation operations

Group	Benchmark	Median time	vs main
Grouping	GroupRules100	222702.311 ns/op	-2.9% (better)
Parsing	ParseGoOutput40	246240.804 ns/op	-5.5% (better)
Validation	ValidateArtifact40	265077.997 ns/op	-11.3% (better)

Compared only with the latest matching platform in the main series.