Share benchmark execution and preserve reviewed evidence

.github/actions/boringcache/action.yml

@@ -35,6 +35,9 @@ outputs:
 runs:
   using: composite
   steps:
+    # Register first so retention runs after the product's post step.
+    - id: retention
+      uses: ./.github/actions/retain-product-evidence
     - id: provider
       uses: boringcache/one@f0fb9b2d926a32b10c543e92093ba00c5a291b79 # v1.33.0
       with:
@@ -47,3 +50,10 @@ runs:
         diagnostics: ${{ inputs.diagnostics }}
         fail-on-cache-error: true
         fail-on-cache-miss: ${{ inputs.fail-on-cache-miss == 'true' }}
+    - name: Register the original product evidence
+      if: always()
+      shell: bash
+      env:
+        EVIDENCE_PATH: ${{ steps.provider.outputs.evidence-path }}
+        REGISTRY_PATH: ${{ steps.retention.outputs.registry-path }}
+      run: printf '%s\n' "$EVIDENCE_PATH" > "$REGISTRY_PATH"

.github/actions/docker-benchmark/action.yml

@@ -0,0 +1,131 @@
+name: Build with the declared Docker cache provider
+description: Measures the same cache publication policy and image output for both providers.
+inputs:
+  strategy:
+    required: true
+  phase:
+    required: true
+  publish-on-warm:
+    default: 'false'
+  cache-scope:
+    required: true
+  cli-version:
+    default: ''
+  cli-platform:
+    default: ''
+  buildkit-image:
+    default: ''
+  context:
+    required: true
+  file:
+    required: true
+  platforms:
+    default: ''
+  target:
+    default: ''
+  tags:
+    default: ''
+  push:
+    default: 'false'
+  load:
+    default: 'false'
+  build-args:
+    default: ''
+  provenance:
+    default: ''
+  sbom:
+    default: 'false'
+  secrets:
+    default: ''
+  no-cache:
+    default: 'false'
+outputs:
+  setup-seconds:
+    value: ${{ steps.build_timer.outputs.setup_seconds }}
+    description: Provider setup duration.
+  build-seconds:
+    value: ${{ steps.build_timing.outputs.build_seconds }}
+    description: Build, image output and declared cache publication duration.
+  cache-hit:
+    value: ${{ steps.publish.outputs.cache-hit || steps.restore.outputs.cache-hit }}
+    description: Product-reported cache outcome, when measured.
+  evidence-path:
+    value: ${{ steps.publish.outputs.evidence-path || steps.restore.outputs.evidence-path }}
+    description: Original product evidence file.
+runs:
+  using: composite
+  steps:
+    - name: Resolve the shared cache publication policy
+      id: policy
+      shell: bash
+      env:
+        PHASE: ${{ inputs.phase }}
+        PUBLISH_ON_WARM: ${{ inputs.publish-on-warm }}
+      run: ruby ./scripts/benchmark-phase.rb policy
+    - name: Start the provider setup timer
+      id: setup_timer
+      shell: bash
+      run: echo "started_at=$(date +%s)" >> "$GITHUB_OUTPUT"
+    - name: Set up the Actions Cache builder
+      if: inputs.strategy == 'actions-cache'
+      uses: ./.github/actions/setup-docker
+    - name: Start the build timer
+      id: build_timer
+      shell: bash
+      env:
+        SETUP_STARTED_AT: ${{ steps.setup_timer.outputs.started_at }}
+      run: |
+        now="$(date +%s)"
+        echo "setup_seconds=$(( now - SETUP_STARTED_AT ))" >> "$GITHUB_OUTPUT"
+        echo "started_at=$now" >> "$GITHUB_OUTPUT"
+    - name: Build with Actions Cache
+      if: inputs.strategy == 'actions-cache'
+      uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8
+      env:
+        DOCKER_BUILD_SUMMARY: 'false'
+        DOCKER_BUILD_RECORD_UPLOAD: 'false'
+      with:
+        context: ${{ inputs.context }}
+        file: ${{ inputs.file }}
+        platforms: ${{ inputs.platforms }}
+        target: ${{ inputs.target }}
+        tags: ${{ inputs.tags }}
+        push: ${{ inputs.push == 'true' }}
+        load: ${{ inputs.load == 'true' }}
+        build-args: ${{ inputs.build-args }}
+        provenance: ${{ inputs.provenance }}
+        sbom: ${{ inputs.sbom == 'true' }}
+        secrets: ${{ inputs.secrets }}
+        no-cache: ${{ inputs.no-cache == 'true' }}
+        cache-from: type=gha,scope=${{ inputs.cache-scope }}
+        cache-to: ${{ steps.policy.outputs.publish_cache == 'true' && format('type=gha,scope={0},mode=max', inputs.cache-scope) || '' }}
+    - name: Build and publish with BoringCache
+      id: publish
+      if: inputs.strategy == 'boringcache' && steps.policy.outputs.publish_cache == 'true'
+      uses: ./.github/actions/boringcache
+      env:
+        BORINGCACHE_MANAGED_BUILDKIT_IMAGE: ${{ inputs.buildkit-image }}
+      with:
+        mode: docker
+        cli-version: ${{ inputs.cli-version }}
+        cli-platform: ${{ inputs.cli-platform }}
+        trust-policy: publish
+        fail-on-cache-miss: ${{ steps.policy.outputs.require_hit }}
+    - name: Build from the BoringCache seed
+      id: restore
+      if: inputs.strategy == 'boringcache' && steps.policy.outputs.publish_cache == 'false'
+      uses: ./.github/actions/boringcache
+      env:
+        BORINGCACHE_MANAGED_BUILDKIT_IMAGE: ${{ inputs.buildkit-image }}
+      with:
+        mode: docker
+        cli-version: ${{ inputs.cli-version }}
+        cli-platform: ${{ inputs.cli-platform }}
+        trust-policy: restore
+        fail-on-cache-miss: ${{ steps.policy.outputs.require_hit }}
+    - name: Capture the build timing
+      id: build_timing
+      shell: bash
+      env:
+        BUILD_STARTED_AT: ${{ steps.build_timer.outputs.started_at }}
+      run: echo "build_seconds=$(( $(date +%s) - BUILD_STARTED_AT ))" >> "$GITHUB_OUTPUT"

.github/actions/prepare-case/action.yml

@@ -10,6 +10,9 @@ inputs:
   suffix:
     description: Optional diagnostic result suffix.
     default: ''
+  variant:
+    description: Reviewed native workload variant.
+    default: ''
 runs:
   using: composite
   steps:
@@ -27,10 +30,17 @@ runs:
         BENCHMARK_CASE_ID: ${{ inputs.case-id }}
         NATIVE_LANE: ${{ inputs.native-lane }}
         BENCHMARK_ID_SUFFIX: ${{ inputs.suffix }}
+        BENCHMARK_VARIANT: ${{ inputs.variant }}
         BUNDLE_GEMFILE: ${{ github.workspace }}/.harness/Gemfile
       run: |
         args=()
         if [[ -n "$NATIVE_LANE" ]]; then
           args+=(--native-lane "$NATIVE_LANE" --suffix "$BENCHMARK_ID_SUFFIX")
+          if [[ -n "$BENCHMARK_VARIANT" ]]; then
+            args+=(--variant "$BENCHMARK_VARIANT")
+          fi
         fi
         ruby .harness/bin/bench prepare "$BENCHMARK_CASE_ID" --directory "$GITHUB_WORKSPACE" "${args[@]}"
+    - name: Install the GitHub artifact client
+      shell: bash
+      run: npm ci --ignore-scripts --no-audit --no-fund --prefix .github/actions/retain-product-evidence

.github/actions/retain-product-evidence/action.yml

@@ -0,0 +1,10 @@
+name: Retain product lifecycle evidence
+description: Uploads the original product evidence after its post step completes.
+outputs:
+  registry-path:
+    description: File in which the wrapper records the public evidence-path output.
+runs:
+  using: node24
+  main: index.cjs
+  post: index.cjs
+  post-if: always()

.github/actions/retain-product-evidence/index.cjs

@@ -0,0 +1,48 @@
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+function register(core) {
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'benchmark-evidence-'));
+  const registry = path.join(directory, 'evidence-path');
+  fs.writeFileSync(registry, '', { mode: 0o600 });
+  core.saveState('evidence-directory', directory);
+  core.setOutput('registry-path', registry);
+}
+
+async function retain(core, artifact) {
+  const directory = core.getState('evidence-directory');
+  const source = fs.readFileSync(path.join(directory, 'evidence-path'), 'utf8').trim();
+  if (!source) {
+    throw new Error('The product did not return an evidence path.');
+  }
+  const name = path.basename(source);
+  if (!/^boringcache-one-evidence-[a-f0-9]{64}\.json$/.test(name)) {
+    throw new Error('The product returned an unexpected evidence filename.');
+  }
+  const stat = fs.lstatSync(source);
+  if (!stat.isFile() || stat.size > 8 * 1024 * 1024) {
+    throw new Error('Product evidence must be a regular JSON file no larger than 8 MiB.');
+  }
+  const content = fs.readFileSync(source);
+  const evidence = JSON.parse(content);
+  if (evidence.schema_version !== 'boringcache_one_evidence.v1' || !evidence.phases) {
+    throw new Error('The product evidence schema is unsupported.');
+  }
+  const target = path.join(directory, name);
+  fs.writeFileSync(target, content, { mode: 0o600 });
+  await artifact.uploadArtifact(`product-${name.slice(0, -5)}`, [target], directory, { retentionDays: 90 });
+}
+
+module.exports = { register, retain };
+
+if (require.main === module) {
+  const core = require('@actions/core');
+  Promise.resolve().then(() => {
+    if (core.getState('evidence-directory')) {
+      const { DefaultArtifactClient } = require('@actions/artifact');
+      return retain(core, new DefaultArtifactClient());
+    }
+    register(core);
+  }).catch(error => core.setFailed(`Product evidence was not retained: ${error.message}`));
+}