feat(xtest): cross-SDK benchmark roll-up and decision-first summaries

.github/workflows/check.yml

@@ -47,9 +47,9 @@ jobs:
         run: >-
           uv run --frozen --no-build pytest --no-header -q
           test_bench_stats.py test_bench_measure.py test_bench_runner.py
-          test_bench_arms.py test_bench_report.py test_sdk_commands.py
-          test_tdfs_units.py test_encryption_units.py test_sizes_units.py
-          test_zip64_units.py
+          test_bench_arms.py test_bench_report.py test_bench_aggregate.py
+          test_sdk_commands.py test_tdfs_units.py test_encryption_units.py
+          test_sizes_units.py test_zip64_units.py
         working-directory: xtest
       - name: Lint and test otdf-local
         run: |

.github/workflows/xtest.yml

@@ -1308,6 +1308,9 @@ jobs:
                 || (matrix.sdk == 'go' && (inputs.otdfctl-ref || 'main latest'))
                 || (matrix.sdk == 'java' && (inputs.java-ref || 'main latest'))
                 || (inputs.js-ref || 'main latest') }}
+          # pytest writes a summary template beside the JSON. Publish it only
+          # after upload-artifact gives us the direct evidence URL.
+          BENCH_DEFER_SUMMARY: "1"
           PLATFORM_DIR: "../../${{ steps.run-platform.outputs.platform-working-dir }}"
           SCHEMA_FILE: "manifest.schema.json"
           PLATFORM_TAG: main
@@ -1328,7 +1331,7 @@ jobs:
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: success() || failure()
         with:
-          name: ${{ job.status == 'success' && '✅' || '❌' }} bench-${{ matrix.sdk }}
+          name: bench-result-${{ matrix.sdk }}
           path: |
             otdftests/xtest/test-results/benchmarks/*.json
             otdftests/xtest/test-results/*.html
@@ -1342,6 +1345,62 @@ jobs:
           path: ${{ steps.run-platform.outputs.platform-log-file }}
           if-no-files-found: ignore
 
+  benchmark-summary:
+    name: Performance benchmark roll-up
+    runs-on: ubuntu-latest
+    needs: [resolve-versions, bench]
+    if: >-
+      always() && (
+        github.event.schedule == '30 6 * * *' ||
+        ((github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call')
+         && inputs.run-benchmarks)
+      )
+    permissions:
+      actions: read
+      contents: read
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          repository: opentdf/tests
+          path: otdftests
+          persist-credentials: false
+
+      - name: Download SDK benchmark results
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        continue-on-error: true
+        with:
+          pattern: bench-result-*
+          path: benchmark-results
+          merge-multiple: true
+
+      - name: Resolve benchmark artifact links
+        id: benchmark-artifacts
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #v9.0.0
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            const artifacts = await github.paginate(
+              github.rest.actions.listWorkflowRunArtifacts,
+              { owner, repo, run_id: context.runId, per_page: 100 },
+            );
+            const urls = {};
+            for (const artifact of artifacts) {
+              const match = artifact.name.match(/^bench-result-(.+)$/);
+              if (match) {
+                urls[match[1]] = `https://github.com/${owner}/${repo}/actions/runs/${context.runId}/artifacts/${artifact.id}`;
+              }
+            }
+            core.setOutput('urls', JSON.stringify(urls));
+
+      - name: Publish combined benchmark summary
+        env:
+          BENCH_ARTIFACT_URLS: ${{ steps.benchmark-artifacts.outputs.urls }}
+          BENCH_EXPECTED_SDKS: ${{ needs.resolve-versions.outputs.bench-sdks }}
+          BENCH_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |-
+          python otdftests/xtest/perf/aggregate.py benchmark-results \
+            >> "$GITHUB_STEP_SUMMARY"
+
   # ZIP64 boundary conformance at 2.1 GiB (DSPX-4592).
   #
   # ZIP central-directory offsets and sizes are 32-bit *unsigned* on the wire.