duel-rails 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6bcc25c75b990e312e5fb3a458f5e3eace8b5dbbe02fcb8c50f0ca0df01d8f54
-  data.tar.gz: a6b29676404b6e35d14321d05f428d902d230d169f084abd65afd7104081fed1
+  metadata.gz: 4e5ae40fccca2ac222b0b74531bf35a79df8e05555f58210c966c505f13800a6
+  data.tar.gz: 166a8ea74a1000fdb64f859475bab318b9f9c31aa60e0e78837f49369dc184dd
 SHA512:
-  metadata.gz: 85ed8cb50f379354f0ba9a5769688fbcc1608bb4ee8dfff8e7586e2f736ed4db193bb99d82c7d76a37b6177175cb010364e60e0e83e6a6aec4fc11539ec30767
-  data.tar.gz: a514a4ddd962ac4b5c5711ec829ccb14a95d9e46cd1be6fc4a289d0bae2518995e49216f57c15e0e6d321832951f611c49e5db4563a5af580475f573f1fae682
+  metadata.gz: e5c8ef296bf6e55639b68f90e76ecee308bc4c054e9c3c2f19351e9a5a7568f76ab597399ccc9d1b58bf67762db264ebb47fe6a5f2e80bd256f72880ba1be8dd
+  data.tar.gz: 3c9c0b98b9e589de2da84e9f9fbea1b0182a956f273adca6437a44870df91645f24f69e1af0d77f8c4ca917539f230b39ac619b48fc12263daed473565cc0ce8

data/CHANGELOG.md

@@ -7,6 +7,46 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.1] - 2026-10-26
+
+### Changed
+
+- The workflow that `rails generate duel:install` writes no longer
+  comments on every pull request. By default, it comments only when a
+  benchmark fails or Duel couldn't compare, and `c.comment` in
+  `.duel.rb` chooses otherwise (`:always` for the old behavior,
+  `:results`, or `:never`). The generated `.duel.rb` shows the setting.
+- The workflow never edits a comment. It used to update one comment on
+  every push, and now posts a new one each time it comments, so the pull
+  request keeps every report. When a run wouldn't get a comment of its
+  own, the workflow still posts one if its last comment on the pull
+  request had another status, so after a failure the first run that
+  passes says so.
+
+### Security
+
+- The workflow that `rails generate duel:install` writes no longer gives
+  the job that runs a pull request's code the `pull-requests: write`
+  permission. The Duel job only reads (`contents: read`, and its
+  checkout keeps no credentials), and keeps the report as an artifact
+  for a day. A Comment job of its own, which checks nothing out and runs
+  none of the app's code, downloads the report and comments with it, for
+  a pull request from the same repository.
+
+### Fixed
+
+- With `c.ruby = :version_file`, the workflow installs the bundle for
+  the baseline's Ruby too, when it differs from the candidate's. The
+  baseline's workers load that bundle, and gems installed for one Ruby
+  version don't load on another, so a branch that changed the Ruby's
+  minor version failed before it compared anything.
+
+- With a `.ruby-version`, the generated workflow installs the baseline's
+  Ruby for every event that compares, not only for a pull request: the
+  commit before a push, the last release on a schedule, and where HEAD
+  left the main branch for a pull request and a manual run, when its
+  `.ruby-version` names another Ruby than HEAD's.
+
 ## [0.1.0] - 2026-10-24
 
 The first release. duel-rails is a Duel plugin for Rails apps, open
@@ -95,5 +135,6 @@ Rails 7.2 or later, and Ruby 3.4 or later.
   CI.
 - RBS signatures in sig/, checked with Steep.
 
-[Unreleased]: https://github.com/sferik/duel-ruby/compare/duel-rails-v0.1.0...HEAD
+[Unreleased]: https://github.com/sferik/duel-ruby/compare/duel-rails-v0.1.1...HEAD
+[0.1.1]: https://github.com/sferik/duel-ruby/compare/duel-rails-v0.1.0...duel-rails-v0.1.1
 [0.1.0]: https://github.com/sferik/duel-ruby/releases/tag/duel-rails-v0.1.0

data/README.md

@@ -68,7 +68,7 @@ production does, with everything of its own:
    | `config/environments/benchmark.rb` | The environment that each version boots in, based on production. |
    | `duel/requests_duel.rb` | A benchmark of each of your app's first 10 routes that a GET reaches without parameters. |
    | `duel/boot_duel.rb` | A benchmark of your app's boot. See [Benchmark your app's boot](#benchmark-your-apps-boot). |
-   | `.github/workflows/perf.yml` | A GitHub Actions workflow that runs Duel on pull requests, on pushes to `main`, and nightly against your last release, and comments on each pull request with Duel's report, updating one comment on every push. See [Report on a pull request](https://github.com/sferik/duel-ruby#report-on-a-pull-request). For an app in a subdirectory of its repository, the workflow is at the repository's root. See [An app in a monorepo](#an-app-in-a-monorepo). |
+   | `.github/workflows/perf.yml` | A GitHub Actions workflow that runs Duel on pull requests, on pushes to `main`, and nightly against your last release, and comments on a pull request with Duel's report when a benchmark fails. It never edits a comment, and after a failure, posts one more when a run passes. To comment on every run, or never, set `c.comment` in `.duel.rb`: see [Choose when to comment on a pull request](https://github.com/sferik/duel-ruby/blob/main/docs/configuration.md#choose-when-to-comment-on-a-pull-request) and [Report on a pull request](https://github.com/sferik/duel-ruby#report-on-a-pull-request). For an app in a subdirectory of its repository, the workflow is at the repository's root. See [An app in a monorepo](#an-app-in-a-monorepo). |
 
    The generator also adds `gem "stackprof", platforms: :mri` to your
    `Gemfile`'s `development` group, unless it has StackProf already, so
@@ -326,8 +326,9 @@ Each Ruby must be installed where Duel finds it: with rbenv, chruby,
 mise, or asdf, or as the Ruby that runs Duel. For more information, see
 Duel's [Run each version on its own Ruby](https://github.com/sferik/duel-ruby/blob/main/docs/configuration.md#run-each-version-on-its-own-ruby).
 On GitHub Actions, the generated workflow installs your app's Ruby, and,
-for a pull request, also the main branch's, so a pull request that
-upgrades Ruby works there too.
+when the baseline's `.ruby-version` names another Ruby, that one too, so
+a pull request, a push, or a nightly run against your last release
+works there when your app upgrades Ruby.
 
 To run both versions on the Ruby that runs Duel, remove
 `c.ruby = :version_file`.
@@ -428,7 +429,9 @@ end
 ```
 
 duel-rails also tells Duel to compare a change to `app/`, `config/`,
-`db/`, `lib/`, `Gemfile`, `Gemfile.lock`, or `.ruby-version`.
+`db/`, `lib/`, `Gemfile`, `Gemfile.lock`, or `.ruby-version`, as well
+as one to your benchmarks (`duel/`) or `.duel.rb`, which Duel always
+watches.
 
 ## An app in a monorepo
 

data/lib/duel/rails/version.rb

@@ -2,6 +2,6 @@
 
 module Duel
   module Rails
-    VERSION = "0.1.0"
+    VERSION = "0.1.1"
   end
 end

data/lib/generators/duel/install/templates/duel.rb.tt

@@ -20,4 +20,9 @@ Duel.configure do |c|
   # fixtures: :all, or seeds: true.
   c.use :rails, database: <%= database ? ":#{database}" : "nil" %>
 <% end -%>
+
+  # When the workflow comments on a pull request with the report: :always,
+  # :results (passed or failed), :failures (failed, or couldn't compare),
+  # or :never.
+  # c.comment = :failures
 end

data/lib/generators/duel/install/templates/perf.yml.tt

@@ -8,14 +8,20 @@ on:
     - cron: "0 4 * * *"
   workflow_dispatch:
 
+# The Duel job runs the branch's code (its benchmarks too), so it only
+# reads. Commenting is the Comment job's, which runs none of it.
 permissions:
   contents: read
-  pull-requests: write # to comment on a pull request with the report
 
 jobs:
   duel:
     name: Duel
     runs-on: ubuntu-latest
+    # Whether the Comment job comments (post, change or none), and the
+    # run's status (passed, failed or neutral), from Duel.
+    outputs:
+      comment: ${{ steps.compare.outputs.comment }}
+      status: ${{ steps.compare.outputs.status }}
 <% if working_directory -%>
     # The app is in a subdirectory of the repository: Duel runs there, and
     # checks out the whole repository for the baseline.
@@ -27,6 +33,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0 # the baseline comes from history, tags included
+          persist-credentials: false
 <% if database == "postgresql" -%>
       # Each worker starts a PostgreSQL server of its own (duel-postgresql).
       - run: sudo apt-get install -y postgresql libpq-dev
@@ -42,24 +49,52 @@ jobs:
 <% end -%>
 <% if version_file? -%>
       # Each version runs on the Ruby its own .ruby-version names (see
-      # .duel.rb): for a pull request that upgrades Ruby, the main branch's
-      # too, linked where Duel finds it (as chruby would). It's set up
-      # before the app's own Ruby, which runs Duel.
+      # .duel.rb). When the baseline's names another Ruby than this code's,
+      # that one is installed too, and linked where Duel finds it (as
+      # chruby would), before the app's own Ruby, which runs Duel. The
+      # baseline is the Compare step's: where HEAD left the main branch
+      # (for a pull request, and run by hand), the commit before a push, or
+      # on a schedule the last release, the newest tag before HEAD that
+      # RELEASE_TAGS matches. (If .duel.rb sets c.main_branch or
+      # c.release_tags, set MAIN_BRANCH or RELEASE_TAGS to match.)
       - name: Find the baseline's Ruby
         id: baseline
-        if: github.event_name == 'pull_request'
-        run: echo "ruby=$(git show "origin/$GITHUB_BASE_REF:./.ruby-version" 2>/dev/null)" >> "$GITHUB_OUTPUT"
+        env:
+          BEFORE: ${{ github.event.before }}
+          MAIN_BRANCH: origin/${{ github.event.repository.default_branch }}
+          RELEASE_TAGS: "v*"
+        run: |
+          case "$GITHUB_EVENT_NAME" in
+            push) base=$BEFORE ;;
+            schedule) base=$(git describe --tags --abbrev=0 --match "$RELEASE_TAGS" HEAD^ 2>/dev/null) || base= ;;
+            *) base=$(git merge-base HEAD "$MAIN_BRANCH" 2>/dev/null) || base= ;;
+          esac
+          ruby_of() { git show "$1:./.ruby-version" 2>/dev/null | awk 'NF { print $1; exit }'; }
+          ruby=
+          # (None without a baseline: a branch's first push, or no release yet.)
+          if [ -n "$base" ] && git cat-file -e "$base^{commit}" 2>/dev/null; then
+            ruby=$(ruby_of "$base")
+            [ "$ruby" = "$(ruby_of HEAD)" ] && ruby=
+          fi
+          echo "ruby=$ruby" >> "$GITHUB_OUTPUT"
       - uses: ruby/setup-ruby@v1
         id: baseline-ruby
         if: steps.baseline.outputs.ruby != ''
         with:
+<% if working_directory -%>
+          working-directory: <%= working_directory %>
+<% end -%>
           ruby-version: ${{ steps.baseline.outputs.ruby }}
+          # The bundle for this Ruby too, which the baseline's workers load.
+          # (Gems installed for one Ruby version don't load on another.)
+          bundler-cache: true
       - name: Link the baseline's Ruby where Duel finds it
         if: steps.baseline.outputs.ruby != ''
+        env:
+          PREFIX: ${{ steps.baseline-ruby.outputs.ruby-prefix }}
         run: |
-          prefix="${{ steps.baseline-ruby.outputs.ruby-prefix }}"
           mkdir -p ~/.rubies
-          ln -sfn "$prefix" ~/.rubies/ruby-"$("$prefix/bin/ruby" -e 'print RUBY_VERSION')"
+          ln -sfn "$PREFIX" ~/.rubies/ruby-"$("$PREFIX/bin/ruby" -e 'print RUBY_VERSION')"
 <% end -%>
       - uses: ruby/setup-ruby@v1
         with:
@@ -72,9 +107,11 @@ jobs:
           bundler-cache: true
       # Against the main branch for a pull request, what was there before
       # for a push, and the last release on a schedule (slow creep). Duel
-      # adds its report to the job's summary, and writes it to duel.md for
-      # the comment.
+      # adds its report to the job's summary, writes it to duel.md for the
+      # comment, and sets the step's outputs to say whether to comment, as
+      # c.comment in .duel.rb says, whatever the outcome.
       - name: Compare
+        id: compare
         env:
           DUEL_BASE: ${{ github.event_name == 'schedule' && 'last-release' || github.event_name == 'push' && github.event.before || '' }}
           # (Run by hand, it compares anyway: with nothing changed, the code
@@ -88,22 +125,52 @@ jobs:
             exit 0
           fi
           bundle exec duel --markdown "$RUNNER_TEMP/duel.md"
-      # The report, as a comment on the pull request: one comment, updated
-      # on every push. (A pull request from a fork gets no comment, as its
-      # token can't write one: the job's summary has the report.)
+      # The report, for the Comment job.
+      - name: Keep the report
+        if: ${{ !cancelled() && github.event_name == 'pull_request' }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: duel-report
+          path: ${{ runner.temp }}/duel.md
+          if-no-files-found: ignore # none when Duel didn't get to compare
+          retention-days: 1
+
+  # The report, as a new comment on the pull request, when Duel says to:
+  # always (post), or only when its last comment's status differs from
+  # this run's (change), so the latest comment is never stale. It never
+  # edits or deletes a comment. This job checks nothing out and runs none
+  # of the branch's code, so it alone can write. (A pull request from a
+  # fork gets no comment, as its token can't write one: the Duel job's
+  # summary has the report.)
+  comment:
+    name: Comment
+    needs: duel
+    if: ${{ !cancelled() && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && (needs.duel.outputs.comment == 'post' || needs.duel.outputs.comment == 'change') }}
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write # to comment on the pull request with the report
+    steps:
+      - name: Get the report
+        id: report
+        continue-on-error: true # there's none when the Duel job failed before comparing
+        uses: actions/download-artifact@v8
+        with:
+          name: duel-report
+          path: ${{ runner.temp }}/report
       - name: Comment on the pull request
-        if: ${{ !cancelled() && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository }}
+        if: steps.report.outcome == 'success'
         env:
           GH_TOKEN: ${{ github.token }}
           PR: ${{ github.event.pull_request.number }}
+          COMMENT: ${{ needs.duel.outputs.comment }}
+          STATUS: ${{ needs.duel.outputs.status }}
         run: |
-          [ -f "$RUNNER_TEMP/duel.md" ] || exit 0
-          marker="<!-- duel<%= " #{working_directory}" if working_directory %> -->"
-          { echo "$marker"; cat "$RUNNER_TEMP/duel.md"; } > "$RUNNER_TEMP/comment.md"
-          ids=$(gh api --paginate "repos/$GITHUB_REPOSITORY/issues/$PR/comments" \
-            --jq ".[] | select(.user.login == \"github-actions[bot]\" and (.body | startswith(\"$marker\"))) | .id")
-          if [ -n "$ids" ]; then
-            gh api --method PATCH "repos/$GITHUB_REPOSITORY/issues/comments/${ids%%$'\n'*}" -F body=@"$RUNNER_TEMP/comment.md" > /dev/null
-          else
+          marker="<!-- duel<%= " #{working_directory}" if working_directory %>"
+          # The first line of the last comment Duel posted here: its marker,
+          # with its status (none in Duel 0.1.0's, which counts as another).
+          last=$(gh api --paginate "repos/$GITHUB_REPOSITORY/issues/$PR/comments" \
+            --jq ".[] | select(.user.login == \"github-actions[bot]\") | .body | split(\"\n\")[0] | rtrimstr(\"\r\") | select(startswith(\"$marker status=\") or . == \"$marker -->\")" | tail -n 1)
+          if [ "$COMMENT" = post ] || { [ -n "$last" ] && [ "$last" != "$marker status=$STATUS -->" ]; }; then
+            { echo "$marker status=$STATUS -->"; cat "$RUNNER_TEMP/report/duel.md"; } > "$RUNNER_TEMP/comment.md"
             gh api --method POST "repos/$GITHUB_REPOSITORY/issues/$PR/comments" -F body=@"$RUNNER_TEMP/comment.md" > /dev/null
           fi

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: duel-rails
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - Erik Berlin