mirror of
https://github.com/semantica-agi/semantica.git
synced 2026-09-13 04:04:09 +00:00
KaifAhmad1
5ed98cefbd
Qodo review on this PR: `pip install --no-deps -e .` / `pip install --no-deps .` still leaves PEP 517 build isolation on by default, which fetches [build-system] requires (setuptools==84.0.0, wheel==0.48.0) completely outside any hash checking - the --require-hashes installs right next to it didn't cover this at all. Adds .github/requirements/pep517-build.txt, hash-locked to the exact pyproject.toml [build-system] requires, and installs it before every local-source install (Dockerfile, ci.yml, benchmark.yml) with --no-build-isolation so pip reuses those hash-verified copies instead of fetching its own.
70 lines
2.7 KiB
YAML
70 lines
2.7 KiB
YAML
name: Semantica Performance Suite
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
performance-test:
|
|
name: Benchmark Runner (Ubuntu/Python 3.12)
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout Code
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Set up Python 3.11
|
|
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
|
|
with:
|
|
python-version: "3.11"
|
|
cache: 'pip'
|
|
|
|
- name: Install Dependencies
|
|
env:
|
|
|
|
BENCHMARK_REAL_LIBS: "1"
|
|
run: |
|
|
pip install -r .github/requirements/bootstrap.txt --require-hashes
|
|
# --no-deps + a hash-pinned install of the same base dependency set
|
|
# (rather than a bare `pip install -e .`) so every fetched package
|
|
# is hash-verified (Scorecard Pinned-Dependencies); the local
|
|
# editable install itself has nothing to hash.
|
|
#
|
|
# --no-deps only skips *runtime* dependency resolution - `-e .`
|
|
# still does a PEP 517 build, which by default creates an isolated
|
|
# build env and fetches [build-system] requires (setuptools,
|
|
# wheel) completely outside any hash checking. Install
|
|
# pep517-build.txt (pins that exact build-system.requires) first
|
|
# and pass --no-build-isolation so pip reuses those hash-verified
|
|
# copies instead of fetching its own.
|
|
pip install -r .github/requirements/pep517-build.txt --require-hashes
|
|
pip install --no-deps --no-build-isolation -e .
|
|
pip install -r .github/requirements/base-deps.txt --require-hashes
|
|
# NOTE: benchmarks/ does not currently exist in this repo, so this
|
|
# step and the run below it fail on any real invocation - pre-existing,
|
|
# unrelated to this pinning change. Left as-is since there's nothing
|
|
# to hash without knowing what belongs there.
|
|
pip install -r benchmarks/requirements.txt
|
|
python -m spacy download en_core_web_sm
|
|
pip install -r .github/requirements/benchmark-extra.txt --require-hashes
|
|
|
|
- name: Execute Benchmarks (Real Mode)
|
|
env:
|
|
BENCHMARK_REAL_LIBS: "1"
|
|
run: |
|
|
python benchmarks/benchmarks_runner.py
|
|
# Optional: Compare to baseline (requires previous run artifact)
|
|
# pytest-benchmark --storage file://benchmarks/results --benchmark-compare
|
|
|
|
- name: Upload Benchmark Results
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
|
if: always()
|
|
with:
|
|
name: benchmark-report-${{ github.run_id }}
|
|
path: benchmarks/results
|
|
retention-days: 30
|