Skip to content

Refactor logic to remove old data strucuture and compare performance #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hungpham10 merged 11 commits into from
Aug 6, 2026
Merged

Refactor logic to remove old data strucuture and compare performance #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
26634bf
Remove old data structure
hungpham10 Aug 5, 2026
a91051d
Benchmark
hungpham10 Aug 6, 2026
feff7dd
Remove temporary codegraph-viz and move benches into .github
hungpham10 Aug 6, 2026
ede272a
Fix issue codspeed
hungpham10 Aug 6, 2026
c30021c
Fix benchmark
hungpham10 Aug 6, 2026
8c7f380
Implement sandbox and diff
hungpham10 Aug 6, 2026
70f273b
Add sandbox execution for diff and origin
hungpham10 Aug 6, 2026
0231bda
Remove unused unittest
hungpham10 Aug 6, 2026
6755ef7
Fix lint
hungpham10 Aug 6, 2026
7631a0d
Remove unused unittest
hungpham10 Aug 6, 2026
84ec227
Temporal remove another environments
hungpham10 Aug 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 37 additions & 0 deletions .github/benches/fetch_repos.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
#!/usr/bin/env bash
# Fetch danh sách repo (pinned) trong .github/benches/repos/sources.txt về
# .github/benches/repos/checkout/<name>, rồi ghi đường dẫn TUYỆT ĐỐI vào
# .github/benches/repos/list.txt để codegraph-bench (CodSpeed) đọc qua env
# CODEGRAPH_BENCH_REPOS_LIST (${{ github.workspace }}/.github/benches/repos/list.txt).
#
# Chạy local: bash .github/benches/fetch_repos.sh
# Chạy trong CI (codspeed.yml) trước `cargo codspeed build`.
set -euo pipefail

DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
OUT="$DIR/repos/checkout"
LIST="$DIR/repos/list.txt"
SRC="$DIR/repos/sources.txt"

mkdir -p "$OUT"
: > "$LIST"

# Mỗi dòng: <name>|<url>|<commit>
# `|| [ -n "$name" ]` xử lý dòng cuối không có trailing `\n`.
while IFS='|' read -r name url commit || [ -n "$name" ]; do
name="$(printf '%s' "$name" | xargs)" # trim
[ -z "$name" ] && continue
[[ "$name" == \#* ]] && continue
dest="$OUT/$name"
Comment on lines +21 to +25

@coderabbitai coderabbitai Bot Aug 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Reject path-like repository names.

name is trimmed but not limited to one path component. A value such as ../../outside can escape repos/checkout, and list.txt can then point the benchmark at an unexpected location. Validate the name with a safe basename allowlist before constructing dest. (raw.githubusercontent.com)

Suggested validation 
   [[ "$name" == \#* ]] && continue
+  if [[ ! "$name" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]]; then
+    printf 'invalid repository name: %s\n' "$name" >&2
+    exit 1
+  fi
   dest="$OUT/$name"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
while IFS='|' read -r name url commit || [ -n "$name" ]; do
name="$(printf '%s' "$name" | xargs)" # trim
[ -z "$name" ] && continue
[[ "$name" == \#* ]] && continue
dest="$OUT/$name"
while IFS='|' read -r name url commit || [ -n "$name" ]; do
name="$(printf '%s' "$name" | xargs)" # trim
[ -z "$name" ] && continue
[[ "$name" == \#* ]] && continue
if [[ ! "$name" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]]; then
printf 'invalid repository name: %s\n' "$name" >&2
exit 1
fi
dest="$OUT/$name"
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/benches/fetch_repos.sh around lines 21 - 25, Validate the trimmed
name in the repository-reading loop before assigning dest, accepting only safe
single-component basename values and rejecting path separators, traversal
components, and other disallowed characters; continue past invalid entries so
dest="$OUT/$name" can never escape the output directory or reference an
unexpected location.

if [ ! -d "$dest/.git" ]; then
echo ">> clone $name ..."
git clone --quiet --filter=blob:none --no-checkout "$url" "$dest"
fi
echo ">> checkout $name @ ${commit:0:12}"
git -C "$dest" fetch --quiet --depth 1 origin "$commit"
git -C "$dest" checkout --quiet "$commit"
echo "$dest" >> "$LIST"
Comment on lines +23 to +33

@coderabbitai coderabbitai Bot Aug 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Reconcile reused checkouts before fetching.

When "$dest/.git" exists, the script skips cloning. It does not verify that origin matches $url, and checkout leaves untracked or ignored files from earlier local runs. A changed source row can therefore benchmark the wrong repository or stale files. Compare the remote URL, remove and reclone on mismatch, then force-clean the checkout before recording it. (raw.githubusercontent.com)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/benches/fetch_repos.sh around lines 23 - 33, Update the checkout
handling around dest and the git clone/fetch commands to validate the existing
repository’s origin URL against $url; remove and reclone "$dest" when they
differ. Before fetching and checking out "$commit", force-clean the repository,
including ignored and untracked files, then append "$dest" to "$LIST" only after
the reconciled checkout is ready.

done < "$SRC"

echo "=== repos ready (${LIST}) ==="
cat "$LIST"
11 changes: 11 additions & 0 deletions .github/benches/repos/sources.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
# Danh sách repo codspeed để benchmark — mỗi dòng: <name>|<git-url>|<commit-sha>
#
# Sửa/thêm dòng để thay đổi tập repo (được fetch về theo `benches/fetch_repos.sh`).
# Commit SHA cố định (pinned) để dữ liệu đầu vào giữ nguyên giữa các lần chạy,
# giúp CodSpeed so sánh performance ổn định. Muốn cập nhật thì đổi SHA rồi re-run.
#
# Các repo nhỏ, đa ngôn ngữ để phủ parser của codegraph-extract:
hello|https://github.com/golang/example|7f05d217867b2af52b0a28c6d1c91df97e1b5b39
serde-json|https://github.com/serde-rs/json|a3e9758ffc88247ab82182cb2505867768a702e3
flask|https://github.com/pallets/flask|6a2f545bfd8ed31e19066a299296917e034aca58
express|https://github.com/expressjs/express|a3714473feb3d2908add734d340e7755fd85e0a3
2 changes: 1 addition & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ jobs:
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, macos-latest, windows-latest]
os: [ubuntu-latest]
steps:
- uses: actions/checkout@v6
- uses: dtolnay/rust-toolchain@stable
Expand Down
52 changes: 52 additions & 0 deletions .github/workflows/codspeed.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,52 @@
name: CodSpeed

on:
push:
branches:
- "main"
pull_request:
# `workflow_dispatch` cho phép CodSpeed trigger backtest performance
# để sinh dữ liệu ban đầu.
workflow_dispatch:

permissions:
contents: read
id-token: write # OpenID Connect auth với CodSpeed

env:
# Danh sách repo (1 path/dòng) sẽ được bench — do .github/benches/fetch_repos.sh
# ghi ra từ .github/benches/repos/sources.txt. codegraph-bench đọc env này khi chạy.
# Dùng path TUYỆT ĐỐI để không phụ thuộc CWD của `cargo codspeed run`.
CODEGRAPH_BENCH_REPOS_LIST: ${{ github.workspace }}/.github/benches/repos/list.txt

jobs:
# Performance benchmarks: extract → index → query trên danh sách repo thật
# (xem crates/codegraph-bench, bench target `codspeed`).
codspeed:
name: Bench
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

@coderabbitai coderabbitai Bot Aug 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow file =="
if [ -f .github/workflows/codspeed.yml ]; then
  cat -n .github/workflows/codspeed.yml
else
  echo "missing .github/workflows/codspeed.yml"
fi

echo
echo "== workflow references to checkout/persist/npm install/code execution =="
rg -n "actions/checkout|git (clone|commit|push|push-default|config|submodule|fetch|pull|push)\s|--depth|persist-credentials|npm install|npm run|pnpm|yarn|uv|python|pytest|codspeed|pull_request|run:" .github/workflows/codspeed.yml || true

Repository: hungpham10/codegraph-rs

Length of output: 2791

🌐 Web query:

actions/checkout v4 README persist-credentials default true

💡 Result:

In actions/checkout v4, the default value for the persist-credentials input is true [1][2][3]. When set to true, the action configures the GitHub Actions authentication token (or SSH key) into the local git configuration [1][2]. This allows subsequent steps in your workflow to execute authenticated git commands without additional configuration [1][4]. The token is automatically removed during the post-job cleanup process [1][3]. If you wish to prevent this behavior—for example, to enhance security or avoid persisting credentials in the local git config—you can explicitly set persist-credentials to false in your workflow file [1][5]: - uses: actions/checkout@v4 with: persist-credentials: false While there has been community discussion regarding changing this default to false to reduce the risk of unintentional credential exposure, it remains true in the current v4 release [1][6][3].

Citations:

Sensitive Data Exposure (CWE-922)

Reachability: External

Disable checkout credential persistence.

actions/checkout@v4 persists the workflow GITHUB_TOKEN in local Git config by default. Since the workflow runs on pull_request and later steps execute repository code under .github/Cargo config, set persist-credentials: false; pass a scoped token only to steps that need authenticated Git access.

Suggested change 
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- uses: actions/checkout@v4
- uses: actions/checkout@v4
with:
persist-credentials: false
🧰 Tools
🪛 zizmor (1.29.0)

[warning] 29-29: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/codspeed.yml at line 29, Update the actions/checkout@v4
step in the workflow to set persist-credentials to false, while preserving the
existing checkout behavior and leaving any authenticated Git access to
explicitly scoped later steps.

Sources: MCP tools, Linters/SAST tools


- name: Setup rust toolchain, cache and cargo-codspeed binary
uses: moonrepo/setup-rust@v0
with:
channel: stable
cache-target: release
bins: cargo-codspeed

# Clone các repo pinned trong benches/repos/sources.txt về
# benches/repos/checkout/ và ghi benches/repos/list.txt.
- name: Fetch bench repos
run: bash .github/benches/fetch_repos.sh

- name: Build benchmark targets
run: cargo codspeed build -p codegraph-bench --features codspeed

# `mode: benchmark` đẩy kết quả lên CodSpeed Cloud (auto-provision bằng OIDC)
# để theo dõi trend. Muốn chạy khô (không lưu baseline) thì đổi `simulation`.
- name: Run benchmarks
uses: CodSpeedHQ/action@v4
with:
mode: simulation
run: cargo codspeed run
Comment on lines +46 to +52

@coderabbitai coderabbitai Bot Aug 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Fix the out-of-date CodSpeed mode comment.

CodSpeedHQ/action@v4 documents simulation and walltime as valid modes; it does not document benchmark. The workflow already uses simulation and uploads CodSpeed benchmark results. Update the comment to avoid future use of an unsupported mode.

Suggested change 
-      # `mode: benchmark` đẩy kết quả lên CodSpeed Cloud (auto-provision bằng OIDC)
-      # để theo dõi trend. Muốn chạy khô (không lưu baseline) thì đổi `simulation`.
+      # `simulation` measures and uploads CodSpeed benchmark results.
+      # Use `walltime` only when wall-time measurements are required.
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# `mode: benchmark` đẩy kết quả lên CodSpeed Cloud (auto-provision bằng OIDC)
# để theo dõi trend. Muốn chạy khô (không lưu baseline) thì đổi `simulation`.
- name: Run benchmarks
uses: CodSpeedHQ/action@v4
with:
mode: simulation
run: cargo codspeed run
# `simulation` measures and uploads CodSpeed benchmark results.
# Use `walltime` only when wall-time measurements are required.
- name: Run benchmarks
uses: CodSpeedHQ/action@v4
with:
mode: simulation
run: cargo codspeed run
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/codspeed.yml around lines 46 - 52, Update the CodSpeed
mode comment above the “Run benchmarks” step to remove the unsupported
“benchmark” mode and accurately describe the supported simulation/walltime
behavior, while preserving the existing simulation configuration and
result-upload behavior.

4 changes: 4 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,3 +58,7 @@ venv/
*.egg-info/
dist/
build/

# Bench repos được fetch về (danh sách nguồn: .github/benches/repos/sources.txt)
.github/benches/repos/checkout/
.github/benches/repos/list.txt
Loading
Loading