From 10a926a2aaf4b72754145121b380c9ce447b9db9 Mon Sep 17 00:00:00 2001 From: CodSpeed Bot Date: Thu, 9 Jul 2026 05:37:58 +0000 Subject: [PATCH 1/2] Point CodSpeed badge to reflex-dev/reviz --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index e06c548a..45af1b74 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # fastcharts -[![CodSpeed](https://img.shields.io/endpoint?url=https://codspeed.io/badge.json)](https://app.codspeed.io/Alek99/charts-exp?utm_source=badge) +[![CodSpeed](https://img.shields.io/endpoint?url=https://codspeed.io/badge.json)](https://app.codspeed.io/reflex-dev/reviz?utm_source=badge) **fastcharts** is an experimental Python charting engine for very large, interactive line and scatter plots. Its core idea is simple: chart cost should From 681092ee1cb5ac9542f04f76bab48725ca9fb68d Mon Sep 17 00:00:00 2001 From: CodSpeed Bot Date: Thu, 9 Jul 2026 05:41:53 +0000 Subject: [PATCH 2/2] Pin CodSpeed workflow actions to full-length commit SHAs --- .github/workflows/codspeed.yml | 12 +++++++----- scripts/verify_ci_workflow.py | 11 +++++++---- 2 files changed, 14 insertions(+), 9 deletions(-) diff --git a/.github/workflows/codspeed.yml b/.github/workflows/codspeed.yml index 39ec98de..ab476077 100644 --- a/.github/workflows/codspeed.yml +++ b/.github/workflows/codspeed.yml @@ -21,12 +21,14 @@ jobs: name: Run benchmarks runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: dtolnay/rust-toolchain@stable - - uses: actions/setup-python@v5 + # Actions pinned to full-length commit SHAs (repo policy requires it); + # the trailing comment records the human-readable version each SHA maps to. + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: "3.11" - - uses: astral-sh/setup-uv@v5 + - uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5 # The native Rust core must be present so the benchmarks measure the # native kernels (BACKEND == "native"); without it, importing the compute @@ -49,7 +51,7 @@ jobs: PY - name: Run benchmarks - uses: CodSpeedHQ/action@v4 + uses: CodSpeedHQ/action@9f3a37ece7abc84992501a7fcd54d1704f3458fa # v4 with: mode: simulation run: .venv/bin/python -m pytest benchmarks/test_codspeed_kernels.py --codspeed diff --git a/scripts/verify_ci_workflow.py b/scripts/verify_ci_workflow.py index 5de02d01..4cb35fbd 100644 --- a/scripts/verify_ci_workflow.py +++ b/scripts/verify_ci_workflow.py @@ -256,17 +256,20 @@ def validate_codspeed_workflow(path: Path = DEFAULT_CODSPEED_WORKFLOW) -> list[s "benchmarks", "CodSpeed", "native-only benchmark path", - "dtolnay/rust-toolchain@stable", - "actions/setup-python@v5", + # Actions are pinned to full-length commit SHAs (repo policy); the + # human-readable version travels in the trailing `# ` comment. + "dtolnay/rust-toolchain@", + "# stable", + "actions/setup-python@", 'python-version: "3.11"', - "astral-sh/setup-uv@v5", + "astral-sh/setup-uv@", "cargo build --release", "FASTCHARTS_REQUIRE_CARGO", "pytest-codspeed", "Verify native benchmark backend", 'k.BACKEND == "native"', "CodSpeed requires native backend", - "CodSpeedHQ/action@v4", + "CodSpeedHQ/action@", "mode: simulation", "benchmarks/test_codspeed_kernels.py --codspeed", )