Enable CodSpeed continuous performance measurement

.github/workflows/codspeed.yml

@@ -21,12 +21,14 @@ jobs:
     name: Run benchmarks
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: actions/setup-python@v5
+      # Actions pinned to full-length commit SHAs (repo policy requires it);
+      # the trailing comment records the human-readable version each SHA maps to.
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.11"
-      - uses: astral-sh/setup-uv@v5
+      - uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
 
       # The native Rust core must be present so the benchmarks measure the
       # native kernels (BACKEND == "native"); without it, importing the compute
@@ -49,7 +51,7 @@ jobs:
           PY
 
       - name: Run benchmarks
-        uses: CodSpeedHQ/action@v4
+        uses: CodSpeedHQ/action@9f3a37ece7abc84992501a7fcd54d1704f3458fa # v4
         with:
           mode: simulation
           run: .venv/bin/python -m pytest benchmarks/test_codspeed_kernels.py --codspeed

README.md

@@ -1,6 +1,6 @@
 # fastcharts
 
-[![CodSpeed](https://img.shields.io/endpoint?url=https://codspeed.io/badge.json)](https://app.codspeed.io/Alek99/charts-exp?utm_source=badge)
+[![CodSpeed](https://img.shields.io/endpoint?url=https://codspeed.io/badge.json)](https://app.codspeed.io/reflex-dev/reviz?utm_source=badge)
 
 **fastcharts** is an experimental Python charting engine for very large,
 interactive line and scatter plots. Its core idea is simple: chart cost should

scripts/verify_ci_workflow.py

@@ -256,17 +256,20 @@ def validate_codspeed_workflow(path: Path = DEFAULT_CODSPEED_WORKFLOW) -> list[s
         "benchmarks",
         "CodSpeed",
         "native-only benchmark path",
-        "dtolnay/rust-toolchain@stable",
-        "actions/setup-python@v5",
+        # Actions are pinned to full-length commit SHAs (repo policy); the
+        # human-readable version travels in the trailing `# <version>` comment.
+        "dtolnay/rust-toolchain@",
+        "# stable",
+        "actions/setup-python@",
         'python-version: "3.11"',
-        "astral-sh/setup-uv@v5",
+        "astral-sh/setup-uv@",
         "cargo build --release",
         "FASTCHARTS_REQUIRE_CARGO",
         "pytest-codspeed",
         "Verify native benchmark backend",
         'k.BACKEND == "native"',
         "CodSpeed requires native backend",
-        "CodSpeedHQ/action@v4",
+        "CodSpeedHQ/action@",
         "mode: simulation",
         "benchmarks/test_codspeed_kernels.py --codspeed",
     )