ci: publish executable hashes and refresh the eBPF allowlist on release

[GuillaumeLagrange]

Publish the SHA-256 of every released executable as a release asset, then ask app.codspeed.io to rebuild its eBPF allowlist.

CodSpeed only lets approved executables load eBPF on its runners. Until now that list was pinned by hand, so every memtrack release needed a manual approval step. With the digests published on the release, the allowlist is derived from them and a new release is approved as soon as the workflow runs.

Each asset is named <executable>-<target>.sha256.sum and holds one sha256sum line (<hex> *<executable>), hashed from the binary inside its release archive. The memtrack releases from memtrack-v1.4.0 to memtrack-v1.6.1 were backfilled with the same files.

Needs the EBPF_ALLOWLIST_REVALIDATE_TOKEN repository secret before the next release.

Refs COD-3826

[codspeed]

Merging this PR will not alter performance

⚠️ Unknown Walltime execution environment detected

Using the Walltime instrument on standard Hosted Runners will lead to inconsistent data.

For the most accurate results, we recommend using CodSpeed Macro Runners: bare-metal machines fine-tuned for performance measurement consistency.

⚠️ 8 benchmarks spent significant time in system calls

System calls cannot be consistently instrumented, so they are not included in the measure, which understates the real cost. Please switch to the Walltime instrument to accurately measure system calls.

Measurement and system calls

• encode_events_realistic[2]
• encode_events_realistic[4]
• find_module_events_with_stacks[1000000]
• sleep 1
• encode_events_realistic[8]
• encode_events_realistic[16]
• find_module_events[1000000]
• encode_events_realistic[1]

✅ 41 untouched benchmarks
⏩ 6 skipped benchmarks¹

---

_{Comparing cod-3826-revalidate-ebpf-allowlist (175ca71) with main (5ff86d7)}

Footnotes

1. 6 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge, with no actionable issue found.

Summary

Publishes executable SHA-256 files from release archives, then asks CodSpeed to refresh its eBPF allowlist.

• Releases now publish executable hashes and refresh the eBPF allowlist.

Diagram

sequenceDiagram
  participant Release as Release workflow
  participant Post as Post-announce job
  participant GitHub as GitHub release
  participant App as CodSpeed app
  Release->>GitHub: Publish archives and undraft release
  Release->>Post: Start after announce
  Post->>Post: Download artifacts and hash executables
  Post->>GitHub: Upload executable hash files
  Post->>App: Request allowlist refresh
  Post->>App: Request rebuilt allowlist
  opt Stable runner release
    Post->>GitHub: Mark release latest
    Post->>GitHub: Trigger action version bump
  end

Loading

_{Reviews (1) · Last reviewed commit: "ci: publish executable hashes and refres..." · Reviewed by Greptile}