wip

Author: wakonig

.github/workflows/benchmark.yml

@@ -3,8 +3,7 @@ name: BW Benchmarks
 on: [workflow_call]
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 env:
   BENCHMARK_JSON: benchmark-results/current.json
@@ -18,6 +17,8 @@ jobs:
   benchmark_attempt:
     runs-on: ubuntu-latest
     continue-on-error: true
+    permissions:
+      contents: read
     defaults:
       run:
         shell: bash -el {0}
@@ -85,6 +86,10 @@ jobs:
   benchmark:
     needs: [benchmark_attempt]
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
 
     steps:
       - name: Checkout BEC Widgets
@@ -185,8 +190,27 @@ jobs:
         if: github.event_name == 'pull_request' && steps.compare.outcome == 'failure'
         run: exit 1
 
+  publish:
+    needs: [benchmark]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout BEC Widgets
+        uses: actions/checkout@v4
+        with:
+          repository: bec-project/bec_widgets
+          ref: ${{ github.sha }}
+
+      - name: Download aggregate benchmark artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: bw-benchmark-json
+          path: .
+
       - name: Prepare gh-pages for publishing
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: |
           # Clean up any existing worktree/directory
           if [ -d gh-pages-benchmark-data ]; then
@@ -203,7 +227,6 @@ jobs:
           fi
 
       - name: Publish benchmark data to gh-pages
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         working-directory: gh-pages-benchmark-data
         run: |
           mkdir -p benchmarks/history

.github/workflows/ci.yml

@@ -23,7 +23,7 @@ concurrency:
 
 permissions:
   pull-requests: write
-  contents: write
+  contents: read
 
 jobs:
   check_pr_status:
@@ -37,6 +37,10 @@ jobs:
   benchmark:
     needs: [check_pr_status]
     if: needs.check_pr_status.outputs.branch-pr == ''
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
     uses: ./.github/workflows/benchmark.yml
 
   unit-test: