1879490 - Assess use of external addon actions/continuous-benchmark in Mozilla's GitHub organization mozilla/neqo

Status: RESOLVED FIXED

(mozilla.org :: Github: Administration, task)

Description

[Lars Eggert [:lars]]

I want to use the https://github.com/marketplace/actions/continuous-benchmark addon in the mozilla/neqo repo for the following reasons:

Performance regression testing during CI

Below are my answers to your stock questions:

** Which repositories do you want to have access? (all or list)

mozilla/neqo

** Are any of those repositories private?

No

** Provide link to vendor's description of permissions needed and why

Needs a GitHub API token, https://github.com/marketplace/actions/continuous-benchmark#commit-comment

** Provide the Install link for a GitHub app

It's not an app, it's an action, but: https://github.com/marketplace/actions/continuous-benchmark

Comment 1

[Chris Brentano [:ctb]]

NI'd Hal to review, I don't believe this one is on the globally allowed or reviewed list yet.

Comment 2

[Lars Eggert [:lars]]

Alternatively - or additionally - something like https://github.com/marketplace/actions/create-or-update-comment that lets my workflow add comments to a PR might be sufficient.

Comment 3

[hwine]

Looks benign, but not obviously backed by a company. So caveats about monitoring any changes apply.

Usage Caveats:

• Pin to a version or ref in your workflow references
• review changes before upgrading
• do not use in a job where other steps may have cached sensitive data in the workspace.

CTB: Okay to add benchmark-action/github-action-benchmark@* to allowed actions for Mozilla

Comment 4

[hwine]

(In reply to Lars Eggert [:lars] from comment #2)

Alternatively - or additionally - something like https://github.com/marketplace/actions/create-or-update-comment that lets my workflow add comments to a PR might be sufficient.

Please file a separate request if you need the other action as well

Comment 5

[Chris Brentano [:ctb]]

(In reply to Hal Wine [:hwine] use NI! from comment #3)

CTB: Okay to add benchmark-action/github-action-benchmark@* to allowed actions for Mozilla

Thanks again Hal. All set.