[codspeed]

Summary

This PR adds continuous performance tracking for the backend with CodSpeed. Benchmarks are written with pytest-codspeed and measured in CodSpeed's CPU simulation mode, which keeps results stable on GitHub-hosted runners.

What's included

Benchmarks (backend/tests/benchmarks/): no database, Docker or network needed

Benchmark	What it measures
test_process_image_for_storage	Stripping EXIF and applying the rotation on a 1280x960 upload
test_filter_exif	Building the allowlisted EXIF block
test_generate_thumbnails	Decoding once and writing every standard WebP thumbnail width
test_validate_product_create_tree	Validating ProductCreateWithComponents with 84 nested components
test_validate_product_export_trees	Validating ProductExportRead trees, including the image and thumbnail URL derivation
test_dump_product_export_json	Serialising export trees to JSON
test_render_products_csv	Rendering the CSV export (400 rows)
test_keyed_digest	Pseudonymising 500 emails with keyed_digest

Tooling

• pytest-codspeed added to the backend tests dependency group (uv.lock updated)
• just backend/bench runs the benchmarks once as plain tests
• New .github/workflows/codspeed.yml workflow runs on pushes to main, on pull requests, and on workflow_dispatch. It reuses the setup-runtime composite action, pins every action to a commit SHA, and authenticates with OIDC (id-token: write is granted to this job only). It is kept separate from ci.yml, as Scorecard is, so the extra permission doesn't spread to other jobs.
• Added the CodSpeed badge to the README, and documented the benchmarks in backend/README.md and backend/tests/README.md

tests/benchmarks isn't in just backend/test-ci, so the existing CI suite is unchanged. The prek hooks (actionlint, zizmor, ruff, rumdl, uv-lock) pass on the changed files.

Running locally

cd backend
just bench                                                                   # plain test run
codspeed run --mode simulation -- uv run pytest tests/benchmarks --codspeed  # measured run

Next steps

• Once this merges, the run on main becomes the baseline, and later PRs get a performance report comment.
• To cover another hot path, add a test_*.py file under backend/tests/benchmarks/ that uses the benchmark fixture.
• If you want PRs blocked on regressions, you can turn on performance checks in the CodSpeed settings.

Comment @codspeedbot <request> (for example, "add a benchmark for the product tree queries") and I'll do it.

[codspeed]

Congrats! CodSpeed is installed 🎉

🆕 8 new benchmarks were detected.

You will start to see performance impacts in the reports once the benchmarks are run from your default branch.

Detected benchmarks

• test_filter_exif: 124 µs
• test_generate_thumbnails: 287.8 ms
• test_process_image_for_storage: 95.2 ms
• test_dump_product_export_json: 87.7 ms
• test_keyed_digest: 15 ms
• test_render_products_csv: 133.8 ms
• test_validate_product_create_tree: 8.7 ms
• test_validate_product_export_trees: 63.2 ms

---

[simonvanlierde]

Thanks for the setup. Replaced by #475, which keeps the workflow and reworks the benchmarks to use realistic inputs and the same code paths as the routes.