Simplify CI approvals, warm main caches, and show merge metadata

.github/dependabot.yml

@@ -0,0 +1,25 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    labels:
+      - 'benchmarks: skip'
+  - package-ecosystem: npm
+    directories:
+      - /
+      - /js/default
+    schedule:
+      interval: weekly
+    labels:
+      - 'benchmarks: skip'
+  - package-ecosystem: cargo
+    directories:
+      - /
+      - /crates/handler-rs
+      - /crates/hyperlight-dummy-guest
+    schedule:
+      interval: weekly
+    labels:
+      - 'benchmarks: skip'

.github/workflows/benchmark-policy.yml

@@ -23,7 +23,6 @@ jobs:
     steps:
       - uses: actions/checkout@v7
         with:
-          ref: main
           persist-credentials: false
       - uses: actions/setup-node@v7
         with:

.github/workflows/benchmark-publication.yml

@@ -9,6 +9,7 @@ on:
 
 permissions:
   contents: write
+  statuses: write
   actions: read
   pull-requests: read
   issues: read
@@ -19,6 +20,7 @@ concurrency:
 
 jobs:
   publish:
+    if: github.event_name == 'push' || github.event.workflow_run.event == 'pull_request'
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:

.github/workflows/benchmark.yml

@@ -1,6 +1,8 @@
 name: Benchmark
 
 on:
+  push:
+    branches: [main]
   pull_request:
     branches: [main]
     types: [opened, synchronize, reopened, labeled, unlabeled, edited, ready_for_review]
@@ -11,22 +13,22 @@ permissions:
   issues: read
 
 concurrency:
-  group: benchmark-${{ github.event.pull_request.number }}
+  group: benchmark-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 env:
   CARGO_TERM_COLOR: always
 
 jobs:
   eligibility:
+    if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     timeout-minutes: 10
     outputs:
       mode: ${{ steps.policy.outputs.mode }}
     steps:
       - uses: actions/checkout@v7
         with:
-          ref: main
           persist-credentials: false
       - uses: actions/setup-node@v7
         with:
@@ -40,7 +42,7 @@ jobs:
   # Record the commit and choose which runners and benchmarks to run.
   configure:
     needs: eligibility
-    if: needs.eligibility.outputs.mode != 'skip'
+    if: ${{ !cancelled() && (github.event_name == 'push' || (needs.eligibility.result == 'success' && needs.eligibility.outputs.mode != 'skip')) }}
     runs-on: ubuntu-latest
     outputs:
       platforms: ${{ steps.matrix.outputs.platforms }}
@@ -60,9 +62,16 @@ jobs:
           key: npm-scripts-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
           restore-keys: npm-scripts-${{ runner.os }}-
       - run: npm ci
+      - name: Save script npm cache
+        if: github.event_name == 'push' && steps.npm-cache.outputs.cache-hit != 'true'
+        uses: actions/cache/save@v6
+        with:
+          path: ~/.npm
+          key: ${{ steps.npm-cache.outputs.cache-primary-key }}
       - id: matrix
         run: node scripts/configure-ci.ts
       - uses: actions/upload-artifact@v7
+        if: github.event_name == 'pull_request'
         with:
           name: run-identity
           path: artifacts/run.json
@@ -72,6 +81,7 @@ jobs:
   # Build guest inputs once on KVM for all measurement configurations.
   producer:
     needs: configure
+    if: ${{ !cancelled() && needs.configure.result == 'success' }}
     runs-on: [self-hosted, Linux, X64, '1ES.Pool=hld-kvm-amd']
     timeout-minutes: 90
     steps:
@@ -99,6 +109,12 @@ jobs:
       - run: node scripts/build-harness.ts inputs
       # Build the embedded Hyperlight runtimes for reuse by platform jobs.
       - run: node scripts/build-harness.ts servers native
+      - name: Save guest npm cache
+        if: github.event_name == 'push' && steps.npm-cache.outputs.cache-hit != 'true'
+        uses: actions/cache/save@v6
+        with:
+          path: ~/.npm
+          key: ${{ steps.npm-cache.outputs.cache-primary-key }}
       - uses: actions/upload-artifact@v7
         with:
           name: guest-inputs
@@ -123,6 +139,7 @@ jobs:
   # Prime each platform's Cargo cache before benchmark jobs fan out.
   prepare:
     needs: [configure, producer]
+    if: ${{ !cancelled() && needs.configure.result == 'success' && needs.producer.result == 'success' }}
     strategy:
       fail-fast: false
       matrix: ${{ fromJSON(needs.configure.outputs.platforms) }}
@@ -154,6 +171,7 @@ jobs:
   # Build from the platform cache and run one runtime/strategy combination.
   measure:
     needs: [configure, prepare]
+    if: github.event_name == 'pull_request'
     strategy:
       fail-fast: false
       matrix: ${{ fromJSON(needs.configure.outputs.configurations) }}
@@ -201,6 +219,7 @@ jobs:
   # Merge results only after every measurement job succeeds.
   collect:
     needs: measure
+    if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
@@ -231,14 +250,13 @@ jobs:
   # Provide one required check that also reports failed, skipped, or cancelled stages.
   benchmark-status:
     name: Benchmark Status
-    if: always()
+    if: ${{ always() && github.event_name == 'pull_request' }}
     needs: [eligibility, configure, producer, prepare, measure, collect]
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v7
         with:
-          ref: main
           persist-credentials: false
       - uses: actions/setup-node@v7
         with:

.github/workflows/preview.yml

@@ -15,7 +15,7 @@ concurrency:
 
 jobs:
   revision:
-    if: ${{ github.event.pull_request.draft == false }}
+    if: ${{ github.event.pull_request.draft == false && github.event.pull_request.user.login != 'dependabot[bot]' }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
     outputs:
@@ -36,18 +36,8 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
 
-  approve:
-    name: "Approve preview PR ${{ needs.revision.outputs.number }} at ${{ needs.revision.outputs.head }}"
-    needs: revision
-    runs-on: ubuntu-latest
-    environment:
-      name: preview-approval
-      url: "https://github.com/${{ needs.revision.outputs.repository }}/commit/${{ needs.revision.outputs.head }}"
-    steps:
-      - run: echo 'Preview revision approved'
-
   build:
-    needs: [revision, approve]
+    needs: revision
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions: