Allow panda.yml to request benchmark runs for PRs

[alganet]

This change introduces a new command to @TheRespectPanda bot, allowing him to dispatch the ci-perf.yml workflow benchmarks for a pull request.

Initially, the bot will just trigger it and return the workflow run URL for manual inspection. Future iterations on this feature could then grab the benchmark results and update the comment.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.47%. Comparing base (e1ff5aa) to head (26c0292).

Additional details and impacted files

@@            Coverage Diff            @@
##                3.0    #1701   +/-   ##
=========================================
  Coverage     99.47%   99.47%           
  Complexity      979      979           
=========================================
  Files           193      193           
  Lines          2294     2294           
=========================================
  Hits           2282     2282           
  Misses           12       12           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR extends the @TheRespectPanda GitHub bot so it can trigger the repository’s performance benchmark workflow for a pull request via an issue comment command.

Changes:

• Add a new @TheRespectPanda benchmark command that dispatches the ci-perf.yml workflow.
• Extend ci-perf.yml workflow_dispatch inputs with an optional pull parameter and add logic to checkout the PR head when provided.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

File	Description
.github/workflows/panda.yml	Adds actions: write permission and implements a new benchmark bot command that dispatches the perf workflow.
.github/workflows/ci-perf.yml	Adds an optional pull input and a conditional step to fetch/checkout the PR head for benchmarking.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

.github/workflows/ci-perf.yml:67

• actions/checkout is configured with persist-credentials: false, but the next steps perform git fetch origin ... (PR ref and benchmarks branch). With credentials removed, these fetches will fail on private repositories (and may also fail under stricter auth settings). Consider using actions/checkout to fetch the PR ref and the benchmarks branch (e.g., a second checkout into a separate path:) or explicitly providing credentials for these fetches while still avoiding credential persistence into later steps.

      - uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Checkout PR head
        run: |
          set -euo pipefail
          PR=${{ github.event.inputs.pull }}
          # Validate that PR is numeric to avoid injection or unexpected ref resolution
          if ! printf '%s\n' "$PR" | grep -Eq '^[0-9]+$'; then
            echo "Invalid pull request number: '$PR'. Expected a numeric value." >&2
            exit 1
          fi
          # fetch the pull request head (works for forks)
          git fetch origin "pull/${PR}/head:pr-${PR}" || git fetch origin "+refs/pull/${PR}/head:pr-${PR}"
          git checkout "pr-${PR}"
          echo "Checked out PR #${PR}"
          echo "BENCHMARK_SHA=$(git rev-parse --verify HEAD)" >> "$GITHUB_ENV"

      - uses: ./.github/actions/setup-action
        with:
          extensions: xdebug

      - name: Fetch Benchmarks
        run: |
          git fetch origin benchmarks
          mkdir -p .phpbench
          git checkout origin/benchmarks -- .phpbench || echo "No previous benchmarks found"

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.