sanstun 0.1.0

A fast, sans-IO implementation of the WireGuard® protocol
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88

name: Benchmarks

on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: true

jobs:
  bencher:
    # Runs with the Bencher API key, so never for code from forks. Dependabot's PRs get no access to it.
    if: >-
      (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
      (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]')
    # The binaries link against the runner's glibc, so this has to match the image's base.
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    env:
      BENCHER_PROJECT: sanstun
      BENCHER_API_KEY: ${{ secrets.BENCHER_API_KEY }}
      BENCHER_SPEC: intel-v1
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - run: rustup toolchain install
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - uses: bencherdev/bencher@f80847436d7157936b40525db4c2a1064124f04a # v0.6.13
      # Runs each benchmark once, so a broken one fails here instead of on Bencher.
      - name: Test benches
        run: cargo bench --benches -- --test
      - name: Push image to the Bencher registry
        run: |
          set -euo pipefail

          mkdir benches-image
          cargo bench --no-run --message-format=json \
            | jq -r 'select(.reason == "compiler-artifact" and .target.kind == ["bench"]) | .executable, "benches-image/\(.target.name)"' \
            | xargs -n 2 cp

          image="registry.bencher.dev/$BENCHER_PROJECT:$GITHUB_SHA"
          docker build -f benches/Dockerfile -t "$image" benches-image
          docker login registry.bencher.dev -u "$BENCHER_PROJECT" --password-stdin <<< "$BENCHER_API_KEY"
          docker push "$image"
          echo "IMAGE=$image" >> "$GITHUB_ENV"
      - name: Run on Bencher Bare Metal
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
        run: |
          set -euo pipefail

          if [ "$GITHUB_EVENT_NAME" = pull_request ]; then
            args=(
              --branch "$GITHUB_HEAD_REF"
              --start-point "$GITHUB_BASE_REF"
              --start-point-hash "$BASE_SHA"
              --start-point-clone-thresholds
              --start-point-reset
            )
          else
            args=(
              --branch main
              --threshold-measure latency
              --threshold-test t_test
              --threshold-min-sample-size 10
              --threshold-max-sample-size 64
              --threshold-upper-boundary 0.99
              --thresholds-reset
            )
          fi

          # Bare Metal jobs can queue for hours, so only submit the job. Its results and
          # alerts show up on Bencher once it has run.
          bencher run "${args[@]}" \
            --testbed "bare-metal-$BENCHER_SPEC" \
            --spec "$BENCHER_SPEC" \
            --image "$IMAGE" \
            --job-timeout 300 \
            --adapter rust_criterion \
            --detach