From 9ac570311b4014dab12ec545a9810c311db79d66 Mon Sep 17 00:00:00 2001
From: Paul Mars <paul.mars@canonical.com>
Date: Fri, 6 Mar 2026 09:51:50 +0100
Subject: [PATCH 1/4] ci: split perf workflow

Do not expose the token used to write the comment to PRs from forks.
---
 .github/workflows/comment-pr.yaml  | 27 +++++++++++++++++++++++++++
 .github/workflows/performance.yaml | 11 +++++------
 2 files changed, 32 insertions(+), 6 deletions(-)
 create mode 100644 .github/workflows/comment-pr.yaml

diff --git a/.github/workflows/comment-pr.yaml b/.github/workflows/comment-pr.yaml
new file mode 100644
index 000000000..72ca8c352
--- /dev/null
+++ b/.github/workflows/comment-pr.yaml
@@ -0,0 +1,27 @@
+name: Comment on pull request
+
+on:
+  workflow_run:
+    workflows: ["Performance"]
+    types: [completed]
+
+jobs:
+  post-comment:
+    name: Post PR comment
+    permissions:
+      pull-requests: write
+    if: ${{ github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success'}}
+    steps:
+      - name: Download comment
+        uses: actions/download-artifact@v4
+        with:
+          name: perf-report
+          path: perf-report.txt
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          run-id: ${{ github.event.workflow_run.id }}
+
+      - name: Post message to PR
+        uses: mshick/add-pr-comment@dd126dd8c253650d181ad9538d8b4fa218fc31e8
+        with:
+          message-path: perf-report.txt
+          issue: ${{ github.event.workflow_run.pull_requests[0].number }}
diff --git a/.github/workflows/performance.yaml b/.github/workflows/performance.yaml
index f24b4de36..981c46043 100644
--- a/.github/workflows/performance.yaml
+++ b/.github/workflows/performance.yaml
@@ -1,7 +1,7 @@
 name: Performance
 
 on:
-  pull_request_target:
+  pull_request:
     branches: [main]
 
 jobs:
@@ -37,8 +37,6 @@ jobs:
     runs-on: ubuntu-22.04
     needs: build
     name: Benchmark chisel info (chisel-releases 24.04)
-    permissions:
-      pull-requests: write
     steps:
       - name: Download base
         uses: actions/download-artifact@v4
@@ -68,7 +66,8 @@ jobs:
           chmod +x base head
           hyperfine --export-markdown "$msg_file" "./base info --release ./chisel-releases 'python3.12_core'" -n "BASE" "./head info --release ./chisel-releases 'python3.12_core'" -n "HEAD"
 
-      - name: Post message to PR
-        uses: mshick/add-pr-comment@v2
+      - name: Upload result
+        uses: actions/upload-artifact@v4
         with:
-          message-path: ${{ steps.benchmark.outputs.msg_file }}
+          name: perf-report
+          path: ${{ steps.benchmark.outputs.msg_file }}

From b40419cdddd7fec9e4185088e1c2b172a1fa90bb Mon Sep 17 00:00:00 2001
From: Paul Mars <paul.mars@canonical.com>
Date: Fri, 6 Mar 2026 11:50:52 +0100
Subject: [PATCH 2/4] ci: add missing directive

---
 .github/workflows/comment-pr.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/comment-pr.yaml b/.github/workflows/comment-pr.yaml
index 72ca8c352..24bf1fbc3 100644
--- a/.github/workflows/comment-pr.yaml
+++ b/.github/workflows/comment-pr.yaml
@@ -8,6 +8,7 @@ on:
 jobs:
   post-comment:
     name: Post PR comment
+    runs-on: ubuntu-latest
     permissions:
       pull-requests: write
     if: ${{ github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success'}}

From 493de9a76c90b0d9747477fd11c8ea59f3e9cf51 Mon Sep 17 00:00:00 2001
From: Paul Mars <paul.mars@canonical.com>
Date: Fri, 6 Mar 2026 16:01:20 +0100
Subject: [PATCH 3/4] ci: set retention on perf report

---
 .github/workflows/performance.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/performance.yaml b/.github/workflows/performance.yaml
index 981c46043..5f3e93bdf 100644
--- a/.github/workflows/performance.yaml
+++ b/.github/workflows/performance.yaml
@@ -71,3 +71,4 @@ jobs:
         with:
           name: perf-report
           path: ${{ steps.benchmark.outputs.msg_file }}
+          retention-days: 1

From 82002cf1fd37a384a32aaab31ae049219584bdf5 Mon Sep 17 00:00:00 2001
From: ROCKs Bot <108744201+ROCKsBot@users.noreply.github.com>
Date: Mon, 9 Mar 2026 07:59:17 +0100
Subject: [PATCH 4/4] Update main.go

---
 cmd/chisel/main.go | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/cmd/chisel/main.go b/cmd/chisel/main.go
index 50792839b..a4f7253ee 100644
--- a/cmd/chisel/main.go
+++ b/cmd/chisel/main.go
@@ -19,6 +19,8 @@ import (
 	//"github.com/canonical/chisel/internal/logger"
 )
 
+// TEST
+
 var (
 	// Standard streams, redirected for testing.
 	Stdin  io.Reader = os.Stdin