Lunny Xiaoandsilverwind 5129ad5439 perf(actions): cache successful runner token verification (#39934) ...

Every Actions runner RPC (`FetchTask` polling, `UpdateTask`,
`UpdateLog`, ...) goes through the `withRunner` interceptor, which
verifies the runner token with PBKDF2 (`auth_model.HashToken`, ~2 ms).
In a 60s CPU profile of a production instance with many runners, this
accounted for ~49% of all CPU samples.

- Cache successful verifications in a dedicated LRU of up to 10000
runners, keyed by the stored salt and hash and holding only a SHA-256
digest of the token. A hit costs ~100 ns.
- The runner is still loaded from the DB on every RPC and failures are
never cached, so deleted runners and wrong tokens never pass.
- The shared `auth_model.TokenCache` is not used because its default 20
entries miss on every poll once more runners poll in turn.

---------

Co-authored-by: silverwind <me@silverwind.io>

2026-10-23 03:59:11 +00:00

..

actions

perf(actions): cache successful runner token verification (#39934)

2026-10-23 03:59:11 +00:00

packages

refactor: carry the API token on the doer (#39690)

2026-10-19 00:34:01 +00:00

v1

feat: Allow automatic project actions on events (#30205)

2026-10-23 01:53:45 +00:00