ci: make builds more secure #103

	name: Benchmarks

	on:
	push:
	branches:
	- 'main'
	tags-ignore:
	- '..*'
	pull_request:
	workflow_dispatch:

	permissions:
	contents: read

	jobs:
	benchmarks:
	runs-on: ubuntu-latest

	strategy:
	matrix:
	node-version: [20.x]

	steps:
	- name: Checkout repository
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	- name: Use Node.js ${{ matrix.node-version }}
	uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
	with:
	node-version: ${{ matrix.node-version }}
	- name: Install dependencies
	run: \|
	npm ci

	- name: Run benchmark
	run: npm run test:packages:benchmark > ./benchmarks-${{ matrix.node-version }}.txt
	- name: Download previous benchmark data
	uses: actions/cache@v1
	with:
	path: ./cache
	key: ${{ runner.os }}-benchmark
	- name: Store benchmark result
	uses: rhysd/github-action-benchmark@v1
	with:
	name: Benchmark
	tool: 'benchmarkjs'
	output-file-path: ./benchmarks-${{ matrix.node-version }}.txt
	external-data-json-path: ./cache/benchmarks-${{ matrix.node-version }}.json
	alert-threshold: '105%'
	fail-on-alert: true
	# TODO enable
	comment-on-alert: false
	auto-push: false
	benchmark-data-dir-path: ./benchmarks
	github-token: ${{ secrets.GITHUB_TOKEN }}
	#alert-comment-cc-users: '@willfarrell'

Provide feedback