[RFC] Branded benchmark PR comments via a GitHub App and a hosted comment relay

[soroushm]

What's the Motivation? 🤔

The soroush-tech/bench-action gate posts its results comment as github-actions[bot]. For the Marketplace release we want the comment authored by our own bot identity (name + avatar) in any consumer repo — the way codecov[bot] works — with zero secrets or token setup for consumers. Comment authorship on GitHub is determined by the token that posts it, and minting a branded token requires the GitHub App's private key, which can never ship inside a public action. The only sound design is a small hosted relay that holds the key.

What are the requirements? ❓

• Consumers configure nothing beyond installing the public GitHub App and granting id-token: write; no secrets, no backend accounts.
• The action never gets worse: any relay failure (app not installed, no OIDC permission, relay down) falls back to the current direct comment, and comment failures never affect the gate verdict.
• The relay can only post to the repo that called it (no spoofing), is rate-limited, and holds the app key as a Cloudflare secret.
• 100% test coverage on all covered modules in both repos, per existing standards.

What are our options? 💡

1. Per-repo app-token wiring (mint an installation token in each consumer's workflow) — requires every consumer to hold our app's private key: impossible for a public action.
2. No branding — keep github-actions[bot]; zero effort, but not the product we want on the Marketplace.
3. Hosted relay + GitHub App (proposed) — the Codecov model; the key stays on our infrastructure, consumers get one-click install.

Proposed solution 🟢

A dedicated Cloudflare Worker workers/bench (@soroush/bench-api) at api.bench.soroush.tech, mirroring workers/api's conventions. Flow:

1. The action (running in the consumer's workflow) requests a GitHub Actions OIDC token (core.getIDToken('soroush-bench-action')) and POSTs { repository, prNumber, body } to /v1/report with the JWT as bearer auth.
2. The relay verifies the JWT (issuer JWKS, signature, audience, expiry) and trusts only its repository claim as the caller's identity.
3. It mints a GitHub App installation token for that repo (App JWT via crypto.subtle RS256 — zero new dependencies) and upserts the marker-matched sticky comment as the bot. 404 when the app isn't installed → the action falls back silently.
4. Action side ships in bench-action v1.1.0 together with the zero-config github-token default: a covered relay.ts client, a branded input (default 'true'), and fallback wiring. Release to the Marketplace only after the relay is live.

Risks & mitigations 🚨

• Abuse / spoofing → posting is confined to the OIDC-verified repository claim (self-spam only); body must start with the report marker and is size-capped; per-IP rate limit.
• Relay outage / JWKS failure → graceful fallback to the unbranded comment; the gate verdict is never touched.
• Fork PRs (no id-token permission) → fallback path, documented.
• Key management → PKCS#8 key stored only as a Worker secret; rotation = new key + wrangler secret put, no action release.
• Pre-existing comments → an existing unbranded sticky comment keeps its original author when updated; documented (delete once to rebrand).

Resources and benchmarks 🔗

• [Epic] Performance-regression gate for styled-system via a reusable bench GitHub Action #292 · feat(bench): performance-regression gate for styled-system via the standalone bench action #307
• https://github.com/soroush-tech/bench-action · https://soroush.tech/bench-action