Separate Performance Baseline Tracking into dedicated workflow

[wsollers]

🎯 Objective

Move the Performance Baseline Tracking job from the main CI workflow into its own dedicated workflow file for better separation of concerns and maintainability.

📋 Summary of Changes

✨ New Features

• Created dedicated workflow:
• Enhanced trigger options:
  • Direct push to main branch
  • Manual workflow dispatch
  • Triggered after successful CI completion
• Improved performance page with dynamic file availability checking
• Better error handling and graceful fallbacks for flame graph generation

🔧 Refactoring

• Removed performance-tracking job from main CI workflow ()
• Eliminated ~400 lines from main CI workflow for better maintainability
• Separated concerns: CI focuses on testing, performance workflow on benchmarking
• Independent scheduling and resource allocation for performance analysis

🎯 Benefits

1. Cleaner Architecture: Clear separation between CI testing and performance analysis
2. Non-Blocking CI: Performance analysis runs independently without affecting CI completion
3. Flexible Triggers: Can run performance analysis on-demand or after successful CI
4. Easier Maintenance: Dedicated workflow files are easier to debug and modify
5. Resource Optimization: Independent scheduling allows better resource allocation

🔍 Functionality Preserved

All existing performance tracking features remain intact:

• ✅ Comprehensive benchmarking (JSON, CSV, console formats)
• ✅ Flame graph generation with enhanced error handling
• ✅ System information collection
• ✅ Historical performance tracking via benchmark-action
• ✅ GitHub Pages integration
• ✅ Automated performance report commits

🚀 Files Changed

• Added: - New dedicated performance workflow
• Modified: - Removed performance tracking job

✅ Testing

• Workflow syntax validation
• All existing CI jobs remain unchanged
• Performance workflow maintains all previous functionality
• No breaking changes to existing processes

📖 Additional Notes

• The performance workflow will now run independently of the main CI pipeline
• This change improves the overall workflow architecture and maintainability
• No changes to the actual performance analysis logic or outputs
• Maintains backward compatibility with existing performance tracking infrastructure

Ready for review and merge! 🚀

[github-actions]

🛡️ Comprehensive SAST Security Analysis

Comprehensive SAST Security Analysis Report

Analysis Date: Sun Nov 2 16:11:02 UTC 2025
Repository: wsollers/utf_strings
Commit: 2eb1c23
Scan Intensity: comprehensive

Security Tools Summary

🛡️ Trivy (Vulnerability & Misconfiguration)

Summary Report

Report Summary

┌────────┬──────┬─────────────────┬─────────┐
│ Target │ Type │ Vulnerabilities │ Secrets │
├────────┼──────┼─────────────────┼─────────┤
│   -    │  -   │        -        │    -    │
└────────┴──────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)

🏗️ Checkov (Infrastructure Security)

ℹ️ Scan completed - check artifacts for details

Report Summary

github_actions scan results:

Passed checks: 1059, Failed checks: 9, Skipped checks: 0

Check: CKV_GHA_7: "The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. "
	FAILED for resource: on(SAST Security Scanning)
	File: /.github/workflows/sast-scanning.yml:24-35

		24 |       scan_intensity:
		25 |         description: "SAST scanning intensity level"
		26 |         required: false
		27 |         default: "comprehensive"
		28 |         type: choice
		29 |         options:
		30 |           - basic
		31 |           - comprehensive
		32 |           - deep
		33 | 
		34 | jobs:
		35 |   # ============================================================================

Check: CKV_GHA_7: "The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. "
	FAILED for resource: on(Create Release)
	File: /.github/workflows/create-release.yml:10-21

		10 |       version:
		11 |         description: "Version number (e.g., 0.0.1)"
		12 |         required: true
		13 |         type: string
		14 |       create_tag:
		15 |         description: "Create git tag if it does not exist"
		16 |         required: true
		17 |         type: boolean
		18 |         default: true
		19 | 
		20 | permissions:
		21 |   contents: write

Check: CKV_GHA_7: "The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. "
	FAILED for resource: on(Release Validation)
	File: /.github/workflows/release-validation.yml:8-14

		8  |       release_tag:
		9  |         description: "Release tag to validate"
		10 |         required: true
		11 |         type: string
		12 | 
		13 | jobs:
		14 |   # ============================================================================

🔐 Gitleaks (Secret Detection)

Scan Status: ✅ Primary scan completed successfully

Secrets Found: 0
✅ No secrets detected in repository history!

🔧 Cppcheck (Static Code Analysis)

Issues Found:

• Errors: 0
• Warnings: 0
• Style Issues: 0

✅ No static analysis issues found!

🔍 Semgrep (Security Pattern Analysis)

Security Findings: 0
✅ No security issues detected!

Next Steps

1. Review all findings in the GitHub Security tab
2. Prioritize critical and high severity issues
3. Download detailed reports from workflow artifacts
4. Implement fixes and re-run security scans
5. Consider adjusting scan intensity for different scenarios

🔍 View scan configuration

Tools Used:

• Trivy: Vulnerability and misconfiguration scanning
• Checkov: Infrastructure security analysis
• Gitleaks: Secret detection in git history
• Cppcheck: Static code analysis for C/C++
• Semgrep: Security pattern matching and code analysis

SARIF Results: All findings are automatically uploaded to the Security/Code Scanning tab for detailed analysis and tracking.

Scan Intensity: comprehensive

Workflow Run: View Details

[github-actions]

Unit Test Results

 9 files  ±0  36 suites  ±0   0s ⏱️ ±0s
 6 tests ±0   6 ✅ ±0  0 💤 ±0  0 ❌ ±0 
54 runs  ±0  54 ✅ ±0  0 💤 ±0  0 ❌ ±0 

Results for commit d94a353. ± Comparison against base commit 0157411.