Trigger the standalone Website workflow at the end of Benchmarks

Author: KSemenenko

.github/workflows/AGENTS.md

@@ -76,3 +76,7 @@
 ## Separate Website workflow, owner correction 2026-10-06
 
 - The owner's explicit correction supersedes the earlier three-workflow limit and every CI/Benchmarks website placement: `Build and Tests` (`ci.yml`) owns full solution build, repository checks and ordinary tests; `Website` (`website.yml`) independently owns site qualification/build/Pages on trusted main pushes, manual dispatch and completed Benchmarks events. `Benchmarks` and manual `Release` retain their existing scopes. Website uses ready authenticated metrics when available and publishes the fully qualified content-only site when none exist; all applicable source, browser, coverage, freshness and permission gates remain mandatory.
+
+## Final Benchmarks Website trigger, owner clarification 2026-10-06
+
+- Benchmarks ends with only a bounded dispatch of `website.yml` on main, after its aggregation dependencies settle even when benchmark work fails. Keep site building, tests and Pages entirely in Website; remove its `workflow_run` subscription. Only the final trigger job receives `actions: write`. Website authenticates an optional triggering run against GitHub and waits boundedly for completion before its existing newest-ready selection; no input supplies trusted measurements. Push/manual Website publication and all original qualification/freshness gates remain independent.

.github/workflows/benchmarks.yml

@@ -439,3 +439,21 @@ jobs:
           path: ${{ runner.temp }}/open-loop-aggregate/**
           if-no-files-found: warn
           retention-days: 90
+  website-trigger:
+    name: Trigger Website
+    needs: [comparison-aggregate]
+    if: >-
+      always() && !cancelled() &&
+      github.repository == 'managedcode/KeyLoad' && github.event.repository.id == 477801965 &&
+      github.ref == 'refs/heads/main' &&
+      (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions: {actions: write}
+    env:
+      GH_TOKEN: ${{ github.token }}
+      GH_REPO: ${{ github.repository }}
+      BENCHMARK_RUN_ID: ${{ github.run_id }}
+    steps:
+      - name: Start the separate Website workflow
+        run: timeout 120s gh api --method POST "repos/$GH_REPO/actions/workflows/website.yml/dispatches" -f ref=main -f "inputs[benchmark_run_id]=$BENCHMARK_RUN_ID"

.github/workflows/website.yml

@@ -3,9 +3,12 @@ on:
   push:
     branches: [main]
   workflow_dispatch:
-  workflow_run:
-    workflows: [Benchmarks]
-    types: [completed]
+    inputs:
+      benchmark_run_id:
+        description: Benchmark run to await (optional)
+        required: false
+        type: string
+        default: ''
 permissions:
   contents: read
 jobs:
@@ -16,16 +19,8 @@ jobs:
       cancel-in-progress: false
     if: >-
       github.repository == 'managedcode/KeyLoad' && github.event.repository.id == 477801965 &&
-      ((github.ref == 'refs/heads/main' &&
-        (github.event_name == 'push' || github.event_name == 'workflow_dispatch')) ||
-       (github.event_name == 'workflow_run' &&
-        github.event.workflow_run.head_repository.id == 477801965 &&
-        github.event.workflow_run.head_branch == 'main' &&
-        github.event.workflow_run.name == 'Benchmarks' &&
-        github.event.workflow_run.path == '.github/workflows/benchmarks.yml' &&
-        github.event.workflow_run.status == 'completed' &&
-        (github.event.workflow_run.event == 'push' || github.event.workflow_run.event == 'workflow_dispatch') &&
-        (github.event.workflow_run.conclusion == 'success' || github.event.workflow_run.conclusion == 'failure')))
+      github.ref == 'refs/heads/main' &&
+      (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
     runs-on: ubuntu-latest
     timeout-minutes: 180
     permissions: {contents: read, actions: read}
@@ -37,6 +32,42 @@ jobs:
       GH_TOKEN: ${{ github.token }}
       GH_REPO: ${{ github.repository }}
     steps:
+      - name: Await the triggering benchmark run
+        if: github.event_name == 'workflow_dispatch' && inputs.benchmark_run_id != ''
+        timeout-minutes: 5
+        env:
+          BENCHMARK_RUN_ID: ${{ inputs.benchmark_run_id }}
+        run: |
+          [[ "$BENCHMARK_RUN_ID" =~ ^[1-9][0-9]*$ && ${#BENCHMARK_RUN_ID} -le 20 ]]
+          benchmark_deadline=$((SECONDS + 270))
+          benchmark_poll=0
+          while ((SECONDS < benchmark_deadline)); do
+            benchmark_remaining=$((benchmark_deadline - SECONDS))
+            ((benchmark_remaining > 0)) || break
+            benchmark_request_timeout=$((benchmark_remaining < 10 ? benchmark_remaining : 10))
+            if ! benchmark_metadata=$(timeout "${benchmark_request_timeout}s" gh api "repos/$GH_REPO/actions/runs/$BENCHMARK_RUN_ID"); then
+              printf '%s\n' 'Unable to read the triggering benchmark run within the bounded request.' >&2
+              exit 1
+            fi
+            jq -e --arg run "$BENCHMARK_RUN_ID" '
+              (.id | tostring) == $run and
+              .repository.id == 477801965 and .repository.full_name == "managedcode/KeyLoad" and
+              .head_repository.id == 477801965 and .head_repository.full_name == "managedcode/KeyLoad" and
+              .head_branch == "main" and .name == "Benchmarks" and
+              .path == ".github/workflows/benchmarks.yml" and
+              (.event == "push" or .event == "workflow_dispatch") and
+              (.head_sha | test("^[a-f0-9]{40}$"))' <<< "$benchmark_metadata" > /dev/null
+            if [[ "$(jq -r .status <<< "$benchmark_metadata")" == completed ]]; then
+              exit 0
+            fi
+            benchmark_poll=$((benchmark_poll + 1))
+            printf 'Waiting for benchmark completion (poll %s).\n' "$benchmark_poll"
+            benchmark_remaining=$((benchmark_deadline - SECONDS))
+            ((benchmark_remaining > 0)) || break
+            sleep "$((benchmark_remaining < 5 ? benchmark_remaining : 5))"
+          done
+          printf '%s\n' 'The triggering benchmark run did not complete within the bounded wait.' >&2
+          exit 1
       - name: Download source code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

AGENTS.md

@@ -519,3 +519,7 @@ A bounded website qualification candidate contains the20-project historical runt
 
 - GitHub Actions MUST expose four plainly named workflows: `Build and Tests` builds the complete solution and runs repository checks and ordinary tests; `Benchmarks` produces authenticated database-comparison JSON; `Website` independently builds, qualifies and deploys the site; `Release` remains the prepared manual product-release workflow. Website jobs and Benchmarks completion triggers MUST NOT be part of Build and Tests. This explicit correction supersedes the earlier three-workflow limit, the CI display name and every placement of website publication inside CI or Benchmarks.
 - Website MUST publish after trusted main source changes or manual dispatch independently of Build and Tests and benchmark success. Consume the newest ready authenticated Benchmarks aggregate when available; otherwise qualify and publish the site without benchmark figures. New ready benchmark data triggers a fresh Website run. Preserve source freshness, original metric provenance, complete applicable website qualification and least-privilege Pages deployment; absence of measurements is not a website failure.
+
+## Final Benchmarks Website trigger, owner clarification 2026-10-06
+
+- Benchmarks MUST finish with only a bounded dispatch of the separate Website workflow; it MUST NOT build, test or deploy the site itself. This supersedes Website's `workflow_run` completion subscription. Confine dispatch permission to that final trigger job, keep main/manual Website publication independent, and authenticate any supplied producer run through GitHub before bounded completion waiting and newest-ready selection. A trigger input is not metric provenance or permission to bypass website qualification.

docs/ADR/ADR-112-independent-website-publication.md

@@ -105,3 +105,37 @@ workflow name to Build and Tests and its four actual readable job labels. It
 retains ci.yml, the complete exact-source/current-attempt/success requirement,
 unique jobs and immutable release protections. Static contract/AST review is the
 allowed preparation evidence; no product Release is dispatched to verify it.
+
+## Final Benchmarks dispatch, owner clarification 2026-10-06
+
+REQ/AC-BC-WEB-007 supersedes the `workflow_run` subscription. Benchmarks' final
+`website-trigger` job depends on the settled `comparison-aggregate` join and uses
+`always() && !cancelled()` plus trusted own-main repository/event admission.
+Its only effect is dispatching the separate Website workflow on main; all site
+source, tests, builds and Pages remain Website-owned. Confine `actions: write` to
+that trigger job, keep every database job read-only, and dispatch after successful
+or failed benchmark work. Trigger failure remains visible and is never fabricated
+as publication success. Build and Tests gains no Website dependency.
+
+The dispatch passes optional `benchmark_run_id` only to resolve the brief race
+before its producer workflow becomes completed. Website authenticates that run
+against original GitHub metadata (own repository/id, main, Benchmarks name/path,
+push/manual event and valid source) and waits at most five minutes before existing
+newest-ready selection. Failure/cancellation does not supply metrics; invalid
+metadata, API errors and timeout fail closed. Empty manual input skips waiting.
+The run input neither selects authoritative metrics nor bypasses archive or
+source/tuple freshness. Current executor events are push and workflow_dispatch;
+retired workflow_run admission is rejected while immutable event validation
+fixtures remain history.
+
+TASK-WEB-TRIGGER-001 lead updates root/local policy and this REQ/AC contract first.
+TASK-WEB-TRIGGER-002 lead owns benchmarks.yml final dispatch, website.yml input,
+bounded admission/wait and native executor-event contract; tests cover manual
+admission/retired event rejection using unchanged controlled objects and a healthy
+follow-up through the actual context API. TASK-WEB-TRIGGER-003 read-only reviewer
+audits the trust/permission/race contract; lead joins static actionlint/YAML graph,
+Aspire regressions, canonical build/format and genuine final dispatch plus separate
+Website/Pages evidence. Preserve unrelated checkout work. No package/data change;
+rollback reverts this coherent dispatch contract to the earlier completion hook
+without rewriting evidence or metric archives. Remain Accepted until original
+required qualification/provider gates have passed.

docs/Architecture.md

@@ -1135,12 +1135,13 @@ flowchart LR
 ## Independent optional benchmark website publication
 
 [ADR-112](ADR/ADR-112-independent-website-publication.md) and
-[REQ/AC-BC-WEB-001..006](Features/BenchmarkComparisons.md) let Website publish website
+[REQ/AC-BC-WEB-001..007](Features/BenchmarkComparisons.md) let Website publish website
 source independently. The latest ready authenticated benchmark aggregate enriches
 the website when available; absence emits no metric catalog or figures. Content
 and measured artifacts have distinct complete applicable qualification, and
 predeploy rechecks actual website/control source plus ready-data identity or null.
-Completed own-main benchmarks trigger another independent Website consumer.
+The final own-main Benchmarks job only dispatches the independent Website workflow;
+Website authenticates and awaits that run's completion before selecting ready data.
 
 ```mermaid
 flowchart LR

docs/Features/BenchmarkComparisons.md

@@ -1253,8 +1253,8 @@ REQ-BC-WEB-006 / AC-BC-WEB-006: expose Build and Tests, Benchmarks, Website and
 Release. Build and Tests runs the complete solution build and every existing
 ordinary/analyzer/scalar/recovery/Aspire RF3 test gate with no website jobs or
 Benchmarks completion trigger. Website alone runs the existing qualified site
-build/deployment on trusted main push/manual and completed own-main Benchmarks
-producers, with no dependency on Build and Tests or successful benchmarks.
+build/deployment on trusted main push/manual, including the final Benchmarks
+dispatch, with no dependency on Build and Tests or successful benchmarks.
 Optional metrics, rejection of invalid selected evidence and the no-data path
 remain AC-BC-WEB-001..005. Native executor authentication must accept only Website
 at `.github/workflows/website.yml` and reject the former CI executor.
@@ -1379,3 +1379,25 @@ Align that exact frozen count with the existing complete manifest, retaining byt
 comparison, sorted uniqueness, regular-path and per-file hash checks. This is a
 static workflow contract repair under AC-BC-WEB-004/005; no file or coverage source
 is removed and no provider pass is claimed until the next genuine run succeeds.
+
+### Final Benchmarks trigger, owner clarification 2026-10-06
+
+REQ-BC-WEB-007 / AC-BC-WEB-007: the final Benchmarks job only dispatches the
+separate Website workflow on main after aggregation dependencies settle. It runs
+on trusted own-main push/manual even when benchmark checks or aggregation fail,
+and never builds/tests/deploys the website. Scope `actions: write` to that job;
+retain read-only database jobs and unchanged workloads. Website uses only push
+and workflow_dispatch events, with its independent source publication intact.
+
+Dispatch supplies only an optional `benchmark_run_id` for completion waiting.
+Website authenticates the actual original run's repository, branch, workflow
+name/path, event and source through GitHub; bounded waiting resolves the race
+between dispatch and producer completion before newest-ready selection. Reject
+invalid/foreign metadata and timeout, preserve failure/absence handling and
+source/tuple freshness. The input never selects metric authority or replaces
+archive provenance. Empty manual input needs no producer wait. Existing native
+TUnit executor operations cover manual admission and retired executor-event
+rejection, unchanged inputs and a healthy follow-up. Static actionlint and YAML
+graph review verify infrastructure; a genuine final dispatch and separate
+workflow_dispatch Website/Pages run supply provider evidence. Ordered tasks and
+ownership are in ADR-112 TASK-WEB-TRIGGER-001..003.

docs/Features/ReleaseDelivery.md

@@ -57,7 +57,8 @@ flowchart LR
     Main[Own main push or manual] --> Benchmarks[All native load comparisons]
     Benchmarks --> Aggregate[Complete authenticated JSON aggregate]
     WebSource[Trusted main source or manual] --> Website[Separate Website workflow]
-    Aggregate --> Website
+    Aggregate --> Trigger[Dispatch Website only]
+    Trigger --> Website
     Website --> Qualify[Applicable site tests browser coverage]
     Qualify --> Deploy[Publish with ready metrics or without figures]
     Manual[Manual own-main Release] --> Version[UTC dated reservation]

docs/implementation/status.json

@@ -4884,7 +4884,7 @@
         "siteTestsFormat": "passed",
         "canonicalBuild": "passed_zero_warnings_zero_errors_final_source",
         "canonicalFormat": "failed_unrelated_BackupRestore_AtomicPartitionRosterFixture_whitespace",
-        "staticWorkflowGovernance": "passed",
+        "staticWorkflowGovernance": "workflow_graph_actionlint_passed; working_tree_governance_failed_unrelated_owner_migration_rule_changed_preserved_root_prefix; scoped_index_prefix_unchanged",
         "contentOnlyAspire": {
           "status": "passed_development_only",
           "tests": 5,
@@ -4901,11 +4901,11 @@
         "alwaysRunExecutorRegressions": {
           "status": "passed_development_only",
           "suite": "Aspire_unit_SiteOptionalBenchmarkSelectionTests",
-          "tests": 22,
-          "passed": 22,
+          "tests": 24,
+          "passed": 24,
           "skipped": 0,
-          "executorCases": 3,
-          "trxSha256": "df3991c8bd94b90a3a95a9ba952e68478111e3f09764f6787b4a4cdb46ddb94d"
+          "executorCases": 5,
+          "trxSha256": "2ed45090c82db5fd2748973794b574932d54ee062f9bc5a013b60054b9516206"
         },
         "firstNativeRun": {
           "source": "6c20cf4fba946afc123fd2fd29960d7995c248f4",
@@ -4929,6 +4929,26 @@
           "selectedBenchmarkRun": 37184989107,
           "selectedMeasuredSource": "73aebfd3f72695357834599e813aba77b9e274ad",
           "qualification": "capture_only_not_site_or_current_database_qualification"
+        },
+        "finalBenchmarkTrigger": {
+          "requirement": "REQ-BC-WEB-007",
+          "producerJob": "website-trigger",
+          "dependsOn": "comparison-aggregate",
+          "onlyEffect": "dispatch_Website_main",
+          "dispatchAfterFailureOrSkip": true,
+          "dispatchAfterWholeWorkflowCancellation": false,
+          "actionsWrite": "only_final_trigger_job",
+          "websiteEvents": [
+            "push",
+            "workflow_dispatch"
+          ],
+          "workflowRunSubscription": false,
+          "producerInput": "benchmark_run_id_wait_only_not_metric_authority",
+          "authenticatedWaitDeadlineSeconds": 270,
+          "stepTimeoutMinutes": 5,
+          "staticContract": "passed",
+          "nativeManualAdmissionAndRetiredEventRejection": "passed_Aspire_unit",
+          "provider": "pending_genuine_final_dispatch_and_separate_Pages_run"
         }
       }
     }

scripts/Features/BenchmarkComparisons/site-isolated-github-capture.mjs

@@ -1,5 +1,4 @@
 import path from 'node:path';
-import { isDeepStrictEqual } from 'node:util';
 import { absolutePath, existingPath } from './aggregate-files.mjs';
 import { createDirectory } from './image-bundle-files.mjs';
 import { GH } from './isolated-github-contract.mjs';
@@ -17,11 +16,6 @@ import { siteMetadataFiles } from './site-isolated-github-files.mjs';
 import { captureHistoricalContract } from './historical-site-evidence.mjs';
 
 async function captureSelectionRuns(directory, context, workflow) {
-  if (context.trigger !== null) {
-    const trigger = await captureApi(`${GH.api}/runs/${context.trigger.runId}/attempts/${context.trigger.attempt}`,
-      path.join(directory, 'trigger-run.json'), false, context);
-    requireSite(isDeepStrictEqual(selectLatestSiteProducer([trigger], workflow), context.trigger));
-  }
   if (context.requestedRun !== null) {
     const pinned = await captureApi(`${GH.api}/runs/${context.requestedRun}`,
       path.join(directory, SITE_GH.pinnedRunCapture), false, context);