[szibis]

Summary

The daily performance report pull request only changes measurement data, but three checks treated it like a code change. On #781 and #805, changelog and label failed, and merging #805 nearly cut a second release (stopped with no-release). This PR fixes those three checks.

• Changelog gate: bench/ab/history/, bench/ab/results/ and the three reports the run regenerates (conformance/registry/generated/perf-evidence.json, conformance/reports/performance.md, conformance/reports/gaps.md) count as non-release, like docs/.
  • The harness (bench/ab/*.py), the registry sources and the registry's other generated files (for example generated/proxy/limits.json, exported from the flags) still require an entry.
• Release bot (auto-release.yaml): the same files count as docs and CI changes. Merging a report therefore never cuts a release, even while [Unreleased] holds entries from an earlier pull request.
  • Before this change, the bot would have cut a release, and a report diff counts as a large change, so it would have been a minor one.
• Labeler: reads the file list from the paginated pull request files API. gh pr diff --name-only fails once a diff passes GitHub's 20,000-line limit (HTTP 406 … too_large), which every daily report does.

Changes

• scripts/ci/check_changelog_pr.py: two path prefixes and three files added to the non-release lists.
• scripts/ci/tests/test_check_changelog_pr.py, two new tests:
  • bench: daily performance report 2026-10-22 #805's file list with both of its commit subjects does not require an entry;
  • the harness, a registry source and generated/proxy/limits.json still do.
• .github/workflows/auto-release.yaml: the docs/CI-only regex now includes the same paths.
• .github/workflows/pr-labeler.yaml: the file list comes from gh api --paginate repos/…/pulls/N/files.
• CHANGELOG.md: a CI entry under [Unreleased].

Proofs

• Changelog gate on bench: daily performance report 2026-10-22 #805's real range (80e94721..f6f6455): the gate from main fails ("CHANGELOG.md must be updated"), and the new gate prints "skipped (no releasable changes detected)". fix(security): resolve the open Semgrep code-scanning alerts in the release workflows and the unwrap check #804's range (80e94721..a5740e1d) still passes as a release entry.
• Release regex on real tag ranges:
  • v2.24.4..58be7559 (bench: daily performance report 2026-10-22 #805's merge): every file matches, so the release is skipped;
  • v2.24.3..a5740e1d (fix(security): resolve the open Semgrep code-scanning alerts in the release workflows and the unwrap check #804): still releases;
  • bench/ab/daily.py, conformance/registry/baseline.json and conformance/registry/generated/proxy/limits.json: still release.
• Labeler: on bench: daily performance report 2026-10-22 #805, gh pr diff --name-only exits 1, and the files API returns all 45 files. On fix(security): resolve the open Semgrep code-scanning alerts in the release workflows and the unwrap check #804, both give the same 6 files.
• Mutation check: widening the exemption to bench/ab/ and conformance/ turns the new harness test red.
• Gates:
  • scripts/ci/tests: 79 tests pass;
  • actionlint passes;
  • the pinned zizmor 1.30.1 reports "No findings" on both workflows;
  • the changelog gate passes on this branch.
• The conformance gate runs in CI. It needs the Go unit results, and no Go code changes here.

Not applicable: no proxy code changes, so e2e vs Loki, the Grafana range matrix, visual proof, A/B, benchstat and the load test do not apply.

Notes:

• Merging cuts a release: scripts/ci/ is outside the docs/CI-only paths, so merging this PR cuts a patch release and opens its metadata PR.
• Daily PRs still need an admin merge: the bot's report commit stays unsigned. Creating it through GitHub's API is a separate change, made after testing on a scratch branch: the payload is several MB and grows every day, and the branch reset has to be safe while a report PR is open.
• New labels: daily PRs will now also get performance (from the bench: title) and scope/docs (from trend.md). The release skip runs before the label-based version bump, so these labels never trigger a release.

[github-actions]

PR Quality Report

Compared against base branch main.

Coverage and tests

Signal	Base	PR	Delta
Test count	11827	11827	0
Coverage	88.3%	88.3%	0.0% (stable)

Compatibility

Track	Base	PR	Delta
Loki API	100.0%	11/11 (100.0%)	0.0% (stable)
Logs Drilldown	100.0%	17/17 (100.0%)	0.0% (stable)
VictoriaLogs	100.0%	11/11 (100.0%)	0.0% (stable)

Performance smoke

Performance smoke was skipped for this PR because no perf-sensitive paths changed.

State

• Coverage, compatibility, and sampled performance are reported here from the same PR workflow.
• This is a delta report, not a release gate by itself. Required checks still decide merge safety.
• Performance smoke was intentionally skipped because no perf-sensitive paths changed in this PR.
• Delta states use the same noise guards as the quality gate (percent + absolute + low-baseline checks), so report labels match merge-gate behavior.