perf(no-ticket): benchmark credential helper flows and cut custom-domain lookup overhead

.github/workflows/codspeed.yml

@@ -0,0 +1,43 @@
+name: CodSpeed
+
+# The repository is not connected on codspeed.io yet, so results cannot
+# upload. Restore the push and pull_request triggers after the connection.
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: codspeed-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  benchmarks:
+    name: Credential helper benchmarks
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.12"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          enable-cache: true
+
+      - name: Install dependencies
+        run: uv sync --locked --group dev --python 3.12
+
+      - name: Run benchmarks
+        uses: CodSpeedHQ/action@373d6868929f444bc08d901fd0eb0ad52a8875ea # v5.2.1
+        with:
+          mode: simulation
+          run: uv run pytest benchmarks/ --codspeed
+          token: ${{ secrets.CODSPEED_TOKEN }}

AGENTS.md

@@ -21,6 +21,7 @@ Python `>=3.10` is required (CI tests 3.10–3.14).
 - Run the unit tests: `pytest -m "not integration"`. Run with coverage: `pytest --cov=cloudsmith_cli`.
 - Run the live-service tests: `pytest -m integration` (requires the `PYTEST_CLOUDSMITH_*` environment variables). Mark each test that calls the live Cloudsmith service with `@pytest.mark.integration`.
 - Run a single test: `pytest cloudsmith_cli/cli/tests/test_push.py::TestClass::test_name` or by node id / `-k <expr>`.
+- Run the credential-helper benchmarks: `pytest benchmarks/ --codspeed`. `.github/workflows/codspeed.yml` runs them on CodSpeed (manual trigger until the repo is connected on codspeed.io); the default `pytest` run does not collect them.
 - Lint/format (all run via pre-commit): `pre-commit run --all-files`. Individual tools: `black .`, `isort .`, `flake8 --config=.flake8`, `pylint --rcfile=.pylintrc <path>`, `pyupgrade --py310-plus <files>`.
 - Release: `bumpversion <major|minor|revision>` then `git push origin <tag>`. The `VERSION` symlink in repo root points at `cloudsmith_cli/data/VERSION`.
 

CHANGELOG.md

@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
+### Changed
+
+- Credential helper lookups against custom domains are now faster. The domain cache file is read once per process instead of on every request, and read-only lookups no longer create the cache directory.
+
 ## [1.25.0] - 2026-08-24
 
 ### Added

benchmarks/test_credential_helpers.py

@@ -0,0 +1,135 @@
+# Copyright 2026 Cloudsmith Ltd
+"""CodSpeed benchmarks for the credential helper flows.
+
+Run with ``pytest benchmarks/ --codspeed``. Each benchmark measures one
+in-process flow that a credential helper runs on each invocation. No
+benchmark touches the network: the custom-domain flow is served from a
+pre-warmed cache.
+"""
+
+import io
+import json
+
+import pytest
+
+from cloudsmith_cli.core.credentials.chain import CredentialProviderChain
+from cloudsmith_cli.core.credentials.models import CredentialContext, CredentialResult
+from cloudsmith_cli.credential_helpers import custom_domains
+from cloudsmith_cli.credential_helpers.backends import BackendKind
+from cloudsmith_cli.credential_helpers.cargo import runtime as cargo_runtime
+from cloudsmith_cli.credential_helpers.common import is_cloudsmith_domain
+from cloudsmith_cli.credential_helpers.custom_domains import CustomDomain, write_cache
+from cloudsmith_cli.credential_helpers.default_domains import (
+    DomainType,
+    load_default_domains,
+)
+from cloudsmith_cli.credential_helpers.docker import runtime as docker_runtime
+from cloudsmith_cli.credential_helpers.pnpm import runtime as pnpm_runtime
+
+API_KEY = "0123456789abcdef0123456789abcdef"
+
+ORG = "acme"
+
+CARGO_GET_REQUEST = json.dumps(
+    {
+        "v": 1,
+        "kind": "get",
+        "operation": "read",
+        "registry": {"index-url": f"sparse+https://cargo.cloudsmith.io/{ORG}/repo/"},
+    }
+)
+
+
+@pytest.fixture
+def credential():
+    return CredentialResult(api_key=API_KEY, source_name="env_var")
+
+
+@pytest.fixture
+def warm_custom_domain_cache(monkeypatch, tmp_path):
+    domain = CustomDomain(
+        host="cargo.example.com",
+        backend_kind=int(BackendKind.CARGO),
+        enabled=True,
+        validated=True,
+        org=ORG,
+        domain_type=DomainType.NATIVE_API,
+    )
+    monkeypatch.setattr(custom_domains, "get_cache_dir", lambda: tmp_path)
+    write_cache(custom_domains.get_cache_path(ORG), [domain])
+    return domain
+
+
+def test_cargo_session(benchmark, credential):
+    def run_session():
+        stdin = io.StringIO(CARGO_GET_REQUEST + "\n")
+        return cargo_runtime.execute(stdin, io.StringIO(), credential=credential)
+
+    exit_code, stderr_text = benchmark(run_session)
+    assert exit_code == 0
+    assert stderr_text is None
+
+
+def test_cargo_handle_request(benchmark, credential):
+    request = json.loads(CARGO_GET_REQUEST)
+    response = benchmark(cargo_runtime.handle_request, request, credential=credential)
+    assert response["Ok"]["token"] == API_KEY
+
+
+def test_docker_get(benchmark, credential):
+    def run_get():
+        stdin = io.StringIO("https://docker.cloudsmith.io\n")
+        return docker_runtime.execute("get", stdin, credential=credential)
+
+    exit_code, stdout_text, _ = benchmark(run_get)
+    assert exit_code == 0
+    assert json.loads(stdout_text)["Secret"] == API_KEY
+
+
+def test_pnpm_get(benchmark, credential):
+    exit_code, token, _ = benchmark(
+        pnpm_runtime.execute,
+        f"https://npm.cloudsmith.io/{ORG}/repo/",
+        credential=credential,
+    )
+    assert exit_code == 0
+    assert token == API_KEY
+
+
+def test_standard_domain_match(benchmark, credential):
+    matched = benchmark(
+        is_cloudsmith_domain,
+        f"https://cargo.cloudsmith.io/{ORG}/repo/",
+        credential=credential,
+        backend_kind=BackendKind.CARGO,
+        org=ORG,
+    )
+    assert matched is True
+
+
+def test_custom_domain_match_from_cache(
+    benchmark, credential, warm_custom_domain_cache
+):
+    matched = benchmark(
+        is_cloudsmith_domain,
+        f"https://{warm_custom_domain_cache.host}/{ORG}/repo/",
+        credential=credential,
+        backend_kind=BackendKind.CARGO,
+        org=ORG,
+    )
+    assert matched is True
+
+
+def test_load_default_domains(benchmark):
+    domains = benchmark(load_default_domains)
+    assert domains
+
+
+def test_credential_chain_resolves_env_var(benchmark):
+    def resolve():
+        chain = CredentialProviderChain()
+        return chain.resolve(CredentialContext(api_key_from_env=API_KEY))
+
+    result = benchmark(resolve)
+    assert result is not None
+    assert result.api_key == API_KEY