SRE-904: Split token minting from the release run

[claude]

Requested by Tim Diekmann · Slack thread

🌟 What is the purpose of this PR?

Ports the token-minting split from hashintel/.github#99 to this repo's release workflow, and removes id-token: write from a job that never consumes it. This is a supply-chain containment change: it narrows what compromised dependency code running in CI can reach.

Before: the single release job held id-token: write while running the full dependency graph (mise/Rust toolchain install, yarn install, turbo builds, yarn changeset publish and every module those load). Any compromised build-time dependency in that job could not only read the HASH Release App installation token and NPM_TOKEN from its own environment, but also use the job-wide ACTIONS_ID_TOKEN_REQUEST_* credentials to mint fresh OIDC tokens and authenticate to any Vault role whose claim bindings the run satisfies — at minimum the sccache role, whose R2 credentials allow poisoning the shared compile cache that feeds every Rust build. Similarly, deploy.yml's setup job granted id-token: write to a job that runs turbo query (dependency code) but consumes no OIDC at all.

After: only a new mint-token job holds id-token: write, and it runs nothing but pinned credential-minting actions (github-app-token, vault-action for the sccache bundle) — no dependency code executes there. The release job holds no OIDC permission: compromised dependency code there gets at most the hour-long installation token it is handed (which the split intentionally does not protect — the publish needs it), and can no longer sign fresh App JWTs in Vault or fetch sccache credentials. The dead grant in deploy.yml's setup job is gone entirely.

🔗 Related links

• SRE-904 (internal)
• SRE-904: Split token minting from the Renovate run .github#99 — the pattern this ports (merged as b7a5d7f)
• SRE-908 / SRE-908: Remove unpinned, script-running package installs from CI #9186, SRE-908: Delete the block-publishing workflows #9187 — deleted the block-publishing workflows, which removed the other two id-token+dependency-code combinations this assessment flagged

🚫 Blocked by

• Repo secret RELEASE_TOKEN_ENC_KEY must exist in hashintel/hash before merge (value: openssl rand -base64 32; repo-level secret). Without it the mint job fails at its : "${ENC_KEY:?}" guard on the next push to main.
• Repo secret SCCACHE_ENC_KEY must exist in hashintel/hash before merge (same openssl rand -base64 32; repo-level secret). It keys the sccache credential handoff in release, lint, and test; without it their credentials jobs fail at the :? guard.
• Repo secret RENOVATE_TOKEN_ENC_KEY — the bumped housekeeping-dependencies.yml declares it required: true. Already created in hashintel/hash as part of the SRE-904: Split token minting from the Renovate run .github#99 rollout, so the passthrough works immediately.

🔍 What does this change?

• .github/workflows/release.yml — split into two jobs:

  • mint-token (environment: main kept — the ci-hash-release Vault role binds the OIDC environment claim): contents: read + id-token: write only; runs the existing pinned github-app-token action unchanged, then encrypts the token with openssl enc -aes-256-cbc -pbkdf2 -salt -pass env:ENC_KEY -base64 -A keyed by the new RELEASE_TOKEN_ENC_KEY secret. Only ciphertext leaves the job (GitHub drops masked values from job outputs, so plaintext could not cross anyway). : "${VAR:?}" guards fail loud on missing inputs. The openssl encrypt/decrypt round-trip was verified against OpenSSL 3.0.13 (the ubuntu-latest version).
  • release: no id-token; decrypts and ::add-mask::s the plaintext directly after checkout, before anything else runs, then the existing checkout/install/changesets steps unchanged. sccache stays: mint-token also fetches the R2 credentials and hands them over as a second ciphertext (keyed by the new SCCACHE_ENC_KEY secret), decrypted inside install-sccache — so the job builds cached without holding OIDC. The Rust toolchain stays: publishing @blockprotocol/type-system builds the wasm artifact from the Rust crate (build:wasm via wasm-pack; rust/pkg/ is gitignored, so it cannot come from the checkout), so rust: false was not an option. environment: main is kept on this job too so environment-scoped secrets remain reachable.
  • NPM_TOKEN handling and the changesets config are untouched.

• .github/workflows/deploy.yml — setup job: id-token: write → contents: read. The job passes rust: false to install-tools, and the sccache credential fetch (gated on Rust) is the only OIDC consumer in that action — nothing in the job can use the grant, so it only widened what its dependency code (turbo query) could mint.

• .github/workflows/{preflight,preflight-todo-comments,housekeeping}.yml + release.yml — bump every hashintel/.github pin from 8c1a3b1 to b7a5d7f651c1d6a862d5dd97aa6164125bedb6c5, the merge commit of SRE-904: Split token minting from the Renovate run .github#99. The bump crosses only Include messages within json_state output #98 (Renovate 43.288.0) and Fix behavior execution for Javascript runners #99 (the mint split); all referenced reusable workflows and the github-app-token action exist unchanged at the new pin.

• .github/workflows/housekeeping.yml — pass RENOVATE_TOKEN_ENC_KEY through to the reusable workflow, which now requires it for the same encrypted job-boundary handoff.

• .github/actions/{encrypt-secret,decrypt-secret,mint-sccache-credentials} (new) — the handoff as dedicated composite actions (plain bash + openssl; every plaintext line is masked before it is output), consumed via new install-tools/install-sccache inputs. This is the only route: install-sccache no longer talks to Vault, and every sccache consumer — release, lint.yml, test.yml, bench.yml, codspeed.yml, canary-release.yml, and deploy.yml's sourcemaps job — mints the bundle in a per-workflow sccache-credentials job (contents: read + id-token: write, no dependency code). Jobs whose id-token grant was sccache-only (lint's package/global, test's unit-tests/integration-tests, canary's publish job) drop it; bench, codspeed, and deploy-sourcemaps keep theirs solely for their other OIDC uses (legacy-Vault AWS upload credentials, CodSpeed's own auth, the Sentry token mint). The dead grants and unused Vault inputs on the rust-less setup jobs are gone. On fork PRs the CF secret is empty, so the fetch is skipped and consumers run uncached, as before.

• .github/workflows/canary-release.yml — its only OIDC consumer was the sccache fetch, so the publish job now consumes the handoff and holds no id-token at all; the workflow-level grant moved into its sccache-credentials job.

Deliberately not changed:

• publish-blocks-to-preview.yml was in scope (two sccache-only id-token grants alongside yarn build + unpinned npx blockprotocol@latest), but SRE-908: Delete the block-publishing workflows #9187 deleted both block-publishing workflows before this PR — nothing left to fix.
• No changes to the ds-helpers publish ordering or any publish-verification steps — separate workstream.

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

This PR:

• does not modify any publishable blocks or libraries, or modifications do not need publishing

📜 Does this require a change to the docs?

The changes in this PR:

• are internal and do not require a docs change

🕸️ Does this require a change to the Turbo Graph?

The changes in this PR:

• do not affect the execution graph

⚠️ Known issues

• The split does not protect the installation token itself — the publish step needs it, so dependency code in the release job can still read it. The same goes for the sccache R2 credentials it is handed (as in every Rust CI job). What the split removes is the ability to mint: fresh App JWTs signed in Vault, or any other role reachable with a fresh OIDC token.
• If npm trusted publishing (SRE-768 follow-up) later replaces NPM_TOKEN, the release job will need id-token: write back for the npm exchange — that use is inseparable from the publish step. The Vault/App-token mint should stay in mint-token regardless.

🐾 Next steps

• Consider the same split for deploy.yml's sourcemaps job's remaining OIDC use (the Sentry token mint alongside dependency code — its sccache fetch already moved out); lower value, tracked separately.

🛡 What tests cover this?

• None automated beyond workflow linting (actionlint on all five changed files; the only findings are the pre-existing queue: keys actionlint's schema does not know). Release workflows are only exercised by a real push to main.

❓ How to test this?

1. After creating the secrets, merge and watch the next main push: mint-token should complete in seconds and output only ciphertext; release should decrypt, mask, and proceed through changesets exactly as before.
2. Confirm the run's release job shows no id-token in its permissions block and that sccache still starts, from the handed-over credentials. Same check for lint's and test's Rust jobs.
3. Housekeeping: confirm the next scheduled run dispatches (the RENOVATE_TOKEN_ENC_KEY secret already exists; the requirement would fail fast at dispatch if it were missing).

📹 Demo

Not applicable (CI-only change).

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hash	Ready	Preview	Aug 11, 2026 12:35pm
hashdotdesign-tokens	Ready	Preview	Aug 11, 2026 12:35pm
petrinaut	Ready	Preview	Aug 11, 2026 12:35pm

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 59.63%. Comparing base (5253e33) to head (4191fe7).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9192      +/-   ##
==========================================
- Coverage   59.63%   59.63%   -0.01%     
==========================================
  Files        1420     1420              
  Lines      138767   138767              
  Branches     6555     6555              
==========================================
- Hits        82755    82754       -1     
- Misses      54948    54949       +1     
  Partials     1064     1064              

Flag	Coverage Δ
apps.hash-ai-worker-ts	1.99% <ø> (ø)
apps.hash-api	14.00% <ø> (ø)
blockprotocol.type-system	40.84% <ø> (ø)
local.claude-hooks	0.00% <ø> (ø)
local.harpc-client	51.49% <ø> (ø)
local.hash-backend-utils	3.27% <ø> (ø)
local.hash-graph-sdk	10.02% <ø> (ø)
local.hash-isomorphic-utils	12.22% <ø> (ø)
rust.antsi	2.36% <ø> (ø)
rust.error-stack	90.81% <ø> (ø)
rust.harpc-codec	84.70% <ø> (ø)
rust.harpc-net	96.23% <ø> (-0.02%)	⬇️
rust.harpc-tower	67.03% <ø> (ø)
rust.harpc-types	0.00% <ø> (ø)
rust.harpc-wire-protocol	92.23% <ø> (ø)
rust.hash-codec	72.76% <ø> (ø)
rust.hash-graph-api	7.36% <ø> (ø)
rust.hash-graph-authorization	62.59% <ø> (ø)
rust.hash-graph-embeddings	91.88% <ø> (ø)
rust.hash-graph-postgres-store	29.33% <ø> (ø)
rust.hash-graph-store	46.78% <ø> (ø)
rust.hash-graph-temporal-versioning	47.95% <ø> (ø)
rust.hash-graph-types	0.00% <ø> (ø)
rust.hash-graph-validation	84.71% <ø> (ø)
rust.hashql-ast	89.63% <ø> (ø)
rust.hashql-compiletest	28.39% <ø> (ø)
rust.hashql-core	78.98% <ø> (ø)
rust.hashql-diagnostics	72.51% <ø> (ø)
rust.hashql-eval	79.82% <ø> (ø)
rust.hashql-hir	89.09% <ø> (ø)
rust.hashql-mir	87.92% <ø> (ø)
rust.hashql-syntax-jexpr	94.04% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[codspeed-hq]

Merging this PR will not alter performance

✅ 98 untouched benchmarks

---

_{Comparing sre-904/release-oidc-split (4191fe7) with main (5253e33)}

[cursor]

PR Summary

High Risk
Changes authentication boundaries for release and all Rust CI (Vault OIDC, encrypted credential handoff, and new required secrets); misconfiguration or a bug in encrypt/decrypt would break builds or widen secret exposure.

Overview
This PR narrows CI supply-chain exposure by moving Vault/OIDC minting out of jobs that run dependency code, and passing secrets across job boundaries as AES-256-CBC ciphertext instead of plaintext outputs.

New composite actions (encrypt-secret, decrypt-secret, mint-sccache-credentials) bundle sccache R2 credentials from Vault, encrypt them, and decrypt with line-by-line ::add-mask:: before use. install-sccache no longer calls Vault; it only decrypts the handed-off JSON. install-tools now takes encrypted_sccache_credentials + sccache_encryption_key instead of Vault/Cloudflare Access inputs.

release.yml is split: mint-token keeps id-token: write, mints the GitHub App token and sccache creds, and exports encrypted outputs; release drops OIDC, decrypts the app token right after checkout, then runs changesets as before.

Lint, test, bench, codspeed, deploy (sourcemaps), and canary-release each gain a dedicated sccache-credentials job; Rust install steps consume the encrypted bundle. Jobs whose only OIDC use was sccache lose id-token: write where applicable; setup jobs that only run turbo query drop unused OIDC. Gate jobs (passed) now assert the credentials job succeeded.

Housekeeping bumps the hashintel/.github pin and passes RENOVATE_TOKEN_ENC_KEY for the same encrypted handoff pattern. Merge depends on repo secrets SCCACHE_ENC_KEY and RELEASE_TOKEN_ENC_KEY.

^{Reviewed by Cursor Bugbot for commit 4191fe7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f720252. Configure here.}

[github-actions]

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2002	$$28.6 \mathrm{ms} \pm 228 \mathrm{μs}\left({\color{gray}0.302 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$3.64 \mathrm{ms} \pm 26.3 \mathrm{μs}\left({\color{gray}3.60 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 1002	$$14.1 \mathrm{ms} \pm 96.8 \mathrm{μs}\left({\color{red}7.13 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 3314	$$45.5 \mathrm{ms} \pm 468 \mathrm{μs}\left({\color{gray}2.12 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$15.4 \mathrm{ms} \pm 111 \mathrm{μs}\left({\color{gray}1.25 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 1527	$$26.0 \mathrm{ms} \pm 258 \mathrm{μs}\left({\color{gray}4.13 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 2078	$$29.8 \mathrm{ms} \pm 215 \mathrm{μs}\left({\color{gray}3.24 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.99 \mathrm{ms} \pm 27.5 \mathrm{μs}\left({\color{red}6.10 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 1033	$$15.1 \mathrm{ms} \pm 95.8 \mathrm{μs}\left({\color{red}13.2 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_medium

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 102	$$4.02 \mathrm{ms} \pm 34.5 \mathrm{μs}\left({\color{gray}2.60 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$3.05 \mathrm{ms} \pm 16.3 \mathrm{μs}\left({\color{gray}-2.253 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 52	$$3.54 \mathrm{ms} \pm 20.6 \mathrm{μs}\left({\color{gray}0.549 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 269	$$5.42 \mathrm{ms} \pm 50.1 \mathrm{μs}\left({\color{gray}1.70 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$3.70 \mathrm{ms} \pm 23.0 \mathrm{μs}\left({\color{gray}0.993 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 108	$$4.25 \mathrm{ms} \pm 31.8 \mathrm{μs}\left({\color{gray}-0.082 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 133	$$4.56 \mathrm{ms} \pm 34.1 \mathrm{μs}\left({\color{gray}-0.526 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.54 \mathrm{ms} \pm 21.4 \mathrm{μs}\left({\color{gray}-0.244 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 63	$$4.15 \mathrm{ms} \pm 29.4 \mathrm{μs}\left({\color{gray}-1.673 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_none

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2	$$2.65 \mathrm{ms} \pm 16.0 \mathrm{μs}\left({\color{gray}1.45 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.57 \mathrm{ms} \pm 19.3 \mathrm{μs}\left({\color{gray}1.54 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 2	$$2.63 \mathrm{ms} \pm 15.8 \mathrm{μs}\left({\color{gray}0.801 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 8	$$2.90 \mathrm{ms} \pm 18.6 \mathrm{μs}\left({\color{gray}-1.779 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.71 \mathrm{ms} \pm 16.3 \mathrm{μs}\left({\color{gray}-0.505 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 3	$$2.94 \mathrm{ms} \pm 20.6 \mathrm{μs}\left({\color{gray}1.22 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_small

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 52	$$3.15 \mathrm{ms} \pm 23.5 \mathrm{μs}\left({\color{gray}0.164 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.86 \mathrm{ms} \pm 19.4 \mathrm{μs}\left({\color{gray}2.63 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 26	$$3.18 \mathrm{ms} \pm 25.1 \mathrm{μs}\left({\color{gray}3.93 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 94	$$3.58 \mathrm{ms} \pm 26.7 \mathrm{μs}\left({\color{gray}2.08 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$3.03 \mathrm{ms} \pm 24.4 \mathrm{μs}\left({\color{gray}-0.885 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 27	$$3.37 \mathrm{ms} \pm 22.8 \mathrm{μs}\left({\color{gray}0.628 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 66	$$3.46 \mathrm{ms} \pm 23.1 \mathrm{μs}\left({\color{gray}-1.185 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.10 \mathrm{ms} \pm 19.6 \mathrm{μs}\left({\color{gray}2.51 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 29	$$3.44 \mathrm{ms} \pm 24.3 \mathrm{μs}\left({\color{gray}-1.007 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_complete

Function	Value	Mean	Flame graphs
entity_by_id;one_depth	1 entities	$$46.0 \mathrm{ms} \pm 333 \mathrm{μs}\left({\color{gray}3.62 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	10 entities	$$35.1 \mathrm{ms} \pm 233 \mathrm{μs}\left({\color{gray}-0.789 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	25 entities	$$38.2 \mathrm{ms} \pm 278 \mathrm{μs}\left({\color{gray}-0.024 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	5 entities	$$33.8 \mathrm{ms} \pm 201 \mathrm{μs}\left({\color{gray}1.17 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	50 entities	$$45.8 \mathrm{ms} \pm 270 \mathrm{μs}\left({\color{gray}1.55 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	1 entities	$$52.7 \mathrm{ms} \pm 417 \mathrm{μs}\left({\color{gray}0.669 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	10 entities	$$42.4 \mathrm{ms} \pm 276 \mathrm{μs}\left({\color{gray}-0.796 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	25 entities	$$96.1 \mathrm{ms} \pm 623 \mathrm{μs}\left({\color{gray}-1.075 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	5 entities	$$35.3 \mathrm{ms} \pm 189 \mathrm{μs}\left({\color{gray}-2.721 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	50 entities	$$285 \mathrm{ms} \pm 1.18 \mathrm{ms}\left({\color{gray}-1.500 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	1 entities	$$11.8 \mathrm{ms} \pm 89.7 \mathrm{μs}\left({\color{gray}0.476 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	10 entities	$$11.9 \mathrm{ms} \pm 62.1 \mathrm{μs}\left({\color{gray}2.69 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	25 entities	$$12.0 \mathrm{ms} \pm 102 \mathrm{μs}\left({\color{gray}-0.501 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	5 entities	$$11.9 \mathrm{ms} \pm 77.5 \mathrm{μs}\left({\color{gray}3.40 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	50 entities	$$11.4 \mathrm{ms} \pm 63.4 \mathrm{μs}\left({\color{gray}-3.562 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_linkless

Function	Value	Mean	Flame graphs
entity_by_id	1 entities	$$11.4 \mathrm{ms} \pm 65.5 \mathrm{μs}\left({\color{gray}-4.692 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10 entities	$$11.5 \mathrm{ms} \pm 63.4 \mathrm{μs}\left({\color{lightgreen}-5.795 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	100 entities	$$11.8 \mathrm{ms} \pm 78.7 \mathrm{μs}\left({\color{gray}-2.496 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	1000 entities	$$11.9 \mathrm{ms} \pm 74.4 \mathrm{μs}\left({\color{lightgreen}-5.806 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10000 entities	$$12.0 \mathrm{ms} \pm 74.4 \mathrm{μs}\left({\color{gray}-3.286 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity

Function	Value	Mean	Flame graphs
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/block/v/1	$$12.4 \mathrm{ms} \pm 65.2 \mathrm{μs}\left({\color{gray}2.02 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/book/v/1	$$12.4 \mathrm{ms} \pm 73.2 \mathrm{μs}\left({\color{gray}1.09 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/building/v/1	$$12.3 \mathrm{ms} \pm 72.2 \mathrm{μs}\left({\color{gray}0.157 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/organization/v/1	$$12.2 \mathrm{ms} \pm 84.2 \mathrm{μs}\left({\color{gray}-0.294 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/page/v/2	$$12.2 \mathrm{ms} \pm 68.3 \mathrm{μs}\left({\color{gray}-0.205 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/person/v/1	$$12.2 \mathrm{ms} \pm 70.3 \mathrm{μs}\left({\color{gray}-1.474 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/playlist/v/1	$$12.3 \mathrm{ms} \pm 80.5 \mathrm{μs}\left({\color{gray}2.90 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/song/v/1	$$12.2 \mathrm{ms} \pm 71.7 \mathrm{μs}\left({\color{gray}1.78 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/uk-address/v/1	$$12.3 \mathrm{ms} \pm 92.0 \mathrm{μs}\left({\color{gray}0.894 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity_type

Function	Value	Mean	Flame graphs
get_entity_type_by_id	Account ID: bf5a9ef5-dc3b-43cf-a291-6210c0321eba	$$9.11 \mathrm{ms} \pm 58.3 \mathrm{μs}\left({\color{gray}2.13 \mathrm{\%}}\right) $$	Flame Graph

representative_read_multiple_entities

Function	Value	Mean	Flame graphs
entity_by_property	traversal_paths=0	0	$$63.3 \mathrm{ms} \pm 402 \mathrm{μs}\left({\color{gray}0.745 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$118 \mathrm{ms} \pm 680 \mathrm{μs}\left({\color{gray}1.95 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$71.7 \mathrm{ms} \pm 608 \mathrm{μs}\left({\color{gray}1.71 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$80.7 \mathrm{ms} \pm 506 \mathrm{μs}\left({\color{gray}0.816 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$90.0 \mathrm{ms} \pm 535 \mathrm{μs}\left({\color{gray}0.886 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$96.9 \mathrm{ms} \pm 483 \mathrm{μs}\left({\color{gray}1.53 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=0	0	$$47.3 \mathrm{ms} \pm 270 \mathrm{μs}\left({\color{gray}1.75 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$75.9 \mathrm{ms} \pm 549 \mathrm{μs}\left({\color{gray}1.47 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$53.6 \mathrm{ms} \pm 390 \mathrm{μs}\left({\color{gray}1.61 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$63.6 \mathrm{ms} \pm 466 \mathrm{μs}\left({\color{gray}1.65 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$65.1 \mathrm{ms} \pm 462 \mathrm{μs}\left({\color{gray}0.904 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$65.2 \mathrm{ms} \pm 401 \mathrm{μs}\left({\color{gray}-1.602 \mathrm{\%}}\right) $$

scenarios

Function	Value	Mean	Flame graphs
full_test	query-limited	$$119 \mathrm{ms} \pm 623 \mathrm{μs}\left({\color{gray}-0.777 \mathrm{\%}}\right) $$	Flame Graph
full_test	query-unlimited	$$130 \mathrm{ms} \pm 776 \mathrm{μs}\left({\color{gray}-2.094 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-limited	$$25.1 \mathrm{ms} \pm 201 \mathrm{μs}\left({\color{red}29.8 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-unlimited	$$509 \mathrm{ms} \pm 1.22 \mathrm{ms}\left({\color{lightgreen}-5.590 \mathrm{\%}}\right) $$	Flame Graph