ci: add default branch checks and codspeed benchmark

[makoMakoGo]

What changed

• Add an always-run Core CI workflow for PRs targeting personal/local-clients.
• Add a CodSpeed workflow and a small Rust normalization benchmark for initial advisory performance reporting.
• Include personal/local-clients in existing CI workflow branch filters and replace hardcoded main coverage badge conditions with the repository default branch.
• Make pricing command tests use fixture pricing caches instead of leaking to live network/cache state.

Why

This prepares the self-maintained fork default branch for ruleset protection and CodSpeed without blocking normal solo-maintainer direct pushes. The core required check can be enabled after this workflow lands on the default branch.

Validation

• cargo fmt --all -- --check
• cargo clippy --locked --workspace --all-features -- -D warnings
• cargo test --locked --workspace --all-features
• cargo bench --locked -p tokscale-core --bench normalization -- --test

---

Summary by cubic

Add Core CI for PRs targeting personal/local-clients, add CodSpeed benchmarks (simulation) for normalization and JSON/JSONL parsing, and restrict coverage to default-branch, non-PR runs with artifacts only. Actions are pinned to SHAs, pricing CLI tests are stabilized, and core dev-dependencies are centralized.

• New Features

  • Core CI for PRs to personal/local-clients.
  • CodSpeed workflow with codspeed-criterion-compat benches for normalization and JSON/JSONL parsing; bench profile optimized for CI; CodSpeed badge in README.
  • CI workflows include personal/local-clients in branch filters; Actions pinned to SHAs; core dev-dependencies centralized.

• Bug Fixes

  • Pricing command tests use local fixture caches and a temp HOME to avoid flakiness.
  • Fixed cargo cache/install conflict in the CodSpeed job.
  • Coverage: only on non-PR runs on the repository default branch with read-only permissions; removed badge generation/extraction and commits; artifacts only.

^{Written for commit 4cedffd. Summary will update on new commits.}

Summary by CodeRabbit

• Chores
  • 新增 CodSpeed 性能测试工作流，并完善 Core CI 与代码覆盖率流程
  • 扩展多套 CI 工作流的触发分支范围，且将关键构建步骤固定到可复现的版本
  • 调整基准构建与运行配置（如 bench 构建选项与相关依赖）
• Tests
  • 新增核心归一化/解析相关基准测试
  • 改进定价相关 CLI 测试：统一使用隔离的临时 HOME 与定价夹具环境
• Documentation
  • README 增加 CodSpeed 指标徽标展示

[coderabbitai]

Walkthrough

在 personal/local-clients 分支新增 CodSpeed 基准 CI 工作流与 Core CI 工作流，将该分支纳入 frontend_ci、launcher_validation、test_coverage 现有工作流触发范围，test_coverage 将硬编码分支条件改为动态默认分支判断，并为 tokscale-core 新增归一化与核心性能基准测试，修复定价 CLI 测试隔离。

Changes

CI 工作流扩展与基准测试接入

Layer / File(s)	Summary
CI 工作流分支扩展与动态条件优化 .github/workflows/frontend_ci.yml, .github/workflows/launcher_validation.yml, .github/workflows/test_coverage.yml	将 frontend_ci、launcher_validation 和 test_coverage 的 push/pull_request 触发分支扩展为包含 personal/local-clients；所有涉及的 action 引用升级为固定 commit hash；test_coverage 工作流将硬编码的 refs/heads/main 执行条件改为基于 github.event.repository.default_branch 的动态判断，并调整覆盖率测试命令增加 --locked 标志。
新增 Core CI 工作流 .github/workflows/core_ci.yml	新增完整 Core CI 工作流，在 personal/local-clients PR 与手动触发时依次执行 cargo fmt、cargo clippy（-D warnings）及 cargo test，包含 Cargo registry 与 target/ 缓存配置。
工作区基准依赖与构建配置 Cargo.toml, crates/tokscale-core/Cargo.toml	在工作区 Cargo.toml 引入 codspeed-criterion-compat = "4.7.0"、tempfile 与 serial_test，新增 [profile.bench] 配置（lto=false, opt-level=3, codegen-units=16）；在 tokscale-core/Cargo.toml 注册 normalization 与 core_benchmarks 基准条目（harness=false）并调整开发依赖为 workspace 版本。
归一化基准实现 crates/tokscale-core/benches/normalization.rs	实现 normalize_models 与 normalize_providers 两个 Criterion 基准，分别对固定的模型与提供方标识符列表逐项调用对应的归一化函数，包含混合批次与单项输入基准，通过 black_box 防止编译器优化。
核心性能基准实现 crates/tokscale-core/benches/core_benchmarks.rs	实现 JSON 与 JSONL 文件解析基准，通过 bench_parse_jsonl 测试 100/1000/5000 行规模的解析性能，通过 bench_parse_json 测试 1000 个对象的 JSON 数组反序列化性能，配合 BenchMessage 结构体与 make_jsonl 辅助函数。
CodSpeed 基准 CI 工作流 .github/workflows/codspeed.yml	新增 codspeed.yml：在 personal/local-clients 分支且特定文件变更时触发，配置最小权限、Cargo 缓存（基于 Cargo.lock 哈希），安装锁定版 cargo-codspeed 4.7.0，执行 cargo codspeed build，并以 simulation 模式通过固定 SHA 的 CodSpeedHQ/action 运行基准。
定价 CLI 测试隔离改造 crates/tokscale-cli/tests/cli_tests.rs	新增 create_pricing_fixture_dir() 辅助函数，将 test_pricing_command_success、test_pricing_command_json、test_pricing_command_with_provider、test_pricing_command_invalid_provider 四个测试改为通过 cmd_with_home(tmp.path()) 在隔离临时 HOME 目录下执行命令。
文档徽标更新 README.md	在 README 顶部徽标集合中新增 CodSpeed 指标展示徽标。

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Poem

🐇 小兔蹦蹦跳，流水线来报到，
基准跑一跑，性能有数了，
分支加一加，测试不再闹，
black_box 挡住优化刀，
CI 绿灯亮，代码质量好！✅

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The PR title accurately summarizes the main changes: adding default branch checks in CI workflows and introducing CodSpeed benchmark integration.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/default-branch-ci-codspeed

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[makoMakoGo]

/juya review

[juya-review-bot]

OpenCodeReview found 2 issue(s).

[coderabbitai]

Actionable comments posted: 5

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/codspeed.yml:
- Line 35: Replace the mutable version tags in the Action references with
complete commit SHAs to prevent supply chain drift. On line 35, change the
`actions/checkout@v5` reference to pin it to a full commit SHA in the format
`actions/checkout@<complete-commit-sha>`. Apply the same fix to the other
mutable tag references on lines 38 and 41 (which use `@v5` and `@stable`), replacing
them with their corresponding full commit SHAs. Use the example format shown on
line 60 as a reference for the correct SHA format structure.
- Around line 34-36: The actions/checkout@v5 step in the Checkout repository
task does not explicitly disable credential persistence. Add a with section to
the checkout action and set persist-credentials to false to follow the principle
of least privilege and prevent the GITHUB_TOKEN from being unnecessarily
persisted in the local git configuration.

In @.github/workflows/core_ci.yml:
- Around line 20-21: The checkout action in the "Checkout repository" step is
not explicitly disabling credential persistence, which increases the token
leakage risk since this job does not perform any git push operations. Add a
`with:` section to the actions/checkout@v5 action with `persist-credentials:
false` to explicitly disable credential persistence and reduce the security
attack surface.
- Line 21: Pin third-party GitHub Actions to immutable commit SHAs instead of
mutable version references to reduce supply chain risk. In the core_ci.yml
workflow file, update three Action uses: replace `actions/checkout@v5` with its
corresponding commit SHA, replace `dtolnay/rust-toolchain@stable` with its
commit SHA, and replace `actions/cache@v5` with its commit SHA. Each Action
reference should use the full commit hash format (e.g.,
`owner/action@abc123def456...`) instead of version tags or branch names, and
consider setting up Dependabot to automatically keep these pinned versions
updated.

In @.github/workflows/test_coverage.yml:
- Line 102: The `uses` reference for taiki-e/install-action is pinned to a
mutable tag (cargo-tarpaulin) instead of a specific commit SHA, which poses a
supply chain security risk. Replace the tag-based reference with a full commit
SHA to ensure the Action version is immutable and cannot be tampered with or
compromised if the upstream account is attacked. Find the line using
taiki-e/install-action@cargo-tarpaulin and update it to reference a complete
commit SHA instead of the tag version.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: a84bbc15-6884-4264-975e-82b2fb434aec

📥 Commits

Reviewing files that changed from the base of the PR and between 2b8ffbd and 5e5212c.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (8)

• .github/workflows/codspeed.yml
• .github/workflows/core_ci.yml
• .github/workflows/frontend_ci.yml
• .github/workflows/launcher_validation.yml
• .github/workflows/test_coverage.yml
• crates/tokscale-cli/tests/cli_tests.rs
• crates/tokscale-core/Cargo.toml
• crates/tokscale-core/benches/normalization.rs

[codspeed-hq]

Congrats! CodSpeed is installed 🎉

🆕 18 new benchmarks were detected.

You will start to see performance impacts in the reports once the benchmarks are run from your default branch.

Detected benchmarks

• mixed_batch: 12.5 µs
• normalize_model_for_grouping[claude_anthropic_date]: 7.3 µs
• normalize_model_for_grouping[gpt_custom_tier]: 6.5 µs
• normalize_model_for_grouping[kimi_free_tier]: 5 µs
• normalize_model_for_grouping[longcat_quantized]: 4.3 µs
• normalize_model_for_grouping[qwen_openrouter_free]: 4.7 µs
• normalize_model_for_grouping[unknown_fast_suffix]: 5 µs
• mixed_batch: 18.4 µs
• normalize_provider_for_grouping[anthropic_provider_path]: 8.5 µs
• normalize_provider_for_grouping[github_copilot_provider]: 5 µs
• normalize_provider_for_grouping[kimi_provider_path]: 4.3 µs
• normalize_provider_for_grouping[openai_codex_provider]: 9 µs
• normalize_provider_for_grouping[opencode_openrouter_path]: 9.1 µs
• normalize_provider_for_grouping[zai_provider_alias]: 8.5 µs
• parse_json_file_userspace/1000_objects: 1.4 ms
• parse_jsonl_file_userspace[100]: 219.8 µs
• parse_jsonl_file_userspace[1000]: 2.2 ms
• parse_jsonl_file_userspace[5000]: 11.1 ms

---

[cubic-dev-ai]

No issues found across 9 files

_{Re-trigger cubic}