CodSpeed CI check auth failing on every run since at least 2026-07-11

[defangdevs]

What I found

The CodSpeed workflow on this repo has failed on every single run going back to at least 2026-07-11 (15+ consecutive runs checked, all failure). Latest at time of filing: https://github.com/DefangLabs/simple-agent-manager/actions/runs/33982812694

Failure is always the same:

Failed to retrieve upload data: 401 Unauthorized
Reason: Repository not found or the user does not have access to it.

Root cause (likely)

.github/workflows/codspeed.yml uses CodSpeedHQ/action@v5 with OIDC (id-token: write) and no token: input. That mode needs the CodSpeed GitHub App installed/authorized for this repo on codspeed.io, or a CODSPEED_TOKEN repo secret. Checked: repo has zero Actions secrets configured, so it's relying on OIDC — and that trust relationship on codspeed.io's side doesn't seem to be set up (or the repo isn't connected there at all).

Why I'm not fixing this myself

This needs an action on the codspeed.io dashboard (connecting/authorizing the repo under the DefangLabs org, or generating a project token) — I don't have access to that account.

What's needed (pick one)

• Log into codspeed.io as a DefangLabs org owner and connect/authorize simple-agent-manager, OR
• Generate a CodSpeed project token there and add it as repo secret CODSPEED_TOKEN (I can add the secret via gh once you hand me the value — no need to touch GitHub UI for that part)
• Alternative: if benchmarking isn't actually wanted right now, disable/remove .github/workflows/codspeed.yml to stop the noise

Note

Not currently blocking merges — no required-status-check ruleset covers it — but it's been silently red on every push to main for ~8 weeks.

History

Originally tracked at defangdevs/nixos-defang-ca#26 (filed there because Issues were off in this repo). Moved here now that Issues are enabled. Recurrences logged there: 2026-08-27 (push to main), 2026-09-05 (PR #45, run 33975929515 and again run 33982812694).

[defangdevs]

Recurred again: 2026-09-16, push to main (raphaeltm#2088), run https://github.com/DefangLabs/simple-agent-manager/actions/runs/35141646033. Same 401/repo-not-connected failure. Still needs the codspeed.io dashboard action described above.

[defangdevs]

Recurrence: 2026-09-21 (push to main, merge of PR raphaeltm#2118, run 35624483423). Same failure as always — still needs the codspeed.io-side fix described above.

[defangdevs]

Recurrence: 2026-09-25 (push to main, merge of PR raphaeltm#2148), run https://github.com/DefangLabs/simple-agent-manager/actions/runs/36202689096. Same 401/repo-not-connected failure. Still needs the codspeed.io dashboard action described above.

[defangdevs]

Recurrence: 2026-09-25, run 36202875069 on dependabot/npm_and_yarn/hono-4.13.5. Same 401 Unauthorized — Repository not found or the user does not have access to it on upload. Still needs the codspeed.io dashboard fix described above.

[defangdevs]

Recurrence: 2026-10-03, run 37092766768 (push to main). Same 401 Unauthorized — Repository not found or the user does not have access to it from CodSpeedHQ/action@v5. Still waiting on the codspeed.io dashboard fix described above.

[defangdevs]

Recurrence: 2026-10-03, run 37092879581 on dependabot/npm_and_yarn/hono-4.13.7 (PR #52). Same 401 Unauthorized — Repository not found or the user does not have access to it from CodSpeedHQ/action@v5. All other PR #52 checks are passing/pending normally — still waiting on the codspeed.io dashboard fix described above.

[defangdevs]

Another recurrence: CodSpeed failed with the same 401 on two dependabot branches today (2026-10-02) — dependabot/npm_and_yarn/dompurify-3.4.16 (run 37092904378) and dependabot/npm_and_yarn/vitest-4.1.11 (run 37092917849). Same root cause as above, no action taken — still needs the codspeed.io dashboard fix.