Add performance tests

.gitignore

@@ -76,6 +76,9 @@ react_on_rails/spec/dummy/**/*.res.js
 react_on_rails_pro/spec/dummy/.bsb.lock
 react_on_rails_pro/spec/dummy/**/*.res.js
 
+# Performance test results
+/bench_results
+
 # Generated by ROR FS-based Registry
 generated
 

.prettierignore

@@ -17,6 +17,7 @@ react_on_rails/spec/dummy/public
 **/.yalc/**
 **/*generated*
 *.res.js
+**/vendor
 
 # Prettier doesn't understand ERB syntax in YAML files and can damage templates
 *.yml

CHANGELOG.md

@@ -25,6 +25,10 @@ After a release, run `/update-changelog` in Claude Code to analyze commits, writ
 
 - **React Server Components Security Vulnerabilities (CVE-2025-55183, CVE-2025-55184, CVE-2025-67779)**: Upgraded React to v19.0.3 and react-on-rails-rsc to v19.0.4 to fix three critical security vulnerabilities in React Server Components. CVE-2025-55183 (CVSS 5.3) involved source code exposure when server function references were stringified, potentially leaking hardcoded secrets. CVE-2025-55184 and CVE-2025-67779 (both CVSS 7.5) involved denial of service attacks via cyclic promise references that could cause infinite loops and 100% CPU consumption. The fixes implement dual-layer cycle detection with a 1,000-iteration depth limit and override `toString()` methods on server references to return safe placeholders. Addresses [issue 2223](https://github.com/shakacode/react_on_rails/issues/2223). [PR 2233](https://github.com/shakacode/react_on_rails/pull/2233) by [AbanoubGhadban](https://github.com/AbanoubGhadban).
 
+#### Developer (Contributors Only)
+
+- **Benchmarking in CI**: A benchmark workflow will now run on all pushes to master, as well as PRs with `benchmark` or `full-ci` labels. [PR 1868](https://github.com/shakacode/react_on_rails/pull/1868) by [alexeyr-ci2](https://github.com/alexeyr-ci2)
+
 ### [16.2.0.beta.20] - 2025-12-12
 
 #### Fixed

CLAUDE.md

@@ -157,6 +157,8 @@ Pre-commit hooks automatically run:
   - All linters: `rake lint` (runs ESLint and RuboCop)
   - ESLint only: `pnpm run lint` or `rake lint:eslint`
   - RuboCop only: `rake lint:rubocop`
+  - GitHub Action files (workflows, reusable actions, etc.): `actionlint`
+  - YAML files: `yamllint` (or validate the syntax with Ruby if it isn't installed). Do _not_ try to run RuboCop on `.yml` files.
 - **Code Formatting**:
   - Format code with Prettier: `rake autofix`
   - Check formatting without fixing: `pnpm run format.listDifferent`

CONTRIBUTING.md

@@ -590,6 +590,75 @@ Removes the `full-ci` label and returns to standard CI behavior:
 - **Force-pushes:** The `/run-skipped-ci` command adds the `full-ci` label to your PR. If you force-push after commenting, the initial workflow run will test the old commit, but subsequent pushes will automatically run full CI because the label persists.
 - **Branch operations:** Avoid deleting or force-pushing branches while workflows are running, as this may cause failures.
 
+### Benchmarking
+
+React on Rails includes a performance benchmark workflow that measures RPS (requests per second) and latency for both Core and Pro versions.
+
+#### When Benchmarks Run
+
+- **Automatically on master**: Benchmarks run on every push to master
+- **On PRs with labels**: Add the `benchmark` or `full-ci` label to your PR to run benchmarks
+- **Manual trigger**: Use `gh workflow run` to run benchmarks with custom parameters (see [https://github.com/cli/cli#installation](https://github.com/cli/cli#installation) if you don't have `gh`):
+
+  ```bash
+  # Run with default parameters
+  gh workflow run benchmark.yml
+
+  # Run with custom parameters
+  gh workflow run benchmark.yml \
+    -f rate=100 \
+    -f duration=60s \
+    -f connections=20 \
+    -f app_version=core_only
+  ```
+
+#### Regression Detection
+
+When benchmarks run, the [github-action-benchmark](https://github.com/benchmark-action/github-action-benchmark) action compares results against historical data. If performance regresses by more than 50%, the workflow will:
+
+1. **Fail the CI check** with `fail-on-alert: true`
+2. **Post a comment on the PR** explaining the regression
+3. **Tag reviewers** for attention
+
+This helps catch performance regressions before they reach production.
+
+#### Running Benchmarks Locally
+
+**Prerequisites:** Install [k6](https://k6.io/docs/get-started/installation/) and [Vegeta](https://github.com/tsenart/vegeta#install).
+
+You can also run the server in a separate terminal instead of backgrounding it.
+
+**Core benchmarks:**
+
+```bash
+cd react_on_rails/spec/dummy
+bin/prod-assets  # Build production assets
+bin/prod &       # Start production server on port 3001
+SERVER_PID=$!
+cd ../..
+ruby benchmarks/bench.rb
+kill $SERVER_PID
+```
+
+**Pro benchmarks:**
+
+```bash
+cd react_on_rails_pro/spec/dummy
+bin/prod-assets
+bin/prod &       # Starts Rails server and node renderer
+SERVER_PID=$!
+cd ../..
+PRO=true ruby benchmarks/bench.rb         # Rails benchmarks
+ruby benchmarks/bench-node-renderer.rb    # Node renderer benchmarks
+kill $SERVER_PID
+```
+
+**Configuration:** Both scripts support environment variables for customization (rate, duration, connections, etc.). See the script headers in [`benchmarks/bench.rb`](benchmarks/bench.rb) and [`benchmarks/bench-node-renderer.rb`](benchmarks/bench-node-renderer.rb) for available options. For debugging, you may want lower `DURATION` and/or specific `ROUTES`:
+
+```bash
+DURATION=5s ROUTES=/ ruby benchmarks/bench.rb
+```
+
 ### Install Generator
 
 In your Rails app add this gem with a path to your fork.