fix(bench): pin composer binary and work around HTTP/3 slowdown

Benchmarks were comparing against whatever composer happened to be on
PATH instead of the pinned submodule version, and paid the HTTP/3
fallback penalty from composer/composer#12987 on every packagist
request.

4 files changed, 33 insertions, 3 deletions

diff --git a/scripts/bench/create-project.sh b/scripts/bench/create-project.sh
index 74d183bf..eebc5f0a 100755
--- a/scripts/bench/create-project.sh
+++ b/scripts/bench/create-project.sh
@@ -4,6 +4,9 @@ set -euo pipefail
 
 REPO_ROOT="$(git -C "$(dirname "${BASH_SOURCE[0]}")" rev-parse --show-toplevel)"
 BIN="$REPO_ROOT/target/release/shirabe"
+COMPOSER_BIN="$REPO_ROOT/composer/bin/composer"
+
+source "$REPO_ROOT/scripts/bench/lib.sh"
 
 PACKAGE="laravel/laravel"
 for arg in "$@"; do
@@ -20,6 +23,8 @@ fi
 
 cargo build --manifest-path "$REPO_ROOT/Cargo.toml" --release --bin shirabe
 
+apply_http3_workaround
+
 OUTDIR="${TMPDIR:-/tmp}/shirabe-bench-create-project-$$"
 mkdir -p "$OUTDIR"
 cd "$OUTDIR"
@@ -34,7 +39,7 @@ hyperfine \
   --export-markdown "$OUTDIR/results-$PACKAGE_SLUG.md" \
   --show-output \
   --command-name Shirabe "RUST_BACKTRACE=1 '$BIN' create-project --profile --no-plugins --no-scripts --no-audit '$PACKAGE' '$TARGET_DIR-shirabe'" \
-  --command-name Composer "composer create-project --profile --no-plugins --no-scripts --no-audit '$PACKAGE' '$TARGET_DIR-composer'"
+  --command-name Composer "'$COMPOSER_BIN' create-project --profile --no-plugins --no-scripts --no-audit '$PACKAGE' '$TARGET_DIR-composer'"
 
 echo ">> results: $OUTDIR/results-$PACKAGE_SLUG.json" >&2
 echo ">>          $OUTDIR/results-$PACKAGE_SLUG.md" >&2
diff --git a/scripts/bench/disable-http3.patch b/scripts/bench/disable-http3.patch
new file mode 100644
index 00000000..55e49f57
--- /dev/null
+++ b/scripts/bench/disable-http3.patch
@@ -0,0 +1,13 @@
+diff --git i/src/Composer/Util/Http/CurlDownloader.php w/src/Composer/Util/Http/CurlDownloader.php
+index 4f2fdb028..44e46d01d 100644
+--- i/src/Composer/Util/Http/CurlDownloader.php
++++ w/src/Composer/Util/Http/CurlDownloader.php
+@@ -242,7 +242,7 @@ private function initDownload(callable $resolve, callable $reject, string $origi
+         if (0 === strpos($url, 'https://')) {
+             $willUseProxy = $proxy->getStatus() !== '' && !$proxy->isExcludedByNoProxy();
+ 
+-            if (!$willUseProxy && \defined('CURL_VERSION_HTTP3') && \defined('CURL_HTTP_VERSION_3') && (CURL_VERSION_HTTP3 & $features) !== 0) {
++            if (false) {
+                 curl_setopt($curlHandle, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_3);
+             } elseif (\defined('CURL_VERSION_HTTP2') && \defined('CURL_HTTP_VERSION_2_0') && (CURL_VERSION_HTTP2 & $features) !== 0) {
+                 curl_setopt($curlHandle, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2_0);
diff --git a/scripts/bench/lib.sh b/scripts/bench/lib.sh
new file mode 100755
index 00000000..a4fa78ab
--- /dev/null
+++ b/scripts/bench/lib.sh
@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+
+# Work around https://github.com/composer/composer/issues/12987:
+apply_http3_workaround() {
+  git -C "$REPO_ROOT/composer" apply "$REPO_ROOT/scripts/bench/disable-http3.patch"
+  trap 'git -C "$REPO_ROOT/composer" restore -- src/Composer/Util/Http/CurlDownloader.php' EXIT
+}
diff --git a/scripts/bench/require.sh b/scripts/bench/require.sh
index 592e0323..0322f24f 100755
--- a/scripts/bench/require.sh
+++ b/scripts/bench/require.sh
@@ -4,6 +4,9 @@ set -euo pipefail
 
 REPO_ROOT="$(git -C "$(dirname "${BASH_SOURCE[0]}")" rev-parse --show-toplevel)"
 BIN="$REPO_ROOT/target/release/shirabe"
+COMPOSER_BIN="$REPO_ROOT/composer/bin/composer"
+
+source "$REPO_ROOT/scripts/bench/lib.sh"
 
 PACKAGE="monolog/monolog"
 for arg in "$@"; do
@@ -20,6 +23,8 @@ fi
 
 cargo build --manifest-path "$REPO_ROOT/Cargo.toml" --release --bin shirabe
 
+apply_http3_workaround
+
 OUTDIR="${TMPDIR:-/tmp}/shirabe-bench-require-$$"
 mkdir -p "$OUTDIR"
 cd "$OUTDIR"
@@ -41,8 +46,8 @@ hyperfine \
   --export-json "$OUTDIR/results-$PACKAGE_SLUG.json" \
   --export-markdown "$OUTDIR/results-$PACKAGE_SLUG.md" \
   --ignore-failure \
-  "'$BIN' require --no-install --no-audit --no-interaction --working-dir='$TARGET_DIR-shirabe' '$PACKAGE'" \
-  "composer require --no-install --no-audit --no-interaction --working-dir='$TARGET_DIR-composer' '$PACKAGE'"
+  --command-name Shirabe "RUST_BACKTRACE=1 '$BIN' require --no-install --no-audit --no-interaction --working-dir='$TARGET_DIR-shirabe' '$PACKAGE'" \
+  --command-name Composer "'$COMPOSER_BIN' require --no-install --no-audit --no-interaction --working-dir='$TARGET_DIR-composer' '$PACKAGE'"
 
 echo ">> results: $OUTDIR/results-$PACKAGE_SLUG.json" >&2
 echo ">>          $OUTDIR/results-$PACKAGE_SLUG.md" >&2