ci: adopt CodSpeed wizard improvements from PR #65

Pulled the integration tweaks from the codspeed-hq[bot] wizard PR
without taking its synthetic benchmarks (ours are richer — real DICOM
fixtures across .50/.51/.57/.70/.80/.81/.90/.91/.201/.5).

Changes:
- CodSpeedHQ/action@v3 → @v4
- Add OIDC auth: `permissions: id-token: write`, drop the
  `token: ${{ secrets.CODSPEED_TOKEN }}` arg. The action now
  authenticates via GitHub's OIDC provider — no secret to manage.
- Explicit `mode: simulation` on the CodSpeed step (deterministic CPU
  simulation, <1% variance, hardware-independent).
- Add `workflow_dispatch` trigger so CodSpeed can run a backtest from
  its dashboard once the repo is connected.
- Bump Node 18 → 22 in test + codspeed-bench jobs (matches the wizard's
  recommendation; our package engines are still >=18 so no impact).
- Add CodSpeed badge to README.

PR #65 can now be closed — its synthetic JS-only benches are subsumed
by ours, and these integration tweaks are now in our branch.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: sedghi

.github/workflows/pr-checks.yml

@@ -13,6 +13,9 @@ on:
   push:
     branches-ignore:
       - main
+  # workflow_dispatch lets CodSpeed trigger a backtest run from the
+  # dashboard (to seed initial perf data after the repo is connected).
+  workflow_dispatch:
 
 # Cancel in-flight runs when a new push lands on the same PR / branch.
 concurrency:
@@ -22,6 +25,7 @@ concurrency:
 permissions:
   contents: read
   pull-requests: write  # CodSpeed action posts a sticky PR comment
+  id-token: write       # OIDC token used by CodSpeedHQ/action for auth
 
 jobs:
   detect-changes:
@@ -129,7 +133,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: '18'
+          node-version: '22'
       - name: Download all built dists
         uses: actions/download-artifact@v4
         with:
@@ -168,7 +172,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: '18'
+          node-version: '22'
       - name: Download all built dists
         uses: actions/download-artifact@v4
         with:
@@ -193,11 +197,12 @@ jobs:
       - name: Install dependencies
         run: yarn install --frozen-lockfile
       - name: Run CodSpeed benchmarks
-        # CodSpeedHQ/action@v3 installs valgrind, wires up the instrumentation
-        # mode for @codspeed/vitest-plugin, runs the inner command under it,
-        # and uploads to codspeed.io. It also posts/updates a sticky PR
-        # comment with the per-bench deltas.
-        uses: CodSpeedHQ/action@v3
+        # CodSpeedHQ/action@v4 sets up CPU simulation (deterministic, <1%
+        # variance, hardware-independent), runs the inner command under
+        # valgrind, uploads to codspeed.io, and posts/updates a sticky PR
+        # comment with the per-bench deltas. Authenticates via GitHub OIDC
+        # (id-token: write above) so no CODSPEED_TOKEN secret is needed.
+        uses: CodSpeedHQ/action@v4
         with:
-          token: ${{ secrets.CODSPEED_TOKEN }}
+          mode: simulation
           run: yarn run bench

README.md

@@ -1,5 +1,7 @@
 # codecs
 
+[![CodSpeed](https://img.shields.io/endpoint?url=https://codspeed.io/badge.json)](https://codspeed.io/cornerstonejs/codecs?utm_source=badge)
+
 ## Packages
 
 This repository is maintained as a monorepo. This means that this repository, instead of containing a single project, contains many projects. If you explore our project structure, you'll see the following: