wip

controllers/actions.github.com/ephemeralrunner_controller_bench_test.go

@@ -0,0 +1,896 @@
+/*
+Copyright 2020 The actions-runner-controller authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package actionsgithubcom
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	actionsv1alpha1 "github.com/actions/actions-runner-controller/apis/actions.github.com/v1alpha1"
+	"github.com/actions/actions-runner-controller/controllers/actions.github.com/multiclient/fake"
+	"github.com/actions/actions-runner-controller/controllers/actions.github.com/secretresolver"
+	"github.com/actions/scaleset"
+	"github.com/go-logr/logr"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	ctrl "sigs.k8s.io/controller-runtime"
+	clientfake "sigs.k8s.io/controller-runtime/pkg/client/fake"
+)
+
+// BenchmarkActionsGithub_Reconcile_EphemeralRunner_NoOp benchmarks a no-op reconcile
+// scenario where an existing EphemeralRunner with finalizers requires no changes
+func BenchmarkActionsGithub_Reconcile_EphemeralRunner_NoOp(b *testing.B) {
+	ctx := context.Background()
+
+	// Setup: Create scheme and fake client
+	scheme := runtime.NewScheme()
+	_ = actionsv1alpha1.AddToScheme(scheme)
+	_ = corev1.AddToScheme(scheme)
+
+	// Create minimal EphemeralRunner with finalizers already added
+	runner := NewMinimalEphemeralRunner("default", "test-runner")
+	runner.Finalizers = []string{
+		ephemeralRunnerFinalizerName,
+		ephemeralRunnerActionsFinalizerName,
+	}
+	runner.Spec.GitHubConfigSecret = "config-secret"
+	runner.Status.RunnerID = 12345
+	runner.Status.RunnerName = "test-runner"
+
+	// Create config secret
+	configSecret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "config-secret",
+			Namespace: "default",
+		},
+		Data: map[string][]byte{
+			"github_token": []byte("test-token"),
+		},
+	}
+
+	// Create JIT secret for the runner (already exists, so no JIT creation needed)
+	jitSecret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-runner",
+			Namespace: "default",
+		},
+		Data: map[string][]byte{
+			"jitToken":   []byte("test-jit-token"),
+			"runnerId":   []byte("12345"),
+			"runnerName": []byte("test-runner"),
+		},
+	}
+
+	// Create pod (already exists, so no pod creation needed)
+	pod := &corev1.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-runner",
+			Namespace: "default",
+		},
+		Spec: corev1.PodSpec{
+			Containers: []corev1.Container{
+				{
+					Name:  "runner",
+					Image: "ghcr.io/actions/runner:latest",
+				},
+			},
+		},
+		Status: corev1.PodStatus{
+			Phase: corev1.PodRunning,
+		},
+	}
+
+	k8sClient := clientfake.NewClientBuilder().
+		WithScheme(scheme).
+		WithObjects(runner, configSecret, jitSecret, pod).
+		WithStatusSubresource(&actionsv1alpha1.EphemeralRunner{}, &corev1.Pod{}).
+		Build()
+
+	// Setup reconciler
+	multiClient := NewFakeMultiClient()
+	reconciler := &EphemeralRunnerReconciler{
+		Client: k8sClient,
+		Scheme: scheme,
+		Log:    logr.Discard(),
+		ResourceBuilder: ResourceBuilder{
+			SecretResolver: secretresolver.New(k8sClient, multiClient),
+		},
+	}
+
+	req := ctrl.Request{
+		NamespacedName: types.NamespacedName{
+			Namespace: "default",
+			Name:      "test-runner",
+		},
+	}
+
+	// Warmup iteration
+	WarmupIteration(b, func() {
+		_, _ = reconciler.Reconcile(ctx, req)
+	})
+
+	// Benchmark loop
+
+	for b.Loop() {
+		_, err := reconciler.Reconcile(ctx, req)
+		if err != nil {
+			b.Fatalf("unexpected error: %v", err)
+		}
+	}
+}
+
+// BenchmarkActionsGithub_Reconcile_EphemeralRunner_FinalizerAdd benchmarks the
+// path where finalizers are added to a new EphemeralRunner
+func BenchmarkActionsGithub_Reconcile_EphemeralRunner_FinalizerAdd(b *testing.B) {
+	ctx := context.Background()
+
+	// Setup: Create scheme
+	scheme := runtime.NewScheme()
+	_ = actionsv1alpha1.AddToScheme(scheme)
+	_ = corev1.AddToScheme(scheme)
+
+	multiClient := fake.NewMultiClient(
+		fake.WithClient(
+			fake.NewClient(
+				fake.WithGetRunner(nil, scaleset.RunnerNotFoundError),
+				fake.WithGenerateJitRunnerConfig(
+					&scaleset.RunnerScaleSetJitRunnerConfig{
+						Runner:           &scaleset.RunnerReference{ID: 1, Name: "test-runner"},
+						EncodedJITConfig: "fake-jit-config",
+					},
+					nil,
+				),
+			),
+		),
+	)
+
+	// Warmup iteration
+	{
+		runner := NewMinimalEphemeralRunner("default", "warmup-runner")
+		runner.Spec.GitHubConfigSecret = "config-secret"
+
+		configSecret := &corev1.Secret{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "config-secret",
+				Namespace: "default",
+			},
+			Data: map[string][]byte{
+				"github_token": []byte("test-token"),
+			},
+		}
+
+		k8sClient := clientfake.NewClientBuilder().
+			WithScheme(scheme).
+			WithObjects(runner, configSecret).
+			WithStatusSubresource(&actionsv1alpha1.EphemeralRunner{}).
+			Build()
+
+		reconciler := &EphemeralRunnerReconciler{
+			Client: k8sClient,
+			Scheme: scheme,
+			Log:    logr.Discard(),
+			ResourceBuilder: ResourceBuilder{
+				SecretResolver: secretresolver.New(k8sClient, multiClient),
+			},
+		}
+
+		req := ctrl.Request{
+			NamespacedName: types.NamespacedName{
+				Namespace: "default",
+				Name:      "warmup-runner",
+			},
+		}
+
+		_, _ = reconciler.Reconcile(ctx, req)
+	}
+
+	// Benchmark loop: Each iteration needs fresh objects since finalizers are added
+
+	for b.Loop() {
+		b.StopTimer()
+
+		runner := NewMinimalEphemeralRunner("default", "test-runner")
+		runner.Spec.GitHubConfigSecret = "config-secret"
+
+		configSecret := &corev1.Secret{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "config-secret",
+				Namespace: "default",
+			},
+			Data: map[string][]byte{
+				"github_token": []byte("test-token"),
+			},
+		}
+
+		k8sClient := clientfake.NewClientBuilder().
+			WithScheme(scheme).
+			WithObjects(runner, configSecret).
+			WithStatusSubresource(&actionsv1alpha1.EphemeralRunner{}).
+			Build()
+
+		reconciler := &EphemeralRunnerReconciler{
+			Client: k8sClient,
+			Scheme: scheme,
+			Log:    logr.Discard(),
+			ResourceBuilder: ResourceBuilder{
+				SecretResolver: secretresolver.New(k8sClient, multiClient),
+			},
+		}
+
+		req := ctrl.Request{
+			NamespacedName: types.NamespacedName{
+				Namespace: "default",
+				Name:      "test-runner",
+			},
+		}
+
+		b.StartTimer()
+
+		_, err := reconciler.Reconcile(ctx, req)
+		if err != nil {
+			b.Fatalf("unexpected error: %v", err)
+		}
+	}
+}
+
+// BenchmarkActionsGithub_Reconcile_EphemeralRunner_Deletion benchmarks the deletion
+// path where finalizers are removed and resources are cleaned up
+func BenchmarkActionsGithub_Reconcile_EphemeralRunner_Deletion(b *testing.B) {
+	ctx := context.Background()
+
+	// Setup: Create scheme
+	scheme := runtime.NewScheme()
+	_ = actionsv1alpha1.AddToScheme(scheme)
+	_ = corev1.AddToScheme(scheme)
+
+	multiClient := NewFakeMultiClient()
+
+	// Warmup iteration
+	{
+		now := metav1.Now()
+		runner := NewMinimalEphemeralRunner("default", "warmup-runner")
+		runner.Finalizers = []string{ephemeralRunnerFinalizerName}
+		runner.DeletionTimestamp = &now
+		runner.Spec.GitHubConfigSecret = "config-secret"
+
+		configSecret := &corev1.Secret{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "config-secret",
+				Namespace: "default",
+			},
+			Data: map[string][]byte{
+				"github_token": []byte("test-token"),
+			},
+		}
+
+		k8sClient := clientfake.NewClientBuilder().
+			WithScheme(scheme).
+			WithObjects(runner, configSecret).
+			WithStatusSubresource(&actionsv1alpha1.EphemeralRunner{}).
+			Build()
+
+		reconciler := &EphemeralRunnerReconciler{
+			Client: k8sClient,
+			Scheme: scheme,
+			Log:    logr.Discard(),
+			ResourceBuilder: ResourceBuilder{
+				SecretResolver: secretresolver.New(k8sClient, multiClient),
+			},
+		}
+
+		req := ctrl.Request{
+			NamespacedName: types.NamespacedName{
+				Namespace: "default",
+				Name:      "warmup-runner",
+			},
+		}
+
+		_, _ = reconciler.Reconcile(ctx, req)
+	}
+
+	// Benchmark loop: Each iteration needs fresh objects
+
+	for b.Loop() {
+		b.StopTimer()
+
+		now := metav1.Now()
+		runner := NewMinimalEphemeralRunner("default", "test-runner")
+		runner.Finalizers = []string{ephemeralRunnerFinalizerName}
+		runner.DeletionTimestamp = &now
+		runner.Spec.GitHubConfigSecret = "config-secret"
+
+		configSecret := &corev1.Secret{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "config-secret",
+				Namespace: "default",
+			},
+			Data: map[string][]byte{
+				"github_token": []byte("test-token"),
+			},
+		}
+
+		k8sClient := clientfake.NewClientBuilder().
+			WithScheme(scheme).
+			WithObjects(runner, configSecret).
+			WithStatusSubresource(&actionsv1alpha1.EphemeralRunner{}).
+			Build()
+
+		reconciler := &EphemeralRunnerReconciler{
+			Client: k8sClient,
+			Scheme: scheme,
+			Log:    logr.Discard(),
+			ResourceBuilder: ResourceBuilder{
+				SecretResolver: secretresolver.New(k8sClient, multiClient),
+			},
+		}
+
+		req := ctrl.Request{
+			NamespacedName: types.NamespacedName{
+				Namespace: "default",
+				Name:      "test-runner",
+			},
+		}
+
+		b.StartTimer()
+
+		_, err := reconciler.Reconcile(ctx, req)
+		if err != nil {
+			b.Fatalf("unexpected error: %v", err)
+		}
+	}
+}
+
+// BenchmarkActionsGithub_Reconcile_EphemeralRunner_DeletionWithActionsCleanup benchmarks
+// the deletion path with actions finalizer requiring service cleanup
+func BenchmarkActionsGithub_Reconcile_EphemeralRunner_DeletionWithActionsCleanup(b *testing.B) {
+	ctx := context.Background()
+
+	// Setup: Create scheme
+	scheme := runtime.NewScheme()
+	_ = actionsv1alpha1.AddToScheme(scheme)
+	_ = corev1.AddToScheme(scheme)
+
+	// Configure fake client to simulate successful cleanup
+	multiClient := fake.NewMultiClient(
+		fake.WithClient(
+			fake.NewClient(
+				fake.WithRemoveRunner(nil), // Successful cleanup
+			),
+		),
+	)
+
+	// Warmup iteration
+	{
+		now := metav1.Now()
+		runner := NewMinimalEphemeralRunner("default", "warmup-runner")
+		runner.Finalizers = []string{
+			ephemeralRunnerFinalizerName,
+			ephemeralRunnerActionsFinalizerName,
+		}
+		runner.DeletionTimestamp = &now
+		runner.Status.RunnerID = 12345
+		runner.Spec.GitHubConfigSecret = "config-secret"
+
+		configSecret := &corev1.Secret{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "config-secret",
+				Namespace: "default",
+			},
+			Data: map[string][]byte{
+				"github_token": []byte("test-token"),
+			},
+		}
+
+		k8sClient := clientfake.NewClientBuilder().
+			WithScheme(scheme).
+			WithObjects(runner, configSecret).
+			WithStatusSubresource(&actionsv1alpha1.EphemeralRunner{}).
+			Build()
+
+		reconciler := &EphemeralRunnerReconciler{
+			Client: k8sClient,
+			Scheme: scheme,
+			Log:    logr.Discard(),
+			ResourceBuilder: ResourceBuilder{
+				SecretResolver: secretresolver.New(k8sClient, multiClient),
+			},
+		}
+
+		req := ctrl.Request{
+			NamespacedName: types.NamespacedName{
+				Namespace: "default",
+				Name:      "warmup-runner",
+			},
+		}
+
+		_, _ = reconciler.Reconcile(ctx, req)
+	}
+
+	// Benchmark loop
+
+	for b.Loop() {
+		b.StopTimer()
+
+		// Create EphemeralRunner marked for deletion with both finalizers
+		now := metav1.Now()
+		runner := NewMinimalEphemeralRunner("default", "test-runner")
+		runner.Finalizers = []string{
+			ephemeralRunnerFinalizerName,
+			ephemeralRunnerActionsFinalizerName,
+		}
+		runner.DeletionTimestamp = &now
+		runner.Status.RunnerID = 12345
+		runner.Spec.GitHubConfigSecret = "config-secret"
+
+		configSecret := &corev1.Secret{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "config-secret",
+				Namespace: "default",
+			},
+			Data: map[string][]byte{
+				"github_token": []byte("test-token"),
+			},
+		}
+
+		k8sClient := clientfake.NewClientBuilder().
+			WithScheme(scheme).
+			WithObjects(runner, configSecret).
+			WithStatusSubresource(&actionsv1alpha1.EphemeralRunner{}).
+			Build()
+
+		reconciler := &EphemeralRunnerReconciler{
+			Client: k8sClient,
+			Scheme: scheme,
+			Log:    logr.Discard(),
+			ResourceBuilder: ResourceBuilder{
+				SecretResolver: secretresolver.New(k8sClient, multiClient),
+			},
+		}
+
+		req := ctrl.Request{
+			NamespacedName: types.NamespacedName{
+				Namespace: "default",
+				Name:      "test-runner",
+			},
+		}
+
+		b.StartTimer()
+
+		_, err := reconciler.Reconcile(ctx, req)
+		if err != nil {
+			b.Fatalf("unexpected error: %v", err)
+		}
+	}
+}
+
+// BenchmarkActionsGithub_Reconcile_EphemeralRunner_RetryableError benchmarks the
+// path where a retryable error occurs during reconciliation
+func BenchmarkActionsGithub_Reconcile_EphemeralRunner_RetryableError(b *testing.B) {
+	ctx := context.Background()
+
+	// Setup: Create scheme
+	scheme := runtime.NewScheme()
+	_ = actionsv1alpha1.AddToScheme(scheme)
+	_ = corev1.AddToScheme(scheme)
+
+	// Configure fake client to return transient error
+	retryableErr := errors.New("transient API error")
+	multiClient := fake.NewMultiClient(
+		fake.WithClient(
+			fake.NewClient(
+				fake.WithRemoveRunner(retryableErr),
+			),
+		),
+	)
+
+	// Warmup iteration
+	{
+		now := metav1.Now()
+		runner := NewMinimalEphemeralRunner("default", "warmup-runner")
+		runner.Finalizers = []string{
+			ephemeralRunnerFinalizerName,
+			ephemeralRunnerActionsFinalizerName,
+		}
+		runner.DeletionTimestamp = &now
+		runner.Status.RunnerID = 12345
+		runner.Spec.GitHubConfigSecret = "config-secret"
+
+		configSecret := &corev1.Secret{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "config-secret",
+				Namespace: "default",
+			},
+			Data: map[string][]byte{
+				"github_token": []byte("test-token"),
+			},
+		}
+
+		k8sClient := clientfake.NewClientBuilder().
+			WithScheme(scheme).
+			WithObjects(runner, configSecret).
+			WithStatusSubresource(&actionsv1alpha1.EphemeralRunner{}).
+			Build()
+
+		reconciler := &EphemeralRunnerReconciler{
+			Client: k8sClient,
+			Scheme: scheme,
+			Log:    logr.Discard(),
+			ResourceBuilder: ResourceBuilder{
+				SecretResolver: secretresolver.New(k8sClient, multiClient),
+			},
+		}
+
+		req := ctrl.Request{
+			NamespacedName: types.NamespacedName{
+				Namespace: "default",
+				Name:      "warmup-runner",
+			},
+		}
+
+		_, _ = reconciler.Reconcile(ctx, req)
+	}
+
+	// Benchmark loop
+
+	for b.Loop() {
+		b.StopTimer()
+
+		// Create EphemeralRunner that will trigger error during cleanup
+		now := metav1.Now()
+		runner := NewMinimalEphemeralRunner("default", "test-runner")
+		runner.Finalizers = []string{
+			ephemeralRunnerFinalizerName,
+			ephemeralRunnerActionsFinalizerName,
+		}
+		runner.DeletionTimestamp = &now
+		runner.Status.RunnerID = 12345
+		runner.Spec.GitHubConfigSecret = "config-secret"
+
+		configSecret := &corev1.Secret{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "config-secret",
+				Namespace: "default",
+			},
+			Data: map[string][]byte{
+				"github_token": []byte("test-token"),
+			},
+		}
+
+		k8sClient := clientfake.NewClientBuilder().
+			WithScheme(scheme).
+			WithObjects(runner, configSecret).
+			WithStatusSubresource(&actionsv1alpha1.EphemeralRunner{}).
+			Build()
+
+		reconciler := &EphemeralRunnerReconciler{
+			Client: k8sClient,
+			Scheme: scheme,
+			Log:    logr.Discard(),
+			ResourceBuilder: ResourceBuilder{
+				SecretResolver: secretresolver.New(k8sClient, multiClient),
+			},
+		}
+
+		req := ctrl.Request{
+			NamespacedName: types.NamespacedName{
+				Namespace: "default",
+				Name:      "test-runner",
+			},
+		}
+
+		b.StartTimer()
+
+		result, err := reconciler.Reconcile(ctx, req)
+
+		// Verify error is returned (expected behavior for retryable errors)
+		if err == nil {
+			b.Fatalf("expected error, got nil")
+		}
+		if result.RequeueAfter != 0 {
+			b.Fatalf("expected no requeue delay on error, got %v", result.RequeueAfter)
+		}
+	}
+}
+
+// BenchmarkActionsGithub_Reconcile_EphemeralRunner_DonePhaseCleanup benchmarks
+// the path where an EphemeralRunner in Done phase triggers resource cleanup
+func BenchmarkActionsGithub_Reconcile_EphemeralRunner_DonePhaseCleanup(b *testing.B) {
+	ctx := context.Background()
+
+	// Setup: Create scheme
+	scheme := runtime.NewScheme()
+	_ = actionsv1alpha1.AddToScheme(scheme)
+	_ = corev1.AddToScheme(scheme)
+
+	multiClient := NewFakeMultiClient()
+
+	// Warmup iteration
+	{
+		runner := NewMinimalEphemeralRunner("default", "warmup-runner")
+		runner.Finalizers = []string{
+			ephemeralRunnerFinalizerName,
+			ephemeralRunnerActionsFinalizerName,
+		}
+		runner.Status.Phase = "Succeeded"
+		runner.Spec.GitHubConfigSecret = "config-secret"
+
+		// Create a pod that will be cleaned up
+		pod := &corev1.Pod{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "warmup-runner",
+				Namespace: "default",
+				OwnerReferences: []metav1.OwnerReference{
+					{
+						APIVersion: actionsv1alpha1.GroupVersion.String(),
+						Kind:       "EphemeralRunner",
+						Name:       "warmup-runner",
+						UID:        runner.UID,
+					},
+				},
+			},
+			Spec: corev1.PodSpec{
+				Containers: []corev1.Container{
+					{
+						Name:  "runner",
+						Image: "ghcr.io/actions/runner:latest",
+					},
+				},
+			},
+		}
+
+		configSecret := &corev1.Secret{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "config-secret",
+				Namespace: "default",
+			},
+			Data: map[string][]byte{
+				"github_token": []byte("test-token"),
+			},
+		}
+
+		k8sClient := clientfake.NewClientBuilder().
+			WithScheme(scheme).
+			WithObjects(runner, pod, configSecret).
+			WithStatusSubresource(&actionsv1alpha1.EphemeralRunner{}).
+			Build()
+
+		reconciler := &EphemeralRunnerReconciler{
+			Client: k8sClient,
+			Scheme: scheme,
+			Log:    logr.Discard(),
+			ResourceBuilder: ResourceBuilder{
+				SecretResolver: secretresolver.New(k8sClient, multiClient),
+			},
+		}
+
+		req := ctrl.Request{
+			NamespacedName: types.NamespacedName{
+				Namespace: "default",
+				Name:      "warmup-runner",
+			},
+		}
+
+		_, _ = reconciler.Reconcile(ctx, req)
+	}
+
+	// Benchmark loop
+
+	for b.Loop() {
+		b.StopTimer()
+
+		// Create EphemeralRunner in Done phase (Succeeded)
+		runner := NewMinimalEphemeralRunner("default", "test-runner")
+		runner.Finalizers = []string{
+			ephemeralRunnerFinalizerName,
+			ephemeralRunnerActionsFinalizerName,
+		}
+		runner.Status.Phase = "Succeeded"
+		runner.Spec.GitHubConfigSecret = "config-secret"
+
+		// Create a pod that will be cleaned up
+		pod := &corev1.Pod{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "test-runner",
+				Namespace: "default",
+				OwnerReferences: []metav1.OwnerReference{
+					{
+						APIVersion: actionsv1alpha1.GroupVersion.String(),
+						Kind:       "EphemeralRunner",
+						Name:       "test-runner",
+						UID:        runner.UID,
+					},
+				},
+			},
+			Spec: corev1.PodSpec{
+				Containers: []corev1.Container{
+					{
+						Name:  "runner",
+						Image: "ghcr.io/actions/runner:latest",
+					},
+				},
+			},
+		}
+
+		configSecret := &corev1.Secret{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "config-secret",
+				Namespace: "default",
+			},
+			Data: map[string][]byte{
+				"github_token": []byte("test-token"),
+			},
+		}
+
+		k8sClient := clientfake.NewClientBuilder().
+			WithScheme(scheme).
+			WithObjects(runner, pod, configSecret).
+			WithStatusSubresource(&actionsv1alpha1.EphemeralRunner{}).
+			Build()
+
+		reconciler := &EphemeralRunnerReconciler{
+			Client: k8sClient,
+			Scheme: scheme,
+			Log:    logr.Discard(),
+			ResourceBuilder: ResourceBuilder{
+				SecretResolver: secretresolver.New(k8sClient, multiClient),
+			},
+		}
+
+		req := ctrl.Request{
+			NamespacedName: types.NamespacedName{
+				Namespace: "default",
+				Name:      "test-runner",
+			},
+		}
+
+		b.StartTimer()
+
+		_, err := reconciler.Reconcile(ctx, req)
+		if err != nil {
+			b.Fatalf("unexpected error: %v", err)
+		}
+	}
+}
+
+// BenchmarkActionsGithub_Reconcile_EphemeralRunner_RequeueAfter benchmarks the
+// path where cleanup is not finished and a requeue is requested
+func BenchmarkActionsGithub_Reconcile_EphemeralRunner_RequeueAfter(b *testing.B) {
+	ctx := context.Background()
+
+	// Setup: Create scheme
+	scheme := runtime.NewScheme()
+	_ = actionsv1alpha1.AddToScheme(scheme)
+	_ = corev1.AddToScheme(scheme)
+
+	multiClient := fake.NewMultiClient(
+		fake.WithClient(
+			fake.NewClient(
+				fake.WithRemoveRunner(scaleset.JobStillRunningError),
+			),
+		),
+	)
+
+	// Warmup iteration
+	{
+		now := metav1.Now()
+		runner := NewMinimalEphemeralRunner("default", "warmup-runner")
+		runner.Finalizers = []string{
+			ephemeralRunnerFinalizerName,
+			ephemeralRunnerActionsFinalizerName,
+		}
+		runner.DeletionTimestamp = &now
+		runner.Status.RunnerID = 12345
+		runner.Spec.GitHubConfigSecret = "config-secret"
+
+		configSecret := &corev1.Secret{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "config-secret",
+				Namespace: "default",
+			},
+			Data: map[string][]byte{
+				"github_token": []byte("test-token"),
+			},
+		}
+
+		k8sClient := clientfake.NewClientBuilder().
+			WithScheme(scheme).
+			WithObjects(runner, configSecret).
+			WithStatusSubresource(&actionsv1alpha1.EphemeralRunner{}).
+			Build()
+
+		reconciler := &EphemeralRunnerReconciler{
+			Client: k8sClient,
+			Scheme: scheme,
+			Log:    logr.Discard(),
+			ResourceBuilder: ResourceBuilder{
+				SecretResolver: secretresolver.New(k8sClient, multiClient),
+			},
+		}
+
+		req := ctrl.Request{
+			NamespacedName: types.NamespacedName{
+				Namespace: "default",
+				Name:      "warmup-runner",
+			},
+		}
+
+		_, _ = reconciler.Reconcile(ctx, req)
+	}
+
+	// Benchmark loop
+
+	for b.Loop() {
+		b.StopTimer()
+
+		now := metav1.Now()
+		runner := NewMinimalEphemeralRunner("default", "test-runner")
+		runner.Finalizers = []string{
+			ephemeralRunnerFinalizerName,
+			ephemeralRunnerActionsFinalizerName,
+		}
+		runner.DeletionTimestamp = &now
+		runner.Status.RunnerID = 12345
+		runner.Spec.GitHubConfigSecret = "config-secret"
+
+		configSecret := &corev1.Secret{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "config-secret",
+				Namespace: "default",
+			},
+			Data: map[string][]byte{
+				"github_token": []byte("test-token"),
+			},
+		}
+
+		k8sClient := clientfake.NewClientBuilder().
+			WithScheme(scheme).
+			WithObjects(runner, configSecret).
+			WithStatusSubresource(&actionsv1alpha1.EphemeralRunner{}).
+			Build()
+
+		reconciler := &EphemeralRunnerReconciler{
+			Client: k8sClient,
+			Scheme: scheme,
+			Log:    logr.Discard(),
+			ResourceBuilder: ResourceBuilder{
+				SecretResolver: secretresolver.New(k8sClient, multiClient),
+			},
+		}
+
+		req := ctrl.Request{
+			NamespacedName: types.NamespacedName{
+				Namespace: "default",
+				Name:      "test-runner",
+			},
+		}
+
+		b.StartTimer()
+
+		result, err := reconciler.Reconcile(ctx, req)
+		if err != nil {
+			b.Fatalf("unexpected error: %v", err)
+		}
+
+		if result.RequeueAfter != 30*time.Second {
+			b.Fatalf("expected RequeueAfter=30s, got %v", result.RequeueAfter)
+		}
+	}
+}