Add cohort_streamed_diff_enabled input to perf test workflow

[vaibhav-jain-exp]

Summary

Adds a cohort_streamed_diff_enabled boolean input (default false) to the manual perf test workflow, forwarded in the repository_dispatch payload to amplitude/sdk-tests, which passes it to the deploy repo so AMPLITUDE_COHORT_STREAMED_DIFF_ENABLED (added in #40, default false) is set on the stage2 perf-test deployment in the same commit as the image tag.

• Manual run with the box checked → deployment gets AMPLITUDE_COHORT_STREAMED_DIFF_ENABLED=true for that perf run.
• Manual run with the box unchecked, or any push to main → flag is explicitly reset to false.

Merge order: amplitude/deploy#23810 → amplitude/sdk-tests#6 → this PR.

Note: the flag is a runtime no-op until #40 merges; to perf-test #40 now, run this workflow from this branch and pass the #40 commit as the sha input.

Testing

• actionlint: no new finding classes vs the base file (new steps follow the file's existing $GITHUB_OUTPUT idiom).
• Payload JSON validity and end-to-end chain (flag=true / flag=false / push-to-main / legacy consumers) verified against the sdk-tests and deploy changes.

🤖 Generated with Claude Code

---

Note

Low Risk
CI-only workflow changes with no application runtime impact; risk is limited to incorrect dispatch payload wiring for perf-test deployments.

Overview
Adds a workflow_dispatch boolean input cohort_streamed_diff_enabled (default false) so manual perf runs can turn on AMPLITUDE_COHORT_STREAMED_DIFF_ENABLED on the stage2 perf-test deployment via the downstream chain.

A new step normalizes that input to true/false (including push-to-main and unchecked manual runs as false) and includes cohort_streamed_diff_enabled in the repository_dispatch client_payload to amplitude/sdk-tests. The job summary now prints the flag value.

Shell steps were tightened to pass values through env instead of inline ${{ }} in scripts, and the dispatch body is built with jq piped to curl instead of an inline JSON string.

^{Reviewed by Cursor Bugbot for commit 86010d6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[semgrep-amplitude]

Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

🎉 Fixed in commit 86010d6 🎉

[semgrep-amplitude]

Semgrep found 2 run-shell-injection findings:

• .github/workflows/perf-test.yml
  • L54-70 - Triage
  • L72-80 - Triage

Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".