diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml new file mode 100644 index 0000000000000..6a76f7bcdbcb0 --- /dev/null +++ b/.github/codeql/codeql-config.yml @@ -0,0 +1,7 @@ +name: "CodeQL config" +queries: + - uses: security-extended + - uses: security-and-quality +paths-ignore: + - tests + - build \ No newline at end of file diff --git a/.github/workflows/cffconvert.yml b/.github/workflows/cffconvert.yml index 7144363717749..0cbaf24059390 100644 --- a/.github/workflows/cffconvert.yml +++ b/.github/workflows/cffconvert.yml @@ -8,7 +8,7 @@ on: jobs: validate: name: "validate" - runs-on: ubuntu-latest + runs-on: ["self-hosted", "1ES.Pool=onnxruntime-github-Ubuntu2204-AMD-CPU"] steps: - name: Check out a copy of the repository uses: actions/checkout@v4 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index e4d1b91bab736..d3b51c0681a20 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -18,7 +18,7 @@ on: jobs: analyze: name: Analyze - runs-on: ubuntu-latest + runs-on: ["self-hosted", "1ES.Pool=onnxruntime-github-Ubuntu2204-AMD-CPU"] permissions: actions: read contents: read @@ -55,6 +55,11 @@ jobs: java-version: '11' distribution: 'microsoft' + - if: ${{ matrix.language == 'javascript' }} + uses: actions/setup-node@v4 + with: + node-version: 20 + # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - if: ${{ matrix.language != 'cpp' }} diff --git a/.github/workflows/gradle-wrapper-validation.yml b/.github/workflows/gradle-wrapper-validation.yml index 32aed81092774..cf3bc598d02bb 100644 --- a/.github/workflows/gradle-wrapper-validation.yml +++ b/.github/workflows/gradle-wrapper-validation.yml @@ -8,7 +8,7 @@ on: [push, pull_request] jobs: validation: name: "Validation" - runs-on: ubuntu-latest + runs-on: ["self-hosted", "1ES.Pool=onnxruntime-github-Ubuntu2204-AMD-CPU"] steps: - uses: actions/checkout@v4 - uses: gradle/actions/wrapper-validation@v4 diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml index a196226a4b836..00960c848b107 100644 --- a/.github/workflows/labeler.yml +++ b/.github/workflows/labeler.yml @@ -8,7 +8,7 @@ permissions: jobs: triage: - runs-on: ubuntu-latest + runs-on: ["self-hosted", "1ES.Pool=onnxruntime-github-Ubuntu2204-AMD-CPU"] steps: - uses: github/issue-labeler@v3.4 with: diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 74fd5d7dfdb28..ec834b07b2c78 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -36,7 +36,7 @@ jobs: lint-python-format: # Required workflow name: Python format - runs-on: ubuntu-latest + runs-on: ["self-hosted", "1ES.Pool=onnxruntime-github-Ubuntu2204-AMD-CPU"] steps: - uses: actions/checkout@v4 - name: Setup Python @@ -114,9 +114,12 @@ jobs: lint-js: name: Lint JavaScript - runs-on: ubuntu-latest + runs-on: ["self-hosted", "1ES.Pool=onnxruntime-github-Ubuntu2204-AMD-CPU"] steps: - uses: actions/checkout@v4 + - uses: actions/setup-node@v4 + with: + node-version: 20 - uses: reviewdog/action-eslint@v1 with: reporter: github-pr-check diff --git a/.github/workflows/linux_training.yml b/.github/workflows/linux_training.yml new file mode 100644 index 0000000000000..d382cdf476283 --- /dev/null +++ b/.github/workflows/linux_training.yml @@ -0,0 +1,55 @@ +name: orttraining-linux-ci-pipeline +on: + push: + branches: + - main + - rel-* + pull_request: + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + orttraining-linux-ci-pipeline: + runs-on: ["self-hosted", "1ES.Pool=onnxruntime-github-Ubuntu2204-AMD-CPU"] + permissions: + actions: read + contents: read + security-events: write + steps: + - uses: actions/checkout@v4 + - run: | + python3 -m pip install --user -r tools/ci_build/github/linux/python/requirements.txt + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + config-file: ./.github/codeql/codeql-config.yml + languages: 'cpp' + - run: | + set -e -x + rm -rf build + python3 tools/ci_build/build.py --build_dir build --config Release --enable_training --skip_submodule_sync --parallel --update --build + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 + with: + category: "/language:cpp" + output: sarif-results + upload: failure-only + + - name: filter-sarif + uses: advanced-security/filter-sarif@v1 + with: + patterns: | + +**/*.cc + +**/*.h + -tests/**/*.* + -build/**/*.* + input: sarif-results/cpp.sarif + output: sarif-results/cpp.sarif + + - name: Upload SARIF + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: sarif-results/cpp.sarif \ No newline at end of file diff --git a/.github/workflows/mac.yml b/.github/workflows/mac.yml index b36b0aa555940..f0669f94c2b1c 100644 --- a/.github/workflows/mac.yml +++ b/.github/workflows/mac.yml @@ -105,7 +105,7 @@ jobs: --use_xnnpack \ --use_binskim_compliant_compile_flags \ --ios \ - --apple_deploy_target=13.0 \ + --apple_deploy_target=15.1 \ --apple_sysroot=iphonesimulator \ --osx_arch=${{ matrix.target_arch }} diff --git a/.github/workflows/pr_checks.yml b/.github/workflows/pr_checks.yml index a711b753c492d..152a2bfc13941 100644 --- a/.github/workflows/pr_checks.yml +++ b/.github/workflows/pr_checks.yml @@ -19,7 +19,7 @@ concurrency: jobs: auto-apply-fixes: name: Suggest fixes - runs-on: ubuntu-latest + runs-on: ["self-hosted", "1ES.Pool=onnxruntime-github-Ubuntu2204-AMD-CPU"] permissions: contents: read pull-requests: write @@ -34,14 +34,13 @@ jobs: with: toolchain: stable components: rustfmt - - name: Install dependencies + - name: Install dependencies and run lintrunner on all files run: | - python -m pip install -r requirements-dev.txt - python -m pip install lintrunner lintrunner-adapters + export PATH=$HOME/.local/bin:$PATH + set -e + python -m pip install --user -r requirements-dev.txt + python -m pip install --user lintrunner lintrunner-adapters lintrunner init - - name: Run lintrunner on all files - run: | - set +e lintrunner f --all-files -v exit 0 - uses: parkerbxyz/suggest-changes@v1 diff --git a/.github/workflows/publish-c-apidocs.yml b/.github/workflows/publish-c-apidocs.yml index 6c4dc43847d0b..303a6f1df6a68 100644 --- a/.github/workflows/publish-c-apidocs.yml +++ b/.github/workflows/publish-c-apidocs.yml @@ -22,7 +22,7 @@ permissions: jobs: build: name: Generate C/C++ API docs - runs-on: ubuntu-latest + runs-on: ["self-hosted", "1ES.Pool=onnxruntime-github-Ubuntu2204-AMD-CPU"] steps: - uses: actions/checkout@v4 - name: Install doxygen and dependencies diff --git a/.github/workflows/publish-csharp-apidocs.yml b/.github/workflows/publish-csharp-apidocs.yml index 862a7a70e33a2..ece0f6c534071 100644 --- a/.github/workflows/publish-csharp-apidocs.yml +++ b/.github/workflows/publish-csharp-apidocs.yml @@ -20,7 +20,7 @@ permissions: jobs: build: - runs-on: ubuntu-latest + runs-on: ["self-hosted", "1ES.Pool=onnxruntime-github-Ubuntu2204-AMD-CPU"] env: DOCFXVERSION: 2.62.2 steps: diff --git a/.github/workflows/publish-gh-pages.yml b/.github/workflows/publish-gh-pages.yml index 1818261b4b766..11745ce24f9e5 100644 --- a/.github/workflows/publish-gh-pages.yml +++ b/.github/workflows/publish-gh-pages.yml @@ -8,7 +8,7 @@ on: jobs: placeholder: - runs-on: ubuntu-latest + runs-on: ["self-hosted", "1ES.Pool=onnxruntime-github-Ubuntu2204-AMD-CPU"] steps: - name: Placeholder step to have workflow included in the GitHub web UI run: | diff --git a/.github/workflows/publish-java-apidocs.yml b/.github/workflows/publish-java-apidocs.yml index 9e42dca708a17..cb2c4cdedc8ae 100644 --- a/.github/workflows/publish-java-apidocs.yml +++ b/.github/workflows/publish-java-apidocs.yml @@ -21,7 +21,7 @@ permissions: jobs: build: name: Generate Java docs - runs-on: ubuntu-latest + runs-on: ["self-hosted", "1ES.Pool=onnxruntime-github-Ubuntu2204-AMD-CPU"] steps: - uses: actions/checkout@v4 - name: Set up JDK 11 diff --git a/.github/workflows/publish-js-apidocs.yml b/.github/workflows/publish-js-apidocs.yml index cec4a52d39c93..5aaac55be52c7 100644 --- a/.github/workflows/publish-js-apidocs.yml +++ b/.github/workflows/publish-js-apidocs.yml @@ -21,7 +21,7 @@ permissions: jobs: build: name: Generate JS API docs - runs-on: ubuntu-latest + runs-on: ["self-hosted", "1ES.Pool=onnxruntime-github-Ubuntu2204-AMD-CPU"] steps: - uses: actions/checkout@v4 - name: Setup Node.js diff --git a/.github/workflows/publish-python-apidocs.yml b/.github/workflows/publish-python-apidocs.yml index 8b2f72d80bacf..7622416d314e1 100644 --- a/.github/workflows/publish-python-apidocs.yml +++ b/.github/workflows/publish-python-apidocs.yml @@ -22,7 +22,7 @@ permissions: jobs: build: name: Generate Python API docs - runs-on: ubuntu-latest + runs-on: ["self-hosted", "1ES.Pool=onnxruntime-github-Ubuntu2204-AMD-CPU"] steps: - uses: actions/checkout@v4 - name: Install tools diff --git a/.github/workflows/skip-doc-change.yml.j2 b/.github/workflows/skip-doc-change.yml.j2 index 58f048122a87e..04f77e5d28713 100644 --- a/.github/workflows/skip-doc-change.yml.j2 +++ b/.github/workflows/skip-doc-change.yml.j2 @@ -14,7 +14,7 @@ jobs: {%- for name in job_names %} job{{ loop.index }}: name: {{ name }} - runs-on: ubuntu-latest + runs-on: ["self-hosted", "1ES.Pool=onnxruntime-github-Ubuntu2204-AMD-CPU"] steps: - run: 'echo "No build required, only documentation changed"' {% endfor %} diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index 181f3fb17d332..14cf0825873a0 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -8,7 +8,7 @@ on: jobs: close-stale-issues: - runs-on: ubuntu-latest + runs-on: ["self-hosted", "1ES.Pool=onnxruntime-github-Ubuntu2204-AMD-CPU"] permissions: issues: write pull-requests: write diff --git a/.github/workflows/title-only-labeler.yml b/.github/workflows/title-only-labeler.yml index e0af2dd06b1b7..7ee9f3917a901 100644 --- a/.github/workflows/title-only-labeler.yml +++ b/.github/workflows/title-only-labeler.yml @@ -8,7 +8,7 @@ permissions: jobs: triage: - runs-on: ubuntu-latest + runs-on: ["self-hosted", "1ES.Pool=onnxruntime-github-Ubuntu2204-AMD-CPU"] steps: - uses: github/issue-labeler@v3.4 with: diff --git a/VERSION_NUMBER b/VERSION_NUMBER index 0044d6cb9691c..769e37e159d42 100644 --- a/VERSION_NUMBER +++ b/VERSION_NUMBER @@ -1 +1 @@ -1.20.1 +1.20.2 diff --git a/csharp/test/Microsoft.ML.OnnxRuntime.Tests.MAUI/Microsoft.ML.OnnxRuntime.Tests.MAUI.csproj b/csharp/test/Microsoft.ML.OnnxRuntime.Tests.MAUI/Microsoft.ML.OnnxRuntime.Tests.MAUI.csproj index e07448daeea7f..b4f1ea5a4f7fe 100644 --- a/csharp/test/Microsoft.ML.OnnxRuntime.Tests.MAUI/Microsoft.ML.OnnxRuntime.Tests.MAUI.csproj +++ b/csharp/test/Microsoft.ML.OnnxRuntime.Tests.MAUI/Microsoft.ML.OnnxRuntime.Tests.MAUI.csproj @@ -7,7 +7,9 @@ - net8.0-android;net8.0-ios;net8.0-maccatalyst + + net8.0-ios;net8.0-maccatalyst $(TargetFrameworks);net8.0-windows10.0.19041.0