MacRelease

# Copyright (c) ONNX Project Contributors
#
# SPDX-License-Identifier: Apache-2.0

name: MacRelease

on:
  schedule:
    # Run weekly on Monday 00:00
    - cron:  '00 00 * * MON'
  push:
    branches: [main, rel-*]
  pull_request:
    branches: [main, rel-*]
  workflow_dispatch:

# Use MACOSX_DEPLOYMENT_TARGET=11.0 to produce compatible wheel
env:
  MACOSX_DEPLOYMENT_TARGET: 11.0

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name == 'workflow_dispatch' }}
  cancel-in-progress: true

jobs:
  build:
    if: github.event_name != 'pull_request' || startsWith( github.base_ref, 'rel-') || contains( github.event.pull_request.labels.*.name, 'run release CIs')
    runs-on: macos-latest
    strategy:
      matrix:
        python-version: ['3.8', '3.9', '3.10', '3.11', '3.12']

    steps:
    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
    - name: Checkout submodules
      shell: bash
      run: |
        auth_header="$(git config --local --get http.https://github.com/.extraheader)"
        git submodule sync --recursive
        git -c "http.extraheader=$auth_header" -c protocol.version=2 submodule update --init --force --recursive --depth=1
    - name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
      with:
        python-version: ${{ matrix.python-version }}

    - name: Install Python dependencies
      run: |
        python -m pip install -q --upgrade pip
        python -m pip install -q -r requirements-release.txt

    - name: Build wheel and install
      env:
        CC: "clang"
        CXX: "clang++"
        ONNX_ML: 1
        CMAKE_OSX_ARCHITECTURES: "arm64;x86_64"
        CMAKE_ARGS: "-DONNX_USE_LITE_PROTO=ON"
      run: |
        # Install Protobuf from source
        export NUM_CORES=`sysctl -n hw.logicalcpu`
        source workflow_scripts/protobuf/build_protobuf_unix.sh $NUM_CORES $(pwd)/protobuf/protobuf_install
        if [ '${{ github.event_name }}' == 'schedule' ]; then
          sed -i '' 's/name = "onnx"/name = "onnx-weekly"/' 'pyproject.toml'
          export ONNX_PREVIEW_BUILD=1
        fi
        python -m build --wheel

    - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
      with:
        name: macos-wheel-${{ matrix.python-version }}
        path: dist

  test:
    needs: build
    runs-on: macos-latest
    strategy:
      matrix:
        python-version: ['3.8', '3.9', '3.10', '3.11', '3.12']
        target-architecture: ['x86_64', 'arm64']

    steps:
    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
    - name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
      with:
        python-version: ${{ matrix.python-version }}

    - name: Install Python dependencies
      run: |
        arch -${{ matrix.target-architecture }} python -m pip install -q --upgrade pip
        arch -${{ matrix.target-architecture }} python -m pip install -q -r requirements-release.txt

    - uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
      with:
        name: macos-wheel-${{ matrix.python-version }}
        path: dist

    - name: Test the wheel
      run: |
        arch -${{ matrix.target-architecture }} python -m pip install --upgrade dist/*.whl
        arch -${{ matrix.target-architecture }} pytest

    - name: Upload wheel to PyPI weekly
      if: github.event_name == 'schedule' && matrix.target-architecture == 'arm64'  # Only triggered by weekly event
      run: |
        twine upload --verbose dist/*.whl --repository-url https://upload.pypi.org/legacy/ -u ${{ secrets.ONNXWEEKLY_USERNAME }} -p ${{ secrets.ONNXWEEKLY_TOKEN }}

    - name: Verify ONNX with the latest numpy
      if: ${{ always() }}
      run: |
        arch -${{ matrix.target-architecture }} python -m pip uninstall -y numpy onnx
        arch -${{ matrix.target-architecture }} python -m pip install numpy
        arch -${{ matrix.target-architecture }}  python -m pip install --upgrade dist/*.whl
        arch -${{ matrix.target-architecture }} pytest

    - name: Verify ONNX with the latest protobuf
      if: ${{ always() }}
      run: |
        arch -${{ matrix.target-architecture }} python -m pip uninstall -y protobuf onnx
        arch -${{ matrix.target-architecture }} python -m pip install protobuf
        arch -${{ matrix.target-architecture }} python -m pip install --upgrade dist/*.whl
        arch -${{ matrix.target-architecture }} pytest

    - name: Verify ONNX with the minimumly supported packages
      if: always() && (matrix.target-architecture == 'x86_64' || (matrix.python-version != '3.8' && matrix.python-version != '3.9'))
      run: |
        arch -${{ matrix.target-architecture }} python -m pip uninstall -y numpy protobuf onnx
        arch -${{ matrix.target-architecture }}  python -m pip install -r requirements-min.txt
        arch -${{ matrix.target-architecture }} python -m pip install --upgrade dist/*.whl
        arch -${{ matrix.target-architecture }} pytest

    # Only triggered by weekly event on certain CI
    - name: Build and upload source distribution to PyPI weekly
      if: github.event_name == 'schedule' && matrix.python-version == '3.10' && matrix.target-architecture == 'arm64'
      run: |
        # Build and upload source distribution to PyPI
        git clean -xdf
        sed -i '' 's/name = "onnx"/name = "onnx-weekly"/' 'pyproject.toml'
        ONNX_PREVIEW_BUILD=1 python -m build --sdist
        twine upload dist/* --repository-url https://upload.pypi.org/legacy/ -u ${{ secrets.ONNXWEEKLY_USERNAME }} -p ${{ secrets.ONNXWEEKLY_TOKEN }}

        # Test weekly source distribution from PyPI
        python -m pip uninstall -y onnx-weekly
        python -m pip install setuptools
        python -m pip install --use-deprecated=legacy-resolver --no-binary onnx-weekly onnx-weekly
        pytest

    - name: Verify ONNX with ONNX Runtime PyPI package
      if: matrix.python-version != '3.12'
      run: |
        arch -${{ matrix.target-architecture }} python -m pip uninstall -y protobuf numpy
        arch -${{ matrix.target-architecture }} python -m pip install -q -r requirements-release.txt
        arch -${{ matrix.target-architecture }} python -m pip install -q onnxruntime==1.17.3
        export ORT_MAX_IR_SUPPORTED_VERSION=9
        export ORT_MAX_ML_OPSET_SUPPORTED_VERSION=3
        export ORT_MAX_ONNX_OPSET_SUPPORTED_VERSION=20
        arch -${{ matrix.target-architecture }} pytest


# Copyright (c) ONNX Project Contributors
#
# SPDX-License-Identifier: Apache-2.0

# Weekly ci workflow for model zoo.
# Runs model checker/shape_inference/version_converter for all models
name: Weekly CI with the latest ONNX and ONNX Model Zoo

on:
  schedule:
    # run weekly on Sunday 23:59
    - cron:  '59 23 * * SUN'
  pull_request:
    branches: [main, rel-*]
  workflow_dispatch:

permissions:  # set top-level default permissions as security best practice
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name == 'workflow_dispatch' }}
  cancel-in-progress: true

jobs:
  build:
    if: github.event_name != 'pull_request' || contains( github.event.pull_request.labels.*.name, 'test ONNX Model Zoo')
    runs-on: macos-latest
    steps:
    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      name: Checkout repo
    - name: Checkout submodules
      shell: bash
      run: |
        auth_header="$(git config --local --get http.https://github.com/.extraheader)"
        git submodule sync --recursive
        git -c "http.extraheader=$auth_header" -c protocol.version=2 submodule update --init --force --recursive --depth=1
    - name: Set up Python
      uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
      with:
        python-version: '3.10'
    - name: Install dependencies
      shell: bash
      run: |
        set -e
        python -m pip install -q --upgrade pip
        python -m pip install -q -r requirements-release.txt

    - name: Build, install and test ONNX
      shell: bash
      run: |
        # Install protobuf from source
        export NUM_CORES=`sysctl -n hw.logicalcpu`
        source workflow_scripts/protobuf/build_protobuf_unix.sh $NUM_CORES $(pwd)/protobuf/protobuf_install
        # Build ONNX
        export CC=clang
        export CXX=clang++
        export ONNX_ML=1
        pip install -e . -v

    - name: Test all models with onnx.checker, onnx.shape_inference, onnx.version_converter
      run: |
        python workflow_scripts/test_model_zoo.py


# Copyright (c) ONNX Project Contributors
#
# SPDX-License-Identifier: Apache-2.0

name: LinuxRelease_x86_64

on:
  schedule:
    # Run weekly on Monday 00:00
    - cron:  '00 00 * * MON'
  push:
    branches: [main, rel-*]
  pull_request:
    branches: [main, rel-*]
  workflow_dispatch:

permissions:  # set top-level default permissions as security best practice
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name == 'workflow_dispatch' }}
  cancel-in-progress: true

jobs:
  build:
    if: github.event_name != 'pull_request' || startsWith( github.base_ref, 'rel-') || contains( github.event.pull_request.labels.*.name, 'run release CIs')
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ['3.8', '3.9', '3.10', '3.11', '3.12']
        architecture: ['x64']

    steps:
    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
    - name: Checkout submodules
      shell: bash
      run: |
        auth_header="$(git config --local --get http.https://github.com/.extraheader)"
        git submodule sync --recursive
        git -c "http.extraheader=$auth_header" -c protocol.version=2 submodule update --init --force --recursive --depth=1

    - name: Build manylinux2014_x86_64
      uses: docker://quay.io/pypa/manylinux2014_x86_64:latest
      with:
        entrypoint: bash
        args: .github/workflows/manylinux/entrypoint.sh ${{ matrix.python-version }} manylinux2014_x86_64 ${{ github.event_name }}

    - name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
      with:
        python-version: ${{ matrix.python-version }}
        architecture: ${{ matrix.architecture }}

    - name: Install python dependencies
      run: |
        python -m pip install -q --upgrade pip
        python -m pip install -q -r requirements-release.txt

    - name: Install protobuf in the GitHub Action environment for testing the wheel
      run: |
        source workflow_scripts/protobuf/build_protobuf_unix.sh $(nproc)

    - name: Test wheel with Python ${{ matrix.python-version }}
      run: |
        python -m pip install dist/*manylinux2014_x86_64.whl
        pytest

    - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32
      with:
        name: wheels
        path: dist

    - name: Upload wheel to PyPI weekly
      if: (github.event_name == 'schedule') # Only triggered by weekly event
      run: |
        twine upload --verbose dist/*.whl --repository-url https://upload.pypi.org/legacy/ -u ${{ secrets.ONNXWEEKLY_USERNAME }} -p ${{ secrets.ONNXWEEKLY_TOKEN }}
        TEST_HUB=1 pytest

    - name: Verify ONNX with the latest numpy
      if: ${{ always() }}
      run: |
        python -m pip uninstall -y numpy onnx && python -m pip install numpy
        python -m pip install dist/*manylinux2014_x86_64.whl
        pytest

    - name: Verify ONNX with the latest protobuf
      if: ${{ always() }}
      run: |
        python -m pip uninstall -y protobuf onnx && python -m pip install protobuf
        python -m pip install dist/*manylinux2014_x86_64.whl
        pytest

    - name: Verify ONNX with the minimumly supported packages
      if: ${{ always() }}
      run: |
        python -m pip uninstall -y numpy protobuf onnx && python -m pip install -r requirements-min.txt
        python -m pip install dist/*manylinux2014_x86_64.whl
        pytest

    - name: Verify ONNX with ONNX Runtime PyPI package
      if: matrix.python-version != '3.12'
      run: |
        python -m pip uninstall -y protobuf numpy && python -m pip install -q -r requirements-release.txt
        python -m pip install -q onnxruntime==1.17.3
        export ORT_MAX_IR_SUPPORTED_VERSION=9
        export ORT_MAX_ML_OPSET_SUPPORTED_VERSION=3
        export ORT_MAX_ONNX_OPSET_SUPPORTED_VERSION=20
        pytest


# Copyright (c) ONNX Project Contributors
#
# SPDX-License-Identifier: Apache-2.0

name: Windows_No_Exception_CI

on:
   push:
    branches: [ main, rel-* ]
   pull_request:
    branches: [ main, rel-* ]

permissions:  # set top-level default permissions as security best practice
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name == 'workflow_dispatch' }}
  cancel-in-progress: true

jobs:
  build:
    runs-on: windows-latest
    strategy:
      matrix:
        python-version: ['3.8', '3.9', '3.10', '3.11', '3.12']
        architecture: ['x64']
    steps:
    - name: Checkout ONNX
      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      with:
         path: ./onnx
         submodules: 'recursive'

    - name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
      with:
        python-version: ${{ matrix.python-version }}
        architecture: ${{ matrix.architecture }}

    - name: Add msbuild to PATH
      uses: microsoft/setup-msbuild@6fb02220983dee41ce7ae257b6f4d8f9bf5ed4ce # v2.0.0
      with:
        msbuild-architecture: ${{ matrix.architecture }}

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        python -m pip install cmake

    - name: Build and test ONNX binaries
      run: |
        . .\onnx\workflow_scripts\protobuf\build_protobuf_win.ps1 -arch ${{ matrix.architecture }}

        cd onnx
        echo "Build ONNX"
        cmake -G "Visual Studio 17 2022" -A ${{ matrix.architecture }} -DONNX_USE_PROTOBUF_SHARED_LIBS=OFF -DONNX_USE_LITE_PROTO=ON -DONNX_WERROR=ON -DONNX_DISABLE_EXCEPTIONS=ON -DCMAKE_EXPORT_COMPILE_COMMANDS=ON -DCMAKE_BUILD_TYPE=Release -DONNX_USE_MSVC_STATIC_RUNTIME=OFF -DONNX_ML=1 -DONNX_BUILD_TESTS=ON -S . -B .setuptools-cmake-build\
        cd .setuptools-cmake-build\
        msbuild onnx.sln /m /p:Configuration=Release

        echo "Run gtests"
        Release\onnx_gtests.exe
        if($lastexitcode -ne 0) {
          EXIT 1
        }

        cd ..
        git clean -xdf
        set ONNX_BUILD_TESTS=1
        echo "Build ONNX with non-static registration for testing selective ONNX schema loading"
        cmake -G "Visual Studio 17 2022" -A ${{ matrix.architecture }} -DONNX_USE_PROTOBUF_SHARED_LIBS=OFF -DONNX_USE_LITE_PROTO=ON -DONNX_WERROR=ON -DCMAKE_EXPORT_COMPILE_COMMANDS=ON -DCMAKE_BUILD_TYPE=Release -DONNX_USE_MSVC_STATIC_RUNTIME=OFF -DONNX_ML=1 -DONNX_BUILD_TESTS=ON -DONNX_DISABLE_STATIC_REGISTRATION=ON -S . -B .setuptools-cmake-build\

        cd .setuptools-cmake-build\
        msbuild onnx.sln /m /p:Configuration=Release

        echo "Only test selective ONNX schema loading"
        Release\onnx_gtests.exe --gtest_filter="SchemaRegistrationTest*"
        if($lastexitcode -ne 0) {
          EXIT 1
        }


# Copyright (c) ONNX Project Contributors
#
# SPDX-License-Identifier: Apache-2.0

name: LinuxRelease_aarch64

on:
  schedule:
    # Run weekly on Monday 00:00
    - cron:  '00 00 * * MON'
  push:
    branches: [main, rel-*]
  pull_request:
    branches: [main, rel-*]
  workflow_dispatch:

permissions:  # set top-level default permissions as security best practice
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name == 'workflow_dispatch' }}
  cancel-in-progress: true

jobs:
  build:
    if: github.event_name != 'pull_request' || startsWith( github.base_ref, 'rel-') || contains( github.event.pull_request.labels.*.name, 'run release CIs')
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: [cp38-cp38, cp39-cp39, cp310-cp310, cp311-cp311, cp312-cp312]
    env:
      # setting up python and docker image
      py: /opt/python/${{ matrix.python-version }}/bin/python
      img: quay.io/pypa/manylinux2014_aarch64

    steps:
    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
    - name: Checkout submodules
      shell: bash
      run: |
        auth_header="$(git config --local --get http.https://github.com/.extraheader)"
        git submodule sync --recursive
        git -c "http.extraheader=$auth_header" -c protocol.version=2 submodule update --init --force --recursive --depth=1

      # setting up qemu for enabling aarch64 binary execution on x86 machine
    - uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0

      # Creating a virtual environment on machine with the help of docker container \
      # and installing the dependencies inside that \
      # so that we can use installed dependencies.
    - name: Install dependencies
      run: |
        docker run --rm -v ${{ github.workspace }}:/ws:rw --workdir=/ws \
          ${{ env.img }} \
          bash -exc '${{ env.py }} -m pip install -q virtualenv && ${{ env.py }} -m venv .env && \
          source .env/bin/activate && \
          ${{ env.py }} -m pip install -q --only-binary google-re2 -r requirements-release.txt && \
          yum install -y protobuf-compiler protobuf-devel
          deactivate'

      # using created virtual environment in new container and executing the script
    - name: Build manylinux2014_aarch64
      run: |
        docker run --rm -v ${{ github.workspace }}:/ws:rw --workdir=/ws \
          ${{ env.img }} \
          bash -exc '\
          source .env/bin/activate && \
          yum install -y sudo && \
          sudo chmod +x .github/workflows/manylinux/entrypoint.sh && \
          sudo .github/workflows/manylinux/entrypoint.sh ${{ env.py }} manylinux2014_aarch64 ${{ github.event_name }}
          deactivate'

      # using created virtual environment in new container and testing the wheel
    - name: Test wheel with Python ${{ matrix.python-version }}
      run: |
        docker run --rm -v ${{ github.workspace }}:/ws:rw --workdir=/ws \
          ${{ env.img }} \
          bash -exc '\
          source .env/bin/activate && \
          python -m pip install -q --upgrade pip && \
          python -m pip install -q --only-binary google-re2 -r requirements-release.txt && \
          pip install dist/*manylinux2014_aarch64.whl && \
          pytest && \
          deactivate'

    - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
      with:
        name: wheels
        path: dist

    - name: Upload wheel to PyPI weekly
      if: (github.event_name == 'schedule') # Only triggered by weekly event
      run: |
        python -m pip install -q twine
        twine upload --verbose dist/*.whl --repository-url https://upload.pypi.org/legacy/ -u ${{ secrets.ONNXWEEKLY_USERNAME }} -p ${{ secrets.ONNXWEEKLY_TOKEN }}

    - name: Verify ONNX with the latest numpy and protobuf
      if: ${{ always() }}
      run: |
         docker run --rm -v ${{ github.workspace }}:/ws:rw --workdir=/ws \
          ${{ env.img }} \
          bash -exc '\
          source .env/bin/activate && \
          python -m pip uninstall -y numpy onnx protobuf && python -m pip install numpy protobuf && \
          python -m pip install dist/*manylinux2014_aarch64.whl && \
          pytest && \
          deactivate'

    - name: Verify ONNX with the minimumly supported packages
      if: ${{ always() }}
      run: |
         docker run --rm -v ${{ github.workspace }}:/ws:rw --workdir=/ws \
          ${{ env.img }} \
          bash -exc '\
          source .env/bin/activate && \
          python -m pip uninstall -y onnx && python -m pip install -r requirements-min.txt && \
          python -m pip install dist/*manylinux2014_aarch64.whl && \
          pytest && \
          deactivate'

    - name: Verify ONNX with ONNX Runtime PyPI package
      if: matrix.python-version != 'cp312-cp312'
      run: |
         docker run --rm -v ${{ github.workspace }}:/ws:rw --workdir=/ws \
          ${{ env.img }} \
          bash -exc '\
          source .env/bin/activate && \
          python -m pip uninstall -y protobuf numpy && python -m pip install -q -r requirements-release.txt && \
          python -m pip install -q onnxruntime==1.16.3 && \
          export ORT_MAX_IR_SUPPORTED_VERSION=9 \
          export ORT_MAX_ML_OPSET_SUPPORTED_VERSION=3 \
          export ORT_MAX_ONNX_OPSET_SUPPORTED_VERSION=20 \
          pytest && \
          deactivate'


Mark stale issues and pull requests

# Copyright (c) ONNX Project Contributors
#
# SPDX-License-Identifier: Apache-2.0

# This workflow warns and then closes issues and PRs that have had no activity for a specified amount of time.
#
# You can adjust the behavior by modifying this file.
# For more information, see:
# https://github.com/actions/stale
name: Mark stale issues and pull requests

on:
  schedule:
  - cron: '39 6 * * *'

permissions:  # set top-level default permissions as security best practice
  contents: read

jobs:
  stale:

    runs-on: ubuntu-latest
    permissions:
      issues: write
      pull-requests: write

    steps:
    - uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9.0.0
      with:
        repo-token: ${{ secrets.GITHUB_TOKEN }}
        days-before-stale: 365
        days-before-close: 21
        ascending: true


CodeQL

# For most projects, this workflow file will not need changing; you simply need
# to commit it to your repository.
#
# You may wish to alter this file to override the set of languages analyzed,
# or to provide custom queries or build logic.
#
# ******** NOTE ********
# We have attempted to detect the languages in your repository. Please check
# the `language` matrix defined below to confirm you have the correct set of
# supported CodeQL languages.
#
name: "CodeQL"

on:
  push:
    branches: [ "main", rel-* ]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [ "main", rel-* ]
  schedule:
    - cron: '33 6 * * 5'

permissions:  # set top-level default permissions as security best practice
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name == 'workflow_dispatch' }}
  cancel-in-progress: true

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        language: [ 'cpp', 'python' ]
        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support

    steps:
    - name: Checkout repository
      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
    - name: Set up Python
      uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
      with:
        python-version: '3.11'
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@f079b8493333aace61c81488f8bd40919487bd9f # v3.25.7
      with:
        languages: ${{ matrix.language }}
        queries: security-extended,security-and-quality
        # If you wish to specify custom queries, you can do so here or in a config file.
        # By default, queries listed here will override any specified in a config file.
        # Prefix the list here with "+" to use these queries and those in the config file.

        # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
        config-file: ./.github/codeql/codeql-config.yml

    # Install onnx so that it is found by the linters
    - name: Install ONNX
      run: |
        source workflow_scripts/protobuf/build_protobuf_unix.sh $(nproc)
        python -m pip install --quiet -r requirements-release.txt
        git submodule update --init --recursive
        export ONNX_ML=1
        pip install .

    # ℹ Command-line programs to run using the OS shell.
    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun

    #   If the Autobuild fails above, remove it and uncomment the following three lines.
    #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.

    # - run: |
    #   echo "Run, Build Application using script"
    #   ./location_of_script_within_repo/buildscript.sh

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@f079b8493333aace61c81488f8bd40919487bd9f # v3.25.7
      with:
        category: "/language:${{matrix.language}}"


Generate and publish ONNX docs

# Copyright (c) ONNX Project Contributors
#
# SPDX-License-Identifier: Apache-2.0

name: Generate and publish ONNX docs

on:
  # Runs on pushes targeting the default branch
  push:
    branches: ["main"]
  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
permissions:
  contents: read
  pages: write
  id-token: write

jobs:
  # Single deploy job since we're just deploying
  deploy:
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Setup Python
        uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
        with:
          python-version: '3.10'
      - name: Setup Pages
        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
      - name: Install Dependencies
        run: |
          python -m pip install --quiet --upgrade pip setuptools wheel
          python -m pip install -r docs/docsgen/source/requirements.txt
          python -m pip install protobuf==3.20.2
      - name: Uninstall onnx
        run: python -m pip uninstall -y onnx
      - name: Install onnx development version
        run: |
          sudo apt-get install libprotobuf-dev protobuf-compiler
          git submodule update --init --recursive
          export CMAKE_ARGS="-DONNX_USE_PROTOBUF_SHARED_LIBS=ON"
          export ONNX_ML=1
          pip install .
      - name: Build Docs
        run: |
          cd docs/docsgen
          make html
      - name: Upload artifact
        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
        with:
          path: 'docs/docsgen/build/html'
      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5


Scorecard supply-chain security

# Copyright (c) ONNX Project Contributors
#
# SPDX-License-Identifier: Apache-2.0

# This workflow uses actions that are not certified by GitHub. They are provided
# by a third-party and are governed by separate terms of service, privacy
# policy, and support documentation.

name: Scorecard supply-chain security
on:
  # For Branch-Protection check. Only the default branch is supported. See
  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
  branch_protection_rule:
  # To guarantee Maintained check is occasionally updated. See
  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
  schedule:
    - cron: '24 10 * * 6'
  push:
    branches: [ "main" ]

# Declare default permissions as read only.
permissions: read-all

jobs:
  analysis:
    name: Scorecard analysis
    runs-on: ubuntu-latest
    permissions:
      # Needed to upload the results to code-scanning dashboard.
      security-events: write
      # Needed to publish results and get a badge (see publish_results below).
      id-token: write
      # Uncomment the permissions below if installing in a private repository.
      # contents: read
      # actions: read

    steps:
      - name: "Checkout code"
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v3.1.0
        with:
          persist-credentials: false

      - name: "Run analysis"
        uses: ossf/scorecard-action@dc50aa9510b46c811795eb24b2f1ba02a914e534 # v2.3.3
        with:
          results_file: results.sarif
          results_format: sarif
          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
          # - you want to enable the Branch-Protection check on a *public* repository, or
          # - you are installing Scorecard on a *private* repository
          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
          # repo_token: ${{ secrets.SCORECARD_TOKEN }}

          # Public repositories:
          #   - Publish results to OpenSSF REST API for easy access by consumers
          #   - Allows the repository to include the Scorecard badge.
          #   - See https://github.com/ossf/scorecard-action#publishing-results.
          # For private repositories:
          #   - `publish_results` will always be set to `false`, regardless
          #     of the value entered here.
          publish_results: true

      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
      # format to the repository Actions tab.
      - name: "Upload artifact"
        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.0
        with:
          name: SARIF file
          path: results.sarif
          retention-days: 5

      # Upload the results to GitHub's code scanning dashboard.
      - name: "Upload to code-scanning"
        uses: github/codeql-action/upload-sarif@f079b8493333aace61c81488f8bd40919487bd9f # v3.25.7
        with:
          sarif_file: results.sarif


REUSE Compliance Check

# SPDX-FileCopyrightText: 2022 Free Software Foundation Europe e.V. <https://fsfe.org>
#
# SPDX-License-Identifier: CC0-1.0

name: REUSE Compliance Check

on: [push, pull_request]

permissions:  # set top-level default permissions as security best practice
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
    - name: REUSE Compliance Check
      uses: fsfe/reuse-action@a46482ca367aef4454a87620aa37c2be4b2f8106 # v3.0.0


Lint

# Copyright (c) ONNX Project Contributors
#
# SPDX-License-Identifier: Apache-2.0

name: Lint

on:
  push:
    branches:
      - main
  pull_request:
  merge_group:

permissions:  # set top-level default permissions as security best practice
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name == 'workflow_dispatch' }}
  cancel-in-progress: true

jobs:
  optional-lint:
    name: Optional Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: misspell # Check spellings as well
        uses: reviewdog/action-misspell@5bd7be2fc7ae56a517184f5c4bbcf2fd7afe3927 # v1.17.0
        with:
          github_token: ${{ secrets.github_token }}
          locale: "US"
          reporter: github-pr-check
          level: info
          filter_mode: diff_context
          exclude: |
            ./docs/docsgen/source/_static/*
      - name: shellcheck # Static check shell scripts
        uses: reviewdog/action-shellcheck@72365a51bf6476fe952a117c3ff703eb7775e40a # v1.20.0
        with:
          github_token: ${{ secrets.github_token }}
          reporter: github-pr-check
          level: info
          filter_mode: diff_context
      - name: cpplint # Static check C++ code
        uses: reviewdog/action-cpplint@004f44c404bd6308ebab788936490bfa4160626f # v1.4.0
        with:
          github_token: ${{ secrets.github_token }}
          reporter: github-pr-check
          level: warning
          flags: --linelength=120
          filter: "-runtime/references"

  enforce-style:
    name: Enforce style
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Setup Python
        uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
        with:
          # Version range or exact version of Python to use, using SemVer's version range syntax. Reads from .python-version if unset.
          python-version: "3.10"
      - name: Install ONNX
        run: |
          source workflow_scripts/protobuf/build_protobuf_unix.sh $(nproc)

          python -m pip install --quiet --upgrade pip setuptools wheel
          python -m pip install --quiet -r requirements-release.txt

          git submodule update --init --recursive
          export ONNX_BUILD_TESTS=0
          export ONNX_ML=1
          export CMAKE_ARGS="-DONNXIFI_DUMMY_BACKEND=ON -DONNX_WERROR=ON"
          export ONNX_NAMESPACE=ONNX_NAMESPACE_FOO_BAR_FOR_CI

          python setup.py install
      - name: Install dependencies
        run: |
          python -m pip install -r requirements-dev.txt
          lintrunner init
      - name: Run lintrunner on all files
        run: |
          set +e
          if ! lintrunner --force-color --all-files --tee-json=lint.json -v; then
              echo ""
              echo -e "\e[1m\e[36mYou can reproduce these results locally by using \`lintrunner\`.\e[0m"
              echo -e "\e[1m\e[36mSee https://github.com/onnx/onnx/blob/main/CONTRIBUTING.md#coding-style for setup instructions.\e[0m"
              exit 1
          fi
      - name: Produce SARIF
        if: always()
        run: |
          python -m lintrunner_adapters to-sarif lint.json lintrunner.sarif
      - name: Upload SARIF file
        # Use always() to always upload SARIF even if lintrunner returns with error code
        # To toggle linter comments in the files page, press `i` on the keyboard
        if: always()
        continue-on-error: true
        uses: github/codeql-action/upload-sarif@f079b8493333aace61c81488f8bd40919487bd9f # v3.25.7
        with:
          # Path to SARIF file relative to the root of the repository
          sarif_file: lintrunner.sarif
          category: lintrunner
          checkout_path: ${{ github.workspace }}
      - name: Check auto-gen files are up-to-date
        run: |
          echo -e "\n::group:: ===> check auto-gen files are up-to-date..."

          ONNX_ML=1 python onnx/defs/gen_doc.py
          python onnx/gen_proto.py -l
          python onnx/gen_proto.py -l --ml
          python onnx/backend/test/stat_coverage.py

          git status
          git diff --exit-code -- . ':(exclude)onnx/onnx-data.proto' ':(exclude)onnx/onnx-data.proto3'
          if [ $? -ne 0 ]; then
            echo "git diff returned failures"
            exit 1
          fi
          echo -e "::endgroup::"


Post clang-tidy review comments

# This standalone CI is needed for commenting in PRs from forks
name: Post clang-tidy review comments

on:
  workflow_run:
    # The name field of the lint action
    workflows: ["Optional_Clang_Tidy_Review"]
    types:
      - completed

permissions:
  checks: write
  pull-requests: write

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: ZedThree/clang-tidy-review/post@85799d63d217e8d0686b7735fb923acc986d8043 # v0.19.0
        with:
          lgtm_comment_body: ""
          # Use annotations instead of comments
          annotations: true
          max_comments: 10


name: Optional_Clang_Tidy_Review

on:
  pull_request:
    branches: [ "main", rel-* ]
    paths:
      - "**.cc"
      - "**.h"
  workflow_dispatch:

permissions:  # set top-level default permissions as security best practice
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name == 'workflow_dispatch' }}
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      # Pleaes note that it won't cause any failure here; it will only post comments in PRs
      - name: clang-tidy review
        uses: ZedThree/clang-tidy-review@85799d63d217e8d0686b7735fb923acc986d8043 # v0.19.0
        with:
          apt_packages: "libprotobuf-dev,protobuf-compiler"
          cmake_command: "cmake -S . -B .setuptools-cmake-build -DCMAKE_EXPORT_COMPILE_COMMANDS=on -DONNX_USE_PROTOBUF_SHARED_LIBS=ON"
          build_dir: ".setuptools-cmake-build"
          exclude: "/third_party/*"
          split_workflow: true
      - uses: ZedThree/clang-tidy-review/upload@85799d63d217e8d0686b7735fb923acc986d8043 # v0.19.0


DCO

# Copyright (c) ONNX Project Contributors
#
# SPDX-License-Identifier: Apache-2.0

name: DCO
on:
  merge_group:

permissions:  # set top-level default permissions as security best practice
  contents: read # Check https://github.com/ossf/scorecard/blob/7ce8609469289d5f3b1bf5ee3122f42b4e3054fb/docs/checks.md#token-permissions

jobs:
  DCO:
    runs-on: ubuntu-latest
    if: ${{ github.actor != 'dependabot[bot]' }}
    steps:
      - run: echo "dummy DCO workflow (it won't run any check actually) to trigger by merge_group in order to enable merge queue"


Check URLs

# Copyright (c) ONNX Project Contributors
#
# SPDX-License-Identifier: Apache-2.0

name: Check URLs

on:
  push:
    branches: [ 'rel-*' ]
  schedule:
    # Run every month
    - cron:  '0 0 1 * *'
  workflow_dispatch:

permissions:  # set top-level default permissions as security best practice
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

    - name: urls-checker-code
      uses: urlstechie/urlchecker-action@b643b43e2ac605e1475331c7b67247d242b7dce4 # v0.0.34
      with:
        subfolder: onnx
        file_types: .md,.py,.rst,.ipynb,.cc,.h,.cpp
        print_all: false
        timeout: 2
        retry_count : 2
        exclude_urls: https://devblogs.nvidia.com/optimizing-recurrent-neural-networks-cudnn-5/,https://media.githubusercontent.com/media/,https://download.onnxruntime.ai/onnx/models
        # exclude_patterns: https://...
        force_pass: false

    - name: urls-checker-docs
      uses: urlstechie/urlchecker-action@b643b43e2ac605e1475331c7b67247d242b7dce4 # v0.0.34
      with:
        subfolder: docs
        file_types: .md,.py,.rst,.ipynb,.cc,.h,.cpp
        print_all: false
        timeout: 10
        retry_count : 2
        exclude_urls: https://github.com/onnx/onnx/blob/main/docs/Operators,https://github.com/onnx/onnx/pull/436
        force_pass: false

    - name: urls-checker-community
      uses: urlstechie/urlchecker-action@b643b43e2ac605e1475331c7b67247d242b7dce4 # v0.0.34
      with:
        subfolder: community
        file_types: .md,.py,.rst
        print_all: false
        timeout: 2
        retry_count : 2
        force_pass: false


name: Auto update documentation/backend test data
on:
  pull_request_target:
  workflow_dispatch:

permissions:  # set top-level default permissions as security best practice
  contents: read # Check https://github.com/ossf/scorecard/blob/7ce8609469289d5f3b1bf5ee3122f42b4e3054fb/docs/checks.md#token-permissions

concurrency:
    group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name == 'workflow_dispatch' }}
    cancel-in-progress: true

jobs:
  auto-update-doc:
    if: contains( github.event.pull_request.labels.*.name, 'auto update doc')
    runs-on: ubuntu-latest
    permissions:
        contents: write

    steps:
    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      with:
        repository: ${{ github.event.pull_request.head.repo.full_name }}
        # Checkout the branch made in the fork. Will automatically push changes
        # back to this branch.
        ref: ${{ github.head_ref }}
    - name: Setup Python
      uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
      with:
        python-version: "3.11"
    - name: Install ONNX from source and update documentation
      run: |
        python -m pip install -q --upgrade pip
        python -m pip install -r requirements-release.txt
        git submodule update --init --recursive
        export ONNX_ML=1
        pip install -e .

        python onnx/defs/gen_doc.py
        python onnx/gen_proto.py -l
        python onnx/gen_proto.py -l --ml
        python onnx/backend/test/stat_coverage.py

        python onnx/backend/test/cmd_tools.py generate-data --diff

        git diff -- . ':(exclude)onnx/onnx-data.proto' ':(exclude)onnx/onnx-data.proto3'

    - name: Commit changes with updated files
      uses: stefanzweifel/git-auto-commit-action@8621497c8c39c72f3e2a999a26b4ca1b5058a842 # v5.0.1
      with:
        commit_message: CI:apply auto updated documentation/backend test data
        commit_options: "--signoff"


CI

# Copyright (c) ONNX Project Contributors
#
# SPDX-License-Identifier: Apache-2.0

name: CI

on:
  schedule:
    - cron: '0 0 * * *'  # every day at midnight for reporting code coverage to codecov
  push:
    branches:
      - main
  pull_request:
  merge_group:
  workflow_dispatch:

permissions:  # set top-level default permissions as security best practice
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name == 'workflow_dispatch' }}
  cancel-in-progress: true

jobs:
  test:
    name: Test ${{ matrix.os }}, ${{ matrix.python_version }}, ${{ matrix.protobuf_type }}, debug=${{ matrix.debug_build }}, onnx_ml=${{ matrix.onnx_ml }}, doc=${{ matrix.documentation }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest,macos-latest]
        python_version: ['3.12', '3.11', '3.10', '3.9', '3.8']
        include:
          - python_version: '3.12'
            onnx_ml: 1
            debug_build: 1
            documentation: 1
            protobuf_type: 'Internal'
          - python_version: '3.11'
            onnx_ml: 1
            debug_build: 0
            documentation: 0
            protobuf_type: 'External'
          - python_version: '3.10'
            onnx_ml: 0
            debug_build: 0
            documentation: 0
            protobuf_type: 'Internal'
          - python_version: '3.9'
            onnx_ml: 1
            debug_build: 0
            documentation: 0
            protobuf_type: 'External'
          - python_version: '3.8'
            onnx_ml: 0
            debug_build: 0
            documentation: 0
            protobuf_type: 'Internal'
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python_version }}

      - name: Show versions
        run: |
          python --version
          cmake --version

      - name: Install external protobuf - Linux
        if: matrix.protobuf_type == 'External' && matrix.os == 'ubuntu-latest'
        run: |
          sudo apt-get install libprotobuf-dev protobuf-compiler

      - name: Install external protobuf - MacOS
        if: matrix.protobuf_type == 'External' && matrix.os == 'macos-latest'
        run: |
          source workflow_scripts/protobuf/build_protobuf_unix.sh 3 $(pwd)/protobuf/protobuf_install

      - name: Set up MSBuild
        if: matrix.os == 'windows-latest'
        uses: microsoft/setup-msbuild@6fb02220983dee41ce7ae257b6f4d8f9bf5ed4ce # v2.0.0
        with:
          msbuild-architecture: x64

      - name: Install external protobuf - Windows
        if: matrix.protobuf_type == 'External' && matrix.os == 'windows-latest'
        run: |
          workflow_scripts/protobuf/build_protobuf_win.ps1

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install -r requirements-release.txt
          python -m pip install protobuf==3.20.2
          git submodule update --init --recursive

      - name: Build and install ONNX - Linux
        if: matrix.os == 'ubuntu-latest'
        run: |
          if [ "${{ matrix.protobuf_type }}" == "External" ]; then
            export CMAKE_ARGS="$CMAKE_ARGS -DCMAKE_POSITION_INDEPENDENT_CODE=ON -DONNX_USE_PROTOBUF_SHARED_LIBS=ON"
          fi
          pip install -e ".[reference]" -v
        env:
          DEBUG: ${{ matrix.debug_build }}
          ONNX_ML: ${{ matrix.onnx_ml }}
          ONNX_BUILD_TESTS: 1
          CMAKE_ARGS: "-DONNX_WERROR=ON -DCMAKE_CXX_FLAGS='-fsanitize=undefined -fno-sanitize-recover=all '"

      - name: Build and install ONNX - MacOS
        if: matrix.os == 'macos-latest'
        run: |
          pip install -e ".[reference]" -v
        env:
          DEBUG: ${{ matrix.debug_build }}
          ONNX_ML: ${{ matrix.onnx_ml }}
          ONNX_BUILD_TESTS: 1
          CMAKE_ARGS: "-DONNX_WERROR=ON"

      - name: Build and install ONNX - Windows
        if: matrix.os == 'windows-latest' && matrix.python_version != '3.9' && matrix.python_version != '3.8' && matrix.python_version != '3.12'
        run: |
          python setup.py build_ext --inplace
          python setup.py install
        env:
          DEBUG: ${{ matrix.debug_build }}
          ONNX_ML: ${{ matrix.onnx_ml }}
          ONNX_BUILD_TESTS: 1
          CMAKE_ARGS: "-DONNX_WERROR=OFF -DONNX_USE_PROTOBUF_SHARED_LIBS=OFF -DONNX_USE_LITE_PROTO=ON"

      - name: Build and install ONNX - Windows
        if: matrix.os == 'windows-latest' && (matrix.python_version == '3.9' || matrix.python_version == '3.8' || matrix.python_version == '3.12')
        run: |
          pip install -e . -v
        env:
          DEBUG: ${{ matrix.debug_build }}
          ONNX_ML: ${{ matrix.onnx_ml }}
          ONNX_BUILD_TESTS: 1
          CMAKE_ARGS: "-DONNX_WERROR=OFF -DONNX_USE_PROTOBUF_SHARED_LIBS=OFF -DONNX_USE_LITE_PROTO=ON"

      - name: Run Python tests
        run: |
          pytest -sv --cov=onnx --cov-report=xml --cov-append --cov-branch --junit-xml pytest.xml -n auto --dist loadscope

      - name: Run C++ tests
        if: matrix.os == 'ubuntu-latest' || matrix.os == 'macos-latest'
        run: |
          export LD_LIBRARY_PATH="./.setuptools-cmake-build/:$LD_LIBRARY_PATH"
          ./.setuptools-cmake-build/onnx_gtests

      - name: Upload coverage to Codecov
        if: always()
        uses: codecov/codecov-action@v4
        with:
          token: ${{ secrets.CODECOV_TOKEN }}

      - name: Upload Test Results
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: Test Results (${{ matrix.os }}-{{ matrix.python_version }})
          path: pytest.xml

      - name: Test backend test data
        if: matrix.documentation == 1 && matrix.os == 'ubuntu-latest'
        run: |
          python onnx/backend/test/cmd_tools.py generate-data --clean
          git status
          git diff --exit-code -- . ':!onnx/onnx-data.proto' ':!onnx/onnx-data.proto3' ':!*output_*.pb' ':!*input_*.pb'
          if [ $? -ne 0 ]; then
            echo "git diff for test generation returned failures. Please check updated node test files"
            exit 1
          fi
          git diff --exit-code --diff-filter=ADR -- . ':!onnx/onnx-data.proto' ':!onnx/onnx-data.proto3'
          if [ $? -ne 0 ]; then
            echo "Test generation returned failures. Please check the number of node test files (input_*.pb or output_*.pb)"
            exit 1
          fi
          pip uninstall -y pillow
          python onnx/backend/test/cmd_tools.py generate-data --clean
          git status
          git diff --exit-code -- . ':!onnx/onnx-data.proto' ':!onnx/onnx-data.proto3' ':!*output_*.pb' ':!*input_*.pb'
          if [ $? -ne 0 ]; then
            echo "git diff for test generation without pillow returned failures. Please check updated node test files"
            exit 1
          fi

      - name: Test documentation
        if: matrix.documentation == 1
        run: |
          pip install -r docs/docsgen/source/requirements.txt
          cd docs/docsgen && make text
        continue-on-error: true

  publish-test-results:
    name: "Publish Test Results to Github"
    needs: test
    runs-on: ubuntu-latest
    permissions:
      checks: write
      # only needed unless run with comment_mode: off
      pull-requests: write
    if: always()
    steps:
      - name: Download Artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: Publish Test Results
        uses: EnricoMi/publish-unit-test-result-action@v2
        with:
          files: "artifacts/**/*.xml"


pyvespa documentation search feed

name: pyvespa documentation search feed
on:
  push:
    branches: [ master ]

env:
  DATA_PLANE_PUBLIC_KEY     : ${{ secrets.VESPA_TEAM_DATA_PLANE_PUBLIC_CERT }}
  DATA_PLANE_PRIVATE_KEY    : ${{ secrets.VESPA_TEAM_DATA_PLANE_PRIVATE_KEY }}
  VESPA_CLI_DATA_PLANE_CERT : ${{ secrets.VESPA_TEAM_VESPA_CLI_DATA_PLANE_CERT }}
  VESPA_CLI_DATA_PLANE_KEY  : ${{ secrets.VESPA_TEAM_VESPA_CLI_DATA_PLANE_KEY }}

jobs:
  build:
    runs-on: ubuntu-latest
    steps:

    - uses: actions/checkout@v4

    - uses: ruby/setup-ruby@v1
      with:
        ruby-version: 3.1
        bundler-cache: true

    - name: Install Sphinx
      run: |
        sudo apt-get install -y pandoc
        python3 -m pip install --upgrade pip
        python3 -m pip install -r docs/sphinx/source/requirements-feed.txt

    - name: Build site
      run: |
        sphinx-build -E -D nbsphinx_allow_errors=True -b html docs/sphinx/source docs/sphinx/build
        #
        # strip liquid macros from html files
        #
        find docs/sphinx/build -name \*.html | \
          while read f; do \
            ( echo -e "---\n---\n"; sed 's/{%/{ %/g; s/%}/% }/g; s/{{/{ {/g; s/}}/} }/g' < ${f} ) >${f}.new; \
            mv ${f}.new ${f}; \
          done
        bundle exec jekyll build -s docs/sphinx/build/ -p _plugins-vespafeed --config _config.yml

    - name: Setup Python
      uses: actions/setup-python@v4
      with:
        python-version: '3.x'

    - name: Install dependencies
      run: |
        pip3 install PyYAML spacy mmh3 requests html5lib beautifulsoup4 markdownify tiktoken

    - name: Get Vespa CLI - update to later versions as needed
      run: |
        # Workaround: Rename the "vespa" directory in pyvespa, conflicts with the cli install below
        # This directory is not needed for the feeding anyway
        mv vespa vespa.org
        apt update && apt -y install curl
        curl -SsLo vespa-cli.tar.gz https://github.com/vespa-engine/vespa/releases/download/v8.209.11/vespa-cli_8.209.11_linux_amd64.tar.gz
        tar -xvf vespa-cli.tar.gz && ln -fs vespa-cli_8.209.11_linux_amd64/bin/vespa

    - name: Feed site
      run: |
        # The python scripts below uses the Vespa CLI for feeding / data access.
        # See https://docs.vespa.ai/en/vespa-cli.html.
        # The environment variables below have credentials for endpoint access -
        # use the key/cert files in .vespa and paste their content into GitHub Secrets.
        # VESPA_CLI_API_KEY must be set and empty as below.
        export VESPA_CLI_DATA_PLANE_CERT
        export VESPA_CLI_DATA_PLANE_KEY
        export VESPA_CLI_API_KEY=
        ./feed_to_vespa.py _config.yml

    - name: Feed paragraphs site
      run: |
        export VESPA_CLI_DATA_PLANE_CERT
        export VESPA_CLI_DATA_PLANE_KEY
        export VESPA_CLI_API_KEY=
        ./feed-split.py pyvespa_index.json https://pyvespa.readthedocs.io/en/latest questions.jsonl
        ./feed_to_vespa.py _paragraphs_config.yml

    - name: Feed suggestions
      run: |
        export VESPA_CLI_DATA_PLANE_CERT
        export VESPA_CLI_DATA_PLANE_KEY
        export VESPA_CLI_API_KEY=
        ./feed_to_vespa.py _suggestions_config.yml


name: vespacli - Check, Update, Test, Create PR, Release

defaults:
  run:
    working-directory: ./vespacli

on:
  workflow_dispatch:
  schedule:
    # Run at midnight sunday-thursday
    - cron: "0 0 * * 1-4"

jobs:
  check-and-update:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.set_output.outputs.version }}

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.10"

      - name: Install dependencies and this repo
        run: |
          python -m pip install --upgrade pip
          pip install -e .[build]
      - name: Check latest version and set version variable
        id: check_latest_version
        run: |
          version=$(python utils/check_latest_version.py)
          echo "Latest version is $version"
          # Set the output variable
          echo "version=$version" >> $GITHUB_OUTPUT

      - name: Update the version (if not NA)
        if: ${{ (steps.check_latest_version.outputs.version != 'NA') }}
        run: |
          # Print evaluation of the condition
          echo "Version is not NA, updating version to ${{ steps.check_latest_version.outputs.version }}"
          echo "Updating Vespa CLI version to ${{ steps.check_latest_version.outputs.version }}"
          python utils/update_version.py --version ${{ steps.check_latest_version.outputs.version }}

      - name: Download latest binaries
        if: ${{ steps.check_latest_version.outputs.version != 'NA' }}
        run: |
          python utils/download_binaries.py --version ${{ steps.check_latest_version.outputs.version }}

      - name: Upload binaries as artifact
        uses: actions/upload-artifact@v4
        with:
          name: binaries
          path: vespacli/vespacli/go-binaries

      - name: Set the output variable
        id: set_output
        if: ${{ steps.check_latest_version.outputs.version != 'NA' }}
        run: |
          echo "version=${{ steps.check_latest_version.outputs.version }}" >> $GITHUB_OUTPUT
  test:
    needs: check-and-update
    if: ${{ needs.check-and-update.outputs.version != 'NA' }}
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest, macos-12, macos-14]
        python-version: ["3.10", "3.11"] # Update or modify Python versions as needed
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}

      - name: Download artifact
        uses: actions/download-artifact@v4
        with:
          name: binaries
          path: vespacli/vespacli/go-binaries

      - name: Set permissions on all files in go-binaries
        run: |
          chmod -R +x vespacli/go-binaries/*

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e .[build]

      - name: Update latest version
        run: |
          python utils/update_version.py --version ${{ needs.check-and-update.outputs.version }}

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e .[build]

      - name: Verify installation
        run: |
          vespa version

  create-pr:
    needs: [check-and-update, test]
    outputs:
      version: ${{ needs.check-and-update.outputs.version }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.10"

      - name: Install dependencies and this repo
        run: |
          python -m pip install --upgrade pip
          pip install -e .[build]

      - name: Update latest version
        run: |
            python utils/update_version.py --version ${{ needs.check-and-update.outputs.version }}

      - name: Create Pull Request
        uses: peter-evans/create-pull-request@v6
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          commit-message: "Update Vespa CLI version to ${{ needs.check-and-update.outputs.version }}"
          title: "Update Vespa CLI version to ${{ needs.check-and-update.outputs.version }}"
          body: "This PR updates the Vespa CLI version to ${{ needs.check-and-update.outputs.version }}"
          branch: "update-vespa-cli-version-${{ needs.check-and-update.outputs.version }}"
          base: "master"
          labels: "vespacli"

  release:
    needs: create-pr
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.10"

      - name: Install dependencies and this repo
        run: |
          python -m pip install --upgrade pip
          pip install -e .[build]

      - name: Download artifact
        uses: actions/download-artifact@v4
        with:
          name: binaries
          path: vespacli/vespacli/go-binaries

      - name: Set permissions on all files in go-binaries
        run: |
          chmod -R +x vespacli/go-binaries/*

      - name: Update latest version
        run: |
          python utils/update_version.py --version ${{ needs.create-pr.outputs.version }}

      - name: Build
        run: |
          python -m build

      - name: Upload to PyPI
        env:
          TWINE_USERNAME: __token__
          TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN_VESPACLI }}
        run: |
          python -m twine upload dist/*


pyvespa - Tests - Except Cloud - Github Action


pyvespa - Release and upload PyPI

name: pyvespa - Release and upload PyPI

on:
  workflow_dispatch:
  release:
    types: [published]
jobs:
  update_version:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e .[build]

      - name: Set version from ref tag that triggered the workflow (strip prefix 'v' from tag)
        id: set_version
        run: |
          echo "tag=${{ github.ref_name }}"
          # strip prefix 'v' from version variable
          version=${tag#v}
          echo "version=$version" >> $GITHUB_OUTPUT

      - name: Update version
        run: |
          echo "Updating pyvespa version to ${{ steps.set_version.outputs.version }}"
          python vespa/utils/update_version.py --version ${{ steps.set_version.outputs.version }}

      - name: Build
        run: |
          python -m build

      - name: Upload to PyPI
        if: github.event_name == 'release'
        env:
          TWINE_USERNAME: __token__
          TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN_PYVESPA }} #TODO: this must be added to secrets
        run: python -m twine upload dist/*

      - name: Create Pull Request
        if: github.event_name == 'release'
        uses: peter-evans/create-pull-request@v6
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          commit-message: "Update pyvespa version to ${{ steps.set_version.outputs.version }}"
          title: "Update pyvespa version to ${{ steps.set_version.outputs.version }}"
          body: "This PR updates the pyvespa version to ${{ steps.set_version.outputs.version }}"
          branch: "update-pyvespa-version-${{ steps.set_version.outputs.version }}"
          base: "master"
          labels: "pyvespa"


pyvespa - Build and Deploy with Java - Github Action


lint

name: lint

on: [push, pull_request]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Set up Python 3.7
        uses: actions/setup-python@v2
        with:
          python-version: 3.7
      - name: Install pre-commit hook
        run: |
          pip install pre-commit
          pre-commit install
      - name: Linting
        run: pre-commit run --all-files
      - name: Check docstring coverage
        run: |
          pip install interrogate
          interrogate -v --ignore-init-method --ignore-module --ignore-nested-functions --ignore-regex "__repr__" --fail-under 90 mmocr


name: merge_stage_test

on:
  push:
    paths-ignore:
      - 'README.md'
      - 'README_zh-CN.md'
      - 'docs/**'
      - 'demo/**'
      - '.dev_scripts/**'
      - '.circleci/**'
      - 'projects/**'
    branches:
      - dev-1.x

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build_cpu_py:
    runs-on: ubuntu-22.04
    strategy:
      matrix:
        python-version: [3.8, 3.9]
        torch: [1.8.1]
        include:
          - torch: 1.8.1
            torchvision: 0.9.1
    steps:
      - uses: actions/checkout@v3
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v4
        with:
          python-version: ${{ matrix.python-version }}
      - name: Upgrade pip
        run: pip install pip --upgrade
      - name: Install PyTorch
        run: pip install torch==${{matrix.torch}}+cpu torchvision==${{matrix.torchvision}}+cpu -f https://download.pytorch.org/whl/cpu/torch_stable.html
      - name: Install MMEngine
        run: pip install git+https://github.com/open-mmlab/mmengine.git@main
      - name: Install MMCV
        run: |
          pip install -U openmim
          mim install 'mmcv >= 2.0.0rc1'
      - name: Install MMDet
        run: pip install git+https://github.com/open-mmlab/mmdetection.git@dev-3.x
      - name: Install other dependencies
        run: pip install -r requirements/tests.txt
      - name: Build and install
        run: rm -rf .eggs && pip install -e .
      - name: Run unittests and generate coverage report
        run: |
          coverage run --branch --source mmocr -m pytest tests/
          coverage xml
          coverage report -m

  build_cpu_pt:
    runs-on: ubuntu-22.04
    strategy:
      matrix:
        python-version: [3.7]
        torch: [1.6.0, 1.7.1, 1.8.1, 1.9.1, 1.10.1, 1.11.0, 1.12.1, 1.13.0]
        include:
          - torch: 1.6.0
            torchvision: 0.7.0
          - torch: 1.7.1
            torchvision: 0.8.2
          - torch: 1.8.1
            torchvision: 0.9.1
          - torch: 1.9.1
            torchvision: 0.10.1
          - torch: 1.10.1
            torchvision: 0.11.2
          - torch: 1.11.0
            torchvision: 0.12.0
          - torch: 1.12.1
            torchvision: 0.13.1
          - torch: 1.13.0
            torchvision: 0.14.0
          - torch: 2.0.0
            torchvision: 0.15.1
            python-version: 3.8
    steps:
      - uses: actions/checkout@v3
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v4
        with:
          python-version: ${{ matrix.python-version }}
      - name: Upgrade pip
        run: pip install pip --upgrade
      - name: Install PyTorch
        run: pip install torch==${{matrix.torch}}+cpu torchvision==${{matrix.torchvision}}+cpu -f https://download.pytorch.org/whl/cpu/torch_stable.html
      - name: Install MMEngine
        run: pip install git+https://github.com/open-mmlab/mmengine.git@main
      - name: Install MMCV
        run: |
          pip install -U openmim
          mim install 'mmcv >= 2.0.0rc1'
      - name: Install MMDet
        run: pip install git+https://github.com/open-mmlab/mmdetection.git@dev-3.x
      - name: Install other dependencies
        run: pip install -r requirements/tests.txt
      - name: Build and install
        run: rm -rf .eggs && pip install -e .
      - name: Run unittests and generate coverage report
        run: |
          coverage run --branch --source mmocr -m pytest tests/
          coverage xml
          coverage report -m
      # Only upload coverage report for python3.7 && pytorch1.8.1 cpu
      - name: Upload coverage to Codecov
        if: ${{matrix.torch == '1.8.1' && matrix.python-version == '3.7'}}
        uses: codecov/codecov-action@v1.0.14
        with:
          file: ./coverage.xml
          flags: unittests
          env_vars: OS,PYTHON
          name: codecov-umbrella
          fail_ci_if_error: false

  build_windows:
    runs-on: windows-2022
    strategy:
      matrix:
        python: [3.7]
        platform: [cpu, cu111]
        torch: [1.8.1]
        torchvision: [0.9.1]
        include:
          - python-version: 3.8
            platform: cu117
            torch: 2.0.0
            torchvision: 0.15.1
    steps:
      - uses: actions/checkout@v2
      - name: Set up Python ${{ matrix.python }}
        uses: actions/setup-python@v2
        with:
          python-version: ${{ matrix.python }}
      - name: Upgrade pip
        run: python -m pip install --upgrade pip
      - name: Install lmdb
        run: pip install lmdb
      - name: Install PyTorch
        run: pip install torch==${{matrix.torch}}+${{matrix.platform}} torchvision==${{matrix.torchvision}}+${{matrix.platform}} -f https://download.pytorch.org/whl/${{matrix.platform}}/torch_stable.html
      - name: Install mmocr dependencies
        run: |
          pip install git+https://github.com/open-mmlab/mmengine.git@main
          pip install -U openmim
          mim install 'mmcv >= 2.0.0rc1'
          pip install git+https://github.com/open-mmlab/mmdetection.git@dev-3.x
          pip install -r requirements/tests.txt
      - name: Build and install
        run: |
          pip install -e .
      - name: Run unittests and generate coverage report
        run: |
          pytest tests/


name: pr_stage_test

on:
  pull_request:
    paths-ignore:
      - 'README.md'
      - 'README_zh-CN.md'
      - 'docs/**'
      - 'demo/**'
      - '.dev_scripts/**'
      - '.circleci/**'
      - 'projects/**'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build_cpu:
    runs-on: ubuntu-22.04
    strategy:
      matrix:
        python-version: [3.7]
        include:
          - torch: 1.8.1
            torchvision: 0.9.1
    steps:
      - uses: actions/checkout@v3
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v4
        with:
          python-version: ${{ matrix.python-version }}
      - name: Upgrade pip
        run: pip install pip --upgrade
      - name: Install PyTorch
        run: pip install torch==${{matrix.torch}}+cpu torchvision==${{matrix.torchvision}}+cpu -f https://download.pytorch.org/whl/cpu/torch_stable.html
      - name: Install MMEngine
        run: pip install git+https://github.com/open-mmlab/mmengine.git@main
      - name: Install MMCV
        run: |
          pip install -U openmim
          mim install 'mmcv >= 2.0.0rc1'
      - name: Install MMDet
        run: pip install git+https://github.com/open-mmlab/mmdetection.git@dev-3.x
      - name: Install other dependencies
        run: pip install -r requirements/tests.txt
      - name: Build and install
        run: rm -rf .eggs && pip install -e .
      - name: Run unittests and generate coverage report
        run: |
          coverage run --branch --source mmocr -m pytest tests/
          coverage xml
          coverage report -m
      # Upload coverage report for python3.7 && pytorch1.8.1 cpu
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v1.0.14
        with:
          file: ./coverage.xml
          flags: unittests
          env_vars: OS,PYTHON
          name: codecov-umbrella
          fail_ci_if_error: false

  build_windows:
    runs-on: windows-2022
    strategy:
      matrix:
        python: [3.7]
        platform: [cpu, cu111]
        torch: [1.8.1]
        torchvision: [0.9.1]
        include:
          - python-version: 3.8
            platform: cu117
            torch: 2.0.0
            torchvision: 0.15.1
    steps:
      - uses: actions/checkout@v3
      - name: Set up Python ${{ matrix.python }}
        uses: actions/setup-python@v4
        with:
          python-version: ${{ matrix.python }}
      - name: Upgrade pip
        run: python -m pip install --upgrade pip
      - name: Install lmdb
        run: pip install lmdb
      - name: Install PyTorch
        run: pip install torch==${{matrix.torch}}+${{matrix.platform}} torchvision==${{matrix.torchvision}}+${{matrix.platform}} -f https://download.pytorch.org/whl/${{matrix.platform}}/torch_stable.html
      - name: Install mmocr dependencies
        run: |
          pip install git+https://github.com/open-mmlab/mmengine.git@main
          pip install -U openmim
          mim install 'mmcv >= 2.0.0rc1'
          pip install git+https://github.com/open-mmlab/mmdetection.git@dev-3.x
          pip install -r requirements/tests.txt
      - name: Build and install
        run: |
          pip install -e .
      - name: Run unittests and generate coverage report
        run: |
          pytest tests/


deploy

name: deploy

on: push

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build-n-publish:
    runs-on: ubuntu-latest
    if: startsWith(github.event.ref, 'refs/tags')
    steps:
      - uses: actions/checkout@v2
      - name: Set up Python 3.7
        uses: actions/setup-python@v1
        with:
          python-version: 3.7
      - name: Build MMOCR
        run: |
          pip install wheel
          python setup.py sdist bdist_wheel
      - name: Publish distribution to PyPI
        run: |
          pip install twine
          twine upload dist/* -u __token__ -p ${{ secrets.pypi_password }}


test-mim

name: test-mim

on:
  push:
    paths:
      - 'model-index.yml'
      - 'configs/**'

  pull_request:
    paths:
      - 'model-index.yml'
      - 'configs/**'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build_cpu:
    runs-on: ubuntu-18.04
    strategy:
      matrix:
        python-version: [3.7]
        torch: [1.8.0]
        include:
          - torch: 1.8.0
            torch_version: torch1.8
            torchvision: 0.9.0
    steps:
      - uses: actions/checkout@v2
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v2
        with:
          python-version: ${{ matrix.python-version }}
      - name: Upgrade pip
        run: pip install pip --upgrade
      - name: Install PyTorch
        run: pip install torch==${{matrix.torch}}+cpu torchvision==${{matrix.torchvision}}+cpu -f https://download.pytorch.org/whl/torch_stable.html
      - name: Install openmim
        run: pip install openmim
      - name: Build and install
        run: rm -rf .eggs && mim install -e .
      - name: test commands of mim
        run: mim search mmocr


AGENT: Pull request and issue AI agent

name: "AGENT: Pull request and issue AI agent"

on:
  pull_request:
  issue_comment:
jobs:
  pr_agent_job:
    runs-on: ubuntu-latest
    environment: PRAgent
    permissions:
      issues: write
      pull-requests: write
      contents: write
    name: Run pr agent on every pull request, respond to user comments
    if: (github.actor == 'mansenfranzen') || (github.triggering_actor == 'mansenfranzen')
    steps:
      - name: PR Agent action step
        id: pragent
        uses: Codium-ai/pr-agent@main
        env:
          OPENAI_KEY: ${{ secrets.OPENAI_KEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}


name: "RELEASE: Changelog Update, Tagging, and PyPI Upload"

on:
  push:
    branches:
      - main

permissions:
  contents: write
  pull-requests: write

jobs:
  release-please:
    runs-on: ubuntu-latest
    environment: ReleasePlease
    outputs:
      release-created: ${{ steps.release.outputs.release_created }}
    steps:
    - uses: google-github-actions/release-please-action@v4
      id: release
      with:
        token: ${{ secrets.GITHUB_TOKEN }}
        config-file: release-please-config.json
        manifest-file: .release-please-manifest.json

  publish-to-pypi:
    name: Upload to PyPI
    needs: release-please
    environment: ReleasePlease
    runs-on: ubuntu-latest
    if: needs.release-please.outputs.release-created
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.10"
      - uses: abatilo/actions-poetry@v3
      - name: build
        run: poetry build
      - name: publish
        run: poetry publish --username __token__ --password ${{ secrets.PYPI_TOKEN }}


TESTS: Push/Pull

name: "TESTS: Push/Pull"
on:
  push:
  pull_request:
  workflow_dispatch:

jobs:
  test-stable:
    environment: Tests
    strategy:
      fail-fast: false
      matrix:
        include:
          - python_version: "3.8"
            pydantic_version: "20"
            sphinx_version: "45"
          - python_version: "3.9"
            pydantic_version: "20"
            sphinx_version: "45"
          - python_version: "3.9"
            pydantic_version: "20"
            sphinx_version: "53"
          - python_version: "3.10"
            pydantic_version: "20"
            sphinx_version: "62"
          - python_version: "3.10"
            pydantic_version: "20"
            sphinx_version: "70"
          - python_version: "3.11"
            pydantic_version: "20"
            sphinx_version: "70"
          - python_version: "3.11"
            pydantic_version: "21"
            sphinx_version: "71"
          - python_version: "3.11"
            pydantic_version: "22"
            sphinx_version: "71"
          - python_version: "3.11"
            pydantic_version: "23"
            sphinx_version: "71"
          - python_version: "3.11"
            pydantic_version: "24"
            sphinx_version: "72"
          - python_version: "3.12"
            pydantic_version: "25"
            sphinx_version: "72"
          - python_version: "3.12"
            pydantic_version: "26"
            sphinx_version: "72"
          - python_version: "3.12"
            pydantic_version: "27"
            sphinx_version: "73"
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Test Environment and Run Tox
        uses: ./.github/actions/invoke-tox
        with:
          python-version: ${{ matrix.python_version }}
          tox-environment: py${{ matrix.python_version }}-pydantic${{ matrix.pydantic_version }}-sphinx${{ matrix.sphinx_version }}
          install-graphviz: true
          codacy: ${{ secrets.CODACY_PROJECT_TOKEN }}

  test-latest:
    environment: Tests
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Test Environment and Run Tox
        uses: ./.github/actions/invoke-tox
        with:
          tox-environment: latest
          install-graphviz: true
          codacy: ${{ secrets.CODACY_PROJECT_TOKEN }}

  test-no-erdantic:
    environment: Tests
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Test Environment and Run Tox
        uses: ./.github/actions/invoke-tox
        with:
          tox-environment: no-erdantic

  linter:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Test Environment and Run Tox
        uses: ./.github/actions/invoke-tox
        with:
          tox-environment: linter

  formatter:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Test Environment and Run Tox
        uses: ./.github/actions/invoke-tox
        with:
          tox-environment: formatter

  type-checker:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Test Environment and Run Tox
        uses: ./.github/actions/invoke-tox
        with:
          tox-environment: type-checker
          install-graphviz: true

  security-scan:
    runs-on: ubuntu-22.04
    strategy:
      fail-fast: false
      matrix:
        scan: ["lib", "dev"]
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Test Environment and Run Tox
        uses: ./.github/actions/invoke-tox
        with:
          tox-environment: security-scan${{ matrix.scan }}
          install-graphviz: true


TESTS: Scheduled

name: "TESTS: Scheduled"
on:
  schedule:
    - cron: "0 1 * * *"

jobs:
  test-latest:
    environment: Tests
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Test Environment and Run Tox
        uses: ./.github/actions/invoke-tox
        with:
          tox-environment: latest
          install-graphviz: true

  test-pre-release:
    environment: Tests
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Test Environment and Run Tox
        uses: ./.github/actions/invoke-tox
        with:
          tox-environment: pre-release
          install-graphviz: true

  security-scan:
    runs-on: ubuntu-22.04
    strategy:
      fail-fast: false
      matrix:
        scan: ["lib", "dev"]
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Test Environment and Run Tox
        uses: ./.github/actions/invoke-tox
        with:
          tox-environment: security-scan-${{ matrix.scan }}
          install-graphviz: true


Base Test Workflow

name: Base Test Workflow

on:
  workflow_call:
    inputs:
      python_version:
        required: true
        type: string
      os:
        required: false
        type: string
        default: "ubuntu-20.04"
      tox_args:
        required: false
        type: string
        default: ""
      napari:
        required: false
        type: string
        default: "latest"
      qt_backend:
        required: false
        type: string
        default: "PyQt5"
      test_data:
        required: false
        type: boolean
        default: False
      coverage:
        required: false
        type: boolean
        default: False
      timeout:
        required: false
        type: number
        default: 60
      pydantic:
        required: false
        type: string
        default: ""

jobs:
  test:
    name: ${{ inputs.os }} py ${{ inputs.python_version }} ${{ inputs.napari }} ${{ inputs.qt_backend }}
    runs-on: ${{ inputs.os }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        name: Install Python ${{ inputs.python_version }}
        with:
          python-version: ${{ inputs.python_version }}
          cache: 'pip'
          cache-dependency-path: 'pyproject.toml'

#      - name: Install ubuntu libraries
#        if: runner.os == 'Linux'
#        run: |
#          sudo apt update
#          sudo apt-get install -y libegl1 libdbus-1-3 libxkbcommon-x11-0 libxcb-icccm4 libxcb-image0 libxcb-keysyms1 libxcb-randr0 libxcb-render-util0 libxcb-xinerama0 libxcb-xinput0 libxcb-xfixes0 x11-utils libxcb-cursor0

      - uses: awalsh128/cache-apt-pkgs-action@latest
        if: runner.os == 'Linux'
        with:
          packages: libegl1 libdbus-1-3 libxkbcommon-x11-0 libxcb-icccm4 libxcb-image0 libxcb-keysyms1 libxcb-randr0 libxcb-render-util0 libxcb-xinerama0 libxcb-xinput0 libxcb-xfixes0 x11-utils libxcb-cursor0 libhdf5-dev
          version: 1.0

      - name: Install Windows OpenGL
        if: runner.os == 'Windows'
        run: |
          git clone --depth 1 git://github.com/pyvista/gl-ci-helpers.git
          powershell gl-ci-helpers/appveyor/install_opengl.ps1
          if (Test-Path -Path "C:\Windows\system32\opengl32.dll" -PathType Leaf) {Exit 0} else {Exit 1}

      - name: Download test data
        if: ${{ inputs.test_data }}
        uses: actions/download-artifact@v4
        with:
          name: test_data
          path: test_data

      - name: Install dependencies
        run: |
          python -m pip install -r requirements/requirements_dev.txt tox-gh-actions>=2.12.0 tox-min-req
          pip list

      - name: Test with tox
        uses: aganders3/headless-gui@v2
        timeout-minutes: ${{ inputs.timeout }}
        with:
          run: python -m tox ${{ inputs.tox_args }}
        env:
          PYVISTA_OFF_SCREEN: True  # required for opengl on windows
          NAPARI: ${{ inputs.napari }}
          BACKEND: ${{ inputs.qt_backend }}
          PIP_CONSTRAINT: requirements/constraints_py${{ inputs.python_version }}${{ inputs.pydantic }}.txt

      - uses: actions/upload-artifact@v4
        with:
          name: timing-report-${{ inputs.os }}-py-${{ inputs.python_version }}-${{ inputs.napari }}-${{ inputs.qt_backend }}-${{ inputs.coverage }}
          path: |
            ./report-*.json
          retention-days: 7

      - name: Upload coverage data
        uses: actions/upload-artifact@v4
        if: ${{ inputs.coverage }}
        with:
          name: cov-reports-${{ inputs.os }}-py-${{ inputs.python_version }}-${{ inputs.napari }}-${{ inputs.qt_backend }}
          path: |
            ./.coverage.*


Check PR title

name: Check PR title

on:
  pull_request_target:
    types:
      - opened
      - reopened
      - edited
      - synchronize

jobs:
  lint:
    runs-on: ubuntu-latest
    permissions:
      statuses: write
    steps:
      - uses: aslafy-z/conventional-pr-title-action@v3
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}


CodeQL

# For most projects, this workflow file will not need changing; you simply need
# to commit it to your repository.
#
# You may wish to alter this file to override the set of languages analyzed,
# or to provide custom queries or build logic.
#
# ******** NOTE ********
# We have attempted to detect the languages in your repository. Please check
# the `language` matrix defined below to confirm you have the correct set of
# supported CodeQL languages.
#
name: "CodeQL"

on:
  push:
    branches: [ develop ]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [ develop ]
  schedule:
    - cron: '18 7 * * 0'

concurrency:
  group: test-codeql-${{ github.ref }}
  cancel-in-progress: true

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        language: [ 'python' ]
        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
        # Learn more:
        # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v3
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
        # By default, queries listed here will override any specified in a config file.
        # Prefix the list here with "+" to use these queries and those in the config file.
        # queries: ./path/to/local/query, your-org/your-repo/queries@main

    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
    # If this step fails, then you should remove it and run the build manually (see below)
    - name: Autobuild
      uses: github/codeql-action/autobuild@v3

    # ℹ Command-line programs to run using the OS shell.
    # 📚 https://git.io/JvXDl

    # ✏ If the Autobuild fails above, remove it and uncomment the following three lines
    #    and modify them (or add more) to build your code if your project
    #    uses a compiled language

    #- run: |
    #   make bootstrap
    #   make release

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v3


Semgrep

on:
  workflow_dispatch: {}
  pull_request_target:
    branches:
      - main
      - master
      - develop

  push:
    branches:
    - main
    - master
    - develop
name: Semgrep
jobs:
  semgrep:
    # User definable name of this GitHub Actions job.
    name: semgrep/ci
    # If you are self-hosting, change the following `runs-on` value:
    runs-on: ubuntu-latest

    container:
      # A Docker image with Semgrep installed. Do not change this.
      image: returntocorp/semgrep

    # Skip any PR created by dependabot to avoid permission issues:
    if: (github.actor != 'dependabot[bot]')

    steps:
      # Fetch project source with GitHub Actions Checkout.
      - uses: actions/checkout@v4
      # Run the "semgrep ci" command on the command line of the docker image.
      - run: semgrep ci
        env:
          # Connect to Semgrep Cloud Platform through your SEMGREP_APP_TOKEN.
          # Generate a token from Semgrep Cloud Platform > Settings
          # and add it to your GitHub secrets.
          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}


napari repo

name: napari repo

on:
  schedule:
    - cron: '0 10 * * 1,3,5'  # every 24 hours
  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

jobs:
  download_data:
    name: Download test data
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
      - shell: bash
        run: bash build_utils/download_data.sh
      - name: Upload test data
        uses: actions/upload-artifact@v4
        with:
          name: test_data
          path: test_data
          retention-days: 5

  test_napari:
    name: ${{ matrix.napari_version }} py${{ matrix.python }}
    runs-on: ${{ matrix.platform }}
    needs: download_data
    strategy:
      fail-fast: false
      matrix:
        platform: [ ubuntu-22.04 ]
        python: ['3.8', '3.9' , '3.10', '3.11']
        napari_version: ['repo']
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python ${{ matrix.python }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python }}

      - name: Install Windows OpenGL
        if: runner.os == 'Windows'
        run: |
          git clone --depth 1 git://github.com/pyvista/gl-ci-helpers.git
          powershell gl-ci-helpers/appveyor/install_opengl.ps1
          if (Test-Path -Path "C:\Windows\system32\opengl32.dll" -PathType Leaf) {Exit 0} else {Exit 1}

      - uses: tlambert03/setup-qt-libs@v1

      - name: Install dependencies
        run: |
          pip install --upgrade pip
          pip install setuptools tox tox-gh-actions

      - name: Download test data
        uses: actions/download-artifact@v4
        with:
          name: test_data
          path: test_data

      - name: Test with tox
        # run tests using pip install --pre
        uses: aganders3/headless-gui@v2
        timeout-minutes: 60
        with:
          run: tox
        env:
          PLATFORM: ${{ matrix.platform }}
          NAPARI: ${{ matrix.napari_version }}
          PYVISTA_OFF_SCREEN: True  # required for opengl on windows

      - name: Report Failures
        if: ${{ failure() }}
        uses: JasonEtco/create-an-issue@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PLATFORM: ${{ matrix.platform }}
          PYTHON: ${{ matrix.python }}
          RUN_ID: ${{ github.run_id }}
          TITLE: '[test-bot] napari repos test fail'
        with:
          filename: .github/TEST_FAIL_TEMPLATE.md
          update_existing: true


napari widgets

name: napari widgets

on:
  push:
    branches:
      - master
      - develop
      - main
      - bugfix/fix_napari_widgets_tests
  pull_request:
    branches:
      - '**'

concurrency:
  group: test-napari-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test-latest-release:
    name: Test latest release ${{ matrix.napari }} ${{ matrix.qt_backend }}
    strategy:
      fail-fast: false
      matrix:
        qt_backend: ["PyQt5", "PySide2"]
        os: ["ubuntu-22.04"]
    uses: ./.github/workflows/base_test_workflow.yml
    with:
      python_version: "3.10"
      os: ${{ matrix.os }}
      napari: "napari419"
      qt_backend: ${{ matrix.qt_backend }}
      timeout: 10

  test-pyqt5:
    name: PyQt5 ${{ matrix.napari }}
    strategy:
      fail-fast: false
      matrix:
        napari: ["napari417", "napari418"]
        qt_backend: ["PyQt5"]
        include:
          - napari: "napari417"
            qt_backend: "PySide2"
    if: github.event_name == 'push'
    uses: ./.github/workflows/base_test_workflow.yml
    with:
      python_version: "3.9"
      os: "ubuntu-20.04"
      napari: ${{ matrix.napari }}
      qt_backend: ${{ matrix.qt_backend }}
      timeout: 10


--pre Test

# An "early warning" cron job that will install dependencies
# with `pip install --pre` periodically to test for breakage
# (and open an issue if a test fails)
name: --pre Test

on:
  push:
    branches:
      - master
      - develop
  schedule:
    - cron: '0 */12 * * *'  # every 12 hours
  pull_request:
    paths:
      - '.github/workflows/test_prereleases.yml'
      - 'pyproject.toml'
      - 'requirements/pre_test_problematic_version.txt'
  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

jobs:
  download_data:
    name: Download test data
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
      - shell: bash
        run: bash build_utils/download_data.sh
      - name: Upload test data
        uses: actions/upload-artifact@v4
        with:
          name: test_data
          path: test_data
          retention-days: 5

  test:
    name: ${{ matrix.platform }} py${{ matrix.python }} ${{ matrix.backend }} --pre
    runs-on: ${{ matrix.platform }}
    needs: download_data
    strategy:
      fail-fast: false
      matrix:
        platform: [windows-2022, macos-12, ubuntu-22.04]
        python: [3.9]
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python ${{ matrix.python }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python }}
          cache: 'pip'
          cache-dependency-path: 'pyproject.toml'

      - name: Install Windows OpenGL
        if: runner.os == 'Windows'
        run: |
          git clone --depth 1 git://github.com/pyvista/gl-ci-helpers.git
          powershell gl-ci-helpers/appveyor/install_opengl.ps1
          if (Test-Path -Path "C:\Windows\system32\opengl32.dll" -PathType Leaf) {Exit 0} else {Exit 1}

      - uses: tlambert03/setup-qt-libs@v1

      - name: Download test data
        uses: actions/download-artifact@v4
        with:
          name: test_data
          path: test_data

      - name: Install dependencies
        run: |
          pip install --upgrade pip
          pip install setuptools tox tox-gh-actions>=2.12.0

      - name: Test with tox linux
        # run tests using pip install --pre
        uses: aganders3/headless-gui@v2
        timeout-minutes: 60
        with:
          run: python -m tox -v --pre
        env:
          PLATFORM: ${{ matrix.platform }}
          PYVISTA_OFF_SCREEN: True  # required for opengl on windows
          NAPARI: latest
          BACKEND: PyQt5
          PIP_CONSTRAINT: requirements/pre_test_problematic_version.txt

      # If something goes wrong, we can open an issue in the repo
      - name: Report Failures
        if: ${{ failure() }}
        uses: JasonEtco/create-an-issue@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PLATFORM: ${{ matrix.platform }}
          PYTHON: ${{ matrix.python }}
          RUN_ID: ${{ github.run_id }}
          TITLE: '[test-bot] pip install --pre is failing'
        with:
          filename: .github/TEST_FAIL_TEMPLATE.md
          update_existing: true

  pyinstaller:
    name: "Test pyinstaller build"
    runs-on: "ubuntu-latest"
    steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-python@v5
      name: Install Python 3.9
      with:
        python-version: 3.9
    - uses: tlambert03/setup-qt-libs@v1
    - name: Install dependencies
      run: |
        pip install --upgrade pip
        pip install pip-tools
    - name: Compile and install PyInstaller requirements
      run: |
        pip-compile --upgrade -o requirements.txt pyproject.toml requirements/pre_test_problematic_version.txt --extra pyinstaller  --pre
        pip-sync
        pip install .
    - name: upload requirements
      uses: actions/upload-artifact@v4
      with:
        name: requirements
        path: requirements.txt
    - name: Run PyInstaller
      run: python  build_utils/create_and_pack_executable.py
    - name: Upload bundle
      uses: actions/upload-artifact@v4
      with:
        name: bundle
        path: dist2/
    - name: Test bundle
      uses: aganders3/headless-gui@v2
      timeout-minutes: 60
      with:
        run: dist/PartSeg/PartSeg _test

      # If something goes wrong, we can open an issue in the repo
    - name: Report Failures
      if: ${{ failure() }}
      uses: JasonEtco/create-an-issue@v2
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        PLATFORM: ${{ matrix.platform }}
        PYTHON: ${{ matrix.python }}
        RUN_ID: ${{ github.run_id }}
        TITLE: '[test-bot] pyinstaller bundle --pre is failing'
      with:
        filename: .github/TEST_FAIL_TEMPLATE.md
        update_existing: true